I am using the HTML Purifier module https://www.drupal.org/project/htmlpurifier. And Drupal version 8.5.6. Most of the help I could find is for Drupal version 7. When I try to embed a YouTube video into the Ckeditor the iframe tag remains but the src url is stripped out. I am allowing every element and class like this, this is part of my GUI config for html purifier:

 Allowed: null
 AllowedAttributes: null
 AllowedElements: null
 SafeEmbed: true
 SafeIframe: true
 SafeObject: true
 FlashCompat: false
 SafeIframeRegexp: null
 YouTube: true

And below is the full config file.

      AllowedClasses: null
      AllowedFrameTargets: _blank,_self,_target,_parent
      AllowedRel: {  }
      AllowedRev: {  }
      ClassUseCDATA: null
      DefaultImageAlt: null
      DefaultInvalidImage: ''
      DefaultInvalidImageAlt: 'Invalid image'
      DefaultTextDir: ltr
      EnableID: false
      ForbiddenClasses: myHeader2,myHeader3,mso*,mso-*
      ID.HTML5: null
      IDBlacklist: {  }
      IDBlacklistRegexp: null
      IDPrefix: ''
      IDPrefixLocal: ''
      AutoParagraph: false
      Custom: {  }
      DisplayLinkURI: false
      Linkify: false
      PurifierLinkify.DocURL: '#%s'
      PurifierLinkify: false
        colgroup: {  }
        th: {  }
        td: {  }
          - src
        td: true
        th: true
      RemoveEmpty.RemoveNbsp: false
      RemoveEmpty: false
      RemoveSpansWithoutAttributes: false
      AllowDuplicates: true
      AllowImportant: true
      AllowTricky: false
      AllowedFonts: null
      AllowedProperties: null
      DefinitionRev: 1
      ForbiddenProperties: {  }
      MaxImgLength: 1200px
      Proprietary: true
      Trusted: true
      DefinitionImpl: Serializer
      SerializerPath: null
      SerializerPermissions: 493
      AggressivelyFixLt: true
      AggressivelyRemoveScript: true
      AllowHostnameUnderscore: false
      CollectErrors: false
        maroon: '#800000'
        red: '#FF0000'
        orange: '#FFA500'
        yellow: '#FFFF00'
        olive: '#808000'
        purple: '#800080'
        fuchsia: '#FF00FF'
        white: '#FFFFFF'
        lime: '#00FF00'
        green: '#008000'
        navy: '#000080'
        blue: '#0000FF'
        aqua: '#00FFFF'
        teal: '#008080'
        black: '#000000'
        silver: '#C0C0C0'
        gray: '#808080'
      ConvertDocumentToFragment: true
      DirectLexLineNumberSyncInterval: 0
      DisableExcludes: false
      EnableIDNA: false
      Encoding: utf-8
      EscapeInvalidChildren: false
      EscapeInvalidTags: false
      EscapeNonASCIICharacters: false
        script: true
        style: true
      Language: en
      LegacyEntityDecoder: false
      LexerImpl: null
      MaintainLineNumbers: null
      NormalizeNewlines: true
      RemoveInvalidImg: true
      RemoveProcessingInstructions: false
      RemoveScriptContents: null
      Custom: {  }
      ExtractStyleBlocks.Escaping: true
      ExtractStyleBlocks.Scope: null
      ExtractStyleBlocks.TidyImpl: null
      ExtractStyleBlocks: false
      YouTube: true
      Allowed: null
      AllowedAttributes: null
      AllowedComments: {  }
      AllowedCommentsRegexp: null
      AllowedElements: null
      AllowedModules: null
      Attr.Name.UseCDATA: false
      BlockWrapper: p
        Structure: true
        Text: true
        Hypertext: true
        List: true
        NonXMLCommonAttributes: true
        XMLCommonAttributes: true
        CommonAttributes: true
      CustomDoctype: null
      DefinitionID: null
      DefinitionRev: 1
      Doctype: null
      FlashAllowFullScreen: true
      ForbiddenAttributes: {  }
      ForbiddenElements: s,h2,h3
      MaxImgLength: 1200
      Nofollow: false
      Parent: div
      Proprietary: true
      SafeEmbed: true
      SafeIframe: true
      SafeObject: true
      SafeScripting: {  }
      Strict: false
      TargetBlank: true
      TargetNoopener: true
      TargetNoreferrer: true
      TidyAdd: {  }
      TidyLevel: medium
      TidyRemove: {  }
      Trusted: true
      XHTML: true
      CommentScriptContents: true
      FixInnerHTML: false
      FlashCompat: false
      Newline: null
      SortAttr: false
      TidyFormat: false
      ForceNoIconv: false
        http: true
        https: true
        mailto: true
        ftp: true
        nntp: true
        news: true
        tel: true
      Base: null
      DefaultScheme: http
      DefinitionID: null
      DefinitionRev: 1
      Disable: false
      DisableExternal: false
      DisableExternalResources: false
      DisableResources: false
      Host: null
      HostBlacklist: {  }
      MakeAbsolute: false
      Munge: null
      MungeResources: false
      MungeSecretKey: null
      OverrideAllowedSchemes: false
      SafeIframeRegexp: null

It works now after changing the last setting in the config file to this: SafeIframeRegexp: %(www.youtube.com/embed)%

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.