diff --git a/NEWS b/NEWS index 00882736..d3f5c1fb 100644 --- a/NEWS +++ b/NEWS @@ -43,6 +43,8 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier - Prevent ]]> from triggering %Core.ConvertDocumentToFragment - Fix bug with inline elements in blockquotes conflicting with strict doctype - Detect if HTML support is disabled for DOM by checking for loadHTML() method. +- Fix bug where dots and double-dots in absolute URLs without hostname were + not collapsed by URIFilter_MakeAbsolute. . Strategy_MakeWellFormed now operates in-place, saving memory and allowing for more interesting filter-backtracking . New HTMLPurifier_Injector->rewind() functionality, allows injectors to rewind diff --git a/configdoc/usage.xml b/configdoc/usage.xml index 33675442..84d6b751 100644 --- a/configdoc/usage.xml +++ b/configdoc/usage.xml @@ -69,18 +69,18 @@ 267 - 294 + 300 272 - 302 + 308 - 298 + 304 @@ -154,7 +154,7 @@ 199 - 238 + 233 27 @@ -208,16 +208,13 @@ - 230 + 242 64 - - 8 - diff --git a/library/HTMLPurifier/URIFilter/MakeAbsolute.php b/library/HTMLPurifier/URIFilter/MakeAbsolute.php index 515cd4af..89998267 100644 --- a/library/HTMLPurifier/URIFilter/MakeAbsolute.php +++ b/library/HTMLPurifier/URIFilter/MakeAbsolute.php @@ -60,6 +60,9 @@ class HTMLPurifier_URIFilter_MakeAbsolute extends HTMLPurifier_URIFilter } $new_stack = $this->_collapseStack($new_stack); $uri->path = implode('/', $new_stack); + } else { + // absolute path, but still we should collapse + $uri->path = implode('/', $this->_collapseStack(explode('/', $uri->path))); } // re-combine $uri->scheme = $this->base->scheme; diff --git a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php index d691d3ca..5952645d 100644 --- a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php +++ b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php @@ -59,6 +59,14 @@ class HTMLPurifier_URIFilter_MakeAbsoluteTest extends HTMLPurifier_URIFilterHarn $this->assertFiltering('././foo/./bar/.././baz', 'http://example.com/foo/foo/baz'); } + function testFilterAbsolutePathWithDot() { + $this->assertFiltering('/./foo', 'http://example.com/foo'); + } + + function testFilterAbsolutePathWithMultiDot() { + $this->assertFiltering('/./foo/../bar/.', 'http://example.com/bar/'); + } + function testFilterRelativePathWithInternalDotDot() { $this->assertFiltering('../baz.txt', 'http://example.com/baz.txt'); }