mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2025-08-12 17:13:57 +02:00
fix: non-substantive typos (#434)
Co-authored-by: Viktor Szépe <viktor@szepe.net> Co-authored-by: Edward Z. Yang <ezyang@mit.edu>
This commit is contained in:
@@ -36,7 +36,7 @@ function formatCode($string)
|
||||
<p>XSS attacks are from
|
||||
<a href="http://ha.ckers.org/xss.html">http://ha.ckers.org/xss.html</a>.</p>
|
||||
<p><strong>Caveats:</strong>
|
||||
<tt>Google.com</tt> has been programatically disallowed, but as you can
|
||||
<tt>Google.com</tt> has been programmatically disallowed, but as you can
|
||||
see, there are ways of getting around that, so coverage in this area
|
||||
is not complete. Most XSS broadcasts its presence by spawning an alert dialogue.
|
||||
The displayed code is not strictly correct, as linebreaks have been forced for
|
||||
@@ -50,7 +50,7 @@ if (version_compare(PHP_VERSION, '5', '<')) exit('<p>Requires PHP 5.</p>');
|
||||
|
||||
$xml = simplexml_load_file('xssAttacks.xml');
|
||||
|
||||
// programatically disallow google.com for URI evasion tests
|
||||
// programmatically disallow google.com for URI evasion tests
|
||||
// not complete
|
||||
$config = HTMLPurifier_Config::createDefault();
|
||||
$config->set('URI.HostBlacklist', array('google.com'));
|
||||
|
Reference in New Issue
Block a user