Absolute positioning, unknown release milestone |
-bottom | Dangerous, must be non-negative |
-left |
-right |
-top |
-clip | - |
-position | ENUM(static, relative, absolute, fixed), permit
+ |
bottom | Dangerous, must be non-negative to even be considered,
+ but it's still possible to arbitrarily position by running over. |
+left |
+right |
+top |
+clip | - |
+position | ENUM(static, relative, absolute, fixed)
relative not absolute? |
-z-index | Dangerous |
+z-index | Dangerous |
Unknown |
-background-image | Dangerous, target milestone 1.2 |
+background-image | Dangerous, target milestone 1.3 |
background-attachment | ENUM(scroll, fixed),
Depends on background-image |
background-position | Depends on background-image |
@@ -150,7 +151,7 @@ thead th {text-align:left;padding:0.1em;background-color:#EEE;}
inline-block has incomplete IE6 support and requires -moz-inline-box
for Mozilla. Unknown target milestone.
height | Interesting, why use it? Unknown target milestone. |
-list-style-image | Dangerous? Target milestone 1.2 |
+list-style-image | Dangerous? Target milestone 1.3 |
max-height | No IE 5/6 |
min-height |
max-width |
@@ -236,7 +237,7 @@ Mozilla on inside and needs -moz-outline, no IE support.
Questionable |
accesskey | A | May interfere with main interface |
tabindex | A | May interfere with main interface |
-target | A | Config enabled, only useful for frame layouts |
+target | A | Config enabled, only useful for frame layouts, disallowed in strict |
@@ -283,11 +284,11 @@ Mozilla on inside and needs -moz-outline, no IE support.
nowrap | TD, TH | Boolean, style 'white-space:nowrap;' (not compat with IE5) |
size | HR | Near-equiv 'width', needs px suffix if original was pixels |
src | IMG | Required, insert blank or default img if not set |
-start | OL | Poorly supported 'counter-reset', transform may not be desirable |
+start | OL | Poorly supported 'counter-reset', allowed in loose, dropped in strict |
type | LI | Equivalent style 'list-style-type', different allowed values though. (needs testing) |
OL |
UL |
-value | LI | Poorly supported 'counter-reset', transform may not be desirable, see ol.start. Configurable. |
+value | LI | Poorly supported 'counter-reset', allowed in loose, dropped in strict |
vspace | IMG | Near-equiv styles 'margin-left' and 'margin-right', needs px suffix, see hspace |
width | HR | Near-equiv style 'width', needs px suffix if original was pixels |
TD, TH |
diff --git a/docs/ref-loose-vs-strict.txt b/docs/ref-loose-vs-strict.txt
index 39d51aa2..3581178f 100644
--- a/docs/ref-loose-vs-strict.txt
+++ b/docs/ref-loose-vs-strict.txt
@@ -8,36 +8,30 @@ to HTML Purifier, though, so let's take a look:
== Major incompatibilities ==
[done] BLOCKQUOTE changes from 'flow' to 'block'
- behavior: inline inner contents should not be nuked, paragraph as necessary
+ current behavior: inline inner contents should not be nuked, block-ify as necessary
[partially-done] U, S, STRIKE cut
- behavior: replace with appropriate inline span + CSS
-[partially-done] ADDRESS from potpourri to Inline (removes p tags) (lower importance)
- behavior: p tags silently dropped or replaced with something (
)
+ current behavior: removed completely
+ projected behavior: replace with appropriate inline span + CSS
+[done] ADDRESS from potpourri to Inline (removes p tags)
+ current behavior: block tags silently dropped
+ ideal behavior: replace tags with something like
. (not high priority)
== Things we can loosen up ==
Tags DIR, MENU, CENTER, ISINDEX, FONT, BASEFONT? allowed in loose
-Attributes allowed in loose:
- div,p,h#.align
- ul,ol.type
- ul,ol,dl.compact
- ol.start
- li.type,value
- hr.align,noshade,size,width
- pre.width
- img.name?,align,border,hspace,vspace
- table.align,bgcolor
- caption.align
- tr.bgcolor
- th,td.nowrap,bgcolor,width,height
+ current behavior: transform to strict-valid forms
+Attributes allowed in loose (see attribute transforms in 'dev-progress.html')
+ current behavior: projected to transform into strict-valid forms
== Periphery issues ==
A tag's attribute 'target' (for selecting frames) cut
- behavior: shouldn't be needed, use loose doctype if needed
-OL/LI tag's attribute 'start' (for renumbering lists) cut
- behavior: no substitute, just delete
+ current behavior: not allowed at all
+ projected behavior: use loose doctype if needed, needs valid values
+[done] OL/LI tag's attribute 'start'/'value' (for renumbering lists) cut
+ current behavior: no substitute, just delete when in strict, allow in loose
Attribute 'name' deprecated in favor of 'id'
- behavior: not allowed in first place, but create proper AttrTransform
-PRE tag allows SUB/SUP? (strict dtd comment vs syntax, loose disallows)
- behavior: disallow as usual
+ current behavior: dropped silently
+ projected behavior: create proper AttrTransform (currently not allowed at all)
+[done] PRE tag allows SUB/SUP? (strict dtd comment vs syntax, loose disallows)
+ current behavior: disallow as usual
diff --git a/docs/ref-strictness.txt b/docs/ref-strictness.txt
index b4f9268b..e383a29b 100644
--- a/docs/ref-strictness.txt
+++ b/docs/ref-strictness.txt
@@ -22,4 +22,15 @@ whole point about CSS is to seperate styling from content, so inline styling
doesn't solve that problem.
It's an icky question, and we'll have to deal with it as more and more
-transforms get implemented.
+transforms get implemented. As of right now, however, we currently support
+these loose-only constructs in loose mode:
+
+- , - attributes
+- ,
, tags
+- flow children in
+- mixed children in
+
+The changed child definitions as well as the ul.start li.value are the most
+compelling reasons why loose should be used. We may want offer disabling ,
+ and by themselves.
+
diff --git a/library/HTMLPurifier/HTMLDefinition.php b/library/HTMLPurifier/HTMLDefinition.php
index d3b88e2e..118515eb 100644
--- a/library/HTMLPurifier/HTMLDefinition.php
+++ b/library/HTMLPurifier/HTMLDefinition.php
@@ -159,17 +159,23 @@ class HTMLPurifier_HTMLDefinition
/**
* Lookup table of flow elements
+ * @public
*/
var $info_flow_elements = array();
+ /**
+ * Boolean is a strict definition?
+ * @public
+ */
+ var $strict;
+
/**
* Initializes the definition, the meat of the class.
*/
function setup($config) {
- // emulates the structure of the DTD
- // these are condensed, however, with bad stuff taken out
- // screening process was done by hand
+ // some cached config values
+ $this->strict = $config->get('HTML', 'Strict');
//////////////////////////////////////////////////////////////////////
// info[] : initializes the definition objects
@@ -188,7 +194,7 @@ class HTMLPurifier_HTMLDefinition
'colgroup', 'col', 'td', 'th', 'tr'
);
- if (!$config->get('HTML', 'Strict')) {
+ if (!$this->strict) {
$allowed_tags[] = 'u';
$allowed_tags[] = 's';
$allowed_tags[] = 'strike';
@@ -201,6 +207,10 @@ class HTMLPurifier_HTMLDefinition
//////////////////////////////////////////////////////////////////////
// info[]->child : defines allowed children for elements
+ // emulates the structure of the DTD
+ // however, these are condensed, with bad stuff taken out
+ // screening process was done by hand
+
// entities: prefixed with e_ and _ replaces . from DTD
// double underlines are entities we made up
@@ -254,7 +264,7 @@ class HTMLPurifier_HTMLDefinition
$this->info['li']->child =
$this->info['div']->child = $e_Flow;
- if ($config->get('HTML', 'Strict')) {
+ if ($this->strict) {
$this->info['blockquote']->child = new HTMLPurifier_ChildDef_StrictBlockquote();
} else {
$this->info['blockquote']->child = $e_Flow;
@@ -299,7 +309,7 @@ class HTMLPurifier_HTMLDefinition
$this->info['dl']->child = new HTMLPurifier_ChildDef_Required('dt|dd');
- if ($config->get('HTML', 'Strict')) {
+ if ($this->strict) {
$this->info['address']->child = $e_Inline;
} else {
$this->info['address']->child =
@@ -445,6 +455,11 @@ class HTMLPurifier_HTMLDefinition
// URI that causes HTTP request
$this->info['img']->attr['src'] = new HTMLPurifier_AttrDef_URI(true);
+ if (!$this->strict) {
+ $this->info['li']->attr['value'] = new HTMLPurifier_AttrDef_Integer();
+ $this->info['ol']->attr['start'] = new HTMLPurifier_AttrDef_Integer();
+ }
+
//////////////////////////////////////////////////////////////////////
// info_tag_transform : transformations of tags