diff --git a/NEWS b/NEWS index 5de45f8d..70e721c2 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,10 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier . Internal change ========================== +2.1.4, unknown release date +- Colors missing # but in hex form will be corrected +- CSS Number algorithm improved + 2.1.3, released 2007-11-05 ! tests/multitest.php allows you to test multiple versions by running tests/index.php through multiple interpreters using `phpv` shell diff --git a/library/HTMLPurifier/AttrDef/CSS/Color.php b/library/HTMLPurifier/AttrDef/CSS/Color.php index 30b38f92..a6711f71 100644 --- a/library/HTMLPurifier/AttrDef/CSS/Color.php +++ b/library/HTMLPurifier/AttrDef/CSS/Color.php @@ -39,20 +39,13 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef if ($colors === null) $colors = $config->get('Core', 'ColorKeywords'); $color = trim($color); - if (!$color) return false; + if ($color === '') return false; $lower = strtolower($color); if (isset($colors[$lower])) return $colors[$lower]; - if ($color[0] === '#') { - // hexadecimal handling - $hex = substr($color, 1); - $length = strlen($hex); - if ($length !== 3 && $length !== 6) return false; - if (!ctype_xdigit($hex)) return false; - } else { + if (strpos($color, 'rgb(') !== false) { // rgb literal handling - if (strpos($color, 'rgb(')) return false; $length = strlen($color); if (strpos($color, ')') !== $length - 1) return false; $triad = substr($color, 4, $length - 4 - 1); @@ -90,6 +83,17 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef } $new_triad = implode(',', $new_parts); $color = "rgb($new_triad)"; + } else { + // hexadecimal handling + if ($color[0] === '#') { + $hex = substr($color, 1); + } else { + $hex = $color; + $color = '#' . $color; + } + $length = strlen($hex); + if ($length !== 3 && $length !== 6) return false; + if (!ctype_xdigit($hex)) return false; } return $color; diff --git a/tests/HTMLPurifier/AttrDef/CSS/ColorTest.php b/tests/HTMLPurifier/AttrDef/CSS/ColorTest.php index 030c6224..4cb8602b 100644 --- a/tests/HTMLPurifier/AttrDef/CSS/ColorTest.php +++ b/tests/HTMLPurifier/AttrDef/CSS/ColorTest.php @@ -11,6 +11,8 @@ class HTMLPurifier_AttrDef_CSS_ColorTest extends HTMLPurifier_AttrDefHarness $this->def = new HTMLPurifier_AttrDef_CSS_Color(); $this->assertDef('#F00'); + $this->assertDef('#fff'); + $this->assertDef('#eeeeee'); $this->assertDef('#808080'); $this->assertDef('rgb(255, 0, 0)', 'rgb(255,0,0)'); // rm spaces $this->assertDef('rgb(100%,0%,0%)'); @@ -27,6 +29,11 @@ class HTMLPurifier_AttrDef_CSS_ColorTest extends HTMLPurifier_AttrDefHarness // color keywords, of course $this->assertDef('red', '#FF0000'); + // malformed hex declaration + $this->assertDef('808080', '#808080'); + $this->assertDef('000000', '#000000'); + $this->assertDef('fed', '#fed'); + // maybe hex transformations would be another nice feature // at the very least transform rgb percent to rgb integer