mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2025-08-04 13:18:00 +02:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
200ead9e4c |
2
Doxyfile
2
Doxyfile
@@ -31,7 +31,7 @@ PROJECT_NAME = HTMLPurifier
|
||||
# This could be handy for archiving the generated documentation or
|
||||
# if some version control system is used.
|
||||
|
||||
PROJECT_NUMBER = 4.18.0
|
||||
PROJECT_NUMBER = 4.15.0
|
||||
|
||||
# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
|
||||
# base path where the generated documentation will be put.
|
||||
|
||||
43
NEWS
43
NEWS
@@ -1,46 +1,3 @@
|
||||
# [4.18.0](https://github.com/ezyang/htmlpurifier/compare/v4.17.0...v4.18.0) (2024-11-01)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 ([#406](https://github.com/ezyang/htmlpurifier/issues/406)) ([d9fbef8](https://github.com/ezyang/htmlpurifier/commit/d9fbef8e27f6a0848a8987a8534351de98eb0fa1))
|
||||
* Avoid a deprecated error when the attribute name is numeric and DirectLex is used ([#412](https://github.com/ezyang/htmlpurifier/issues/412)) ([f0fbf51](https://github.com/ezyang/htmlpurifier/commit/f0fbf510981b27fc03168efdb17d6bff48f521af))
|
||||
* checking that node has property name ([#399](https://github.com/ezyang/htmlpurifier/issues/399)) ([9ca5a36](https://github.com/ezyang/htmlpurifier/commit/9ca5a3687bd2e6e42ed9d5199b2cfb1dbd6dbdc2))
|
||||
* Ignore conditional comments ([#401](https://github.com/ezyang/htmlpurifier/issues/401)) ([4828fdf](https://github.com/ezyang/htmlpurifier/commit/4828fdf45a93eeeacfcbcc855f96f9a7e6b4ed44))
|
||||
* Support PHP 8.4 ([#396](https://github.com/ezyang/htmlpurifier/issues/396)) ([92da247](https://github.com/ezyang/htmlpurifier/commit/92da2473ffbb3ed5e894560d4166b1ca8032aeb3))
|
||||
* undefined array key warning ([#419](https://github.com/ezyang/htmlpurifier/issues/419)) ([01be377](https://github.com/ezyang/htmlpurifier/commit/01be377f93654fad4d3fbc8c81779f14316eaecf))
|
||||
|
||||
|
||||
### Features
|
||||
|
||||
* Add allowfullscreen attr for iframe ([#411](https://github.com/ezyang/htmlpurifier/issues/411)) ([70754a2](https://github.com/ezyang/htmlpurifier/commit/70754a253342f67a67425cfa81029db3a5c1bd28))
|
||||
* add directive for removing blank nodes ([#404](https://github.com/ezyang/htmlpurifier/issues/404)) ([c9d60c9](https://github.com/ezyang/htmlpurifier/commit/c9d60c96d799c02bc357c88a49f422034b6914fd))
|
||||
* Add support for CSS aspect-ratio ([#408](https://github.com/ezyang/htmlpurifier/issues/408)) ([93bee73](https://github.com/ezyang/htmlpurifier/commit/93bee733497a098b65daf5910f1c435d347860a4))
|
||||
* Allow universal CSS values for all properties ([#410](https://github.com/ezyang/htmlpurifier/issues/410)) ([9723267](https://github.com/ezyang/htmlpurifier/commit/972326785d201b81e1095bc296b99bbcfa8c7fd4))
|
||||
|
||||
# [4.17.0](https://github.com/ezyang/htmlpurifier/compare/v4.16.0...v4.17.0) (2023-11-17)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* CSSTidy ImportantComments not handled properly ([#359](https://github.com/ezyang/htmlpurifier/issues/359)) ([78a9b4d](https://github.com/ezyang/htmlpurifier/commit/78a9b4d0dae8bce9a70e4e7e551bf51e9a23706d))
|
||||
* fix CI ([#361](https://github.com/ezyang/htmlpurifier/issues/361)) ([9ec687c](https://github.com/ezyang/htmlpurifier/commit/9ec687c904a1fe66a5395d22c50f7043e045d1d3))
|
||||
* Invalid scheme check in Attr.TargetBlank ([#363](https://github.com/ezyang/htmlpurifier/issues/363)) ([0176ef4](https://github.com/ezyang/htmlpurifier/commit/0176ef4bb6f57103fdcb60a802603e60e81ee93e))
|
||||
* semantic release ([#339](https://github.com/ezyang/htmlpurifier/issues/339)) ([d82f3d9](https://github.com/ezyang/htmlpurifier/commit/d82f3d996a0d9b0f23364946d9a14408c1ad72c5))
|
||||
* semantic release ([#341](https://github.com/ezyang/htmlpurifier/issues/341)) ([e55fead](https://github.com/ezyang/htmlpurifier/commit/e55fead09f39430d30f48438f06e7bc2326efc94)), closes [#339](https://github.com/ezyang/htmlpurifier/issues/339)
|
||||
* Support for locales using decimal separators other than . (dot) ([#372](https://github.com/ezyang/htmlpurifier/issues/372)) ([43f49ac](https://github.com/ezyang/htmlpurifier/commit/43f49ac9a51b81dfd07d3bc8dcfc5ec5637a5e3b))
|
||||
|
||||
|
||||
### Features
|
||||
|
||||
* Add support for all text-decoration properties ([#360](https://github.com/ezyang/htmlpurifier/issues/360)) ([2d775c0](https://github.com/ezyang/htmlpurifier/commit/2d775c01874e2f676ba1a2d9fe69b47c2a823061))
|
||||
* Allows commas to be included in tel URI ([#389](https://github.com/ezyang/htmlpurifier/issues/389)) ([ec92490](https://github.com/ezyang/htmlpurifier/commit/ec924901392f088d334622f806b9449b17b75d7b)), closes [#388](https://github.com/ezyang/htmlpurifier/issues/388)
|
||||
|
||||
|
||||
### Reverts
|
||||
|
||||
* Revert "fix: semantic release (#339)" (#340) ([3e83215](https://github.com/ezyang/htmlpurifier/commit/3e832152a6173f880c6495a3ab2b0e5235e253a6)), closes [#339](https://github.com/ezyang/htmlpurifier/issues/339) [#340](https://github.com/ezyang/htmlpurifier/issues/340)
|
||||
|
||||
NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
|
||||
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ TODO:
|
||||
*/
|
||||
|
||||
if (version_compare(PHP_VERSION, '5.2', '<')) exit('PHP 5.2+ required.');
|
||||
error_reporting(E_ALL);
|
||||
error_reporting(E_ALL | E_STRICT);
|
||||
|
||||
// load dual-libraries
|
||||
require_once dirname(__FILE__) . '/../extras/HTMLPurifierExtras.auto.php';
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
</file>
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>90</line>
|
||||
<line>315</line>
|
||||
<line>331</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/Lexer/DirectLex.php">
|
||||
<line>67</line>
|
||||
@@ -19,37 +19,37 @@
|
||||
</directive>
|
||||
<directive id="CSS.MaxImgLength">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>253</line>
|
||||
<line>256</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="CSS.Proprietary">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>397</line>
|
||||
<line>381</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="CSS.AllowTricky">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>401</line>
|
||||
<line>385</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="CSS.Trusted">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>405</line>
|
||||
<line>389</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="CSS.AllowImportant">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>409</line>
|
||||
<line>393</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="CSS.AllowedProperties">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>538</line>
|
||||
<line>522</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="CSS.ForbiddenProperties">
|
||||
<file name="HTMLPurifier/CSSDefinition.php">
|
||||
<line>554</line>
|
||||
<line>538</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Cache.DefinitionImpl">
|
||||
@@ -124,7 +124,7 @@
|
||||
<line>122</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>299</line>
|
||||
<line>313</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Output.Newline">
|
||||
@@ -172,15 +172,12 @@
|
||||
<line>234</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>304</line>
|
||||
<line>342</line>
|
||||
<line>318</line>
|
||||
<line>358</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/AttrDef/HTML/ContentEditable.php">
|
||||
<line>8</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/HTMLModule/Iframe.php">
|
||||
<line>43</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/HTMLModule/Image.php">
|
||||
<line>37</line>
|
||||
</file>
|
||||
@@ -270,22 +267,22 @@
|
||||
<directive id="Core.LegacyEntityDecoder">
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>220</line>
|
||||
<line>326</line>
|
||||
<line>342</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.ConvertDocumentToFragment">
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>313</line>
|
||||
<line>329</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.RemoveProcessingInstructions">
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>336</line>
|
||||
<line>352</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.HiddenElements">
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>340</line>
|
||||
<line>356</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
|
||||
<line>36</line>
|
||||
@@ -293,12 +290,12 @@
|
||||
</directive>
|
||||
<directive id="Core.AggressivelyRemoveScript">
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>341</line>
|
||||
<line>357</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.RemoveScriptContents">
|
||||
<file name="HTMLPurifier/Lexer.php">
|
||||
<line>342</line>
|
||||
<line>358</line>
|
||||
</file>
|
||||
<file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
|
||||
<line>35</line>
|
||||
@@ -360,7 +357,7 @@
|
||||
</directive>
|
||||
<directive id="CSS.AllowedFonts">
|
||||
<file name="HTMLPurifier/AttrDef/CSS/FontFamily.php">
|
||||
<line>62</line>
|
||||
<line>64</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Attr.AllowedClasses">
|
||||
@@ -411,12 +408,12 @@
|
||||
</directive>
|
||||
<directive id="Core.AllowHostnameUnderscore">
|
||||
<file name="HTMLPurifier/AttrDef/URI/Host.php">
|
||||
<line>71</line>
|
||||
<line>77</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.EnableIDNA">
|
||||
<file name="HTMLPurifier/AttrDef/URI/Host.php">
|
||||
<line>103</line>
|
||||
<line>109</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Attr.DefaultTextDir">
|
||||
@@ -473,17 +470,17 @@
|
||||
</directive>
|
||||
<directive id="Filter.ExtractStyleBlocks.TidyImpl">
|
||||
<file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
|
||||
<line>106</line>
|
||||
<line>94</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Filter.ExtractStyleBlocks.Scope">
|
||||
<file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
|
||||
<line>137</line>
|
||||
<line>125</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Filter.ExtractStyleBlocks.Escaping">
|
||||
<file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
|
||||
<line>351</line>
|
||||
<line>330</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="HTML.Forms">
|
||||
@@ -555,11 +552,6 @@
|
||||
<line>72</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.RemoveBlanks">
|
||||
<file name="HTMLPurifier/Lexer/DOMLex.php">
|
||||
<line>75</line>
|
||||
</file>
|
||||
</directive>
|
||||
<directive id="Core.DirectLexLineNumberSyncInterval">
|
||||
<file name="HTMLPurifier/Lexer/DirectLex.php">
|
||||
<line>84</line>
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
* primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
|
||||
* FILE, changes will be overwritten the next time the script is run.
|
||||
*
|
||||
* @version 4.18.0
|
||||
* @version 4.15.0
|
||||
*
|
||||
* @warning
|
||||
* You must *not* include any other HTML Purifier files before this file,
|
||||
@@ -101,7 +101,6 @@ require 'HTMLPurifier/AttrDef/CSS/Length.php';
|
||||
require 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
|
||||
require 'HTMLPurifier/AttrDef/CSS/Multiple.php';
|
||||
require 'HTMLPurifier/AttrDef/CSS/Percentage.php';
|
||||
require 'HTMLPurifier/AttrDef/CSS/Ratio.php';
|
||||
require 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
|
||||
require 'HTMLPurifier/AttrDef/CSS/URI.php';
|
||||
require 'HTMLPurifier/AttrDef/HTML/Bool.php';
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
*/
|
||||
|
||||
/*
|
||||
HTML Purifier 4.18.0 - Standards Compliant HTML Filtering
|
||||
HTML Purifier 4.15.0 - Standards Compliant HTML Filtering
|
||||
Copyright (C) 2006-2008 Edward Z. Yang
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
@@ -58,12 +58,12 @@ class HTMLPurifier
|
||||
* Version of HTML Purifier.
|
||||
* @type string
|
||||
*/
|
||||
public $version = '4.18.0';
|
||||
public $version = '4.15.0';
|
||||
|
||||
/**
|
||||
* Constant with version of HTML Purifier.
|
||||
*/
|
||||
const VERSION = '4.18.0';
|
||||
const VERSION = '4.15.0';
|
||||
|
||||
/**
|
||||
* Global configuration object.
|
||||
|
||||
@@ -95,7 +95,6 @@ require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Length.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ListStyle.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Multiple.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Percentage.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Ratio.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/TextDecoration.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/URI.php';
|
||||
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
|
||||
|
||||
@@ -27,13 +27,6 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
|
||||
$definition = $config->getCSSDefinition();
|
||||
$allow_duplicates = $config->get("CSS.AllowDuplicates");
|
||||
|
||||
$universal_attrdef = new HTMLPurifier_AttrDef_Enum(
|
||||
array(
|
||||
'initial',
|
||||
'inherit',
|
||||
'unset',
|
||||
)
|
||||
);
|
||||
|
||||
// According to the CSS2.1 spec, the places where a
|
||||
// non-delimiting semicolon can appear are in strings
|
||||
@@ -103,13 +96,16 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
|
||||
if (!$ok) {
|
||||
continue;
|
||||
}
|
||||
$result = $universal_attrdef->validate($value, $config, $context);
|
||||
if ($result === false) {
|
||||
// inefficient call, since the validator will do this again
|
||||
if (strtolower(trim($value)) !== 'inherit') {
|
||||
// inherit works for everything (but only on the base property)
|
||||
$result = $definition->info[$property]->validate(
|
||||
$value,
|
||||
$config,
|
||||
$context
|
||||
);
|
||||
} else {
|
||||
$result = 'inherit';
|
||||
}
|
||||
if ($result === false) {
|
||||
continue;
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Validates a ratio as defined by the CSS spec.
|
||||
*/
|
||||
class HTMLPurifier_AttrDef_CSS_Ratio extends HTMLPurifier_AttrDef
|
||||
{
|
||||
/**
|
||||
* @param string $ratio Ratio to validate
|
||||
* @param HTMLPurifier_Config $config Configuration options
|
||||
* @param HTMLPurifier_Context $context Context
|
||||
*
|
||||
* @return string|boolean
|
||||
*
|
||||
* @warning Some contexts do not pass $config, $context. These
|
||||
* variables should not be used without checking HTMLPurifier_Length
|
||||
*/
|
||||
public function validate($ratio, $config, $context)
|
||||
{
|
||||
$ratio = $this->parseCDATA($ratio);
|
||||
|
||||
$parts = explode('/', $ratio, 2);
|
||||
$length = count($parts);
|
||||
|
||||
if ($length < 1 || $length > 2) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$num = new \HTMLPurifier_AttrDef_CSS_Number();
|
||||
|
||||
if ($length === 1) {
|
||||
return $num->validate($parts[0], $config, $context);
|
||||
}
|
||||
|
||||
$num1 = $num->validate($parts[0], $config, $context);
|
||||
$num2 = $num->validate($parts[1], $config, $context);
|
||||
|
||||
if ($num1 === false || $num2 === false) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return $num1 . '/' . $num2;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
@@ -63,18 +63,24 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
|
||||
// This doesn't match I18N domain names, but we don't have proper IRI support,
|
||||
// so force users to insert Punycode.
|
||||
|
||||
// Underscores defined as Unreserved Characters in RFC 3986 are
|
||||
// allowed in a URI. There are cases where we want to consider a
|
||||
// URI containing "_" such as "_dmarc.example.com".
|
||||
// Underscores are not allowed in the default. If you want to
|
||||
// allow it, set Core.AllowHostnameUnderscore to true.
|
||||
// There is not a good sense in which underscores should be
|
||||
// allowed, since it's technically not! (And if you go as
|
||||
// far to allow everything as specified by the DNS spec...
|
||||
// well, that's literally everything, modulo some space limits
|
||||
// for the components and the overall name (which, by the way,
|
||||
// we are NOT checking!). So we (arbitrarily) decide this:
|
||||
// let's allow underscores wherever we would have allowed
|
||||
// hyphens, if they are enabled. This is a pretty good match
|
||||
// for browser behavior, for example, a large number of browsers
|
||||
// cannot handle foo_.example.com, but foo_bar.example.com is
|
||||
// fairly well supported.
|
||||
$underscore = $config->get('Core.AllowHostnameUnderscore') ? '_' : '';
|
||||
|
||||
// Based off of RFC 1738, but amended so that
|
||||
// as per RFC 3696, the top label need only not be all numeric.
|
||||
// The productions describing this are:
|
||||
$a = '[a-z]'; // alpha
|
||||
$an = "[a-z0-9$underscore]"; // alphanum
|
||||
$an = '[a-z0-9]'; // alphanum
|
||||
$and = "[a-z0-9-$underscore]"; // alphanum | "-"
|
||||
// domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
|
||||
$domainlabel = "$an(?:$and*$an)?";
|
||||
|
||||
@@ -77,7 +77,7 @@ class HTMLPurifier_AttrTypes
|
||||
}
|
||||
|
||||
if (!isset($this->info[$type])) {
|
||||
throw new Exception('Cannot retrieve undefined attribute type ' . $type);
|
||||
trigger_error('Cannot retrieve undefined attribute type ' . $type, E_USER_ERROR);
|
||||
return;
|
||||
}
|
||||
return $this->info[$type]->make($string);
|
||||
|
||||
@@ -116,6 +116,8 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
|
||||
'auto',
|
||||
'cover',
|
||||
'contain',
|
||||
'initial',
|
||||
'inherit',
|
||||
]
|
||||
),
|
||||
new HTMLPurifier_AttrDef_CSS_Percentage(),
|
||||
@@ -234,20 +236,21 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
|
||||
[
|
||||
new HTMLPurifier_AttrDef_CSS_Length('0'),
|
||||
new HTMLPurifier_AttrDef_CSS_Percentage(true),
|
||||
new HTMLPurifier_AttrDef_Enum(['auto'])
|
||||
new HTMLPurifier_AttrDef_Enum(['auto', 'initial', 'inherit'])
|
||||
]
|
||||
);
|
||||
$trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite(
|
||||
[
|
||||
new HTMLPurifier_AttrDef_CSS_Length('0'),
|
||||
new HTMLPurifier_AttrDef_CSS_Percentage(true),
|
||||
new HTMLPurifier_AttrDef_Enum(['initial', 'inherit'])
|
||||
]
|
||||
);
|
||||
$trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite(
|
||||
[
|
||||
new HTMLPurifier_AttrDef_CSS_Length('0'),
|
||||
new HTMLPurifier_AttrDef_CSS_Percentage(true),
|
||||
new HTMLPurifier_AttrDef_Enum(['none'])
|
||||
new HTMLPurifier_AttrDef_Enum(['none', 'initial', 'inherit'])
|
||||
]
|
||||
);
|
||||
$max = $config->get('CSS.MaxImgLength');
|
||||
@@ -275,7 +278,12 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
|
||||
new HTMLPurifier_AttrDef_Switch(
|
||||
'img',
|
||||
// For img tags:
|
||||
new HTMLPurifier_AttrDef_CSS_Length('0', $max),
|
||||
new HTMLPurifier_AttrDef_CSS_Composite(
|
||||
[
|
||||
new HTMLPurifier_AttrDef_CSS_Length('0', $max),
|
||||
new HTMLPurifier_AttrDef_Enum(['initial', 'inherit'])
|
||||
]
|
||||
),
|
||||
// For everyone else:
|
||||
$trusted_min_wh
|
||||
);
|
||||
@@ -289,29 +297,22 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
|
||||
new HTMLPurifier_AttrDef_CSS_Composite(
|
||||
[
|
||||
new HTMLPurifier_AttrDef_CSS_Length('0', $max),
|
||||
new HTMLPurifier_AttrDef_Enum(['none'])
|
||||
new HTMLPurifier_AttrDef_Enum(['none', 'initial', 'inherit'])
|
||||
]
|
||||
),
|
||||
// For everyone else:
|
||||
$trusted_max_wh
|
||||
);
|
||||
|
||||
$this->info['aspect-ratio'] = new HTMLPurifier_AttrDef_CSS_Multiple(
|
||||
new HTMLPurifier_AttrDef_CSS_Composite([
|
||||
new HTMLPurifier_AttrDef_CSS_Ratio(),
|
||||
new HTMLPurifier_AttrDef_Enum(['auto']),
|
||||
])
|
||||
);
|
||||
|
||||
// text-decoration and related shorthands
|
||||
$this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();
|
||||
|
||||
$this->info['text-decoration-line'] = new HTMLPurifier_AttrDef_Enum(
|
||||
['none', 'underline', 'overline', 'line-through']
|
||||
['none', 'underline', 'overline', 'line-through', 'initial', 'inherit']
|
||||
);
|
||||
|
||||
$this->info['text-decoration-style'] = new HTMLPurifier_AttrDef_Enum(
|
||||
['solid', 'double', 'dotted', 'dashed', 'wavy']
|
||||
['solid', 'double', 'dotted', 'dashed', 'wavy', 'initial', 'inherit']
|
||||
);
|
||||
|
||||
$this->info['text-decoration-color'] = new HTMLPurifier_AttrDef_CSS_Color();
|
||||
@@ -319,7 +320,7 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
|
||||
$this->info['text-decoration-thickness'] = new HTMLPurifier_AttrDef_CSS_Composite([
|
||||
new HTMLPurifier_AttrDef_CSS_Length(),
|
||||
new HTMLPurifier_AttrDef_CSS_Percentage(),
|
||||
new HTMLPurifier_AttrDef_Enum(['auto', 'from-font'])
|
||||
new HTMLPurifier_AttrDef_Enum(['auto', 'from-font', 'initial', 'inherit'])
|
||||
]);
|
||||
|
||||
$this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
|
||||
|
||||
@@ -190,9 +190,6 @@ class HTMLPurifier_ChildDef_Table extends HTMLPurifier_ChildDef
|
||||
$current_tr_tbody = null;
|
||||
|
||||
foreach($content as $node) {
|
||||
if (!isset($node->name)) {
|
||||
continue;
|
||||
}
|
||||
switch ($node->name) {
|
||||
case 'tbody':
|
||||
$current_tr_tbody = null;
|
||||
|
||||
@@ -21,7 +21,7 @@ class HTMLPurifier_Config
|
||||
* HTML Purifier's version
|
||||
* @type string
|
||||
*/
|
||||
public $version = '4.18.0';
|
||||
public $version = '4.15.0';
|
||||
|
||||
/**
|
||||
* Whether or not to automatically finalize
|
||||
@@ -898,11 +898,7 @@ class HTMLPurifier_Config
|
||||
break;
|
||||
}
|
||||
}
|
||||
if ($no == E_USER_ERROR) {
|
||||
throw new Exception($msg . $extra);
|
||||
} else {
|
||||
trigger_error($msg . $extra, $no);
|
||||
}
|
||||
trigger_error($msg . $extra, $no);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1,10 +0,0 @@
|
||||
Core.RemoveBlanks
|
||||
TYPE: bool
|
||||
DEFAULT: false
|
||||
VERSION: 4.18
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
If set to true, blank nodes will be removed. This can be useful for maintaining
|
||||
backwards compatibility when upgrading from previous versions of PHP.
|
||||
</p>
|
||||
--# vim: et sw=4 sts=4
|
||||
@@ -86,7 +86,7 @@ class HTMLPurifier_DoctypeRegistry
|
||||
$doctype = $this->aliases[$doctype];
|
||||
}
|
||||
if (!isset($this->doctypes[$doctype])) {
|
||||
throw new Exception('Doctype ' . htmlspecialchars($doctype) . ' does not exist');
|
||||
trigger_error('Doctype ' . htmlspecialchars($doctype) . ' does not exist', E_USER_ERROR);
|
||||
$anon = new HTMLPurifier_Doctype($doctype);
|
||||
return $anon;
|
||||
}
|
||||
|
||||
@@ -390,7 +390,7 @@ class HTMLPurifier_Encoder
|
||||
$str = self::unsafeIconv($encoding, 'utf-8//IGNORE', $str);
|
||||
if ($str === false) {
|
||||
// $encoding is not a valid encoding
|
||||
throw new Exception('Invalid encoding ' . $encoding);
|
||||
trigger_error('Invalid encoding ' . $encoding, E_USER_ERROR);
|
||||
return '';
|
||||
}
|
||||
// If the string is bjorked by Shift_JIS or a similar encoding
|
||||
|
||||
@@ -116,8 +116,8 @@ class HTMLPurifier_EntityParser
|
||||
protected function entityCallback($matches)
|
||||
{
|
||||
$entity = $matches[0];
|
||||
$hex_part = isset($matches[1]) ? $matches[1] : null;
|
||||
$dec_part = isset($matches[2]) ? $matches[2] : null;
|
||||
$hex_part = @$matches[1];
|
||||
$dec_part = @$matches[2];
|
||||
$named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3];
|
||||
if ($hex_part !== NULL && $hex_part !== "") {
|
||||
return HTMLPurifier_Encoder::unichr(hexdec($hex_part));
|
||||
|
||||
@@ -54,11 +54,6 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
|
||||
*/
|
||||
private $_enum_attrdef;
|
||||
|
||||
/**
|
||||
* @type HTMLPurifier_AttrDef_Enum
|
||||
*/
|
||||
private $_universal_attrdef;
|
||||
|
||||
public function __construct()
|
||||
{
|
||||
$this->_tidy = new csstidy();
|
||||
@@ -75,13 +70,6 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
|
||||
'focus'
|
||||
)
|
||||
);
|
||||
$this->_universal_attrdef = new HTMLPurifier_AttrDef_Enum(
|
||||
array(
|
||||
'initial',
|
||||
'inherit',
|
||||
'unset',
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -319,11 +307,6 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
|
||||
unset($style[$name]);
|
||||
continue;
|
||||
}
|
||||
$uni_ret = $this->_universal_attrdef->validate($value, $config, $context);
|
||||
if ($uni_ret !== false) {
|
||||
$style[$name] = $uni_ret;
|
||||
continue;
|
||||
}
|
||||
$def = $css_definition->info[$name];
|
||||
$ret = $def->validate($value, $config, $context);
|
||||
if ($ret === false) {
|
||||
|
||||
@@ -264,8 +264,9 @@ class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition
|
||||
if (isset($this->info_content_sets['Block'][$block_wrapper])) {
|
||||
$this->info_block_wrapper = $block_wrapper;
|
||||
} else {
|
||||
throw new Exception(
|
||||
'Cannot use non-block element as block wrapper'
|
||||
trigger_error(
|
||||
'Cannot use non-block element as block wrapper',
|
||||
E_USER_ERROR
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -28,28 +28,22 @@ class HTMLPurifier_HTMLModule_Iframe extends HTMLPurifier_HTMLModule
|
||||
if ($config->get('HTML.SafeIframe')) {
|
||||
$this->safe = true;
|
||||
}
|
||||
$attrs = array(
|
||||
'src' => 'URI#embedded',
|
||||
'width' => 'Length',
|
||||
'height' => 'Length',
|
||||
'name' => 'ID',
|
||||
'scrolling' => 'Enum#yes,no,auto',
|
||||
'frameborder' => 'Enum#0,1',
|
||||
'longdesc' => 'URI',
|
||||
'marginheight' => 'Pixels',
|
||||
'marginwidth' => 'Pixels',
|
||||
);
|
||||
|
||||
if ($config->get('HTML.Trusted')) {
|
||||
$attrs['allowfullscreen'] = 'Bool#allowfullscreen';
|
||||
}
|
||||
|
||||
$this->addElement(
|
||||
'iframe',
|
||||
'Inline',
|
||||
'Flow',
|
||||
'Common',
|
||||
$attrs
|
||||
array(
|
||||
'src' => 'URI#embedded',
|
||||
'width' => 'Length',
|
||||
'height' => 'Length',
|
||||
'name' => 'ID',
|
||||
'scrolling' => 'Enum#yes,no,auto',
|
||||
'frameborder' => 'Enum#0,1',
|
||||
'longdesc' => 'URI',
|
||||
'marginheight' => 'Pixels',
|
||||
'marginwidth' => 'Pixels',
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -112,8 +112,9 @@ class HTMLPurifier_HTMLModule_Tidy extends HTMLPurifier_HTMLModule
|
||||
return;
|
||||
}
|
||||
if (!isset($this->fixesForLevel[$this->defaultLevel])) {
|
||||
throw new Exception(
|
||||
'Default level ' . $this->defaultLevel . ' does not exist'
|
||||
trigger_error(
|
||||
'Default level ' . $this->defaultLevel . ' does not exist',
|
||||
E_USER_ERROR
|
||||
);
|
||||
return;
|
||||
}
|
||||
@@ -161,7 +162,8 @@ class HTMLPurifier_HTMLModule_Tidy extends HTMLPurifier_HTMLModule
|
||||
$e->$type = $fix;
|
||||
break;
|
||||
default:
|
||||
throw new Exception("Fix type $type not supported");
|
||||
trigger_error("Fix type $type not supported", E_USER_ERROR);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -269,6 +269,20 @@ class HTMLPurifier_Lexer
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Special Internet Explorer conditional comments should be removed.
|
||||
* @param string $string HTML string to process.
|
||||
* @return string HTML with conditional comments removed.
|
||||
*/
|
||||
protected static function removeIEConditional($string)
|
||||
{
|
||||
return preg_replace(
|
||||
'#<!--\[if [^>]+\]>.*?<!\[endif\]-->#si', // probably should generalize for all strings
|
||||
'',
|
||||
$string
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback function for escapeCDATA() that does the work.
|
||||
*
|
||||
@@ -309,6 +323,8 @@ class HTMLPurifier_Lexer
|
||||
// escape CDATA
|
||||
$html = $this->escapeCDATA($html);
|
||||
|
||||
$html = $this->removeIEConditional($html);
|
||||
|
||||
// extract body from document if applicable
|
||||
if ($config->get('Core.ConvertDocumentToFragment')) {
|
||||
$e = false;
|
||||
|
||||
@@ -72,9 +72,6 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
|
||||
if ($config->get('Core.AllowParseManyTags') && defined('LIBXML_PARSEHUGE')) {
|
||||
$options |= LIBXML_PARSEHUGE;
|
||||
}
|
||||
if ($config->get('Core.RemoveBlanks') && defined('LIBXML_NOBLANKS')) {
|
||||
$options |= LIBXML_NOBLANKS;
|
||||
}
|
||||
|
||||
set_error_handler(array($this, 'muteErrorHandler'));
|
||||
// loadHTML() fails on PHP 5.3 when second parameter is given
|
||||
|
||||
@@ -44,7 +44,7 @@ abstract class HTMLPurifier_Token_Tag extends HTMLPurifier_Token
|
||||
$this->name = ctype_lower($name) ? $name : strtolower($name);
|
||||
foreach ($attr as $key => $value) {
|
||||
// normalization only necessary when key is not lowercase
|
||||
if (!ctype_lower((string)$key)) {
|
||||
if (!ctype_lower($key)) {
|
||||
$new_key = strtolower($key);
|
||||
if (!isset($attr[$new_key])) {
|
||||
$attr[$new_key] = $attr[$key];
|
||||
|
||||
@@ -54,6 +54,5 @@ if (strtolower($GLOBALS['PHORUM']['DATA']['CHARSET']) !== 'utf-8') {
|
||||
$config->set('Core.EscapeNonASCIICharacters', true);
|
||||
}
|
||||
$config->set('Core.AllowParseManyTags', false);
|
||||
$config->set('Core.RemoveBlanks', false);
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
<?php
|
||||
|
||||
class HTMLPurifier_AttrDef_CSS_RatioTest extends HTMLPurifier_AttrDefHarness
|
||||
{
|
||||
|
||||
public function test()
|
||||
{
|
||||
$this->def = new HTMLPurifier_AttrDef_CSS_Ratio();
|
||||
|
||||
$this->assertDef('1/2');
|
||||
$this->assertDef('1 / 2', '1/2');
|
||||
$this->assertDef('1');
|
||||
$this->assertDef('1/0');
|
||||
$this->assertDef('0/1');
|
||||
|
||||
$this->assertDef('1/2/3', false);
|
||||
$this->assertDef('/2/3', false);
|
||||
$this->assertDef('/12', false);
|
||||
$this->assertDef('1/', false);
|
||||
$this->assertDef('asdf', false);
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
@@ -72,10 +72,6 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
|
||||
$this->assertDef('min-width:50rem;');
|
||||
$this->assertDef('min-width:50vw;');
|
||||
$this->assertDef('min-width:-50vw;', false);
|
||||
$this->assertDef('aspect-ratio:16/9;');
|
||||
$this->assertDef('aspect-ratio:auto;');
|
||||
$this->assertDef('aspect-ratio:16/9 auto;');
|
||||
$this->assertDef('aspect-ratio:auto 16/9;');
|
||||
$this->assertDef('text-decoration:underline;');
|
||||
$this->assertDef('text-decoration-line:overline;');
|
||||
$this->assertDef('text-decoration-style:dashed;');
|
||||
@@ -120,10 +116,8 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
|
||||
$this->assertDef('text-transform:capitalize;destroy:it;',
|
||||
'text-transform:capitalize;');
|
||||
|
||||
// universal values work for everything
|
||||
// inherit works for everything
|
||||
$this->assertDef('text-align:inherit;');
|
||||
$this->assertDef('text-align:initial;');
|
||||
$this->assertDef('text-align:unset;');
|
||||
|
||||
// bad props
|
||||
$this->assertDef('nodice:foobar;', false);
|
||||
|
||||
@@ -56,8 +56,7 @@ class HTMLPurifier_AttrDef_URI_HostTest extends HTMLPurifier_AttrDefHarness
|
||||
function testAllowUnderscore() {
|
||||
$this->config->set('Core.AllowHostnameUnderscore', true);
|
||||
$this->assertDef("foo_bar.example.com");
|
||||
$this->assertDef("foo_.example.com");
|
||||
$this->assertDef("_dmarc.example.com");
|
||||
$this->assertDef("foo_.example.com", false);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -88,13 +88,6 @@ class HTMLPurifier_Filter_ExtractStyleBlocksTest extends HTMLPurifier_Harness
|
||||
$this->assertCleanCSS("a .foo #id div.cl#foo {\nfont-weight:700\n}");
|
||||
}
|
||||
|
||||
public function test_cleanCSS_universals()
|
||||
{
|
||||
$this->assertCleanCSS("a {\nfont-weight:inherit\n}");
|
||||
$this->assertCleanCSS("a {\nfont-weight:initial\n}");
|
||||
$this->assertCleanCSS("a {\nfont-weight:unset\n}");
|
||||
}
|
||||
|
||||
public function test_cleanCSS_angledBrackets()
|
||||
{
|
||||
// [Content] No longer can smuggle in angled brackets using
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
<table>
|
||||
<caption>
|
||||
Cool Table
|
||||
</caption>
|
||||
<tr>
|
||||
<td>
|
||||
Element 1
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
@@ -1,7 +0,0 @@
|
||||
<table><caption>
|
||||
Cool Table
|
||||
</caption>
|
||||
<tr><td>
|
||||
Element 1
|
||||
</td>
|
||||
</tr></table>
|
||||
@@ -222,17 +222,6 @@ a[href|title]
|
||||
$this->assertPurification_AllowedAttributes_local_p_style();
|
||||
}
|
||||
|
||||
public function test_AllowedAttributes_invalidAttributeDueToConsistingOfNumbers_UsingDirectLex()
|
||||
{
|
||||
$this->config->set('HTML.AllowedElements', array('a'));
|
||||
$this->config->set('HTML.AllowedAttributes', 'href');
|
||||
$this->config->set('Core.LexerImpl', 'DirectLex');
|
||||
$this->assertPurification(
|
||||
'<a href="https://example.com/" 10="hoge">Test</a>',
|
||||
'<a href="https://example.com/">Test</a>'
|
||||
);
|
||||
}
|
||||
|
||||
public function test_ForbiddenElements()
|
||||
{
|
||||
$this->config->set('HTML.ForbiddenElements', 'b');
|
||||
@@ -410,19 +399,6 @@ a[href|title]
|
||||
$this->assertIdentical($input, $output);
|
||||
}
|
||||
|
||||
public function test_removeBlanks()
|
||||
{
|
||||
$config = HTMLPurifier_Config::createDefault();
|
||||
$config->set('Core.RemoveBlanks', true);
|
||||
|
||||
$input = file_get_contents(__DIR__ . '/FixtureData/RemoveBlankTestCaseInput.html');
|
||||
$expected = file_get_contents(__DIR__ . '/FixtureData/RemoveBlankTestCaseOutput.html');
|
||||
|
||||
$purifier = new HTMLPurifier($config);
|
||||
$actual = $purifier->purify($input);
|
||||
$this->assertIdentical($expected, $actual);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
--INI--
|
||||
HTML.SafeIframe = true
|
||||
HTML.Trusted = true
|
||||
URI.SafeIframeRegexp = "%^http://www.youtube.com/embed/%"
|
||||
--HTML--
|
||||
<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen></iframe>
|
||||
--EXPECT--
|
||||
<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
|
||||
--# vim: et sw=4 sts=4
|
||||
@@ -380,24 +380,6 @@ class HTMLPurifier_LexerTest extends HTMLPurifier_Harness
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Conditional comments are not supported by HTMLPurifier, but we
|
||||
* should make sure they don't break the lexer.
|
||||
*/
|
||||
public function test_tokenizeHTML_conditionalComments()
|
||||
{
|
||||
$this->assertTokenization(
|
||||
'<!--[if mso]>A<![endif]-->B<!--[if !mso]><!---->C<!-- <![endif]-->',
|
||||
array(
|
||||
new HTMLPurifier_Token_Comment('[if mso]>A<![endif]'),
|
||||
new HTMLPurifier_Token_Text("B"),
|
||||
new HTMLPurifier_Token_Comment('[if !mso]><!--'),
|
||||
new HTMLPurifier_Token_Text("C"),
|
||||
new HTMLPurifier_Token_Comment(' <![endif]'),
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
public function test_tokenizeHTML_unterminatedTag()
|
||||
{
|
||||
$this->assertTokenization(
|
||||
@@ -803,6 +785,14 @@ div {}
|
||||
);
|
||||
}
|
||||
|
||||
public function test_tokenizeHTML_ignoreIECondComment()
|
||||
{
|
||||
$this->assertTokenization(
|
||||
'<!--[if IE]>foo<a>bar<!-- baz --><![endif]-->',
|
||||
array()
|
||||
);
|
||||
}
|
||||
|
||||
public function test_tokenizeHTML_removeProcessingInstruction()
|
||||
{
|
||||
$this->config->set('Core.RemoveProcessingInstructions', true);
|
||||
@@ -834,6 +824,16 @@ div {}
|
||||
);
|
||||
}
|
||||
|
||||
public function test_tokenizeHTML_conditionalCommentUngreedy()
|
||||
{
|
||||
$this->assertTokenization(
|
||||
'<!--[if gte mso 9]>a<![endif]-->b<!--[if gte mso 9]>c<![endif]-->',
|
||||
array(
|
||||
new HTMLPurifier_Token_Text("b")
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
public function test_tokenizeHTML_imgTag()
|
||||
{
|
||||
$start = array(
|
||||
|
||||
@@ -48,7 +48,7 @@ if ( is_string($GLOBALS['HTMLPurifierTest']['PEAR']) ) {
|
||||
}
|
||||
|
||||
// after external libraries are loaded, turn on compile time errors
|
||||
error_reporting(E_ALL);
|
||||
error_reporting(E_ALL | E_STRICT);
|
||||
|
||||
// initialize extra HTML Purifier libraries
|
||||
require '../extras/HTMLPurifierExtras.auto.php';
|
||||
|
||||
@@ -23,8 +23,9 @@
|
||||
* $test_files) do not have underscores in their names.
|
||||
*/
|
||||
|
||||
// HTML Purifier runs error free.
|
||||
error_reporting(E_ALL);
|
||||
// HTML Purifier runs error free on E_STRICT, so if code reports
|
||||
// errors, we want to know about it.
|
||||
error_reporting(E_ALL | E_STRICT);
|
||||
|
||||
// Because we always want to know about errors, and because SimpleTest
|
||||
// will notify us about them, logging the errors to stderr is
|
||||
|
||||
Reference in New Issue
Block a user