CKEditor stripping attributes even though they are allowed.
Hey guys, so I need your help. I have a Drupal installation where I'm migrating from CKEditor 4 to 5 because of the recent CVE. Now, it all went well up until this point. I have a module installed: CKEditor iframe 3.0.0-alpha1 The Drupal version is: 10.2.3
This module allows me to have an iframe button in the editor which works great, the only problem because of cookie consent I need to be able to give the iframes custom data attributes.
Because of that, I went ahead and put iframe into the Source editing tab:
<cite> <dl> <dt> <dd> <span> <blockquote cite> <ul type> <ol type> <h2 id> <h3 id> <h4 id> <a hreflang target> <img data-caption> <p class="head"> <iframe data-* allowfullscreen>
Which gives me the following list of enabled HTML tags, in here we clearly have iframe with all its attributes, even data.
<br> <p class="small head text-align-left text-align-center text-align-right text-align-justify"> <h2 id class="text-align-left text-align-center text-align-right text-align-justify"> <h3 id class="text-align-left text-align-center text-align-right text-align-justify"> <h4 id class="text-align-left text-align-center text-align-right text-align-justify"> <span class="red"> <a class="btn-2" hreflang target href> <cite> <dl> <dt> <dd> <blockquote cite> <ul type> <ol type start> <img data-caption src alt height width data-entity-uuid data-entity-type data-align class> <iframe data-* allowfullscreen src frameborder height width name tabindex title> <strong> <em> <code> <s> <sub> <sup> <li> <hr> <table> <tr> <td rowspan colspan> <th rowspan colspan> <thead> <tbody> <tfoot> <caption>
Now I though eureka and went ahead and added following into a block where it uses ckeditor5. I thought I had it but now when I save this look at what it sends to the server.
<p>
<iframe allowfullscreen=""
data-sid="funktionale_cookies"
data-src="https://www.google.com/maps/embed?pb=!1m14!1m8!1m3!1d13617.38510795184!2d8.29376!3d47.4474!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x0%3A0xdf8587cc7b7afd93!2sH%C3%BCsser%20Gm%C3%BCr%20%2B%20Partner%20AG%20Treuhand-%20und%20Revisionsgesellschaft!5e1!3m2!1sde!2sch!4v1605577645797!5m2!1sde!2sch"
frameborder="0"
height="600"
src=""
tabindex="0"
width="100%"></iframe>
</p>
With this you can clearly see it for some odd reason strips out my attributes.
What I would've expected here is the HTML to be sent over and all good, but it didn't want to be that way. Now I'm kind of at a loss, I even asked my supervisor, and he also doesn't know what to do.
So if anyone has any ideas, help is welcome.