Release 3.3.0.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>

.gitattributes

@@ -0,0 +1 @@
+configdoc/usage.xml -crlf

.gitignore

@@ -0,0 +1,18 @@
+conf/
+test-settings.php
+library/HTMLPurifier/DefinitionCache/Serializer/*/
+library/standalone/
+library/HTMLPurifier.standalone.php
+library/HTMLPurifier*.tgz
+library/package*.xml
+smoketests/test-schema.html
+configdoc/*.html
+configdoc/configdoc.xml
+docs/doxygen*
+*.phpt.diff
+*.phpt.exp
+*.phpt.log
+*.phpt.out
+*.phpt.php
+*.phpt.skip.php
+*.htmlt.ini

CREDITS

@@ -5,3 +5,5 @@ Almost everything written by Edward Z. Yang (Ambush Commander).  Lots of thanks
 to the DevNetwork Community for their help (see docs/ref-devnetwork.html for
 more details), Feyd especially (namely IPv6 and optimization).  Thanks to RSnake
 for letting me package his fantastic XSS cheatsheet for a smoketest.
+
+    vim: et sw=4 sts=4

FOCUS

@@ -0,0 +1,13 @@
+7 - Major bugfixes
+
+[ Appendix A: Release focus IDs ]
+0 - N/A
+1 - Initial freshmeat announcement
+2 - Documentation
+3 - Code cleanup
+4 - Minor feature enhancements
+5 - Major feature enhancements
+6 - Minor bugfixes
+7 - Major bugfixes
+8 - Minor security fixes
+9 - Major security fixes

INSTALL

@@ -2,8 +2,8 @@
 Install
     How to install HTML Purifier
 
-HTML Purifier is designed to run out of the box, so actually using the 
+HTML Purifier is designed to run out of the box, so actually using the
-library is extremely easy.  (Although... if you were looking for a 
+library is extremely easy.  (Although... if you were looking for a
 step-by-step installation GUI, you've downloaded the wrong software!)
 
 While the impatient can get going immediately with some of the sample
@@ -15,16 +15,15 @@ with these contents.
 ---------------------------------------------------------------------------
 1.  Compatibility
 
-HTML Purifier is PHP 5 only, and is actively tested from PHP 5.0.5 and 
+HTML Purifier is PHP 5 only, and is actively tested from PHP 5.0.5 and
-up. It has no core dependencies with other libraries. PHP 
+up. It has no core dependencies with other libraries. PHP
-4 support was deprecated on December 31, 2007 with HTML Purifier 3.0.0. 
+4 support was deprecated on December 31, 2007 with HTML Purifier 3.0.0.
-Essential security fixes will be issued for the 2.1.x branch until 
-August 8, 2008. 
 
 These optional extensions can enhance the capabilities of HTML Purifier:
 
-    * iconv : Converts text to and from non-UTF-8 encodings
+    * iconv  : Converts text to and from non-UTF-8 encodings
-    * tidy  : Used for pretty-printing HTML
+    * bcmath : Used for unit conversion and imagecrash protection
+    * tidy   : Used for pretty-printing HTML
 
 
 ---------------------------------------------------------------------------
@@ -95,32 +94,32 @@ Autoload compatibility
     HTML Purifier attempts to be as smart as possible when registering an
     autoloader, but there are some cases where you will need to change
     your own code to accomodate HTML Purifier. These are those cases:
-    
+
     PHP VERSION IS LESS THAN 5.1.2, AND YOU'VE DEFINED __autoload
         Because spl_autoload_register() doesn't exist in early versions
         of PHP 5, HTML Purifier has no way of adding itself to the autoload
         stack. Modify your __autoload function to test
         HTMLPurifier_Bootstrap::autoload($class)
-        
+
         For example, suppose your autoload function looks like this:
-        
+
             function __autoload($class) {
                 require str_replace('_', '/', $class) . '.php';
                 return true;
             }
-        
+
         A modified version with HTML Purifier would look like this:
-        
+
             function __autoload($class) {
                 if (HTMLPurifier_Bootstrap::autoload($class)) return true;
                 require str_replace('_', '/', $class) . '.php';
                 return true;
             }
-        
+
         Note that there *is* some custom behavior in our autoloader; the
         original autoloader in our example would work for 99% of the time,
         but would fail when including language files.
-    
+
     AN __autoload FUNCTION IS DECLARED AFTER OUR AUTOLOADER IS REGISTERED
         spl_autoload_register() has the curious behavior of disabling
         the existing __autoload() handler. Users need to explicitly
@@ -130,14 +129,14 @@ Autoload compatibility
         HTML Purifier will register the function for you. But if it is
         declared afterwards, it will mysteriously not work. This
         snippet of code (after your autoloader is defined) will fix it:
-        
+
             spl_autoload_register('__autoload')
-    
+
     Users should also be on guard if they use a version of PHP previous
     to 5.1.2 without an autoloader--HTML Purifier will define __autoload()
     for you, which can collide with an autoloader that was added by *you*
     later.
-    
+
 
 For better performance
 ----------------------
@@ -146,18 +145,18 @@ For better performance
     with large amounts of code (HTML Purifier included), don't like
     autoloaders. We offer an include file that includes all of HTML Purifier's
     files in one go in an opcode cache friendly manner:
-    
+
         // If /path/to/library isn't already in your include path, uncomment
         // the below line:
         // require '/path/to/library/HTMLPurifier.path.php';
-        
+
         require 'HTMLPurifier.includes.php';
-    
+
     Optional components still need to be included--you'll know if you try to
     use a feature and you get a class doesn't exists error! The autoloader
     can be used in conjunction with this approach to catch classes that are
     missing. Simply add this afterwards:
-    
+
         require 'HTMLPurifier.autoload.php';
 
 Standalone version
@@ -168,22 +167,22 @@ Standalone version
     maintenance/generate-standalone.php . The standalone version has the
     benefit of having most of its code in one file, so parsing is much
     faster and the library is easier to manage.
-    
+
     If HTMLPurifier.standalone.php exists in the library directory, you
     can use it like this:
-    
+
         require '/path/to/HTMLPurifier.standalone.php';
-    
+
     This is equivalent to including HTMLPurifier.includes.php, except that
     the contents of standalone/ will be added to your path. To override this
     behavior, specify a new HTMLPURIFIER_PREFIX where standalone files can
     be found (usually, this will be one directory up, the "true" library
     directory in full distributions). Don't forget to set your path too!
-    
+
     The autoloader can be added to the end to ensure the classes are
     loaded when necessary; otherwise you can manually include them.
     To use the autoloader, use this:
-    
+
         require 'HTMLPurifier.autoload.php';
 
 For advanced users
@@ -191,14 +190,14 @@ For advanced users
 
     HTMLPurifier.auto.php performs a number of operations that can be done
     individually. These are:
-    
+
         HTMLPurifier.path.php
             Puts /path/to/library in the include path. For high performance,
             this should be done in php.ini.
-        
+
         HTMLPurifier.autoload.php
             Registers our autoload handler HTMLPurifier_Bootstrap::autoload($class).
-    
+
     You can do these operations by yourself--in fact, you must modify your own
     autoload handler if you are using a version of PHP earlier than PHP 5.1.2
     (See "Autoload compatibility" above).
@@ -353,7 +352,7 @@ If your website is in UTF-8 and XHTML Transitional, use this code:
 
 <?php
     require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
-    
+
     $purifier = new HTMLPurifier();
     $clean_html = $purifier->purify($dirty_html);
 ?>
@@ -362,12 +361,13 @@ If your website is in a different encoding or doctype, use this code:
 
 <?php
     require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
-    
+
     $config = HTMLPurifier_Config::createDefault();
     $config->set('Core', 'Encoding', 'ISO-8859-1'); // replace with your encoding
     $config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); // replace with your doctype
     $purifier = new HTMLPurifier($config);
-    
+
     $clean_html = $purifier->purify($dirty_html);
 ?>
 
+    vim: et sw=4 sts=4

INSTALL.fr.utf8

@@ -20,7 +20,7 @@ ce document pour quelques choses.
 HTML Purifier fonctionne dans PHP 5. PHP 5.0.5 est le dernier
 version que je le testais.  Il ne dépend de les autre librairies.
 
-Les extensions optionnel est iconv (en général déjà installer) et 
+Les extensions optionnel est iconv (en général déjà installer) et
 tidy (répandu aussi). Si vous utilisez UTF-8 et ne voulez pas
 l'indentation, vous pouvez utiliser HTML Purifier sans ces extensions.
 
@@ -48,7 +48,7 @@ Si votre site web est en UTF-8 et XHTML Transitional, utilisez:
 
 <?php
     require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
-    
+
     $purificateur = new HTMLPurifier();
     $html_propre = $purificateur->purify($html_salle);
 ?>
@@ -57,11 +57,13 @@ Sinon, utilisez:
 
 <?php
     require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
-    
+
     $config = HTMLPurifier_Config::createDefault();
     $config->set('Core', 'Encoding', 'ISO-8859-1'); //remplacez avec votre encoding
     $config->set('Core', 'XHTML', true); //remplacez avec false si HTML 4.01
     $purificateur = new HTMLPurifier($config);
-    
+
     $html_propre = $purificateur->purify($html_salle);
-?>
+?>
+
+    vim: et sw=4 sts=4

LICENSE

@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
 on the Library (independent of the use of the Library in a tool for
 writing it).  Whether that is true depends on what the Library does
 and what the program that uses the Library does.
-  
+
   1. You may copy and distribute verbatim copies of the Library's
 complete source code as you receive it, in any medium, provided that
 you conspicuously and appropriately publish on each copy an
@@ -501,4 +501,4 @@ necessary.  Here is a sample; alter the names:
 
 That's all there is to it!
 
-
+    vim: et sw=4 sts=4

NEWS

@@ -9,6 +9,174 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
     . Internal change
 ==========================
 
+3.3.0, released 2009-02-16
+! Implement CSS property 'overflow' when %CSS.AllowTricky is true.
+! Implement generic property list classess
+- Fix bug with testEncodingSupportsASCII() algorithm when iconv() implementation
+  does not do the "right thing" with characters not supported in the output
+  set.
+- Spellcheck UTF-8: The Secret To Character Encoding
+- Fix improper removal of the contents of elements with only whitespace. Thanks
+  Eric Wald for reporting.
+- Fix broken test suite in versions of PHP without spl_autoload_register()
+- Fix degenerate case with YouTube filter involving double hyphens.
+  Thanks Pierre Attar for reporting.
+- Fix YouTube rendering problem on certain versions of Firefox.
+- Fix CSSDefinition Printer problems with decorators
+- Add text parameter to unit tests, forces text output
+. Add verbose mode to command line test runner, use (--verbose)
+. Turn on unit tests for UnitConverter
+. Fix missing version number in configuration %Attr.DefaultImageAlt (added 3.2.0)
+. Fix newline errors that caused spurious failures when CRLF HTML Purifier was
+  tested on Linux.
+. Removed trailing whitespace from all text files, see
+  remote-trailing-whitespace.php maintenance script.
+. Convert configuration to use property list backend.
+
+3.2.0, released 2008-10-31
+# Using %Core.CollectErrors forces line number/column tracking on, whereas
+  previously you could theoretically turn it off.
+# HTMLPurifier_Injector->notifyEnd() is formally deprecated. Please
+  use handleEnd() instead.
+! %Output.AttrSort for when you need your attributes in alphabetical order to
+  deal with a bug in FCKEditor. Requested by frank farmer.
+! Enable HTML comments when %HTML.Trusted is on. Requested by Waldo Jaquith.
+! Proper support for name attribute. It is now allowed and equivalent to the id
+  attribute in a and img tags, and is only converted to id when %HTML.TidyLevel
+  is heavy (for all doctypes).
+! %AutoFormat.RemoveEmpty to remove some empty tags from documents. Please don't
+  use on hand-written HTML.
+! Add error-cases for unsupported elements in MakeWellFormed. This enables
+  the strategy to be used, standalone, on untrusted input.
+! %Core.AggressivelyFixLt is on by default. This causes more sensible
+  processing of left angled brackets in smileys and other whatnot.
+! Test scripts now have a 'type' parameter, which lets you say 'htmlpurifier',
+  'phpt', 'vtest', etc. in order to only execute those tests. This supercedes
+  the --only-phpt parameter, although for backwards-compatibility the flag
+  will still work.
+! AutoParagraph auto-formatter will now preserve double-newlines upon output.
+  Users who are not performing inbound filtering, this may seem a little
+  useless, but as a bonus, the test suite and handling of edge cases is also
+  improved.
+! Experimental implementation of forms for %HTML.Trusted
+! Track column numbers when maintain line numbers is on
+! Proprietary 'background' attribute on table-related elements converted into
+  corresponding CSS.  Thanks Fusemail for sponsoring this feature!
+! Add forward(), forwardUntilEndToken(), backward() and current() to Injector
+  supertype.
+! HTMLPurifier_Injector->handleEnd() permits modification to end tokens. The
+  time of operation varies slightly from notifyEnd() as *all* end tokens are
+  processed by the injector before they are subject to the well-formedness rules.
+! %Attr.DefaultImageAlt allows overriding default behavior of setting alt to
+  basename of image when not present.
+! %AutoFormat.DisplayLinkURI neuters <a> tags into plain text URLs.
+- Fix two bugs in %URI.MakeAbsolute; one involving empty paths in base URLs,
+  the other involving an undefined $is_folder error.
+- Throw error when %Core.Encoding is set to a spurious value. Previously,
+  this errored silently and returned false.
+- Redirected stderr to stdout for flush error output.
+- %URI.DisableExternal will now use the host in %URI.Base if %URI.Host is not
+  available.
+- Do not re-munge URL if the output URL has the same host as the input URL.
+  Requested by Chris.
+- Fix error in documentation regarding %Filter.ExtractStyleBlocks
+- Prevent <![CDATA[<body></body>]]> from triggering %Core.ConvertDocumentToFragment
+- Fix bug with inline elements in blockquotes conflicting with strict doctype
+- Detect if HTML support is disabled for DOM by checking for loadHTML() method.
+- Fix bug where dots and double-dots in absolute URLs without hostname were
+  not collapsed by URIFilter_MakeAbsolute.
+- Fix bug with anonymous modules operating on SafeEmbed or SafeObject elements
+  by reordering their addition.
+- Will now throw exception on many error conditions during lexer creation; also
+  throw an exception when MaintainLineNumbers is true, but a non-tracksLineNumbers
+  is being used.
+- Detect if domxml extension is loaded, and use DirectLEx accordingly.
+- Improve handling of big numbers with floating point arithmetic in UnitConverter.
+  Reported by David Morton.
+. Strategy_MakeWellFormed now operates in-place, saving memory and allowing
+  for more interesting filter-backtracking
+. New HTMLPurifier_Injector->rewind() functionality, allows injectors to rewind
+  index to reprocess tokens.
+. StringHashParser now allows for multiline sections with "empty" content;
+  previously the section would remain undefined.
+. Added --quick option to multitest.php, which tests only the most recent
+  release for each series.
+. Added --distro option to multitest.php, which accepts either 'normal' or
+  'standalone'. This supercedes --exclude-normal and --exclude-standalone
+
+3.1.1, released 2008-06-19
+# %URI.Munge now, by default, does not munge resources (for example, <img src="">)
+  In order to enable this again, please set %URI.MungeResources to true.
+! More robust imagecrash protection with height/width CSS with %CSS.MaxImgLength,
+  and height/width HTML with %HTML.MaxImgLength.
+! %URI.MungeSecretKey for secure URI munging. Thanks Chris
+  for sponsoring this feature. Check out the corresponding documentation
+  for details. (Att Nightly testers: The API for this feature changed before
+  the general release. Namely, rename your directives %URI.SecureMungeSecretKey =>
+  %URI.MungeSecretKey and and %URI.SecureMunge => %URI.Munge)
+! Implemented post URI filtering. Set member variable $post to true to set
+  a URIFilter as such.
+! Allow modules to define injectors via $info_injector. Injectors are
+  automatically disabled if injector's needed elements are not found.
+! Support for "safe" objects added, use %HTML.SafeObject and %HTML.SafeEmbed.
+  Thanks Chris for sponsoring. If you've been using ad hoc code from the
+  forums, PLEASE use this instead.
+! Added substitutions for %e, %n, %a and %p in %URI.Munge (in order,
+  embedded, tag name, attribute name, CSS property name). See %URI.Munge
+  for more details. Requested by Jochem Blok.
+- Disable percent height/width attributes for img.
+- AttrValidator operations are now atomic; updates to attributes are not
+  manifest in token until end of operations. This prevents naughty internal
+  code from directly modifying CurrentToken when they're not supposed to.
+  This semantics change was requested by frank farmer.
+- Percent encoding checks enabled for URI query and fragment
+- Fix stray backslashes in font-family; CSS Unicode character escapes are
+  now properly resolved (although *only* in font-family). Thanks Takeshi Terada
+  for reporting.
+- Improve parseCDATA algorithm to take into account newline normalization
+- Account for browser confusion between Yen character and backslash in
+  Shift_JIS encoding. This fix generalizes to any other encoding which is not
+  a strict superset of printable ASCII. Thanks Takeshi Terada for reporting.
+- Fix missing configuration parameter in Generator calls. Thanks vs for the
+  partial patch.
+- Improved adherence to Unicode by checking for non-character codepoints.
+  Thanks Geoffrey Sneddon for reporting. This may result in degraded
+  performance for extremely large inputs.
+- Allow CSS property-value pair ''text-decoration: none''. Thanks Jochem Blok
+  for reporting.
+. Added HTMLPurifier_UnitConverter and HTMLPurifier_Length for convenient
+  handling of CSS-style lengths. HTMLPurifier_AttrDef_CSS_Length now uses
+  this class.
+. API of HTMLPurifier_AttrDef_CSS_Length changed from __construct($disable_negative)
+  to __construct($min, $max). __construct(true) is equivalent to
+  __construct('0').
+. Added HTMLPurifier_AttrDef_Switch class
+. Rename HTMLPurifier_HTMLModule_Tidy->construct() to setup() and bubble method
+  up inheritance hierarchy to HTMLPurifier_HTMLModule. All HTMLModules
+  get this called with the configuration object.  All modules now
+  use this rather than __construct(), although legacy code using constructors
+  will still work--the new format, however, lets modules access the
+  configuration object for HTML namespace dependant tweaks.
+. AttrDef_HTML_Pixels now takes a single construction parameter, pixels.
+. ConfigSchema data-structure heavily optimized; on average it uses a third
+  the memory it did previously. The interface has changed accordingly,
+  consult changes to HTMLPurifier_Config for details.
+. Variable parsing types now are magic integers instead of strings
+. Added benchmark for ConfigSchema
+. HTMLPurifier_Generator requires $config and $context parameters. If you
+  don't know what they should be, use HTMLPurifier_Config::createDefault()
+  and new HTMLPurifier_Context().
+. Printers now properly distinguish between output configuration, and
+  target configuration. This is not applicable to scripts using
+  the Printers for HTML Purifier related tasks.
+. HTML/CSS Printers must be primed with prepareGenerator($gen_config), otherwise
+  fatal errors will ensue.
+. URIFilter->prepare can return false in order to abort loading of the filter
+. Factory for AttrDef_URI implemented, URI#embedded to indicate URI that embeds
+  an external resource.
+. %URI.Munge functionality factored out into a post-filter class.
+. Added CurrentCSSProperty context variable during CSS validation
+
 3.1.0, released 2008-05-18
 # Unnecessary references to objects (vestiges of PHP4) removed from method
   signatures.  The following methods do not need references when assigning from
@@ -33,7 +201,8 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   and allows for version numbers like "3.1.0-dev".
 ! %HTML.Allowed deals gracefully with whitespace anywhere, anytime!
 ! HTML Purifier's URI handling is a lot more robust, with much stricter
-  validation checks and better percent encoding handling.
+  validation checks and better percent encoding handling. Thanks Gareth Heyes
+  for indicating security vulnerabilities from lax percent encoding.
 ! Bootstrap autoloader deals more robustly with classes that don't exist,
   preventing class_exists($class, true) from barfing.
 - InterchangeBuilder now alphabetizes its lists
@@ -84,7 +253,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   enabled using %Filter.$filter_name or by setting your own filters using
   %Filter.Custom
 # Directive-level safety properties superceded in favor of module-level
-  safety. Internal method HTMLModule->addElement() has changed, although 
+  safety. Internal method HTMLModule->addElement() has changed, although
   the externally visible HTMLDefinition->addElement has *not* changed.
 ! Extra utility classes for testing and non-library operations can
   be found in extras/. Specifically, these are FSTools and ConfigDoc.
@@ -124,7 +293,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
 . Dry runs now supported in SimpleTest; testing facilities improved
 . Bootstrap class added for handling autoloading functionality
 . Implemented recursive glob at FSTools->globr
-. ConfigSchema now has instance methods for all corresponding define* 
+. ConfigSchema now has instance methods for all corresponding define*
   static methods.
 . A couple of new historical maintenance scripts were added.
 . HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php split into two files
@@ -145,7 +314,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
 . HTMLPurifier_ConfigSchema->validate() deprecated in favor of
   HTMLPurifier_VarParser->parse()
 . Integers auto-cast into float type by VarParser.
-. HTMLPURIFIER_STRICT removed; no validation is performed on runtime, only 
+. HTMLPURIFIER_STRICT removed; no validation is performed on runtime, only
   during cache generation
 . Reordered script calls in maintenance/flush.php
 . Command line scripts now honor exit codes
@@ -187,7 +356,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   script (you must provide this script!)
 - Fixed poor include ordering for Email URI AttrDefs, causes fatal errors
   on some systems.
-- Injector algorithm further refined: off-by-one error regarding skip 
+- Injector algorithm further refined: off-by-one error regarding skip
   counts for dormant injectors fixed
 - Corrective blockquote definition now enabled for HTML 4.01 Strict
 - Fatal error when <img> tag (or any other element with required attributes)
@@ -212,7 +381,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   facilities in PHP 5
 - Make ErrorCollectorEMock work in both PHP 4 and PHP 5
 - Make PH5P work with PHP 5.0 by removing unnecessary array parameter typedef
-. %Core.AcceptFullDocuments renamed to %Core.ConvertDocumentToFragment 
+. %Core.AcceptFullDocuments renamed to %Core.ConvertDocumentToFragment
   to better communicate its purpose
 . Error unit tests can now specify the expectation of no errors. Future
   iterations of the harness will be extremely strict about what errors
@@ -371,7 +540,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   and better modularization
 # Configuration object now finalizes itself when a read operation is
   performed on it, ensuring that its internal state stays consistent.
-  To revert this behavior, you can set the $autoFinalize member variable 
+  To revert this behavior, you can set the $autoFinalize member variable
   off, but it's not recommended.
 # New compact syntax for AttrDef objects that can be used to instantiate
   new objects via make()
@@ -455,7 +624,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   AttrTransform_EnumToCSS, refer to HTMLModule/TransformToStrict.php to
   see how the new equivalent is implemented
 . Unit tests now use exclusively assertIdentical
- 
+
 1.6.0, released 2007-04-01
 ! Support for most common deprecated attributes via transformations:
   + bgcolor in td, th, tr and table
@@ -669,3 +838,5 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
   + Shorthand CSS properties
   + Table CSS properties
   + Deprecated attribute transformations
+
+    vim: et sw=4 sts=4

README

@@ -2,15 +2,15 @@
 README
     All about HTML Purifier
 
-HTML Purifier is an HTML filtering solution that uses a unique combination 
+HTML Purifier is an HTML filtering solution that uses a unique combination
-of robust whitelists and agressive parsing to ensure that not only are 
+of robust whitelists and agressive parsing to ensure that not only are
-XSS attacks thwarted, but the resulting HTML is standards compliant. 
+XSS attacks thwarted, but the resulting HTML is standards compliant.
 
-HTML Purifier is oriented towards richly formatted documents from 
+HTML Purifier is oriented towards richly formatted documents from
-untrusted sources that require CSS and a full tag-set.  This library can 
+untrusted sources that require CSS and a full tag-set.  This library can
-be configured to accept a more restrictive set of tags, but it won't be 
+be configured to accept a more restrictive set of tags, but it won't be
-as efficient as more bare-bones parsers. It will, however, do the job 
+as efficient as more bare-bones parsers. It will, however, do the job
-right, which may be more important. 
+right, which may be more important.
 
 Places to go:
 
@@ -20,3 +20,5 @@ Places to go:
 * See WYSIWYG for information on editors like TinyMCE and FCKeditor
 
 HTML Purifier can be found on the web at: http://htmlpurifier.org/
+
+    vim: et sw=4 sts=4

TODO

@@ -11,24 +11,29 @@ If no interest is expressed for a feature that may require a considerable
 amount of effort to implement, it may get endlessly delayed. Do not be
 afraid to cast your vote for the next feature to be implemented!
 
-- Implement validation for query and for fragment
+- Investigate how early internal structures can be accessed; this would
+  prevent structures from being parsed and serialized multiple times.
+- Built-in support for target="_blank" on all external links
+- Allow <a id="asdf" name="asdf">
+- Convert configuration to allow an arbitrary number of namespaces;
+  then rename as appropriate.
 
 FUTURE VERSIONS
 ---------------
 
-3.2 release [It's All About Trust] (floating)
+4.1 release [It's All About Trust] (floating)
  # Implement untrusted, dangerous elements/attributes
-    - Objects and Forms are especially wanted
  # Implement IDREF support (harder than it seems, since you cannot have
    IDREFs to non-existent IDs)
  # Frameset XHTML 1.0 and HTML 4.01 doctypes
- - Research and implement a "safe" version of the Object module
+ - Implement <area>
+ - Figure out how to simultaneously set %CSS.Trusted and %HTML.Trusted (?)
 
-3.3 release [Error'ed]
+4.2 release [Error'ed]
  # Error logging for filtering/cleanup procedures
  - XSS-attempt detection--certain errors are flagged XSS-like
 
-3.4 release [Do What I Mean, Not What I Say]
+4.3 release [Do What I Mean, Not What I Say]
  # Additional support for poorly written HTML
     - Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
     - Friendly strict handling of <address> (block -> <br>)
@@ -39,31 +44,28 @@ FUTURE VERSIONS
     contents should be dropped or not (currently, there's code that could do
     something like this if it didn't drop the inner text too.)
  - Remove <span> tags that don't do anything (no attributes)
- - Remove empty inline tags<i></i>
  - Append something to duplicate IDs so they're still usable (impl. note: the
    dupe detector would also need to detect the suffix as well)
  - Externalize inline CSS to promote clean HTML, proposed by Sander Tekelenburg
 
-4.0 release [Beyond HTML]
+5.0 release [Beyond HTML]
  # Legit token based CSS parsing (will require revamping almost every
    AttrDef class). Probably will use CSSTidy class?
  # More control over allowed CSS properties using a modularization
  # HTML 5 support
- # IRI support
+ # IRI support (this includes IDN)
  - Standardize token armor for all areas of processing
  - Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
    Also, enable disabling of directionality
 
-5.0 release [To XML and Beyond]
+6.0 release [To XML and Beyond]
- - AllowedAttributes and ForbiddenAttributes step on the toes of XML by
-   using periods; this needs to be changed.
  - Extended HTML capabilities based on namespacing and tag transforms (COMPLEX)
     - Hooks for adding custom processors to custom namespaced tags and
       attributes, offer default implementation
     - Lots of documentation and samples
 
 Ongoing
- - More refactoring to take advantage of PHP5's facilities 
+ - More refactoring to take advantage of PHP5's facilities
  - Refactor unit tests into lots of test methods
  - Plugins for major CMSes (COMPLEX)
     - phpBB
@@ -104,6 +106,7 @@ Neat feature related
  - Full set of color keywords. Also, a way to add onto them without
    finalizing the configuration object.
  - Write a var_export and memcached DefinitionCache - Denis
+ - Allow restriction of allowed class values
 
 Maintenance related (slightly boring)
  # CHMOD install script for PEAR installs
@@ -124,3 +127,5 @@ Wontfix
  - Pretty-printing HTML: users can use Tidy on the output on entire page
  - Native content compression, whitespace stripping: use gzip if this is
    really important
+
+    vim: et sw=4 sts=4

VERSION

@@ -1 +1 @@
-3.1.0
+3.3.0

WHATSNEW

@@ -1,10 +1,6 @@
-HTML Purifier 3.1.0 is the second release series for HTML Purifier on PHP 5
+HTML Purifier 3.3.0 is fixes a number of obscure bugs reported and fixed
-as well as a security update related to URIs. It shifts over to using
+over a four month period.  It is probably the last release in the 3.x
-autoload, and also includes support for the !important CSS modifier,
+series.  Notable new features include support for the overflow CSS
-display and visibility CSS properties with %CSS.AllowTricky, marquee with
+property; notable bugfixes include fixed YouTube rendering in certain
-%HTML.Proprietary (had you scared for a moment, hmm?), a kses() wrapper,
+versions of Firefox, CSSDefinition Printer, improved early PHP support
-%CSS.AllowedProperties, %HTML.ForbiddenAttributes and
+and bugs in iconv.
-%HTML.ForbiddenElements and a totally revamped ConfigDoc system. Since the
-release candidate, there have also been a number of stability fixes such as
-improved URI escaping, a change in serializer ID format, and a relaxed
-format for %HTML.Allowed. And as always, numerous bugfixes.

WYSIWYG

@@ -16,3 +16,5 @@ trouble.  Therein lies the solution:
 HTML Purifier is perfect for filtering pure-HTML input from WYSIWYG editors.
 
 Enough said.
+
+    vim: et sw=4 sts=4

benchmarks/ConfigSchema.php

@@ -0,0 +1,16 @@
+<?php
+
+chdir(dirname(__FILE__));
+
+//require_once '../library/HTMLPurifier.path.php';
+shell_exec('php ../maintenance/generate-schema-cache.php');
+require_once '../library/HTMLPurifier.path.php';
+require_once 'HTMLPurifier.includes.php';
+
+$begin = xdebug_memory_usage();
+
+$schema = HTMLPurifier_ConfigSchema::makeFromSerial();
+
+echo xdebug_memory_usage() - $begin;
+
+// vim: et sw=4 sts=4

benchmarks/Lexer.php

@@ -9,7 +9,7 @@ require_once 'Text/Password.php'; // for generating random input
 
 $LEXERS = array();
 $RUNS = isset($GLOBALS['HTMLPurifierTest']['Runs'])
-    ? $GLOBALS['HTMLPurifierTest']['Runs'] : 2; 
+    ? $GLOBALS['HTMLPurifierTest']['Runs'] : 2;
 
 require_once 'HTMLPurifier/Lexer/DirectLex.php';
 $LEXERS['DirectLex'] = new HTMLPurifier_Lexer_DirectLex();
@@ -22,48 +22,48 @@ if (version_compare(PHP_VERSION, '5', '>=')) {
 // custom class to aid unit testing
 class RowTimer extends Benchmark_Timer
 {
-    
+
     var $name;
-    
+
     function RowTimer($name, $auto = false) {
         $this->name = htmlentities($name);
         $this->Benchmark_Timer($auto);
     }
-    
+
     function getOutput() {
 
         $total  = $this->TimeElapsed();
         $result = $this->getProfiling();
         $dashes = '';
-        
+
         $out = '<tr>';
-        
+
         $out .= "<td>{$this->name}</td>";
-        
+
         $standard = false;
-        
+
         foreach ($result as $k => $v) {
             if ($v['name'] == 'Start' || $v['name'] == 'Stop') continue;
-            
+
             //$perc = (($v['diff'] * 100) / $total);
             //$tperc = (($v['total'] * 100) / $total);
-            
+
             //$out .= '<td align="right">' . $v['diff'] . '</td>';
-            
+
             if ($standard == false) $standard = $v['diff'];
-            
+
             $perc = $v['diff'] * 100 / $standard;
             $bad_run = ($v['diff'] < 0);
-            
+
             $out .= '<td align="right"'.
                    ($bad_run ? ' style="color:#AAA;"' : '').
                    '>' . number_format($perc, 2, '.', '') .
                    '%</td><td>'.number_format($v['diff'],4,'.','').'</td>';
-            
+
         }
-        
+
         $out .= '</tr>';
-        
+
         return $out;
     }
 }
@@ -80,18 +80,18 @@ function print_lexers() {
 
 function do_benchmark($name, $document) {
     global $LEXERS, $RUNS;
-    
+
     $config = HTMLPurifier_Config::createDefault();
     $context = new HTMLPurifier_Context();
-    
+
     $timer = new RowTimer($name);
     $timer->start();
-    
+
     foreach($LEXERS as $key => $lexer) {
         for ($i=0; $i<$RUNS; $i++) $tokens = $lexer->tokenizeHTML($document, $config, $context);
         $timer->setMarker($key);
     }
-    
+
     $timer->stop();
     $timer->display();
 }
@@ -118,11 +118,11 @@ foreach ($LEXERS as $key => $value) {
 $dir = 'samples/Lexer';
 $dh  = opendir($dir);
 while (false !== ($filename = readdir($dh))) {
-    
+
     if (strpos($filename, '.html') !== strlen($filename) - 5) continue;
     $document = file_get_contents($dir . '/' . $filename);
     do_benchmark("File: $filename", $document);
-    
+
 }
 
 // crashers, caused infinite loops before
@@ -153,3 +153,6 @@ echo '<div>Random input was: ' .
 
 
 </body></html>
+<?php
+
+// vim: et sw=4 sts=4

benchmarks/Trace.php

@@ -17,3 +17,5 @@ $data = $purifier->purify(file_get_contents('samples/Lexer/4.html'));
 xdebug_stop_trace();
 
 echo "Trace finished.";
+
+// vim: et sw=4 sts=4

benchmarks/samples/Lexer/1.html

@@ -28,7 +28,7 @@
 
  <li>HX Edison Taiji Club <a href="http://www.taijiclub.org/downloads/Taiji_club_regulation_.pdf">by-law</a>  effective 3/28/2006</li>
  <li>A new email account for our club: HXEdisontaijiclub@yahoo.com</li>
- 
+
  <li>Workshop conducted by <a href="http://www.taijiclub.org/ch/Digest/LiDeyin">?????</a> Li Deyin is set on June 4, 2006 at Clarion Hotel in Edison from 9:30am-12pm; <a href="http://www.taijiclub.org/en/Registration">Registration</a></li>
 
 </ul>
@@ -36,7 +36,7 @@
 
 
 
-<p><i>Taiji</i> is an ancient Chinese tradition of movement systems that is associated with philosophy, physiology, psychology, geometry and dynamics. It is the slowest form of martial arts and is meant to improve the internal spirit.   It is soothing to the soul and extremely invigorating. </p> 
+<p><i>Taiji</i> is an ancient Chinese tradition of movement systems that is associated with philosophy, physiology, psychology, geometry and dynamics. It is the slowest form of martial arts and is meant to improve the internal spirit.   It is soothing to the soul and extremely invigorating. </p>
 
 <p>The founder of Taiji was Zhang Sanfeng (Chang San-feng), who was a monk of the Wu Dang (Wu Tang) Monastery and lived in the period from 1391 to 1459. His exercises stressed suppleness and elasticity as opposed to the hardness and force of other martial art styles. Several centuries old, Taiji was originally developed as a form of self-defense, emphasizing strength, balance, flexibility and speed. Tai Chi also differs from other martial arts in that it is based on the Taoist religion and aims to avoid aggressive forces. </p>
 
@@ -50,4 +50,6 @@
 
 <div style="text-align:center;">Click on photo to see HR version</div></div>
 </body>
-</html>
+</html>
+
+<!-- vim: et sw=4 sts=4 -->

benchmarks/samples/Lexer/2.html

@@ -14,4 +14,6 @@ function rwt(el,ct,cd,sg){var e = window.encodeURIComponent ? encodeURIComponent
 <form action=/search name=f><script><!--
 function qs(el) {if (window.RegExp && window.encodeURIComponent) {var ue=el.href;var qe=encodeURIComponent(document.f.q.value);if(ue.indexOf("q=")!=-1){el.href=ue.replace(new RegExp("q=[^&$]*"),"q="+qe);}else{el.href=ue+"&q="+qe;}}return 1;}
 // -->
-</script><table border=0 cellspacing=0 cellpadding=4><tr><td nowrap><font size=-1><b>Web</b>&nbsp;&nbsp;&nbsp;&nbsp;<a id=1a class=q href="/imghp?hl=en&tab=wi" onClick="return qs(this);">Images</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=2a class=q href="http://groups.google.com/grphp?hl=en&tab=wg" onClick="return qs(this);">Groups</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=4a class=q href="http://news.google.com/nwshp?hl=en&tab=wn" onClick="return qs(this);">News</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=5a class=q href="http://froogle.google.com/frghp?hl=en&tab=wf" onClick="return qs(this);">Froogle</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=8a class=q href="/lochp?hl=en&tab=wl" onClick="return qs(this);">Local</a>&nbsp;&nbsp;&nbsp;&nbsp;<b><a href="/intl/en/options/" class=q>more&nbsp;&raquo;</a></b></font></td></tr></table><table cellspacing=0 cellpadding=0><tr><td width=25%>&nbsp;</td><td align=center><input type=hidden name=hl value=en><input maxlength=2048 size=55 name=q value="" title="Google Search"><br><input type=submit value="Google Search" name=btnG><input type=submit value="I'm Feeling Lucky" name=btnI></td><td valign=top nowrap width=25%><font size=-2>&nbsp;&nbsp;<a href=/advanced_search?hl=en>Advanced Search</a><br>&nbsp;&nbsp;<a href=/preferences?hl=en>Preferences</a><br>&nbsp;&nbsp;<a href=/language_tools?hl=en>Language Tools</a></font></td></tr></table></form><br><br><font size=-1><a href="/ads/">Advertising&nbsp;Programs</a> - <a href=/services/>Business Solutions</a> - <a href=/about.html>About Google</a></font><p><font size=-2>&copy;2006 Google</font></p></center></body></html>
+</script><table border=0 cellspacing=0 cellpadding=4><tr><td nowrap><font size=-1><b>Web</b>&nbsp;&nbsp;&nbsp;&nbsp;<a id=1a class=q href="/imghp?hl=en&tab=wi" onClick="return qs(this);">Images</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=2a class=q href="http://groups.google.com/grphp?hl=en&tab=wg" onClick="return qs(this);">Groups</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=4a class=q href="http://news.google.com/nwshp?hl=en&tab=wn" onClick="return qs(this);">News</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=5a class=q href="http://froogle.google.com/frghp?hl=en&tab=wf" onClick="return qs(this);">Froogle</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=8a class=q href="/lochp?hl=en&tab=wl" onClick="return qs(this);">Local</a>&nbsp;&nbsp;&nbsp;&nbsp;<b><a href="/intl/en/options/" class=q>more&nbsp;&raquo;</a></b></font></td></tr></table><table cellspacing=0 cellpadding=0><tr><td width=25%>&nbsp;</td><td align=center><input type=hidden name=hl value=en><input maxlength=2048 size=55 name=q value="" title="Google Search"><br><input type=submit value="Google Search" name=btnG><input type=submit value="I'm Feeling Lucky" name=btnI></td><td valign=top nowrap width=25%><font size=-2>&nbsp;&nbsp;<a href=/advanced_search?hl=en>Advanced Search</a><br>&nbsp;&nbsp;<a href=/preferences?hl=en>Preferences</a><br>&nbsp;&nbsp;<a href=/language_tools?hl=en>Language Tools</a></font></td></tr></table></form><br><br><font size=-1><a href="/ads/">Advertising&nbsp;Programs</a> - <a href=/services/>Business Solutions</a> - <a href=/about.html>About Google</a></font><p><font size=-2>&copy;2006 Google</font></p></center></body></html>
+
+<!-- vim: et sw=4 sts=4 -->

benchmarks/samples/Lexer/3.html

@@ -67,21 +67,21 @@ if (objAdMgr.isSlotAvailable("leaderboard")) {
 </table>
 <table width="86%" border="0" cellspacing="0" cellpadding="2">
   <tr>
-    <td height="388" width="19%" bgcolor="#FFCCFF" valign="top"> 
+    <td height="388" width="19%" bgcolor="#FFCCFF" valign="top">
       <p>May 1, 2000</p>
       <p><b>Pop Culture</b> </p>
       <p>by. H. Finkelstein</p>
 
     </td>
-    <td height="388" width="52%" valign="top"> 
+    <td height="388" width="52%" valign="top">
-      <p>Welcome to the <b>Anime Digi-Lib</b>, a virtual index to anime on the 
+      <p>Welcome to the <b>Anime Digi-Lib</b>, a virtual index to anime on the
-        internet. This site strives to house a comprehensive index to both personal 
+        internet. This site strives to house a comprehensive index to both personal
-        and commercial websites and provides reviews to these sites. We hope to 
+        and commercial websites and provides reviews to these sites. We hope to
-        be a gateway for people who've never imagined they'd ever be interested 
+        be a gateway for people who've never imagined they'd ever be interested
         in Japanese Animation. </p>
       <table width="99%" border="1" cellspacing="0" cellpadding="2" height="320" name="Searchnservices">
         <tr>
-          <td height="263" valign="top" width="58%"> 
+          <td height="263" valign="top" width="58%">
             <p>&nbsp; </p>
             <p>&nbsp;</p>
 
@@ -107,15 +107,15 @@ if (objAdMgr.isSlotAvailable("leaderboard")) {
 </form>
 
 
-            <td> 
+            <td>
               <table border="0" cellpadding="0" cellspacing="0" width="100%">
 <tr><td><font face="verdana,geneva" color="#000011" size="1">What is better, subtitled or dubbed anime?</font></td></tr>
 <tr><td><input type="radio" name="rd" value="1"><font face="verdana" size="2" color="#000011">Subtitled</font></td></tr>
 
 <tr><td align="middle"><font face="verdana" size="1"><a href="http://pub.alxnet.com/poll?id=2079873&q=view">Current results</a></font></td></tr>
 </table></td></tr>
-          <tr> 
+          <tr>
-            <td><font face="verdana" size="1"><a href="http://www.alxnet.com/services/poll/">Free 
+            <td><font face="verdana" size="1"><a href="http://www.alxnet.com/services/poll/">Free
               Web Polls</a></font></td>
           </tr>
 </table></form>
@@ -126,3 +126,5 @@ if (objAdMgr.isSlotAvailable("leaderboard")) {
 </body>
 
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

benchmarks/samples/Lexer/4.html

@@ -138,7 +138,7 @@
 </table>
 <p><script type="text/javascript">
 //<![CDATA[
- if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); } 
+ if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); }
 //]]>
 </script></p>
 <div class="editsection" style="float:right;margin-left:5px;">[<a href="/w/index.php?title=Tai_Chi_Chuan&amp;action=edit&amp;section=1" title="Edit section: Overview">edit</a>]</div>
@@ -279,19 +279,19 @@ Yang Small Frame                     |                             <a href="/wik
 
    |                                                                          |
 <a href="/w/index.php?title=Wu_Ta-kuei&amp;action=edit" class="new" title="Wu Ta-kuei">Wu Ta-kuei</a>                                                                  <a href="/w/index.php?title=Sun_Hsing-i&amp;action=edit" class="new" title="Sun Hsing-i">Sun Hsing-i</a>
-1923-1970                                                                   1891-1929                  
+1923-1970                                                                   1891-1929
-                           
+
-<b>MODERN FORMS</b>        
+<b>MODERN FORMS</b>
-                                      
+
-from Yang Ch`eng-fu                     
+from Yang Ch`eng-fu
-        |               
+        |
-        |              
+        |
-        |                         
+        |
-        +--------------+      
+        +--------------+
-        |              |       
+        |              |
-  <a href="/wiki/Cheng_Man-ch%27ing" title="Cheng Man-ch'ing">Cheng Man-ch'ing</a>     |   
+  <a href="/wiki/Cheng_Man-ch%27ing" title="Cheng Man-ch'ing">Cheng Man-ch'ing</a>     |
-  1901-1975            |    
+  1901-1975            |
-  Short (37) Form      |     
+  Short (37) Form      |
                        |
               Chinese Sports Commission
               1956
@@ -538,3 +538,5 @@ Retrieved from "<a href="http://en.wikipedia.org/wiki/Tai_Chi_Chuan">http://en.w
 
 <!-- Served by srv25 in 0.089 secs. -->
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

benchmarks/samples/Lexer/DISCLAIMER.txt

@@ -2,4 +2,6 @@ Disclaimer:
 
 The HTML used in these samples are taken from random websites.  I claim
 no copyright over these and assert that I may use them like this under
-fair use.
+fair use.
+
+    vim: et sw=4 sts=4

configdoc/generate.php

@@ -59,3 +59,4 @@ if (php_sapi_name() != 'cli') {
     echo 'Files generated successfully.';
 }
 
+// vim: et sw=4 sts=4

configdoc/styles/plain.css

@@ -40,3 +40,5 @@ h4 {font-family:sans-serif; font-size:0.9em; font-weight:bold; }
 .deprecated {color: #CCC;}
 .deprecated table.constraints th {background:#FFF;}
 .deprecated-notice {color: #000; text-align:center; margin-bottom: 1em;}
+
+/* vim: et sw=4 sts=4 */

configdoc/styles/plain.xsl

@@ -14,13 +14,13 @@
     />
     <xsl:param name="css" select="'styles/plain.css'"/>
     <xsl:param name="title" select="'Configuration Documentation'"/>
-    
+
     <xsl:variable name="typeLookup"  select="document('../types.xml')/types" />
     <xsl:variable name="usageLookup" select="document('../usage.xml')/usage" />
-    
+
     <!-- Twiddle this variable to get the columns as even as possible -->
-    <xsl:variable name="maxNumberAdjust" select="1" />
+    <xsl:variable name="maxNumberAdjust" select="2" />
-    
+
     <xsl:template match="/">
         <html lang="en" xml:lang="en">
             <head>
@@ -45,7 +45,7 @@
             </body>
         </html>
     </xsl:template>
-    
+
     <xsl:template match="title" mode="toc" />
     <xsl:template match="namespace" mode="toc">
         <xsl:param name="overflowNumber" />
@@ -83,9 +83,9 @@
             </li>
         </xsl:if>
     </xsl:template>
-    
+
     <xsl:template match="title" />
-    
+
     <xsl:template match="namespace">
         <div class="namespace">
             <xsl:apply-templates />
@@ -102,7 +102,7 @@
             <xsl:copy-of xmlns:xhtml="http://www.w3.org/1999/xhtml" select="xhtml:div/node()" />
         </div>
     </xsl:template>
-    
+
     <xsl:template match="directive">
         <div>
             <xsl:attribute name="class"><!--
@@ -122,10 +122,10 @@
     <xsl:template match="alias" mode="anchor">
         <a id="{.}"></a>
     </xsl:template>
-    
+
     <!-- Do not pass through -->
     <xsl:template match="alias"></xsl:template>
-    
+
     <xsl:template match="directive/constraints">
         <xsl:param name="id" />
         <table class="constraints">
@@ -179,7 +179,7 @@
             </xsl:for-each>
         </li>
     </xsl:template>
-    
+
     <xsl:template match="constraints/version">
         <tr>
             <th>Version added</th>
@@ -229,5 +229,7 @@
     <xsl:template match="constraints/external/project">
         <li><xsl:value-of select="." /></li>
     </xsl:template>
-    
+
 </xsl:stylesheet>
+
+<!-- vim: et sw=4 sts=4 -->

configdoc/types.xml

@@ -12,3 +12,5 @@
   <type id="hash">Associative array</type>
   <type id="mixed">Mixed</type>
 </types>
+
+<!-- vim: et sw=4 sts=4 -->

configdoc/usage.xml

@@ -5,35 +5,40 @@
    <line>131</line>
   </file>
   <file name="HTMLPurifier/Lexer.php">
-   <line>85</line>
+   <line>81</line>
   </file>
   <file name="HTMLPurifier/Lexer/DirectLex.php">
-   <line>50</line>
+   <line>53</line>
-   <line>62</line>
+   <line>73</line>
-   <line>327</line>
+   <line>348</line>
   </file>
   <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
-   <line>44</line>
+   <line>47</line>
+  </file>
+ </directive>
+ <directive id="CSS.MaxImgLength">
+  <file name="HTMLPurifier/CSSDefinition.php">
+   <line>157</line>
   </file>
  </directive>
  <directive id="CSS.Proprietary">
   <file name="HTMLPurifier/CSSDefinition.php">
-   <line>202</line>
+   <line>214</line>
   </file>
  </directive>
  <directive id="CSS.AllowTricky">
   <file name="HTMLPurifier/CSSDefinition.php">
-   <line>206</line>
+   <line>218</line>
   </file>
  </directive>
  <directive id="CSS.AllowImportant">
   <file name="HTMLPurifier/CSSDefinition.php">
-   <line>210</line>
+   <line>222</line>
   </file>
  </directive>
  <directive id="CSS.AllowedProperties">
   <file name="HTMLPurifier/CSSDefinition.php">
-   <line>262</line>
+   <line>275</line>
   </file>
  </directive>
  <directive id="Cache.DefinitionImpl">
@@ -63,106 +68,116 @@
  </directive>
  <directive id="Core.Encoding">
   <file name="HTMLPurifier/Encoder.php">
-   <line>281</line>
+   <line>267</line>
-   <line>305</line>
+   <line>300</line>
   </file>
  </directive>
  <directive id="Test.ForceNoIconv">
   <file name="HTMLPurifier/Encoder.php">
-   <line>283</line>
+   <line>272</line>
-   <line>310</line>
+   <line>308</line>
   </file>
  </directive>
  <directive id="Core.EscapeNonASCIICharacters">
   <file name="HTMLPurifier/Encoder.php">
-   <line>307</line>
+   <line>304</line>
-  </file>
- </directive>
- <directive id="Core.MaintainLineNumbers">
-  <file name="HTMLPurifier/ErrorCollector.php">
-   <line>81</line>
-  </file>
-  <file name="HTMLPurifier/Lexer.php">
-   <line>82</line>
-  </file>
-  <file name="HTMLPurifier/Lexer/DirectLex.php">
-   <line>45</line>
   </file>
  </directive>
  <directive id="Output.CommentScriptContents">
   <file name="HTMLPurifier/Generator.php">
-   <line>41</line>
+   <line>45</line>
+  </file>
+ </directive>
+ <directive id="Output.SortAttr">
+  <file name="HTMLPurifier/Generator.php">
+   <line>46</line>
   </file>
  </directive>
  <directive id="Output.TidyFormat">
   <file name="HTMLPurifier/Generator.php">
-   <line>70</line>
+   <line>75</line>
   </file>
  </directive>
  <directive id="Output.Newline">
   <file name="HTMLPurifier/Generator.php">
-   <line>84</line>
+   <line>89</line>
   </file>
  </directive>
  <directive id="HTML.BlockWrapper">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>213</line>
+   <line>222</line>
   </file>
  </directive>
  <directive id="HTML.Parent">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>221</line>
+   <line>230</line>
   </file>
  </directive>
  <directive id="HTML.AllowedElements">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>238</line>
+   <line>247</line>
   </file>
  </directive>
  <directive id="HTML.AllowedAttributes">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>239</line>
+   <line>248</line>
   </file>
  </directive>
  <directive id="HTML.Allowed">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>242</line>
+   <line>251</line>
   </file>
  </directive>
  <directive id="HTML.ForbiddenElements">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>328</line>
+   <line>337</line>
   </file>
  </directive>
  <directive id="HTML.ForbiddenAttributes">
   <file name="HTMLPurifier/HTMLDefinition.php">
-   <line>329</line>
+   <line>338</line>
   </file>
  </directive>
  <directive id="HTML.Trusted">
   <file name="HTMLPurifier/HTMLModuleManager.php">
-   <line>198</line>
+   <line>202</line>
   </file>
   <file name="HTMLPurifier/Lexer.php">
-   <line>238</line>
+   <line>258</line>
+  </file>
+  <file name="HTMLPurifier/HTMLModule/Image.php">
+   <line>27</line>
   </file>
   <file name="HTMLPurifier/Lexer/DirectLex.php">
-   <line>34</line>
+   <line>36</line>
+  </file>
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>23</line>
   </file>
  </directive>
  <directive id="HTML.AllowedModules">
   <file name="HTMLPurifier/HTMLModuleManager.php">
-   <line>205</line>
+   <line>209</line>
   </file>
  </directive>
  <directive id="HTML.CoreModules">
   <file name="HTMLPurifier/HTMLModuleManager.php">
-   <line>206</line>
+   <line>210</line>
   </file>
  </directive>
  <directive id="HTML.Proprietary">
   <file name="HTMLPurifier/HTMLModuleManager.php">
-   <line>220</line>
+   <line>221</line>
+  </file>
+ </directive>
+ <directive id="HTML.SafeObject">
+  <file name="HTMLPurifier/HTMLModuleManager.php">
+   <line>226</line>
+  </file>
+ </directive>
+ <directive id="HTML.SafeEmbed">
+  <file name="HTMLPurifier/HTMLModuleManager.php">
+   <line>229</line>
   </file>
  </directive>
  <directive id="Attr.IDBlacklist">
@@ -177,30 +192,35 @@
  </directive>
  <directive id="Core.LexerImpl">
   <file name="HTMLPurifier/Lexer.php">
-   <line>70</line>
+   <line>76</line>
+  </file>
+ </directive>
+ <directive id="Core.MaintainLineNumbers">
+  <file name="HTMLPurifier/Lexer.php">
+   <line>80</line>
+  </file>
+  <file name="HTMLPurifier/Lexer/DirectLex.php">
+   <line>48</line>
   </file>
  </directive>
  <directive id="Core.ConvertDocumentToFragment">
   <file name="HTMLPurifier/Lexer.php">
-   <line>230</line>
+   <line>267</line>
   </file>
  </directive>
  <directive id="URI.Host">
   <file name="HTMLPurifier/URIDefinition.php">
-   <line>57</line>
+   <line>64</line>
-  </file>
-  <file name="HTMLPurifier/URIFilter/DisableExternal.php">
-   <line>8</line>
   </file>
  </directive>
  <directive id="URI.Base">
   <file name="HTMLPurifier/URIDefinition.php">
-   <line>58</line>
+   <line>65</line>
   </file>
  </directive>
  <directive id="URI.DefaultScheme">
   <file name="HTMLPurifier/URIDefinition.php">
-   <line>65</line>
+   <line>72</line>
   </file>
  </directive>
  <directive id="URI.AllowedSchemes">
@@ -215,12 +235,7 @@
  </directive>
  <directive id="URI.Disable">
   <file name="HTMLPurifier/AttrDef/URI.php">
-   <line>23</line>
+   <line>28</line>
-  </file>
- </directive>
- <directive id="URI.Munge">
-  <file name="HTMLPurifier/AttrDef/URI.php">
-   <line>68</line>
   </file>
  </directive>
  <directive id="Core.ColorKeywords">
@@ -275,14 +290,19 @@
    <line>19</line>
   </file>
  </directive>
+ <directive id="Attr.DefaultImageAlt">
+  <file name="HTMLPurifier/AttrTransform/ImgRequired.php">
+   <line>25</line>
+  </file>
+ </directive>
  <directive id="Attr.DefaultInvalidImageAlt">
   <file name="HTMLPurifier/AttrTransform/ImgRequired.php">
-   <line>27</line>
+   <line>32</line>
   </file>
  </directive>
  <directive id="Core.EscapeInvalidChildren">
   <file name="HTMLPurifier/ChildDef/Required.php">
-   <line>55</line>
+   <line>62</line>
   </file>
  </directive>
  <directive id="Cache.SerializerPath">
@@ -305,6 +325,17 @@
    <line>123</line>
   </file>
  </directive>
+ <directive id="HTML.MaxImgLength">
+  <file name="HTMLPurifier/HTMLModule/Image.php">
+   <line>14</line>
+  </file>
+  <file name="HTMLPurifier/HTMLModule/SafeEmbed.php">
+   <line>13</line>
+  </file>
+  <file name="HTMLPurifier/HTMLModule/SafeObject.php">
+   <line>19</line>
+  </file>
+ </directive>
  <directive id="HTML.TidyLevel">
   <file name="HTMLPurifier/HTMLModule/Tidy.php">
    <line>45</line>
@@ -332,12 +363,12 @@
  </directive>
  <directive id="Core.DirectLexLineNumberSyncInterval">
   <file name="HTMLPurifier/Lexer/DirectLex.php">
-   <line>59</line>
+   <line>70</line>
   </file>
  </directive>
  <directive id="Core.EscapeInvalidTags">
   <file name="HTMLPurifier/Strategy/MakeWellFormed.php">
-   <line>22</line>
+   <line>45</line>
   </file>
   <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
    <line>19</line>
@@ -345,12 +376,12 @@
  </directive>
  <directive id="Core.RemoveScriptContents">
   <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
-   <line>22</line>
+   <line>25</line>
   </file>
  </directive>
  <directive id="Core.HiddenElements">
   <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
-   <line>23</line>
+   <line>26</line>
   </file>
  </directive>
  <directive id="URI.HostBlacklist">
@@ -358,4 +389,14 @@
    <line>8</line>
   </file>
  </directive>
+ <directive id="URI.MungeResources">
+  <file name="HTMLPurifier/URIFilter/Munge.php">
+   <line>14</line>
+  </file>
+ </directive>
+ <directive id="URI.MungeSecretKey">
+  <file name="HTMLPurifier/URIFilter/Munge.php">
+   <line>15</line>
+  </file>
+ </directive>
 </usage>

docs/dev-advanced-api.html

@@ -164,7 +164,7 @@ to make things simpler. It can be a literal object or:</p>
         class with that function registered as a callback.</li>-->
     <li>String attribute type: We'll use <code>HTMLPurifier_AttrTypes</code>
         to resolve it for you. Any data that follows a hash mark (#) will
-        be used to customize the attribute type: in the example above, 
+        be used to customize the attribute type: in the example above,
         we specify which values for Enum to allow.</li>
 </ul>
 
@@ -213,6 +213,6 @@ the usual things required are:</p>
 
 <p>See <code>HTMLPurifier/HTMLModule.php</code> for details.</p>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/dev-code-quality.txt

@@ -25,3 +25,5 @@ URIScheme - needs to have callable generic checks
     mailto - doesn't validate emails, doesn't validate querystring
     news - doesn't validate opaque path
     nntp - doesn't constrain path
+
+    vim: et sw=4 sts=4

docs/dev-config-schema.html

@@ -9,29 +9,29 @@
     <title>Config Schema - HTML Purifier</title>
   </head>
   <body>
-    
+
     <h1>Config Schema</h1>
-    
+
     <div id="filing">Filed under Development</div>
     <div id="index">Return to the <a href="index.html">index</a>.</div>
     <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
-    
+
     <p>
       HTML Purifier has a fairly complex system for configuration. Users
       interact with a <code>HTMLPurifier_Config</code> object to
       set configuration directives. The values they set are validated according
       to a configuration schema, <code>HTMLPurifier_ConfigSchema</code>.
     </p>
-    
+
     <p>
       The schema is mostly transparent to end-users, but if you're doing development
       work for HTML Purifier and need to define a new configuration directive,
       you'll need to interact with it. We'll also talk about how to define
       userspace configuration directives at the very end.
     </p>
-    
+
     <h2>Write a directive file</h2>
-    
+
     <p>
       Directive files define configuration directives to be used by
       HTML Purifier. They are placed in <code>library/HTMLPurifier/ConfigSchema/schema/</code>
@@ -42,7 +42,7 @@
       <a href="http://qa.php.net/write-test.php">PHPT</a> tests. Here's a
       sample directive file, <code>Test.Sample.txt</code>:
     </p>
-    
+
     <pre>Test.Sample
 TYPE: string/null
 DEFAULT: NULL
@@ -54,11 +54,11 @@ This is a sample configuration directive for the purposes of the
 &lt;code&gt;dev-config-schema.html&lt;code&gt; documentation.
 --ALIASES--
 Test.Example</pre>
-    
+
     <p>
       Each of these segments has a specific meaning:
     </p>
-    
+
     <table class="table">
       <thead>
         <tr>
@@ -143,11 +143,11 @@ Test.Example</pre>
         </tr>
       </tbody>
     </table>
-    
+
     <p>
       Some notes on format and style:
     </p>
-    
+
     <ul>
       <li>
         Each of these keys can be expressed in the short format
@@ -162,11 +162,11 @@ Test.Example</pre>
         not rely on editor word-wrapping.
       </li>
     </ul>
-    
+
     <p>
       Also, as promised, here is the set of possible types:
     </p>
-    
+
     <table class="table">
       <thead>
         <tr>
@@ -233,27 +233,27 @@ Test.Example</pre>
         </tr>
       </tbody>
     </table>
-    
+
     <p>
       The examples represent what will be returned out of the configuration
       object; users have a little bit of leeway when setting configuration
       values (for example, a lookup value can be specified as a list;
       HTML Purifier will flip it as necessary.) These types are defined
-      in <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/VarParser.php">
+      in <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/VarParser.php">
       library/HTMLPurifier/VarParser.php</a>.
     </p>
-    
+
     <p>
       For more information on what values are allowed, and how they are parsed,
-      consult <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
+      consult <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
       library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php</a>, as well
-      as <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/Interchange/Directive.php">
+      as <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/Interchange/Directive.php">
       library/HTMLPurifier/ConfigSchema/Interchange/Directive.php</a> for
       the semantics of the parsed values.
     </p>
-    
+
     <h2>Refreshing the cache</h2>
-    
+
     <p>
       You may have noticed that your directive file isn't doing anything
       yet. That's because it hasn't been added to the runtime
@@ -262,33 +262,33 @@ Test.Example</pre>
       If there were no errors, you're good to go! Don't forget to add
       some unit tests for your functionality!
     </p>
-    
+
     <p>
       If you ever make changes to your configuration directives, you
       will need to run this script again.
     </p>
-    
+
     <h2>Errors</h2>
-    
+
     <p>
       All directive files go through a rigorous validation process
-      through <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/">
+      through <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/Validator.php">
       library/HTMLPurifier/ConfigSchema/Validator.php</a>, as well
       as some basic checks during building. While
       listing every error out here is out-of-scope for this document, we
       can give some general tips for interpreting error messages.
       There are two types of errors: builder errors and validation errors.
     </p>
-    
+
     <h3>Builder errors</h3>
-    
+
     <blockquote>
       <p>
         <strong>Exception:</strong> Expected type string, got
         integer in DEFAULT in directive hash 'Ns.Dir'
       </p>
     </blockquote>
-    
+
     <p>
       You can identify a builder error by the keyword "directive hash."
       These are the easiest to deal with, because they directly correspond
@@ -298,28 +298,28 @@ Test.Example</pre>
       This particular error would occur if your default value is not the same
       type as TYPE.
     </p>
-    
+
     <h3>Validation errors</h3>
-    
+
     <blockquote>
       <p>
         <strong>Exception:</strong> Alias 3 in valueAliases in directive
         'Ns.Dir' must be a string
       </p>
     </blockquote>
-    
+
     <p>
       These are a little trickier, because we're not actually validating
       your directive file, or even the direct string hash representation.
       We're validating an Interchange object, and the error messages do
       not mention any string hash keys.
     </p>
-    
+
     <p>
       Nevertheless, it's not difficult to figure out what went wrong.
       Read the "context" statements in reverse:
     </p>
-    
+
     <dl>
       <dt>in directive 'Ns.Dir'</dt>
         <dd>This means we need to look at the directive file <code>Ns.Dir.txt</code></dd>
@@ -329,22 +329,22 @@ Test.Example</pre>
       <dt>Alias 3</dt>
         <dd>The value alias that is equal to 3 is the culprit.</dd>
     </dl>
-    
+
     <p>
       In this particular case, you're not allowed to alias integers values to
       strings values.
     </p>
-    
+
     <p>
       The most difficult part is translating the Interchange member variable (valueAliases)
       into a directive file key (VALUE-ALIASES), but there's a one-to-one
       correspondence currently. If the two formats diverge, any discrepancies
-      will be described in <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
+      will be described in <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
       library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php</a>.
     </p>
-    
+
     <h2>Internals</h2>
-    
+
     <p>
       Much of the configuration schema framework's codebase deals with
       shuffling data from one format to another, and doing validation on this
@@ -352,7 +352,7 @@ Test.Example</pre>
       The keystone of all of this is the <code>HTMLPurifier_ConfigSchema_Interchange</code>
       class, which represents the purest, parsed representation of the schema.
     </p>
-    
+
     <p>
       Hand-writing this data is unwieldy, however, so we write directive files.
       These directive files are parsed by <code>HTMLPurifier_StringHashParser</code>
@@ -360,7 +360,7 @@ Test.Example</pre>
       are run through <code>HTMLPurifier_ConfigSchema_InterchangeBuilder</code>
       to construct the interchange object.
     </p>
-    
+
     <p>
       From the interchange object, the data can be siphoned into other forms
       using <code>HTMLPurifier_ConfigSchema_Builder</code> subclasses.
@@ -369,8 +369,8 @@ Test.Example</pre>
       which <code>HTMLPurifier_Config</code> uses to validate its incoming
       data. There is also an XML serializer, which is used to build documentation.
     </p>
-    
-    <div id="version">$Id$</div>
 
   </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/dev-flush.html

@@ -62,6 +62,6 @@
     do.
 </p>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/dev-includes.txt

@@ -91,14 +91,14 @@ use the stub for all cases (which might not be a bad idea).
     Deprecated
     ----------
     One of the things I'd like to do is have the code search for any classes
-    that are explicitly mentioned in the code. If a class isn't mentioned, I 
+    that are explicitly mentioned in the code. If a class isn't mentioned, I
     get to assume that it is "optional," i.e. included via introspection.
     The choice is either to use PHP's tokenizer or use regexps; regexps would
     be faster but a tokenizer would be more correct. If this ends up being
     unfeasible, adding dependency comments isn't a bad idea. (This could
     even be done automatically by search/replacing require_once, although
     we'd have to manually inspect the results for the optional requires.)
-    
+
     NOTE: This ends up not being necessary, as we're going to make the user
     figure out all the extra classes they need, and only include the core
     which is predetermined.
@@ -193,7 +193,7 @@ configuration directives would be used to generate our key (meta-directives!)
     mechanism works better. However, we can uniquely identify the
     schema based on the directories they loaded, so there's no need
     for a DefinitionId until we give them full programmatic control.
-    
+
     These variables should be directly incorporated into ConfigSchema,
     and ConfigSchema should handle serialization. Some refactoring will be
     necessary for the DefinitionCache classes, as they are built with
@@ -277,3 +277,5 @@ DEPRECATED-VERSION: If the directive was deprecated, when was it deprecated?
 DEPRECATED-USE: If the directive was deprecated, what should the user use now?
 REQUIRES: What classes does this configuration directive require, but are
     not part of the HTML Purifier core?
+
+    vim: et sw=4 sts=4

docs/dev-naming.html

@@ -35,7 +35,7 @@ help you find the correct functionality more quickly.  Here they are:</p>
 <dt>Harness and Test are reserved class names for unit tests</dt>
     <dd>The suffix <code>Test</code> indicates that the class is a subclass of UnitTestCase
     (of the Simpletest library) and is testable. "Harness" indicates a subclass
-    of UnitTestCase that is not meant to be run but to be extended into 
+    of UnitTestCase that is not meant to be run but to be extended into
     concrete test cases and contains custom test methods (i.e. assert*())</dd>
 
 <dt>Class names do not necessarily represent inheritance hierarchies</dt>
@@ -51,7 +51,7 @@ help you find the correct functionality more quickly.  Here they are:</p>
     all must be present in order for proper functioning.</dd>
 
 <dt>Abbreviations are avoided</dt>
-    <dd>We try to avoid abbreviations as much as possible, but in some cases, 
+    <dd>We try to avoid abbreviations as much as possible, but in some cases,
     abbreviated version is more readable than the full version. Here, we
     list common abbreviations:
     <ul>
@@ -77,6 +77,6 @@ help you find the correct functionality more quickly.  Here they are:</p>
 
 </dl>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/dev-optimization.html

@@ -27,6 +27,6 @@ that itch, put it here!</p>
     <li>Parallelize strategies</li>
 </ul>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/dev-progress.html

@@ -303,6 +303,6 @@ Mozilla on inside and needs -moz-outline, no IE support.</td></tr>
 
 </table>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-customize.html

@@ -206,14 +206,14 @@ $def = $config->getHTMLDefinition(true);</pre>
 <h2>Turn off caching</h2>
 
 <p>
-  To make development easier, we're going to temporarily turn off 
+  To make development easier, we're going to temporarily turn off
   definition caching:
 </p>
 
 <pre>$config = HTMLPurifier_Config::createDefault();
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
-<strong>$config->set('Core', 'DefinitionCache', null); // remove this later!</strong>
+<strong>$config->set('Cache', 'DefinitionImpl', null); // remove this later!</strong>
 $def = $config->getHTMLDefinition(true);</pre>
 
 <p>
@@ -269,7 +269,7 @@ $def = $config->getHTMLDefinition(true);</pre>
 <pre>$config = HTMLPurifier_Config::createDefault();
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
-$config->set('Core', 'DefinitionCache', null); // remove this later!
+$config->set('Cache', 'DefinitionImpl', null); // remove this later!
 $def = $config->getHTMLDefinition(true);
 <strong>$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');</strong></pre>
 
@@ -372,10 +372,10 @@ $def = $config->getHTMLDefinition(true);
 
 <p>
   For a complete list, consult
-  <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/AttrTypes.php"><code>library/HTMLPurifier/AttrTypes.php</code></a>;
+  <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/AttrTypes.php"><code>library/HTMLPurifier/AttrTypes.php</code></a>;
   more information on attributes that accept parameters can be found on their
   respective includes in
-  <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/AttrDef/"><code>library/HTMLPurifier/AttrDef</code></a>.
+  <a href="http://repo.or.cz/w/htmlpurifier.git?a=tree;hb=HEAD;f=library/HTMLPurifier/AttrDef"><code>library/HTMLPurifier/AttrDef</code></a>.
 </p>
 
 <p>
@@ -387,7 +387,7 @@ $def = $config->getHTMLDefinition(true);
 <pre>$config = HTMLPurifier_Config::createDefault();
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
-$config->set('Core', 'DefinitionCache', null); // remove this later!
+$config->set('Cache', 'DefinitionImpl', null); // remove this later!
 $def = $config->getHTMLDefinition(true);
 <strong>$def->addAttribute('a', 'target', new HTMLPurifier_AttrDef_Enum(
   array('_blank','_self','_target','_top')
@@ -401,8 +401,8 @@ $def = $config->getHTMLDefinition(true);
 
 <p>
   Adding attributes is really small-fry stuff, though, and it was possible
-  to add them (albeit a bit more wordy) prior to 2.0. The real gem of 
+  to add them (albeit a bit more wordy) prior to 2.0. The real gem of
-  the Advanced API is adding elements. There are five questions to 
+  the Advanced API is adding elements. There are five questions to
   ask when adding a new element:
 </p>
 
@@ -493,9 +493,9 @@ $def = $config->getHTMLDefinition(true);
 <p>
   The <code>(%flow;)*</code> indicates the allowed children of the
   <code>li</code> tag: <code>li</code> allows any number of flow
-  elements as its children. (The <code>- O</code> allows the closing tag to be 
+  elements as its children. (The <code>- O</code> allows the closing tag to be
-  omitted, though in XML this is not allowed.) In HTML Purifier, 
+  omitted, though in XML this is not allowed.) In HTML Purifier,
-  we'd write it like <code>Flow</code> (here's where the content sets 
+  we'd write it like <code>Flow</code> (here's where the content sets
   we were discussing earlier come into play). There are three shorthand
   content models you can specify:
 </p>
@@ -596,7 +596,7 @@ $def = $config->getHTMLDefinition(true);
   be nuked.  This is why there is are specific content model types like
   Optional and Required: while they could be implemented as <code>Custom:
   (valid | elements)*</code>, the custom classes contain special recovery
-  measures that make sure as much of the user's original content gets 
+  measures that make sure as much of the user's original content gets
   through. HTML Purifier's core, as a rule, does not use Custom.
 </p>
 
@@ -676,7 +676,7 @@ $def = $config->getHTMLDefinition(true);
   href="http://www.w3.org/TR/xhtml-modularization/abstract_modules.html#s_commonatts">abstract
   modules of the XHTML Modularization 1.1</a>. We believe this section
   to be in error, as <code>br</code> permits the use of the <code>style</code>
-  attribute even though it uses the <code>Core</code> collection, and 
+  attribute even though it uses the <code>Core</code> collection, and
   the DTD and XML Schemas supplied by W3C support our interpretation.
 </p>
 
@@ -734,7 +734,7 @@ $def = $config->getHTMLDefinition(true);
 <pre>$config = HTMLPurifier_Config::createDefault();
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
-$config->set('Core', 'DefinitionCache', null); // remove this later!
+$config->set('Cache', 'DefinitionImpl', null); // remove this later!
 $def = $config->getHTMLDefinition(true);
 $def->addAttribute('a', 'target', new HTMLPurifier_AttrDef_Enum(
   array('_blank','_self','_target','_top')
@@ -764,7 +764,7 @@ $form->excludes = array('form' => true);</strong></pre>
 <p>
   And that's all there is to it! Implementing the rest of the form
   module is left as an exercise to the user; to see more examples
-  check the <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/HTMLModule/"><code>library/HTMLPurifier/HTMLModule/</code></a> directory
+  check the <a href="http://repo.or.cz/w/htmlpurifier.git?a=tree;hb=HEAD;f=library/HTMLPurifier/HTMLModule"><code>library/HTMLPurifier/HTMLModule/</code></a> directory
   in your local HTML Purifier installation.
 </p>
 
@@ -789,10 +789,10 @@ $form->excludes = array('form' => true);</strong></pre>
 </p>
 
 <ul>
-  <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/HTMLModule.php"><code>library/HTMLPurifier/HTMLModule.php</code></a></li>
+  <li><a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/HTMLModule.php"><code>library/HTMLPurifier/HTMLModule.php</code></a></li>
-  <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ElementDef.php"><code>library/HTMLPurifier/ElementDef.php</code></a></li>
+  <li><a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ElementDef.php"><code>library/HTMLPurifier/ElementDef.php</code></a></li>
 </ul>
 
-<div id="version">$Id: enduser-tidy.html 1158 2007-06-18 19:26:29Z Edward $</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-id.html

@@ -141,7 +141,7 @@ anchors is beyond me.</p>
 
 <p>Don't come crying to me when your page mysteriously stops validating, though.</p>
 
-<div id="version">$Id$</div>
-
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-overview.txt

@@ -55,3 +55,5 @@ HTML tags.  Things like blog comments are, in all likelihood, most appropriately
 written in an extremely restrictive set of markup that doesn't require
 all this functionality (or not written in HTML at all), although this may
 be changing in the future with the addition of levels of filtering.
+
+    vim: et sw=4 sts=4

docs/enduser-security.txt

@@ -14,3 +14,5 @@ to be effective. Things to remember:
 
 4. CSS: document pending
 Explain which CSS styles we blocked and why.
+
+    vim: et sw=4 sts=4

docs/enduser-slow.html

@@ -17,25 +17,25 @@
 <div id="index">Return to the <a href="index.html">index</a>.</div>
 <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
 
-<p>HTML Purifier is a very powerful library. But with power comes great 
+<p>HTML Purifier is a very powerful library. But with power comes great
-responsibility, in the form of longer execution times.  Remember, this 
+responsibility, in the form of longer execution times.  Remember, this
-library isn't lightly grazing over submitted HTML: it's deconstructing 
+library isn't lightly grazing over submitted HTML: it's deconstructing
-the whole thing, rigorously checking the parts, and then putting it back 
+the whole thing, rigorously checking the parts, and then putting it back
 together. </p>
 
-<p>So, if it so turns out that HTML Purifier is kinda too slow for outbound 
+<p>So, if it so turns out that HTML Purifier is kinda too slow for outbound
 filtering, you've got a few options: </p>
 
 <h2>Inbound filtering</h2>
 
-<p>Perform filtering of HTML when it's submitted by the user. Since the 
+<p>Perform filtering of HTML when it's submitted by the user. Since the
-user is already submitting something, an extra half a second tacked on 
+user is already submitting something, an extra half a second tacked on
-to the load time probably isn't going to be that huge of a problem.  
+to the load time probably isn't going to be that huge of a problem.
-Then, displaying the content is a simple a manner of outputting it 
+Then, displaying the content is a simple a manner of outputting it
-directly from your database/filesystem. The trouble with this method is 
+directly from your database/filesystem. The trouble with this method is
-that your user loses the original text, and when doing edits, will be 
+that your user loses the original text, and when doing edits, will be
-handling the filtered text.  While this may be a good thing, especially 
+handling the filtered text.  While this may be a good thing, especially
-if you're using a WYSIWYG editor, it can also result in data-loss if a 
+if you're using a WYSIWYG editor, it can also result in data-loss if a
 user makes a typo. </p>
 
 <p>Example (non-functional):</p>
@@ -66,14 +66,14 @@ user makes a typo. </p>
 
 <h2>Caching the filtered output</h2>
 
-<p>Accept the submitted text and put it unaltered into the database, but 
+<p>Accept the submitted text and put it unaltered into the database, but
-then also generate a filtered version and stash that in the database.  
+then also generate a filtered version and stash that in the database.
-Serve the filtered version to readers, and the unaltered version to 
+Serve the filtered version to readers, and the unaltered version to
-editors.  If need be, you can invalidate the cache and have the cached 
+editors.  If need be, you can invalidate the cache and have the cached
-filtered version be regenerated on the first page view.  Pros? Full data 
+filtered version be regenerated on the first page view.  Pros? Full data
-retention. Cons? It's more complicated, and opens other editors up to 
+retention. Cons? It's more complicated, and opens other editors up to
-XSS if they are using a WYSIWYG editor (to fix that, they'd have to be 
+XSS if they are using a WYSIWYG editor (to fix that, they'd have to be
-able to get their hands on the *really* original text served in 
+able to get their hands on the *really* original text served in
 plaintext mode). </p>
 
 <p>Example (non-functional):</p>
@@ -108,10 +108,12 @@ plaintext mode). </p>
 <p>In short, inbound filtering is the simple option and caching is the
 robust option (albeit with bigger storage requirements). </p>
 
-<p>There is a third option, independent of the two we've discussed: profile 
+<p>There is a third option, independent of the two we've discussed: profile
-and optimize HTMLPurifier yourself. Be sure to report back your results 
+and optimize HTMLPurifier yourself. Be sure to report back your results
-if you decide to do that! Especially if you port HTML Purifier to C++. 
+if you decide to do that! Especially if you port HTML Purifier to C++.
 <tt>;-)</tt></p>
 
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-tidy.html

@@ -50,7 +50,7 @@ not need Tidy installed on your PHP to use these features!</strong></p>
 
 <h2>What are levels?</h2>
 
-<p>Levels describe how aggressive the Tidy module should be when 
+<p>Levels describe how aggressive the Tidy module should be when
 cleaning up HTML. There are four levels to pick: none, light, medium
 and heavy. Each of these levels has a well-defined set of behavior
 associated with it, although it may change depending on your doctype.</p>
@@ -225,6 +225,6 @@ and if that still doesn't satisfy your appetite, do some fine-tuning.
 Other than that, don't worry about it: this all works silently and
 effectively in the background.</p>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-uri-filter.html

@@ -92,7 +92,7 @@
 </tbody></table>
 
 <p>
-  Because the URI is presented to us in this form, and not 
+  Because the URI is presented to us in this form, and not
   <code>http://bob@example.com:8080/foo.php?q=string#hash</code>, it saves us
   a lot of trouble in having to parse the URI every time we want to filter
   it. For the record, the above URI has the following components:
@@ -130,30 +130,26 @@
 </p>
 
 <p>
-  Let's suppose I wanted to write a filter that de-internationalized domain
+  Let's suppose I wanted to write a filter that converted links with a
-  names by converting them to <a href="http://en.wikipedia.org/wiki/Punycode">Punycode</a>.
+  custom <code>image</code> scheme to its corresponding real path on
-  Assuming that <code>punycode_encode($input)</code> converts <code>$input</code> to
+  our website:
-  Punycode and returns <code>false</code> on failure:
 </p>
 
-<pre>class HTMLPurifier_URIFilter_ConvertIDNToPunycode extends HTMLPurifier_URIFilter
+<pre>class HTMLPurifier_URIFilter_TransformImageScheme extends HTMLPurifier_URIFilter
 {
-    public $name = 'ConvertIDNToPunycode';
+    public $name = 'TransformImageScheme';
     public function filter(&$uri, $config, $context) {
-        if (is_null($uri->host)) return true;
+        if ($uri->scheme !== 'image') return true;
-        if ($uri->host == utf8_decode($uri->host)) {
+        $img_name = $uri->path;
-            // is ASCII, abort
+        // Overwrite the previous URI object
-            return true;
+        $uri = new HTMLPurifier_URI('http', null, null, null, '/img/' . $img_name . '.png', null, null);
-        }
-        $host = punycode_encode($uri->host);
-        if ($host === false) return false;
-        $uri->host = $host;
         return true;
     }
 }</pre>
 
 <p>
-  Notice I did not <code>return $uri;</code>.
+  Notice I did not <code>return $uri;</code>. This filter would turn
+  <code>image:Foo</code> into <code>/img/Foo.png</code>.
 </p>
 
 <h2>Activating your filter</h2>
@@ -186,16 +182,35 @@ $uri->registerFilter(new HTMLPurifier_URIFilter_<strong>NameOfFilter</strong>())
   is set to true.
 </p>
 
+<h2>Post-filter</h2>
+
+<p>
+    Remember our TransformImageScheme filter? That filter acted before we had
+    performed scheme validation; otherwise, the URI would have been filtered
+    out when it was discovered that there was no image scheme. Well, a post-filter
+    is run after scheme specific validation, so it's ideal for bulk
+    post-processing of URIs, including munging. To specify a URI as a post-filter,
+    set the <code>$post</code> member variable to TRUE.
+</p>
+
+<pre>class HTMLPurifier_URIFilter_MyPostFilter extends HTMLPurifier_URIFilter
+{
+    public $name = 'MyPostFilter';
+    public $post = true;
+    // ... extra code here
+}
+</pre>
+
 <h2>Examples</h2>
 
 <p>
   Check the
-  <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/URIFilter/">URIFilter</a>
+  <a href="http://repo.or.cz/w/htmlpurifier.git?a=tree;hb=HEAD;f=library/HTMLPurifier/URIFilter">URIFilter</a>
-  directory for more implementation examples, and see <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/docs/proposal-new-directives.txt">the
+  directory for more implementation examples, and see <a href="proposal-new-directives.txt">the
   new directives proposal document</a> for ideas on what could be implemented
   as a filter.
 </p>
 
-<div id="version">$Id$</div>
-
 </body></html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-utf8.html

@@ -106,7 +106,7 @@ there are now many character encodings floating around.</p>
     interpret raw zeroes and ones into real characters. It
     usually does this by pairing numbers with characters.</p>
     <p>There are many different types of character encodings floating
-    around, but the ones we deal most frequently with are ASCII, 
+    around, but the ones we deal most frequently with are ASCII,
     8-bit encodings, and Unicode-based encodings.</p>
     <ul>
         <li><strong>ASCII</strong> is a 7-bit encoding based on the
@@ -118,9 +118,8 @@ there are now many character encodings floating around.</p>
             see a page on the web, chances are it's encoded in one
             of these encodings.</li>
         <li><strong>Unicode-based encodings</strong> implement the
-            Unicode standard and include UTF-8, UCS-2 and UTF-16.
+            Unicode standard and include UTF-8, UTF-16 and UTF-32/UCS-4.
-            They go beyond 8-bits (the first two are variable length,
+            They go beyond 8-bits and support almost
-            while the second one uses 16-bits), and support almost
             every language in the world. UTF-8 is gaining traction
             as the dominant international encoding of the web.</li>
     </ul>
@@ -307,7 +306,7 @@ languages</a>. The appropriate code is:</p>
 
 <p>...replacing UTF-8 with whatever your embedded encoding is.
 This code must come before any output, so be careful about
-stray whitespace in your application (i.e., any whitespace before 
+stray whitespace in your application (i.e., any whitespace before
 output excluding whitespace within &lt;?php ?&gt; tags).</p>
 
 <h4 id="fixcharset-server-phpini">PHP ini directive</h4>
@@ -367,9 +366,9 @@ to send anything at all:</p>
 <pre><a href="http://httpd.apache.org/docs/1.3/mod/core.html#adddefaultcharset">AddDefaultCharset</a> Off</pre>
 
 <p>...making your internal charset declaration (usually the <code>META</code> tags)
-the sole source of character encoding 
+the sole source of character encoding
-information. In these cases, it is <em>especially</em> important to make 
+information. In these cases, it is <em>especially</em> important to make
-sure you have valid <code>META</code> tags on your pages and all the 
+sure you have valid <code>META</code> tags on your pages and all the
 text before them is ASCII.</p>
 
 <blockquote class="aside"><p>These directives can also be
@@ -444,9 +443,9 @@ Declarations. They look like:</p>
 <p>For XHTML, this XML Declaration theoretically
 overrides the <code>META</code> tag. In reality, this happens only when the
 XHTML is actually served as legit XML and not HTML, which is almost always
-never due to Internet Explorer's lack of support for 
+never due to Internet Explorer's lack of support for
 <code>application/xhtml+xml</code> (even though doing so is often
-argued to be <a href="http://www.hixie.ch/advocacy/xhtml">good 
+argued to be <a href="http://www.hixie.ch/advocacy/xhtml">good
 practice</a> and is required by the XHTML 1.1 specification).</p>
 
 <p>For XML, however, this XML Declaration is extremely important.
@@ -457,7 +456,7 @@ ISO-8859-1 encoding (you see this in garbled RSS feeds).</p>
 
 <p>In short, if you use XHTML and have gone through the
 trouble of adding the XML Declaration, make sure it jives
-with your <code>META</code> tags (which should only be present 
+with your <code>META</code> tags (which should only be present
 if served in text/html) and HTTP headers.</p>
 
 <h3 id="fixcharset-internals">Inside the process</h3>
@@ -482,7 +481,7 @@ if we don't know it's character encoding? And how do we figure out
 the character encoding, if we don't know the contents of the
 <code>META</code> tag?</p>
 
-<p>Fortunantely for us, the characters we need to write the
+<p>Fortunately for us, the characters we need to write the
 <code>META</code> are in ASCII, which is pretty much universal
 over every character encoding that is in common use today. So,
 all the web-browser has to do is parse all the way down until
@@ -490,7 +489,7 @@ it gets to the Content-Type tag, extract the character encoding
 tag, then re-parse the document according to this new information.</p>
 
 <p>Obviously this is complicated, so browsers prefer the simpler
-and more efficient solution: get the character encoding from a 
+and more efficient solution: get the character encoding from a
 somewhere other than the document itself, i.e. the HTTP headers,
 much to the chagrin of HTML authors who can't set these headers.</p>
 
@@ -527,7 +526,7 @@ you don't have to use those user-unfriendly entities.</p>
 
 <h3 id="whyutf8-user">User-friendly</h3>
 
-<p>Websites encoded in Latin-1 (ISO-8859-1) which ocassionally need
+<p>Websites encoded in Latin-1 (ISO-8859-1) which occasionally need
 a special character outside of their scope often will use a character
 entity reference to achieve the desired effect. For instance, &theta; can be
 written <code>&amp;theta;</code>, regardless of the character encoding's
@@ -579,19 +578,21 @@ files.</p>
 <a href="http://web.archive.org/web/20060427015200/ppewww.ph.gla.ac.uk/~flavell/charset/form-i18n.html">
 <code>FORM</code> submission and i18n</a>. That document contains lots
 of useful information, but is written in a rambly manner, so
-here I try to get right to the point. (Note: the original has 
+here I try to get right to the point. (Note: the original has
 disappeared off the web, so I am linking to the Web Archive copy.)</p>
 
 <h4 id="whyutf8-forms-urlencoded"><code>application/x-www-form-urlencoded</code></h4>
 
 <p>This is the Content-Type that GET requests must use, and POST requests
-use by default. It involves the ubiquituous percent encoding format that
+use by default. It involves the ubiquitous percent encoding format that
 looks something like: <code>%C3%86</code>. There is no official way of
 determining the character encoding of such a request, since the percent
 encoding operates on a byte level, so it is usually assumed that it
 is the same as the encoding the page containing the form was submitted
-in. You'll run into very few problems if you only use characters in
+in. (<a href="http://tools.ietf.org/html/rfc3986#section-2.5">RFC 3986</a>
-the character encoding you chose.</p>
+recommends that textual identifiers be translated to UTF-8; however, browser
+compliance is spotty.) You'll run into very few problems
+if you only use characters in the character encoding you chose.</p>
 
 <p>However, once you start adding characters outside of your encoding
 (and this is a lot more common than you may think: take curly
@@ -673,7 +674,7 @@ it up to the module iconv to do the dirty work.</p>
 <p>This approach, however, is not perfect. iconv is blithely unaware
 of HTML character entities. HTML Purifier, in order to
 protect against sophisticated escaping schemes, normalizes all character
-and numeric entitie references before processing the text. This leads to
+and numeric entity references before processing the text. This leads to
 one important ramification:</p>
 
 <p><strong>Any character that is not supported by the target character
@@ -769,7 +770,7 @@ the text when you try to convert it to UTF-8. You'll have to convert
 it to a binary field, convert it to a Shift-JIS field (the real encoding),
 and then finally to UTF-8. Many a website had pages irreversibly mangled
 because they didn't realize that they'd been deluding themselves about
-the character encoding all along, don't become the next victim.</p>
+the character encoding all along; don't become the next victim.</p>
 
 <p>For <a href="http://www.postgresql.org/docs/8.2/static/multibyte.html">PostgreSQL</a>, there appears to be no direct way to change the
 encoding of a database (as of 8.2). You will have to dump the data, and then reimport
@@ -789,7 +790,7 @@ usually supported).</p>
 
 <h4 id="migrate-db-binary">Binary</h4>
 
-<p>Due to the abovementioned compatibility issues, a more interoperable
+<p>Due to the aforementioned compatibility issues, a more interoperable
 way of storing UTF-8 text is to stuff it in a binary datatype.
 <code>CHAR</code> becomes <code>BINARY</code>, <code>VARCHAR</code> becomes
 <code>VARBINARY</code> and <code>TEXT</code> becomes <code>BLOB</code>.
@@ -885,7 +886,7 @@ sure the page is saved WITHOUT the BOM.</p>
 </blockquote>
 
 <p>If you are reading in text files to insert into the middle of another
-page, it is strongly advised (but not strictly necessary) that you replace out the UTF-8 byte 
+page, it is strongly advised (but not strictly necessary) that you replace out the UTF-8 byte
 sequence for BOM <code>&quot;\xEF\xBB\xBF&quot;</code> before inserting it in,
 via:</p>
 
@@ -916,8 +917,8 @@ anyway. So we'll deal with the other two edge cases.</p>
 would like to read your website but get heaps of question marks or
 other meaningless characters. Fixing this problem requires the
 installation of a font or language pack which is often highly
-dependent on what the language is. <a href="http://bn.wikipedia.org/wiki/%E0%A6%89%E0%A6%87%E0%A6%95%E0%A6%BF%E0%A6%AA%E0%A7%87%E0%A6%A1%E0%A6%BF%E0%A6%AF%E0%A6%BC%E0%A6%BE:Bangla_script_display_help">Here is an example</a>
+dependent on what the language is. <a href="http://bn.wikipedia.org/wiki/%E0%A6%89%E0%A6%87%E0%A6%95%E0%A6%BF%E0%A6%AA%E0%A7%87%E0%A6%A1%E0%A6%BF%E0%A6%AF%E0%A6%BC%E0%A6%BE:Bangla_script_display_and_input_help">Here is an example</a>
-of such a help file for the Bengali language, I am sure there are
+of such a help file for the Bengali language; I am sure there are
 others out there too. You just have to point users to the appropriate
 help file.</p>
 
@@ -927,7 +928,7 @@ help file.</p>
 characters embedded in what otherwise would be very bland ASCII are
 letters of the
 <a href="http://en.wikipedia.org/wiki/International_Phonetic_Alphabet">International
-Phonetic Alphabet (IPA)</a>, use to designate pronounciations in a very standard
+Phonetic Alphabet (IPA)</a>, use to designate pronunciations in a very standard
 manner (you probably see them all the time in your dictionary). Your
 average font probably won't have support for all of the IPA characters
 like &#664; (bilabial click) or &#658; (voiced postalveolar fricative).
@@ -940,15 +941,15 @@ most widely used browser in the entire world? Microsoft IE 6
 is not smart enough to borrow from other fonts when a character isn't
 present, so more often than not you'll be slapped with a nice big &#65533;.
 To get things to work, MSIE 6 needs a little nudge. You could configure it
-to use a different font to render the text, but you can acheive the same
+to use a different font to render the text, but you can achieve the same
 effect by selectively changing the font for blocks of special characters
 to known good Unicode fonts.</p>
 
-<p>Fortunantely, the folks over at Wikipedia have already done all the
+<p>Fortunately, the folks over at Wikipedia have already done all the
 heavy lifting for you. Get the CSS from the horses mouth here:
 <a href="http://en.wikipedia.org/wiki/MediaWiki:Common.css">Common.css</a>,
 and search for &quot;.IPA&quot; There are also a smattering of
-other classes you can use for other purposes, check out 
+other classes you can use for other purposes, check out
 <a href="http://meta.wikimedia.org/wiki/Help:Special_characters#Displaying_Special_Characters">this page</a>
 for more details. For you lazy ones, this should work:</p>
 
@@ -971,7 +972,7 @@ users.</p>
 <h3 id="migrate-variablewidth">Dealing with variable width in functions</h3>
 
 <p>When people claim that PHP6 will solve all our Unicode problems, they're
-misinformed. It will not fix any of the abovementioned troubles. It will,
+misinformed. It will not fix any of the aforementioned troubles. It will,
 however, fix the problem we are about to discuss: processing UTF-8 text
 in PHP.</p>
 
@@ -1034,7 +1035,7 @@ directory.</p>
 <p>Well, that's it. Hopefully this document has served as a very
 practical springboard into knowledge of how UTF-8 works.  You may have
 decided that you don't want to migrate yet: that's fine, just know
-what will happen to your output and what bug reports you may recieve.</p>
+what will happen to your output and what bug reports you may receive.</p>
 
 <p>Many other developers have already discussed the subject of Unicode,
 UTF-8 and internationalization, and I would like to defer to them for
@@ -1054,3 +1055,5 @@ a more in-depth look into character sets and encodings.</p>
 
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/enduser-youtube.html

@@ -70,7 +70,7 @@ into your documents. YouTube's code goes like this:</p>
 class=&quot;embed-youtube&quot;&gt;AyPzM5WK8ys&lt;/span&gt;</code> your
 application can reconstruct the full object from this small snippet that
 passes through HTML Purifier <em>unharmed</em>.
-<a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/Filter/YouTube.php">Show me the code!</a></p>
+<a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/Filter/YouTube.php">Show me the code!</a></p>
 
 <p>And the corresponding usage:</p>
 
@@ -148,3 +148,5 @@ with the core!</p>
 
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/examples/basic.php

@@ -20,3 +20,4 @@ $pure_html = $purifier->purify($html);
 
 echo '<pre>' . htmlspecialchars($pure_html) . '</pre>';
 
+// vim: et sw=4 sts=4

docs/fixquotes.htc

@@ -4,3 +4,5 @@ function init() {
   element.innerHTML = '“'+element.innerHTML+'”';
 }
 </script>
+
+<!-- vim: et sw=4 sts=4 -->

docs/index.html

@@ -98,8 +98,8 @@ the code. They may be upgraded to HTML files or stay as TXT scratchpads.</p>
 <table class="table">
 
 <thead><tr>
-    <th width="10%">Type</th>
+    <th style="width:10%">Type</th>
-    <th width="20%">Name</th>
+    <th style="width:20%">Name</th>
     <th>Description</th>
 </tr></thead>
 
@@ -175,6 +175,7 @@ the code. They may be upgraded to HTML files or stay as TXT scratchpads.</p>
 
 </table>
 
-<div id="version">$Id$</div>
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/proposal-colors.html

@@ -42,7 +42,7 @@ into the mix.</li>
 something like that?</li>
 </ol>
 
-<div id="version">$Id$</div>
-
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/proposal-config.txt

@@ -19,3 +19,5 @@ Definition objects are complex datatypes influenced by their respective
 directive namespaces (HTMLDefinition with HTML and CSSDefinition with CSS).
 If any of these directives is updated, HTML Purifier forces the definition
 to be regenerated.
+
+    vim: et sw=4 sts=4

docs/proposal-css-extraction.txt

@@ -30,3 +30,5 @@ Beyond that, HTML Purifier can magically merge common CSS values together,
 and a whole manner of other heuristic things.  HTML Purifier should also
 make it easy for an admin to re-style the HTML semantically. Speed is not
 an issue. Also, better WYSIWYG editors are needed.
+
+    vim: et sw=4 sts=4

docs/proposal-errors.txt

@@ -0,0 +1,211 @@
+Considerations for ErrorCollection
+
+Presently, HTML Purifier takes a code-execution centric approach to handling
+errors. Errors are organized and grouped according to which segment of the
+code triggers them, not necessarily the portion of the input document that
+triggered the error. This means that errors are pseudo-sorted by category,
+rather than location in the document.
+
+One easy way to "fix" this problem would be to re-sort according to line number.
+However, the "category" style information we derive from naively following
+program execution is still useful. After all, each of the strategies which
+can report errors still process the document mostly linearly. Furthermore,
+not only do they process linearly, but the way they pass off operations to
+sub-systems mirrors that of the document. For example, AttrValidator will
+linearly proceed through elements, and on each element will use AttrDef to
+validate those contents. From there, the attribute might have more
+sub-components, which have execution passed off accordingly.
+
+In fact, each strategy handles a very specific class of "error."
+
+RemoveForeignElements   - element tokens
+MakeWellFormed          - element token ordering
+FixNesting              - element token ordering
+ValidateAttributes      - attributes of elements
+
+The crucial point is that while we care about the hierarchy governing these
+different errors, we *don't* care about any other information about what actually
+happens to the elements. This brings up another point: if HTML Purifier fixes
+something, this is not really a notice/warning/error; it's really a suggestion
+of a way to fix the aforementioned defects.
+
+In short, the refactoring to take this into account kinda sucks.
+
+Errors should not be recorded in order that they are reported. Instead, they
+should be bound to the line (and preferably element) in which they were found.
+This means we need some way to uniquely identify every element in the document,
+which doesn't presently exist. An easy way of adding this would be to track
+line columns. An important ramification of this is that we *must* use the
+DirectLex implementation.
+
+    1. Implement column numbers for DirectLex [DONE!]
+    2. Disable error collection when not using DirectLex [DONE!]
+
+Next, we need to re-orient all of the error declarations to place CurrentToken
+at utmost important. Since this is passed via Context, it's not always clear
+if that's available. ErrorCollector should complain HARD if it isn't available.
+There are some locations when we don't have a token available. These include:
+
+    * Lexing - this can actually have a row and column, but NOT correspond to
+      a token
+    * End of document errors - bump this to the end
+
+Actually, we *don't* have to complain if CurrentToken isn't available; we just
+set it as a document-wide error. And actually, nothing needs to be done here.
+
+Something interesting to consider is whether or not we care about the locations
+of attributes and CSS properties, i.e. the sub-objects that compose these things.
+In terms of consistency, at the very least attributes should have column/line
+numbers attached to them. However, this may be overkill, as attributes are
+uniquely identifiable. You could go even further, with CSS, but they are also
+uniquely identifiable.
+
+Bottom-line is, however, this information must be available, in form of the
+CurrentAttribute and CurrentCssProperty (theoretical) context variables, and
+it must be used to organize the errors that the sub-processes may throw.
+There is also a hierarchy of sorts that may make merging this into one context
+variable more sense, if it hadn't been for HTML's reasonably rigid structure.
+A CSS property will never contain an HTML attribute. So we won't ever get
+recursive relations, and having multiple depths won't ever make sense. Leave
+this be.
+
+We already have this information, and consequently, using start and end is
+*unnecessary*, so long as the context variables are set appropriately. We don't
+care if an error was thrown by an attribute transform or an attribute definition;
+to the end user these are the same (for a developer, they are different, but
+they're better off with a stack trace (which we should add support for) in such
+cases).
+
+    3. Remove start()/end() code. Don't get rid of recursion, though [DONE]
+    4. Setup ErrorCollector to use context information to setup hierarchies.
+       This may require a different internal format. Use objects if it gets
+       complex. [DONE]
+
+       ASIDE
+            More on this topic: since we are now binding errors to lines
+            and columns, a particular error can have three relationships to that
+            specific location:
+
+            1. The token at that location directly
+                RemoveForeignElements
+                AttrValidator (transforms)
+                MakeWellFormed
+            2. A "component" of that token (i.e. attribute)
+                AttrValidator (removals)
+            3. A modification to that node (i.e. contents from start to end
+               token) as a whole
+                FixNesting
+
+            This needs to be marked accordingly. In the presentation, it might
+            make sense keep (3) separate, have (2) a sublist of (1). (1) can
+            be a closing tag, in which case (3) makes no sense at all, OR it
+            should be related with its opening tag (this may not necessarily
+            be possible before MakeWellFormed is run).
+
+            So, the line and column counts as our identifier, so:
+
+            $errors[$line][$col] = ...
+
+            Then, we need to identify case 1, 2 or 3. They are identified as
+            such:
+
+            1. Need some sort of semaphore in RemoveForeignElements, etc.
+            2. If CurrentAttr/CurrentCssProperty is non-null
+            3. Default (FixNesting, MakeWellFormed)
+
+            One consideration about (1) is that it usually is actually a
+            (3) modification, but we have no way of knowing about that because
+            of various optimizations. However, they can probably be treated
+            the same. The other difficulty is that (3) is never a line and
+            column; rather, it is a range (i.e. a duple) and telling the user
+            the very start of the range may confuse them. For example,
+
+            <b>Foo<div>bar</div></b>
+            ^     ^
+
+            The node being operated on is <b>, so the error would be assigned
+            to the first caret, with a "node reorganized" error. Then, the
+            ChildDef would have submitted its own suggestions and errors with
+            regard to what's going in the internals.  So I suppose this is
+            ok. :-)
+
+            Now, the structure of the earlier mentioned ... would be something
+            like this:
+
+            object {
+                type = (token|attr|property),
+                value, // appropriate for type
+                errors => array(),
+                sub-errors = [recursive],
+            }
+
+            This helps us keep things agnostic. It is also sufficiently complex
+            enough to warrant an object.
+
+So, more wanking about the object format is in order. The way HTML Purifier is
+currently setup, the only possible hierarchy is:
+
+    token -> attr -> css property
+
+These relations do not exist all of the time; a comment or end token would not
+ever have any attributes, and non-style attributes would never have CSS properties
+associated with them.
+
+I believe that it is worth supporting multiple paths. At some point, we might
+have a hierarchy like:
+
+    * -> syntax
+      -> token -> attr -> css property
+                       -> url
+               -> css stylesheet <style>
+
+et cetera. Now, one of the practical implications of this is that every "node"
+on our tree is well-defined, so in theory it should be possible to either 1.
+create a separate class for each error struct, or 2. embed this information
+directly into HTML Purifier's token stream.  Embedding the information in the
+token stream is not a terribly good idea, since tokens can be removed, etc.
+So that leaves us with 1... and if we use a generic interface we can cut down
+on a lot of code we might need. So let's leave it like this.
+
+~~~~
+
+Then we setup suggestions.
+
+    5. Setup a separate error class which tells the user any modifications
+       HTML Purifier made.
+
+Some information about this:
+
+Our current paradigm is to tell the user what HTML Purifier did to the HTML.
+This is the most natural mode of operation, since that's what HTML Purifier
+is all about; it was not meant to be a validator.
+
+However, most other people have experience dealing with a validator. In cases
+where HTML Purifier unambiguously does the right thing, simply giving the user
+the correct version isn't a bad idea, but problems arise when:
+
+- The user has such bad HTML we do something odd, when we should have just
+  flagged the HTML as an error. Such examples are when we do things like
+  remove text from directly inside a <table> tag. It was probably meant to
+  be in a <td> tag or be outside the table, but we're not smart enough to
+  realize this so we just remove it. In such a case, we should tell the user
+  that there was foreign data in the table, but then we shouldn't "demand"
+  the user remove the data; it's more of a "here's a possible way of
+  rectifying the problem"
+
+- Giving line context for input is hard enough, but feasible; giving output
+  line context will be extremely difficult due to shifting lines; we'd probably
+  have to track what the tokens are and then find the appropriate out context
+  and it's not guaranteed to work etc etc etc.
+
+````````````
+
+Don't forget to spruce up output.
+
+    6. Output needs to automatically give line and column numbers, basically
+       "at line" on steroids. Look at W3C's output; it's ok. [PARTIALLY DONE]
+
+       - We need a standard CSS to apply (check demo.css for some starting
+         styling; some buttons would also be hip)
+
+    vim: et sw=4 sts=4

docs/proposal-filter-levels.txt

@@ -133,3 +133,5 @@ Dramatic - border, list-style-position (list-style), margin, padding,
 
 Dramatic elements substantially change the look of text in ways that should
 probably have been reserved to other areas.
+
+    vim: et sw=4 sts=4

docs/proposal-language.txt

@@ -60,3 +60,5 @@ Neat functionality:
 -  Roman numeral formatting
 
 Items marked with a + likely need to be addressed by HTML Purifier
+
+    vim: et sw=4 sts=4

docs/proposal-new-directives.txt

@@ -16,7 +16,7 @@ implemented, give us a ring, and we'll move it up the priority chain.
     %Attr.ClassBlacklist. When it's Whitelist, only allow those in
     %Attr.ClassWhitelist.
 
-%Attr.MaxWidth, 
+%Attr.MaxWidth,
 %Attr.MaxHeight - caps for width and height related checks.
     (the hack in Pixels for an image crashing attack could be replaced by this)
 
@@ -41,3 +41,4 @@ implemented, give us a ring, and we'll move it up the priority chain.
     absolute DNS.  While this is actually the preferred method according to
     the RFC, most people opt to use a relative domain name relative to . (root).
 
+    vim: et sw=4 sts=4

docs/ref-content-models.txt

@@ -46,3 +46,5 @@ is eliminated completely, in the latter case, the text of the node
 would is preserved (as the parent node does allow PCDATA).  Custom
 content model implementations probably are not the best way of handling
 these cases, instead, node bubbling should be implemented instead.
+
+    vim: et sw=4 sts=4

docs/ref-css-length.txt

@@ -22,7 +22,9 @@ Relative:
     1 ex ~= 0.5 em, though Mozilla Firefox says 1 ex = 6px
     1 px ~= 1 pt
 
-Watch out: font-sizes can also be nested to get successively larger 
+Watch out: font-sizes can also be nested to get successively larger
 (although I do not relish having to keep track of context font-sizes,
 this may be necessary, especially for some of the more advanced features
 for preventing things like white on white).
+
+    vim: et sw=4 sts=4

docs/ref-devnetwork.html

@@ -40,6 +40,7 @@ the development of this library in these forum threads:</p>
 
 <p>...as well as any I may have forgotten.</p>
 
-<div id="version">$Id$</div>
 </body>
 </html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/ref-html-modularization.txt

@@ -121,7 +121,7 @@ a proprietary system called ChildDef for performance and flexibility
 reasons, but this does not line up very well with W3C's notion of
 regexps for defining the allowed children of an element.
 
-HTMLPurifier->elements[$element]->content_model and 
+HTMLPurifier->elements[$element]->content_model and
 HTMLPurifier->elements[$element]->content_model_type store information
 about the final ChildDef that will be stored in
 HTMLPurifier->elements[$element]->child (we use a different variable
@@ -162,3 +162,5 @@ array of content set names to content set contents. If the content set
 already exists, your values are appended on to it (great for, say,
 registering the font tag as an inline element), otherwise it is
 created. They are substituted into content_model.
+
+    vim: et sw=4 sts=4

docs/ref-proprietary-tags.txt

@@ -22,3 +22,5 @@ HTML Purifier context.
 
 These should be put into their own Tidy module, not loaded by default(?). These
 all qualify as "lenient" transforms.
+
+    vim: et sw=4 sts=4

docs/ref-whatwg.txt

@@ -18,7 +18,9 @@ committing ourselves till the spec stabilizes, though.
 
 More immediately speaking though, however, is the well-defined parsing
 behavior that HTML 5 adds. While I have little interest in writing
-another DirectLex parser, other parsers like ph5p 
+another DirectLex parser, other parsers like ph5p
 <http://jero.net/lab/ph5p/> can be adapted to DOMLex to support much more
 flexible HTML parsing (a cool feature I've seen is how they resolve
 <b>bold<i>both</b>italic</i>).
+
+    vim: et sw=4 sts=4

docs/specimens/LICENSE

@@ -1,8 +1,10 @@
-Licensing of Specimens
+Licensing of Specimens
-
+
-Some files in this directory have different licenses:
+Some files in this directory have different licenses:
-
+
-windows-live-mail-desktop-beta.html - donated by laacz, public domain
+windows-live-mail-desktop-beta.html - donated by laacz, public domain
-img.png - LGPL, from <http://commons.wikimedia.org/wiki/Image:Pastille_chrome.png>
+img.png - LGPL, from <http://commons.wikimedia.org/wiki/Image:Pastille_chrome.png>
-
+
-All other files are by me, and are licensed under LGPL.
+All other files are by me, and are licensed under LGPL.
+
+    vim: et sw=4 sts=4

docs/specimens/html-align-to-css.html

@@ -162,4 +162,6 @@ div.segment {width:250px; float:left; margin-top:1em;}
 </div>
 
 </body>
-</html>
+</html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/specimens/jochem-blok-word.html

@@ -0,0 +1,131 @@
+<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
+
+<head>
+<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
+<meta name=Generator content="Microsoft Word 12 (filtered medium)">
+<!--[if !mso]>
+<style>
+v\:* {behavior:url(#default#VML);}
+o\:* {behavior:url(#default#VML);}
+w\:* {behavior:url(#default#VML);}
+..shape {behavior:url(#default#VML);}
+</style>
+<![endif]-->
+<style>
+<!--
+ /* Font Definitions */
+ @font-face
+	{font-family:"Cambria Math";
+	panose-1:2 4 5 3 5 4 6 3 2 4;}
+@font-face
+	{font-family:Calibri;
+	panose-1:2 15 5 2 2 2 4 3 2 4;}
+@font-face
+	{font-family:Tahoma;
+	panose-1:2 11 6 4 3 5 4 4 2 4;}
+@font-face
+	{font-family:Verdana;
+	panose-1:2 11 6 4 3 5 4 4 2 4;}
+ /* Style Definitions */
+ p.MsoNormal, li.MsoNormal, div.MsoNormal
+	{margin:0cm;
+	margin-bottom:.0001pt;
+	font-size:10.0pt;
+	font-family:"Verdana","sans-serif";}
+a:link, span.MsoHyperlink
+	{mso-style-priority:99;
+	color:blue;
+	text-decoration:underline;}
+a:visited, span.MsoHyperlinkFollowed
+	{mso-style-priority:99;
+	color:purple;
+	text-decoration:underline;}
+p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
+	{mso-style-priority:99;
+	mso-style-link:"Balloon Text Char";
+	margin:0cm;
+	margin-bottom:.0001pt;
+	font-size:8.0pt;
+	font-family:"Tahoma","sans-serif";}
+span.EmailStyle17
+	{mso-style-type:personal-compose;
+	font-family:"Verdana","sans-serif";
+	color:windowtext;}
+span.BalloonTextChar
+	{mso-style-name:"Balloon Text Char";
+	mso-style-priority:99;
+	mso-style-link:"Balloon Text";
+	font-family:"Tahoma","sans-serif";}
+..MsoChpDefault
+	{mso-style-type:export-only;}
+@page Section1
+	{size:612.0pt 792.0pt;
+	margin:70.85pt 70.85pt 70.85pt 70.85pt;}
+div.Section1
+	{page:Section1;}
+-->
+</style>
+<!--[if gte mso 9]><xml>
+ <o:shapedefaults v:ext="edit" spidmax="2050" />
+</xml><![endif]--><!--[if gte mso 9]><xml>
+ <o:shapelayout v:ext="edit">
+  <o:idmap v:ext="edit" data="1" />
+ </o:shapelayout></xml><![endif]-->
+</head>
+
+<body lang=NL link=blue vlink=purple>
+
+<div class=Section1>
+
+<p class=MsoNormal><img width=1277 height=994 id="Picture_x0020_1"
+src="cid:image001.png@01C8CBDF.5D1BAEE0"><o:p></o:p></p>
+
+<p class=MsoNormal><o:p>&nbsp;</o:p></p>
+
+<p class=MsoNormal><b>Name<o:p></o:p></b></p>
+
+<p class=MsoNormal>E-mail : <a href="mailto:mail@example.com"><span
+style='color:windowtext'>mail@example.com</span></a><o:p></o:p></p>
+
+<p class=MsoNormal><o:p>&nbsp;</o:p></p>
+
+<p class=MsoNormal><b>Company<o:p></o:p></b></p>
+
+<p class=MsoNormal>Address 1<o:p></o:p></p>
+
+<p class=MsoNormal>Address 2<o:p></o:p></p>
+
+<p class=MsoNormal><o:p>&nbsp;</o:p></p>
+
+<p class=MsoNormal>Telefoon&nbsp; : +xx xx xxx xxx xx <span style='color:black'><o:p></o:p></span></p>
+
+<p class=MsoNormal><span lang=EN-US style='color:black'>Fax&nbsp; : +xx xx xxx xx xx<o:p></o:p></span></p>
+
+<p class=MsoNormal><span lang=EN-US style='color:black'>Internet : </span><span
+style='color:black'><a href="http://www.example.com/"><span lang=EN-US
+style='color:black'>http://www.example.com</span></a></span><span
+lang=EN-US style='color:black'><o:p></o:p></span></p>
+
+<p class=MsoNormal><span lang=EN-US style='color:black'>Kamer van koophandel
+xxxxxxxxx<o:p></o:p></span></p>
+
+<p class=MsoNormal><span lang=EN-US style='color:black'><o:p>&nbsp;</o:p></span></p>
+
+<p class=MsoNormal><span lang=EN-US style='font-size:7.5pt;color:black'>Op deze
+e-mail is een disclaimer van toepassing, ga naar </span><span lang=EN-US
+style='font-size:7.5pt'><a
+href="http://www.example.com/disclaimer"><span
+style='color:black'>www.example.com/disclaimer</span></a><br>
+<span style='color:black'>A disclaimer is applicable to this email, please
+refer to </span><a href="http://www.example.com/disclaimer"><span
+style='color:black'>www.example.com/disclaimer</span></a><o:p></o:p></span></p>
+
+<p class=MsoNormal><span lang=EN-US><o:p>&nbsp;</o:p></span></p>
+
+</div>
+
+</body>
+
+</html>
+
+<!-- vim: et sw=4 sts=4 -->

docs/specimens/windows-live-mail-desktop-beta.html

@@ -4,71 +4,73 @@
 <STYLE></STYLE>
 
 <META content="MSHTML 6.00.6000.16414" name=GENERATOR></HEAD>
-<BODY id=MailContainerBody 
+<BODY id=MailContainerBody
-style="PADDING-RIGHT: 10px; PADDING-LEFT: 10px; FONT-SIZE: 10pt; COLOR: #000000; PADDING-TOP: 15px; FONT-FAMILY: Arial" 
+style="PADDING-RIGHT: 10px; PADDING-LEFT: 10px; FONT-SIZE: 10pt; COLOR: #000000; PADDING-TOP: 15px; FONT-FAMILY: Arial"
-bgColor=#ff6600 leftMargin=0 background="" topMargin=0 
+bgColor=#ff6600 leftMargin=0 background="" topMargin=0
 name="Compose message area" acc_role="text" CanvasTabStop="false">
-<DIV 
+<DIV
-style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; WIDTH: 100%; MARGIN-RIGHT: 10px; PADDING-TOP: 5px; BORDER-BOTTOM: #dddddd 1px solid; FONT-FAMILY: Verdana; HEIGHT: 25px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN 
+style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; WIDTH: 100%; MARGIN-RIGHT: 10px; PADDING-TOP: 5px; BORDER-BOTTOM: #dddddd 1px solid; FONT-FAMILY: Verdana; HEIGHT: 25px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN
-title="View a slideshow of the pictures in this e-mail message." 
+title="View a slideshow of the pictures in this e-mail message."
-style="PADDING-RIGHT: 20px"><A style="COLOR: #0088e4" 
+style="PADDING-RIGHT: 20px"><A style="COLOR: #0088e4"
-href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216">Play 
+href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216">Play
-slideshow </A></SPAN><SPAN style="COLOR: #909090"><SPAN>|</SPAN><SPAN 
+slideshow </A></SPAN><SPAN style="COLOR: #909090"><SPAN>|</SPAN><SPAN
-style="PADDING-LEFT: 20px"> Download the highest quality version of a picture by 
+style="PADDING-LEFT: 20px"> Download the highest quality version of a picture by
 clicking the + above it </SPAN></SPAN></NOBR></DIV>
-<DIV 
+<DIV
 style="PADDING-RIGHT: 5px; PADDING-LEFT: 7px; PADDING-BOTTOM: 2px; WIDTH: 100%; PADDING-TOP: 2px">
 <OL>
-  <LI><IMG title="Angry smile emoticon" 
+  <LI><IMG title="Angry smile emoticon"
-  style="FLOAT: none; MARGIN: 0px; POSITION: static" tabIndex=-1 
+  style="FLOAT: none; MARGIN: 0px; POSITION: static" tabIndex=-1
-  alt="Angry smile emoticon" src="cid:49F0C856199E4D688D2D740680733D74@wc" 
+  alt="Angry smile emoticon" src="cid:49F0C856199E4D688D2D740680733D74@wc"
-  MSNNonUserImageOrEmoticon="true">Un ka <FONT style="BACKGROUND-COLOR: #800000" 
+  MSNNonUserImageOrEmoticon="true">Un ka <FONT style="BACKGROUND-COLOR: #800000"
-  color=#cc99ff><STRONG>Tev</STRONG></FONT> iet, un ko tu dari? 
+  color=#cc99ff><STRONG>Tev</STRONG></FONT> iet, un ko tu dari?
   <LI>Aha!</LI></OL>
 
 <UL>
-  <LI>Buletets 
+  <LI>Buletets
   <LI>
-  <DIV align=justify><A title=http://laacz.lv/blog/ 
+  <DIV align=justify><A title=http://laacz.lv/blog/
-  href="http://laacz.lv/blog/">http://laacz.lv/blog/</A> un <A 
+  href="http://laacz.lv/blog/">http://laacz.lv/blog/</A> un <A
   title=http://google.com/ href="http://google.com/">gugle</A></DIV>
-  <LI>Sarakstucitis</LI></UL></DIV><SPAN><SPAN xmlns:canvas="canvas-namespace-id" 
+  <LI>Sarakstucitis</LI></UL></DIV><SPAN><SPAN xmlns:canvas="canvas-namespace-id"
-layoutEmptyTextWellFont="Tahoma"><SPAN 
+layoutEmptyTextWellFont="Tahoma"><SPAN
-style="MARGIN-BOTTOM: 15px; OVERFLOW: visible; HEIGHT: 16px"></SPAN><SPAN 
+style="MARGIN-BOTTOM: 15px; OVERFLOW: visible; HEIGHT: 16px"></SPAN><SPAN
 style="MARGIN-BOTTOM: 25px; VERTICAL-ALIGN: top; OVERFLOW: visible; MARGIN-RIGHT: 25px; HEIGHT: 234px">
 <TABLE style="DISPLAY: inline">
   <TBODY>
   <TR>
 
     <TD>
-      <DIV 
+      <DIV
-      style="FONT-WEIGHT: bold; FONT-SIZE: 12pt; FONT-FAMILY: arial; TEXT-ALIGN: center"><A 
+      style="FONT-WEIGHT: bold; FONT-SIZE: 12pt; FONT-FAMILY: arial; TEXT-ALIGN: center"><A
-      id=HiresARef 
+      id=HiresARef
-      title="Click here to view or download a high resolution version of this picture" 
+      title="Click here to view or download a high resolution version of this picture"
-      style="COLOR: #0088e4; TEXT-DECORATION: none" 
+      style="COLOR: #0088e4; TEXT-DECORATION: none"
       href="http://byfiles.storage.msn.com/x1pMvt0I80jTgT6DuaCpEMbprX3nk3jNv_vjigxV_EYVSMyM_PKgEvDEUtuNhQC-F-23mTTcKyqx6eGaeK2e_wMJ0ikwpDdFntk4SY7pfJUv2g2Ck6R2S2vAA?download">+</A></DIV>
-      <DIV 
+      <DIV
-      title="Click here to view the full image using the online photo viewer." 
+      title="Click here to view the full image using the online photo viewer."
-      style="DISPLAY: inline; OVERFLOW: hidden; WIDTH: 140px; HEIGHT: 140px"><A 
+      style="DISPLAY: inline; OVERFLOW: hidden; WIDTH: 140px; HEIGHT: 140px"><A
-      href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216" 
+      href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216"
-      border="0"><IMG 
+      border="0"><IMG
-      style="MARGIN-TOP: 15px; DISPLAY: inline-block; MARGIN-LEFT: 0px" 
+      style="MARGIN-TOP: 15px; DISPLAY: inline-block; MARGIN-LEFT: 0px"
-      height=109 src="cid:006A71303B80404E9FB6184E55D6A446@wc" width=140 
+      height=109 src="cid:006A71303B80404E9FB6184E55D6A446@wc" width=140
       border=0></A></DIV></TD></TR>
   <TR>
     <TD>
-      <DIV 
+      <DIV
-      style="FONT-SIZE: 10pt; WIDTH: 140px; FONT-FAMILY: verdana; TEXT-ALIGN: center"><EM><STRONG>This 
+      style="FONT-SIZE: 10pt; WIDTH: 140px; FONT-FAMILY: verdana; TEXT-ALIGN: center"><EM><STRONG>This
-      <U>is </U></STRONG><U>tit</U>le</EM> fo<STRONG>r <FONT 
+      <U>is </U></STRONG><U>tit</U>le</EM> fo<STRONG>r <FONT
-      face="Arial Black">t<FONT color=#800000 size=7>h<U>i</U></FONT>s 
+      face="Arial Black">t<FONT color=#800000 size=7>h<U>i</U></FONT>s
       </FONT>picture</STRONG></DIV></TD></TR></TBODY></TABLE></SPAN></SPAN></SPAN>
 
-<DIV 
+<DIV
 style="PADDING-RIGHT: 5px; PADDING-LEFT: 7px; PADDING-BOTTOM: 2px; WIDTH: 100%; PADDING-TOP: 2px; HEIGHT: 50px">
 <DIV>&nbsp;</DIV></DIV>
-<DIV 
+<DIV
-style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; MARGIN-BOTTOM: 10px; WIDTH: 100%; COLOR: #909090; MARGIN-RIGHT: 10px; PADDING-TOP: 9px; FONT-FAMILY: Verdana; HEIGHT: 42px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN 
+style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; MARGIN-BOTTOM: 10px; WIDTH: 100%; COLOR: #909090; MARGIN-RIGHT: 10px; PADDING-TOP: 9px; FONT-FAMILY: Verdana; HEIGHT: 42px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN
-title="Join Windows Live to share photos using Windows Live Photo E-mail.">Online 
+title="Join Windows Live to share photos using Windows Live Photo E-mail.">Online
-pictures are available for 30 days. <A style="COLOR: #0088e4" 
+pictures are available for 30 days. <A style="COLOR: #0088e4"
-href="http://g.msn.com/5meen_us/175">Get Windows Live Mail desktop to create 
+href="http://g.msn.com/5meen_us/175">Get Windows Live Mail desktop to create
-your own photo e-mails. </A></SPAN></NOBR></DIV></BODY></HTML>
+your own photo e-mails. </A></SPAN></NOBR></DIV></BODY></HTML>
+
+<!-- vim: et sw=4 sts=4 -->

docs/style.css

@@ -72,3 +72,5 @@ q:after {
 .fixme:before {content:"Fix me: "; font-weight:bold; color:#C00; }
 
 #applicability {margin: 1em 5%; font-style:italic;}
+
+/* vim: et sw=4 sts=4 */

extras/ConfigDoc/HTMLXSLTProcessor.php

@@ -5,17 +5,17 @@
  */
 class ConfigDoc_HTMLXSLTProcessor
 {
-    
+
     /**
      * Instance of XSLTProcessor
      */
     protected $xsltProcessor;
-    
+
     public function __construct($proc = false) {
         if ($proc === false) $proc = new XSLTProcessor();
         $this->xsltProcessor = $proc;
     }
-    
+
     /**
      * @note Allows a string $xsl filename to be passed
      */
@@ -27,7 +27,7 @@ class ConfigDoc_HTMLXSLTProcessor
         }
         return $this->xsltProcessor->importStylesheet($xsl);
     }
-    
+
     /**
      * Transforms an XML file into compatible XHTML based on the stylesheet
      * @param $xml XML DOM tree, or string filename
@@ -42,12 +42,12 @@ class ConfigDoc_HTMLXSLTProcessor
             $dom = $xml;
         }
         $out = $this->xsltProcessor->transformToXML($dom);
-        
+
         // fudges for HTML backwards compatibility
         // assumes that document is XHTML
         $out = str_replace('/>', ' />', $out); // <br /> not <br/>
         $out = str_replace(' xmlns=""', '', $out); // rm unnecessary xmlns
-        
+
         if (class_exists('Tidy')) {
             // cleanup output
             $config = array(
@@ -60,10 +60,10 @@ class ConfigDoc_HTMLXSLTProcessor
             $tidy->cleanRepair();
             $out = (string) $tidy;
         }
-        
+
         return $out;
     }
-    
+
     /**
      * Bulk sets parameters for the XSL stylesheet
      * @param array $options Associative array of options to set
@@ -73,13 +73,14 @@ class ConfigDoc_HTMLXSLTProcessor
             $this->xsltProcessor->setParameter('', $name, $value);
         }
     }
-    
+
     /**
      * Forward any other calls to the XSLT processor
      */
     public function __call($name, $arguments) {
         call_user_func_array(array($this->xsltProcessor, $name), $arguments);
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

extras/FSTools.php

@@ -3,15 +3,15 @@
 /**
  * Filesystem tools not provided by default; can recursively create, copy
  * and delete folders. Some template methods are provided for extensibility.
- * 
+ *
  * @note This class must be instantiated to be used, although it does
  *       not maintain state.
  */
 class FSTools
 {
-    
+
     private static $singleton;
-    
+
     /**
      * Returns a global instance of FSTools
      */
@@ -19,7 +19,7 @@ class FSTools
         if (empty(FSTools::$singleton)) FSTools::$singleton = new FSTools();
         return FSTools::$singleton;
     }
-    
+
     /**
      * Sets our global singleton to something else; useful for overloading
      * functions.
@@ -27,7 +27,7 @@ class FSTools
     static public function setSingleton($singleton) {
         FSTools::$singleton = $singleton;
     }
-    
+
     /**
      * Recursively creates a directory
      * @param string $folder Name of folder to create
@@ -51,7 +51,7 @@ class FSTools
             $base .= DIRECTORY_SEPARATOR;
         }
     }
-    
+
     /**
      * Copy a file, or recursively copy a folder and its contents; modified
      * so that copied files, if PHP, have includes removed
@@ -85,17 +85,17 @@ class FSTools
         $dir->close();
         return true;
     }
-    
+
     /**
      * Overloadable function that tests a filename for copyability. By
      * default, everything should be copied; you can restrict things to
-     * ignore hidden files, unreadable files, etc. This function 
+     * ignore hidden files, unreadable files, etc. This function
      * applies to copyr().
      */
     public function copyable($file) {
         return true;
     }
-    
+
     /**
      * Delete a file, or a folder and its contents
      * @note Adapted from http://aidanlister.com/repos/v/function.rmdirr.php
@@ -106,12 +106,12 @@ class FSTools
         if (!$this->file_exists($dirname)) {
             return false;
         }
-     
+
         // Simple delete for a file
         if ($this->is_file($dirname) || $this->is_link($dirname)) {
             return $this->unlink($dirname);
         }
-     
+
         // Loop through the folder
         $dir = $this->dir($dirname);
         while (false !== $entry = $dir->read()) {
@@ -122,12 +122,12 @@ class FSTools
             // Recurse
             $this->rmdirr($dirname . DIRECTORY_SEPARATOR . $entry);
         }
-     
+
         // Clean up
         $dir->close();
         return $this->rmdir($dirname);
     }
-    
+
     /**
      * Recursively globs a directory.
      */
@@ -140,9 +140,9 @@ class FSTools
             $sub_files = $this->globr($sub_dir, $pattern, $flags);
             $files = array_merge($files, $sub_files);
         }
-        return $files; 
+        return $files;
     }
-    
+
     /**
      * Allows for PHP functions to be called and be stubbed.
      * @warning This function will not work for functions that need
@@ -151,5 +151,7 @@ class FSTools
     public function __call($name, $args) {
         return call_user_func_array($name, $args);
     }
-    
+
 }
+
+// vim: et sw=4 sts=4

extras/FSTools/File.php

@@ -9,16 +9,16 @@
  */
 class FSTools_File
 {
-    
+
     /** Filename of file this object represents */
     protected $name;
-    
+
     /** Handle for the file */
     protected $handle = false;
-    
+
     /** Instance of FSTools for interfacing with filesystem */
     protected $fs;
-    
+
     /**
      * Filename of file you wish to instantiate.
      * @note This file need not exist
@@ -27,13 +27,13 @@ class FSTools_File
         $this->name = $name;
         $this->fs = $fs ? $fs : FSTools::singleton();
     }
-    
+
     /** Returns the filename of the file. */
     public function getName() {return $this->name;}
-    
+
     /** Returns directory of the file without trailing slash */
     public function getDirectory() {return $this->fs->dirname($this->name);}
-    
+
     /**
      * Retrieves the contents of a file
      * @todo Throw an exception if file doesn't exist
@@ -41,27 +41,27 @@ class FSTools_File
     public function get() {
         return $this->fs->file_get_contents($this->name);
     }
-    
+
     /** Writes contents to a file, creates new file if necessary */
     public function write($contents) {
         return $this->fs->file_put_contents($this->name, $contents);
     }
-    
+
     /** Deletes the file */
     public function delete() {
         return $this->fs->unlink($this->name);
     }
-    
+
     /** Returns true if file exists and is a file. */
     public function exists() {
         return $this->fs->is_file($this->name);
     }
-    
+
     /** Returns last file modification time */
     public function getMTime() {
         return $this->fs->filemtime($this->name);
     }
-    
+
     /**
      * Chmod a file
      * @note We ignore errors because of some weird owner trickery due
@@ -70,14 +70,14 @@ class FSTools_File
     public function chmod($octal_code) {
         return @$this->fs->chmod($this->name, $octal_code);
     }
-    
+
     /** Opens file's handle */
     public function open($mode) {
         if ($this->handle) $this->close();
         $this->handle = $this->fs->fopen($this->name, $mode);
         return true;
     }
-    
+
     /** Closes file's handle */
     public function close() {
         if (!$this->handle) return false;
@@ -85,40 +85,42 @@ class FSTools_File
         $this->handle = false;
         return $status;
     }
-    
+
     /** Retrieves a line from an open file, with optional max length $length */
     public function getLine($length = null) {
         if (!$this->handle) $this->open('r');
         if ($length === null) return $this->fs->fgets($this->handle);
         else return $this->fs->fgets($this->handle, $length);
     }
-    
+
     /** Retrieves a character from an open file */
     public function getChar() {
         if (!$this->handle) $this->open('r');
         return $this->fs->fgetc($this->handle);
     }
-    
+
     /** Retrieves an $length bytes of data from an open data */
     public function read($length) {
         if (!$this->handle) $this->open('r');
         return $this->fs->fread($this->handle, $length);
     }
-    
+
     /** Writes to an open file */
     public function put($string) {
         if (!$this->handle) $this->open('a');
         return $this->fs->fwrite($this->handle, $string);
     }
-    
+
     /** Returns TRUE if the end of the file has been reached */
     public function eof() {
         if (!$this->handle) return true;
         return $this->fs->feof($this->handle);
     }
-    
+
     public function __destruct() {
         if ($this->handle) $this->close();
     }
-    
+
 }
+
+// vim: et sw=4 sts=4

extras/HTMLPurifierExtras.auto.php

@@ -7,3 +7,5 @@
 set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
 require_once 'HTMLPurifierExtras.php';
 require_once 'HTMLPurifierExtras.autoload.php';
+
+// vim: et sw=4 sts=4

extras/HTMLPurifierExtras.autoload.php

@@ -3,7 +3,7 @@
 /**
  * @file
  * Convenience file that registers autoload handler for HTML Purifier.
- * 
+ *
  * @warning
  *      This autoloader does not contain the compatibility code seen in
  *      HTMLPurifier_Bootstrap; the user is expected to make any necessary
@@ -21,3 +21,5 @@ if (function_exists('spl_autoload_register')) {
         return HTMLPurifierExtras::autoload($class);
     }
 }
+
+// vim: et sw=4 sts=4

extras/HTMLPurifierExtras.php

@@ -6,14 +6,14 @@
  */
 class HTMLPurifierExtras
 {
-    
+
     public static function autoload($class) {
         $path = HTMLPurifierExtras::getPath($class);
         if (!$path) return false;
         require $path;
         return true;
     }
-    
+
     public static function getPath($class) {
         if (
             strncmp('FSTools', $class, 7) !== 0 &&
@@ -23,5 +23,7 @@ class HTMLPurifierExtras
         // Standard implementation:
         return str_replace('_', '/', $class) . '.php';
     }
-    
+
 }
+
+// vim: et sw=4 sts=4

extras/README

@@ -24,7 +24,9 @@ the filesystem. It currently consists of two classes:
   to call arbitrary native PHP functions through it like $FS->fopen(...).
   This makes it a lot simpler to mock these filesystem calls for unit testing.
 
-- FSTools_File: This object represents a single file, and has almost any 
+- FSTools_File: This object represents a single file, and has almost any
   method imaginable one would need.
 
 Check the files themselves for more information.
+
+    vim: et sw=4 sts=4

library/HTMLPurifier.auto.php

@@ -7,3 +7,5 @@
 set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
 require_once 'HTMLPurifier/Bootstrap.php';
 require_once 'HTMLPurifier.autoload.php';
+
+// vim: et sw=4 sts=4

library/HTMLPurifier.autoload.php

@@ -17,3 +17,5 @@ if (function_exists('spl_autoload_register') && function_exists('spl_autoload_un
         return HTMLPurifier_Bootstrap::autoload($class);
     }
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier.func.php

@@ -20,3 +20,4 @@ function HTMLPurifier($html, $config = null) {
     return $purifier->purify($html, $config);
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier.includes.php

@@ -6,13 +6,13 @@
  * the core files required by HTML Purifier. Use this if performance is a
  * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
  * FILE, changes will be overwritten the next time the script is run.
- * 
+ *
- * @version 3.1.0
+ * @version 3.3.0
- * 
+ *
  * @warning
  *      You must *not* include any other HTML Purifier files before this file,
  *      because 'require' not 'require_once' is used.
- * 
+ *
  * @warning
  *      This file requires that the include path contains the HTML Purifier
  *      library directory; this is not auto-set.
@@ -29,7 +29,6 @@ require 'HTMLPurifier/Definition.php';
 require 'HTMLPurifier/CSSDefinition.php';
 require 'HTMLPurifier/ChildDef.php';
 require 'HTMLPurifier/Config.php';
-require 'HTMLPurifier/ConfigDef.php';
 require 'HTMLPurifier/ConfigSchema.php';
 require 'HTMLPurifier/ContentSets.php';
 require 'HTMLPurifier/Context.php';
@@ -42,6 +41,7 @@ require 'HTMLPurifier/Encoder.php';
 require 'HTMLPurifier/EntityLookup.php';
 require 'HTMLPurifier/EntityParser.php';
 require 'HTMLPurifier/ErrorCollector.php';
+require 'HTMLPurifier/ErrorStruct.php';
 require 'HTMLPurifier/Exception.php';
 require 'HTMLPurifier/Filter.php';
 require 'HTMLPurifier/Generator.php';
@@ -52,8 +52,11 @@ require 'HTMLPurifier/IDAccumulator.php';
 require 'HTMLPurifier/Injector.php';
 require 'HTMLPurifier/Language.php';
 require 'HTMLPurifier/LanguageFactory.php';
+require 'HTMLPurifier/Length.php';
 require 'HTMLPurifier/Lexer.php';
 require 'HTMLPurifier/PercentEncoder.php';
+require 'HTMLPurifier/PropertyList.php';
+require 'HTMLPurifier/PropertyListIterator.php';
 require 'HTMLPurifier/Strategy.php';
 require 'HTMLPurifier/StringHash.php';
 require 'HTMLPurifier/StringHashParser.php';
@@ -66,12 +69,14 @@ require 'HTMLPurifier/URIFilter.php';
 require 'HTMLPurifier/URIParser.php';
 require 'HTMLPurifier/URIScheme.php';
 require 'HTMLPurifier/URISchemeRegistry.php';
+require 'HTMLPurifier/UnitConverter.php';
 require 'HTMLPurifier/VarParser.php';
 require 'HTMLPurifier/VarParserException.php';
 require 'HTMLPurifier/AttrDef/CSS.php';
 require 'HTMLPurifier/AttrDef/Enum.php';
 require 'HTMLPurifier/AttrDef/Integer.php';
 require 'HTMLPurifier/AttrDef/Lang.php';
+require 'HTMLPurifier/AttrDef/Switch.php';
 require 'HTMLPurifier/AttrDef/Text.php';
 require 'HTMLPurifier/AttrDef/URI.php';
 require 'HTMLPurifier/AttrDef/CSS/Number.php';
@@ -106,6 +111,7 @@ require 'HTMLPurifier/AttrDef/URI/Host.php';
 require 'HTMLPurifier/AttrDef/URI/IPv4.php';
 require 'HTMLPurifier/AttrDef/URI/IPv6.php';
 require 'HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
+require 'HTMLPurifier/AttrTransform/Background.php';
 require 'HTMLPurifier/AttrTransform/BdoDir.php';
 require 'HTMLPurifier/AttrTransform/BgColor.php';
 require 'HTMLPurifier/AttrTransform/BoolToCSS.php';
@@ -113,10 +119,15 @@ require 'HTMLPurifier/AttrTransform/Border.php';
 require 'HTMLPurifier/AttrTransform/EnumToCSS.php';
 require 'HTMLPurifier/AttrTransform/ImgRequired.php';
 require 'HTMLPurifier/AttrTransform/ImgSpace.php';
+require 'HTMLPurifier/AttrTransform/Input.php';
 require 'HTMLPurifier/AttrTransform/Lang.php';
 require 'HTMLPurifier/AttrTransform/Length.php';
 require 'HTMLPurifier/AttrTransform/Name.php';
+require 'HTMLPurifier/AttrTransform/SafeEmbed.php';
+require 'HTMLPurifier/AttrTransform/SafeObject.php';
+require 'HTMLPurifier/AttrTransform/SafeParam.php';
 require 'HTMLPurifier/AttrTransform/ScriptRequired.php';
+require 'HTMLPurifier/AttrTransform/Textarea.php';
 require 'HTMLPurifier/ChildDef/Chameleon.php';
 require 'HTMLPurifier/ChildDef/Custom.php';
 require 'HTMLPurifier/ChildDef/Empty.php';
@@ -124,9 +135,6 @@ require 'HTMLPurifier/ChildDef/Required.php';
 require 'HTMLPurifier/ChildDef/Optional.php';
 require 'HTMLPurifier/ChildDef/StrictBlockquote.php';
 require 'HTMLPurifier/ChildDef/Table.php';
-require 'HTMLPurifier/ConfigDef/Directive.php';
-require 'HTMLPurifier/ConfigDef/DirectiveAlias.php';
-require 'HTMLPurifier/ConfigDef/Namespace.php';
 require 'HTMLPurifier/DefinitionCache/Decorator.php';
 require 'HTMLPurifier/DefinitionCache/Null.php';
 require 'HTMLPurifier/DefinitionCache/Serializer.php';
@@ -135,15 +143,19 @@ require 'HTMLPurifier/DefinitionCache/Decorator/Memory.php';
 require 'HTMLPurifier/HTMLModule/Bdo.php';
 require 'HTMLPurifier/HTMLModule/CommonAttributes.php';
 require 'HTMLPurifier/HTMLModule/Edit.php';
+require 'HTMLPurifier/HTMLModule/Forms.php';
 require 'HTMLPurifier/HTMLModule/Hypertext.php';
 require 'HTMLPurifier/HTMLModule/Image.php';
 require 'HTMLPurifier/HTMLModule/Legacy.php';
 require 'HTMLPurifier/HTMLModule/List.php';
+require 'HTMLPurifier/HTMLModule/Name.php';
 require 'HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
 require 'HTMLPurifier/HTMLModule/Object.php';
 require 'HTMLPurifier/HTMLModule/Presentation.php';
 require 'HTMLPurifier/HTMLModule/Proprietary.php';
 require 'HTMLPurifier/HTMLModule/Ruby.php';
+require 'HTMLPurifier/HTMLModule/SafeEmbed.php';
+require 'HTMLPurifier/HTMLModule/SafeObject.php';
 require 'HTMLPurifier/HTMLModule/Scripting.php';
 require 'HTMLPurifier/HTMLModule/StyleAttribute.php';
 require 'HTMLPurifier/HTMLModule/Tables.php';
@@ -151,14 +163,18 @@ require 'HTMLPurifier/HTMLModule/Target.php';
 require 'HTMLPurifier/HTMLModule/Text.php';
 require 'HTMLPurifier/HTMLModule/Tidy.php';
 require 'HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
+require 'HTMLPurifier/HTMLModule/Tidy/Name.php';
 require 'HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
 require 'HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
 require 'HTMLPurifier/HTMLModule/Tidy/Strict.php';
 require 'HTMLPurifier/HTMLModule/Tidy/Transitional.php';
 require 'HTMLPurifier/HTMLModule/Tidy/XHTML.php';
 require 'HTMLPurifier/Injector/AutoParagraph.php';
+require 'HTMLPurifier/Injector/DisplayLinkURI.php';
 require 'HTMLPurifier/Injector/Linkify.php';
 require 'HTMLPurifier/Injector/PurifierLinkify.php';
+require 'HTMLPurifier/Injector/RemoveEmpty.php';
+require 'HTMLPurifier/Injector/SafeObject.php';
 require 'HTMLPurifier/Lexer/DOMLex.php';
 require 'HTMLPurifier/Lexer/DirectLex.php';
 require 'HTMLPurifier/Strategy/Composite.php';
@@ -179,6 +195,7 @@ require 'HTMLPurifier/URIFilter/DisableExternal.php';
 require 'HTMLPurifier/URIFilter/DisableExternalResources.php';
 require 'HTMLPurifier/URIFilter/HostBlacklist.php';
 require 'HTMLPurifier/URIFilter/MakeAbsolute.php';
+require 'HTMLPurifier/URIFilter/Munge.php';
 require 'HTMLPurifier/URIScheme/ftp.php';
 require 'HTMLPurifier/URIScheme/http.php';
 require 'HTMLPurifier/URIScheme/https.php';

library/HTMLPurifier.kses.php

@@ -26,3 +26,5 @@ function kses($string, $allowed_html, $allowed_protocols = null) {
     $purifier = new HTMLPurifier($config);
     return $purifier->purify($string);
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier.path.php

@@ -7,3 +7,5 @@
  */
 
 set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
+
+// vim: et sw=4 sts=4

library/HTMLPurifier.php

@@ -1,11 +1,11 @@
 <?php
 
 /*! @mainpage
- * 
+ *
  * HTML Purifier is an HTML filter that will take an arbitrary snippet of
  * HTML and rigorously test, validate and filter it into a version that
  * is safe for output onto webpages. It achieves this by:
- * 
+ *
  *  -# Lexing (parsing into tokens) the document,
  *  -# Executing various strategies on the tokens:
  *      -# Removing all elements not in the whitelist,
@@ -13,13 +13,13 @@
  *      -# Fixing the nesting of the nodes, and
  *      -# Validating attributes of the nodes; and
  *  -# Generating HTML from the purified tokens.
- * 
+ *
  * However, most users will only need to interface with the HTMLPurifier
  * and HTMLPurifier_Config.
  */
 
 /*
-    HTML Purifier 3.1.0 - Standards Compliant HTML Filtering
+    HTML Purifier 3.3.0 - Standards Compliant HTML Filtering
     Copyright (C) 2006-2008 Edward Z. Yang
 
     This library is free software; you can redistribute it and/or
@@ -39,44 +39,44 @@
 
 /**
  * Facade that coordinates HTML Purifier's subsystems in order to purify HTML.
- * 
+ *
- * @note There are several points in which configuration can be specified 
+ * @note There are several points in which configuration can be specified
  *       for HTML Purifier.  The precedence of these (from lowest to
  *       highest) is as follows:
  *          -# Instance: new HTMLPurifier($config)
  *          -# Invocation: purify($html, $config)
  *       These configurations are entirely independent of each other and
  *       are *not* merged (this behavior may change in the future).
- * 
+ *
  * @todo We need an easier way to inject strategies using the configuration
  *       object.
  */
 class HTMLPurifier
 {
-    
+
     /** Version of HTML Purifier */
-    public $version = '3.1.0';
+    public $version = '3.3.0';
-    
+
     /** Constant with version of HTML Purifier */
-    const VERSION = '3.1.0';
+    const VERSION = '3.3.0';
-    
+
     /** Global configuration object */
     public $config;
-    
+
     /** Array of extra HTMLPurifier_Filter objects to run on HTML, for backwards compatibility */
     private $filters = array();
-    
+
     /** Single instance of HTML Purifier */
     private static $instance;
-    
+
     protected $strategy, $generator;
-    
+
     /**
      * Resultant HTMLPurifier_Context of last run purification. Is an array
      * of contexts if the last called method was purifyArray().
      */
     public $context;
-    
+
     /**
      * Initializes the purifier.
      * @param $config Optional HTMLPurifier_Config object for all instances of
@@ -86,13 +86,13 @@ class HTMLPurifier
      *                HTMLPurifier_Config::create() supports.
      */
     public function __construct($config = null) {
-        
+
         $this->config = HTMLPurifier_Config::create($config);
-        
+
         $this->strategy     = new HTMLPurifier_Strategy_Core();
-        
+
     }
-    
+
     /**
      * Adds a filter to process the output. First come first serve
      * @param $filter HTMLPurifier_Filter object
@@ -101,10 +101,10 @@ class HTMLPurifier
         trigger_error('HTMLPurifier->addFilter() is deprecated, use configuration directives in the Filter namespace or Filter.Custom', E_USER_WARNING);
         $this->filters[] = $filter;
     }
-    
+
     /**
      * Filters an HTML snippet/document to be XSS-free and standards-compliant.
-     * 
+     *
      * @param $html String of HTML to purify
      * @param $config HTMLPurifier_Config object for this operation, if omitted,
      *                defaults to the config object specified during this
@@ -113,38 +113,38 @@ class HTMLPurifier
      * @return Purified HTML
      */
     public function purify($html, $config = null) {
-        
+
         // :TODO: make the config merge in, instead of replace
         $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
-        
+
         // implementation is partially environment dependant, partially
         // configuration dependant
         $lexer = HTMLPurifier_Lexer::create($config);
-        
+
         $context = new HTMLPurifier_Context();
-        
+
         // setup HTML generator
         $this->generator = new HTMLPurifier_Generator($config, $context);
         $context->register('Generator', $this->generator);
-        
+
         // set up global context variables
         if ($config->get('Core', 'CollectErrors')) {
             // may get moved out if other facilities use it
             $language_factory = HTMLPurifier_LanguageFactory::instance();
             $language = $language_factory->create($config, $context);
             $context->register('Locale', $language);
-            
+
             $error_collector = new HTMLPurifier_ErrorCollector($context);
             $context->register('ErrorCollector', $error_collector);
         }
-        
+
         // setup id_accumulator context, necessary due to the fact that
         // AttrValidator can be called from many places
         $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
         $context->register('IDAccumulator', $id_accumulator);
-        
+
         $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
-        
+
         // setup filters
         $filter_flags = $config->getBatch('Filter');
         $custom_filters = $filter_flags['Custom'];
@@ -161,13 +161,13 @@ class HTMLPurifier
         }
         $filters = array_merge($filters, $this->filters);
         // maybe prepare(), but later
-        
+
         for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
             $html = $filters[$i]->preFilter($html, $config, $context);
         }
-        
+
         // purified HTML
-        $html = 
+        $html =
             $this->generator->generateFromTokens(
                 // list of tokens
                 $this->strategy->execute(
@@ -179,16 +179,16 @@ class HTMLPurifier
                     $config, $context
                 )
             );
-        
+
         for ($i = $filter_size - 1; $i >= 0; $i--) {
             $html = $filters[$i]->postFilter($html, $config, $context);
         }
-        
+
         $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
         $this->context =& $context;
         return $html;
     }
-    
+
     /**
      * Filters an array of HTML snippets
      * @param $config Optional HTMLPurifier_Config object for this operation.
@@ -204,7 +204,7 @@ class HTMLPurifier
         $this->context = $context_array;
         return $array_of_html;
     }
-    
+
     /**
      * Singleton for enforcing just one HTML Purifier in your system
      * @param $prototype Optional prototype HTMLPurifier instance to
@@ -223,12 +223,14 @@ class HTMLPurifier
         }
         return self::$instance;
     }
-    
+
     /**
      * @note Backwards compatibility, see instance()
      */
     public static function getInstance($prototype = null) {
         return HTMLPurifier::instance($prototype);
     }
-    
+
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier.safe-includes.php

@@ -1,183 +1,200 @@
-<?php
+<?php
-
+
-/**
+/**
- * @file
+ * @file
- * This file was auto-generated by generate-includes.php and includes all of
+ * This file was auto-generated by generate-includes.php and includes all of
- * the core files required by HTML Purifier. This is a convenience stub that
+ * the core files required by HTML Purifier. This is a convenience stub that
- * includes all files using dirname(__FILE__) and require_once. PLEASE DO NOT
+ * includes all files using dirname(__FILE__) and require_once. PLEASE DO NOT
- * EDIT THIS FILE, changes will be overwritten the next time the script is run.
+ * EDIT THIS FILE, changes will be overwritten the next time the script is run.
- * 
+ *
- * Changes to include_path are not necessary.
+ * Changes to include_path are not necessary.
- */
+ */
-
+
-$__dir = dirname(__FILE__);
+$__dir = dirname(__FILE__);
-
+
-require_once $__dir . '/HTMLPurifier.php';
+require_once $__dir . '/HTMLPurifier.php';
-require_once $__dir . '/HTMLPurifier/AttrCollections.php';
+require_once $__dir . '/HTMLPurifier/AttrCollections.php';
-require_once $__dir . '/HTMLPurifier/AttrDef.php';
+require_once $__dir . '/HTMLPurifier/AttrDef.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform.php';
-require_once $__dir . '/HTMLPurifier/AttrTypes.php';
+require_once $__dir . '/HTMLPurifier/AttrTypes.php';
-require_once $__dir . '/HTMLPurifier/AttrValidator.php';
+require_once $__dir . '/HTMLPurifier/AttrValidator.php';
-require_once $__dir . '/HTMLPurifier/Bootstrap.php';
+require_once $__dir . '/HTMLPurifier/Bootstrap.php';
-require_once $__dir . '/HTMLPurifier/Definition.php';
+require_once $__dir . '/HTMLPurifier/Definition.php';
-require_once $__dir . '/HTMLPurifier/CSSDefinition.php';
+require_once $__dir . '/HTMLPurifier/CSSDefinition.php';
-require_once $__dir . '/HTMLPurifier/ChildDef.php';
+require_once $__dir . '/HTMLPurifier/ChildDef.php';
-require_once $__dir . '/HTMLPurifier/Config.php';
+require_once $__dir . '/HTMLPurifier/Config.php';
-require_once $__dir . '/HTMLPurifier/ConfigDef.php';
+require_once $__dir . '/HTMLPurifier/ConfigSchema.php';
-require_once $__dir . '/HTMLPurifier/ConfigSchema.php';
+require_once $__dir . '/HTMLPurifier/ContentSets.php';
-require_once $__dir . '/HTMLPurifier/ContentSets.php';
+require_once $__dir . '/HTMLPurifier/Context.php';
-require_once $__dir . '/HTMLPurifier/Context.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCache.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCacheFactory.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCacheFactory.php';
+require_once $__dir . '/HTMLPurifier/Doctype.php';
-require_once $__dir . '/HTMLPurifier/Doctype.php';
+require_once $__dir . '/HTMLPurifier/DoctypeRegistry.php';
-require_once $__dir . '/HTMLPurifier/DoctypeRegistry.php';
+require_once $__dir . '/HTMLPurifier/ElementDef.php';
-require_once $__dir . '/HTMLPurifier/ElementDef.php';
+require_once $__dir . '/HTMLPurifier/Encoder.php';
-require_once $__dir . '/HTMLPurifier/Encoder.php';
+require_once $__dir . '/HTMLPurifier/EntityLookup.php';
-require_once $__dir . '/HTMLPurifier/EntityLookup.php';
+require_once $__dir . '/HTMLPurifier/EntityParser.php';
-require_once $__dir . '/HTMLPurifier/EntityParser.php';
+require_once $__dir . '/HTMLPurifier/ErrorCollector.php';
-require_once $__dir . '/HTMLPurifier/ErrorCollector.php';
+require_once $__dir . '/HTMLPurifier/ErrorStruct.php';
-require_once $__dir . '/HTMLPurifier/Exception.php';
+require_once $__dir . '/HTMLPurifier/Exception.php';
-require_once $__dir . '/HTMLPurifier/Filter.php';
+require_once $__dir . '/HTMLPurifier/Filter.php';
-require_once $__dir . '/HTMLPurifier/Generator.php';
+require_once $__dir . '/HTMLPurifier/Generator.php';
-require_once $__dir . '/HTMLPurifier/HTMLDefinition.php';
+require_once $__dir . '/HTMLPurifier/HTMLDefinition.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule.php';
-require_once $__dir . '/HTMLPurifier/HTMLModuleManager.php';
+require_once $__dir . '/HTMLPurifier/HTMLModuleManager.php';
-require_once $__dir . '/HTMLPurifier/IDAccumulator.php';
+require_once $__dir . '/HTMLPurifier/IDAccumulator.php';
-require_once $__dir . '/HTMLPurifier/Injector.php';
+require_once $__dir . '/HTMLPurifier/Injector.php';
-require_once $__dir . '/HTMLPurifier/Language.php';
+require_once $__dir . '/HTMLPurifier/Language.php';
-require_once $__dir . '/HTMLPurifier/LanguageFactory.php';
+require_once $__dir . '/HTMLPurifier/LanguageFactory.php';
-require_once $__dir . '/HTMLPurifier/Lexer.php';
+require_once $__dir . '/HTMLPurifier/Length.php';
-require_once $__dir . '/HTMLPurifier/PercentEncoder.php';
+require_once $__dir . '/HTMLPurifier/Lexer.php';
-require_once $__dir . '/HTMLPurifier/Strategy.php';
+require_once $__dir . '/HTMLPurifier/PercentEncoder.php';
-require_once $__dir . '/HTMLPurifier/StringHash.php';
+require_once $__dir . '/HTMLPurifier/PropertyList.php';
-require_once $__dir . '/HTMLPurifier/StringHashParser.php';
+require_once $__dir . '/HTMLPurifier/PropertyListIterator.php';
-require_once $__dir . '/HTMLPurifier/TagTransform.php';
+require_once $__dir . '/HTMLPurifier/Strategy.php';
-require_once $__dir . '/HTMLPurifier/Token.php';
+require_once $__dir . '/HTMLPurifier/StringHash.php';
-require_once $__dir . '/HTMLPurifier/TokenFactory.php';
+require_once $__dir . '/HTMLPurifier/StringHashParser.php';
-require_once $__dir . '/HTMLPurifier/URI.php';
+require_once $__dir . '/HTMLPurifier/TagTransform.php';
-require_once $__dir . '/HTMLPurifier/URIDefinition.php';
+require_once $__dir . '/HTMLPurifier/Token.php';
-require_once $__dir . '/HTMLPurifier/URIFilter.php';
+require_once $__dir . '/HTMLPurifier/TokenFactory.php';
-require_once $__dir . '/HTMLPurifier/URIParser.php';
+require_once $__dir . '/HTMLPurifier/URI.php';
-require_once $__dir . '/HTMLPurifier/URIScheme.php';
+require_once $__dir . '/HTMLPurifier/URIDefinition.php';
-require_once $__dir . '/HTMLPurifier/URISchemeRegistry.php';
+require_once $__dir . '/HTMLPurifier/URIFilter.php';
-require_once $__dir . '/HTMLPurifier/VarParser.php';
+require_once $__dir . '/HTMLPurifier/URIParser.php';
-require_once $__dir . '/HTMLPurifier/VarParserException.php';
+require_once $__dir . '/HTMLPurifier/URIScheme.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS.php';
+require_once $__dir . '/HTMLPurifier/URISchemeRegistry.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/Enum.php';
+require_once $__dir . '/HTMLPurifier/UnitConverter.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/Integer.php';
+require_once $__dir . '/HTMLPurifier/VarParser.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/Lang.php';
+require_once $__dir . '/HTMLPurifier/VarParserException.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/Text.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/URI.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Enum.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Number.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Integer.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/AlphaValue.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Lang.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Background.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Switch.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Text.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Border.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Color.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Number.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Composite.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/AlphaValue.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Background.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Filter.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Font.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Border.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/FontFamily.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Color.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Composite.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Length.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ListStyle.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Filter.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Multiple.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Font.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Percentage.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/FontFamily.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/TextDecoration.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/CSS/URI.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Length.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ListStyle.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Color.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Multiple.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/FrameTarget.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Percentage.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/ID.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/TextDecoration.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Pixels.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/URI.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Length.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/LinkTypes.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Color.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/MultiLength.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/FrameTarget.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Nmtokens.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/ID.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Pixels.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/URI/Host.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Length.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv4.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/LinkTypes.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv6.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/MultiLength.php';
-require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Nmtokens.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/BdoDir.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/BgColor.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/Host.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/BoolToCSS.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv4.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/Border.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv6.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/EnumToCSS.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/ImgRequired.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Background.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/ImgSpace.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/BdoDir.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/Lang.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/BgColor.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/Length.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/BoolToCSS.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/Name.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Border.php';
-require_once $__dir . '/HTMLPurifier/AttrTransform/ScriptRequired.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/EnumToCSS.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/Chameleon.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/ImgRequired.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/Custom.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/ImgSpace.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/Empty.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Input.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/Required.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Lang.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/Optional.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Length.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/StrictBlockquote.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Name.php';
-require_once $__dir . '/HTMLPurifier/ChildDef/Table.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/SafeEmbed.php';
-require_once $__dir . '/HTMLPurifier/ConfigDef/Directive.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/SafeObject.php';
-require_once $__dir . '/HTMLPurifier/ConfigDef/DirectiveAlias.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/SafeParam.php';
-require_once $__dir . '/HTMLPurifier/ConfigDef/Namespace.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/ScriptRequired.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Textarea.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCache/Null.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Chameleon.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCache/Serializer.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Custom.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Empty.php';
-require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Memory.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Required.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Bdo.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Optional.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/CommonAttributes.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/StrictBlockquote.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Edit.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Table.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Hypertext.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Image.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Null.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Legacy.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Serializer.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/List.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Memory.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Object.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Bdo.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Presentation.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/CommonAttributes.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Proprietary.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Edit.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Ruby.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Forms.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Scripting.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Hypertext.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/StyleAttribute.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Image.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tables.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Legacy.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Target.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/List.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Text.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Name.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Object.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Presentation.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Proprietary.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Strict.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Ruby.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Transitional.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/SafeEmbed.php';
-require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTML.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/SafeObject.php';
-require_once $__dir . '/HTMLPurifier/Injector/AutoParagraph.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Scripting.php';
-require_once $__dir . '/HTMLPurifier/Injector/Linkify.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/StyleAttribute.php';
-require_once $__dir . '/HTMLPurifier/Injector/PurifierLinkify.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tables.php';
-require_once $__dir . '/HTMLPurifier/Lexer/DOMLex.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Target.php';
-require_once $__dir . '/HTMLPurifier/Lexer/DirectLex.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Text.php';
-require_once $__dir . '/HTMLPurifier/Strategy/Composite.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy.php';
-require_once $__dir . '/HTMLPurifier/Strategy/Core.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
-require_once $__dir . '/HTMLPurifier/Strategy/FixNesting.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Name.php';
-require_once $__dir . '/HTMLPurifier/Strategy/MakeWellFormed.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
-require_once $__dir . '/HTMLPurifier/Strategy/RemoveForeignElements.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
-require_once $__dir . '/HTMLPurifier/Strategy/ValidateAttributes.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Strict.php';
-require_once $__dir . '/HTMLPurifier/TagTransform/Font.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Transitional.php';
-require_once $__dir . '/HTMLPurifier/TagTransform/Simple.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTML.php';
-require_once $__dir . '/HTMLPurifier/Token/Comment.php';
+require_once $__dir . '/HTMLPurifier/Injector/AutoParagraph.php';
-require_once $__dir . '/HTMLPurifier/Token/Tag.php';
+require_once $__dir . '/HTMLPurifier/Injector/DisplayLinkURI.php';
-require_once $__dir . '/HTMLPurifier/Token/Empty.php';
+require_once $__dir . '/HTMLPurifier/Injector/Linkify.php';
-require_once $__dir . '/HTMLPurifier/Token/End.php';
+require_once $__dir . '/HTMLPurifier/Injector/PurifierLinkify.php';
-require_once $__dir . '/HTMLPurifier/Token/Start.php';
+require_once $__dir . '/HTMLPurifier/Injector/RemoveEmpty.php';
-require_once $__dir . '/HTMLPurifier/Token/Text.php';
+require_once $__dir . '/HTMLPurifier/Injector/SafeObject.php';
-require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternal.php';
+require_once $__dir . '/HTMLPurifier/Lexer/DOMLex.php';
-require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternalResources.php';
+require_once $__dir . '/HTMLPurifier/Lexer/DirectLex.php';
-require_once $__dir . '/HTMLPurifier/URIFilter/HostBlacklist.php';
+require_once $__dir . '/HTMLPurifier/Strategy/Composite.php';
-require_once $__dir . '/HTMLPurifier/URIFilter/MakeAbsolute.php';
+require_once $__dir . '/HTMLPurifier/Strategy/Core.php';
-require_once $__dir . '/HTMLPurifier/URIScheme/ftp.php';
+require_once $__dir . '/HTMLPurifier/Strategy/FixNesting.php';
-require_once $__dir . '/HTMLPurifier/URIScheme/http.php';
+require_once $__dir . '/HTMLPurifier/Strategy/MakeWellFormed.php';
-require_once $__dir . '/HTMLPurifier/URIScheme/https.php';
+require_once $__dir . '/HTMLPurifier/Strategy/RemoveForeignElements.php';
-require_once $__dir . '/HTMLPurifier/URIScheme/mailto.php';
+require_once $__dir . '/HTMLPurifier/Strategy/ValidateAttributes.php';
-require_once $__dir . '/HTMLPurifier/URIScheme/news.php';
+require_once $__dir . '/HTMLPurifier/TagTransform/Font.php';
-require_once $__dir . '/HTMLPurifier/URIScheme/nntp.php';
+require_once $__dir . '/HTMLPurifier/TagTransform/Simple.php';
-require_once $__dir . '/HTMLPurifier/VarParser/Flexible.php';
+require_once $__dir . '/HTMLPurifier/Token/Comment.php';
-require_once $__dir . '/HTMLPurifier/VarParser/Native.php';
+require_once $__dir . '/HTMLPurifier/Token/Tag.php';
+require_once $__dir . '/HTMLPurifier/Token/Empty.php';
+require_once $__dir . '/HTMLPurifier/Token/End.php';
+require_once $__dir . '/HTMLPurifier/Token/Start.php';
+require_once $__dir . '/HTMLPurifier/Token/Text.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternal.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternalResources.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/HostBlacklist.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/MakeAbsolute.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/Munge.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/ftp.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/http.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/https.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/mailto.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/news.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/nntp.php';
+require_once $__dir . '/HTMLPurifier/VarParser/Flexible.php';
+require_once $__dir . '/HTMLPurifier/VarParser/Native.php';

library/HTMLPurifier/AttrCollections.php

@@ -6,12 +6,12 @@
 
 class HTMLPurifier_AttrCollections
 {
-    
+
     /**
      * Associative array of attribute collections, indexed by name
      */
     public $info = array();
-    
+
     /**
      * Performs all expansions on internal data for use by other inclusions
      * It also collects all attribute collection extensions from
@@ -45,7 +45,7 @@ class HTMLPurifier_AttrCollections
             $this->expandIdentifiers($this->info[$name], $attr_types);
         }
     }
-    
+
     /**
      * Takes a reference to an attribute associative array and performs
      * all inclusions specified by the zero index.
@@ -72,7 +72,7 @@ class HTMLPurifier_AttrCollections
         }
         unset($attr[0]);
     }
-    
+
     /**
      * Expands all string identifiers in an attribute array by replacing
      * them with the appropriate values inside HTMLPurifier_AttrTypes
@@ -80,17 +80,17 @@ class HTMLPurifier_AttrCollections
      * @param $attr_types HTMLPurifier_AttrTypes instance
      */
     public function expandIdentifiers(&$attr, $attr_types) {
-        
+
         // because foreach will process new elements we add, make sure we
         // skip duplicates
         $processed = array();
-        
+
         foreach ($attr as $def_i => $def) {
             // skip inclusions
             if ($def_i === 0) continue;
-            
+
             if (isset($processed[$def_i])) continue;
-            
+
             // determine whether or not attribute is required
             if ($required = (strpos($def_i, '*') !== false)) {
                 // rename the definition
@@ -98,21 +98,21 @@ class HTMLPurifier_AttrCollections
                 $def_i = trim($def_i, '*');
                 $attr[$def_i] = $def;
             }
-            
+
             $processed[$def_i] = true;
-            
+
             // if we've already got a literal object, move on
             if (is_object($def)) {
                 // preserve previous required
                 $attr[$def_i]->required = ($required || $attr[$def_i]->required);
                 continue;
             }
-            
+
             if ($def === false) {
                 unset($attr[$def_i]);
                 continue;
             }
-            
+
             if ($t = $attr_types->get($def)) {
                 $attr[$def_i] = $t;
                 $attr[$def_i]->required = $required;
@@ -120,8 +120,9 @@ class HTMLPurifier_AttrCollections
                 unset($attr[$def_i]);
             }
         }
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef.php

@@ -2,68 +2,65 @@
 
 /**
  * Base class for all validating attribute definitions.
- * 
+ *
  * This family of classes forms the core for not only HTML attribute validation,
  * but also any sort of string that needs to be validated or cleaned (which
- * means CSS properties and composite definitions are defined here too).  
+ * means CSS properties and composite definitions are defined here too).
  * Besides defining (through code) what precisely makes the string valid,
  * subclasses are also responsible for cleaning the code if possible.
  */
 
 abstract class HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Tells us whether or not an HTML attribute is minimized. Has no
      * meaning in other contexts.
      */
     public $minimized = false;
-    
+
     /**
      * Tells us whether or not an HTML attribute is required. Has no
      * meaning in other contexts
      */
     public $required = false;
-    
+
     /**
      * Validates and cleans passed string according to a definition.
-     * 
+     *
      * @param $string String to be validated and cleaned.
      * @param $config Mandatory HTMLPurifier_Config object.
      * @param $context Mandatory HTMLPurifier_AttrContext object.
      */
     abstract public function validate($string, $config, $context);
-    
+
     /**
      * Convenience method that parses a string as if it were CDATA.
-     * 
+     *
      * This method process a string in the manner specified at
      * <http://www.w3.org/TR/html4/types.html#h-6.2> by removing
      * leading and trailing whitespace, ignoring line feeds, and replacing
      * carriage returns and tabs with spaces.  While most useful for HTML
      * attributes specified as CDATA, it can also be applied to most CSS
      * values.
-     * 
+     *
      * @note This method is not entirely standards compliant, as trim() removes
      *       more types of whitespace than specified in the spec. In practice,
      *       this is rarely a problem, as those extra characters usually have
      *       already been removed by HTMLPurifier_Encoder.
-     * 
+     *
      * @warning This processing is inconsistent with XML's whitespace handling
      *          as specified by section 3.3.3 and referenced XHTML 1.0 section
-     *          4.7.  Compliant processing requires all line breaks normalized
+     *          4.7.  However, note that we are NOT necessarily
-     *          to "\n", so the fix is not as simple as fixing it in this
+     *          parsing XML, thus, this behavior may still be correct. We
-     *          function.  Trim and whitespace collapsing are supposed to only
+     *          assume that newlines have been normalized.
-     *          occur in NMTOKENs.  However, note that we are NOT necessarily
-     *          parsing XML, thus, this behavior may still be correct.
      */
     public function parseCDATA($string) {
         $string = trim($string);
-        $string = str_replace("\n", '', $string);
+        $string = str_replace(array("\n", "\t", "\r"), ' ', $string);
-        $string = str_replace(array("\r", "\t"), ' ', $string);
         return $string;
     }
-    
+
     /**
      * Factory method for creating this class from a string.
      * @param $string String construction info
@@ -76,7 +73,7 @@ abstract class HTMLPurifier_AttrDef
         // to clone or instantiate new copies. (Instantiation is safer.)
         return $this;
     }
-    
+
     /**
      * Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work
      * properly. THIS IS A HACK!
@@ -84,6 +81,7 @@ abstract class HTMLPurifier_AttrDef
     protected function mungeRgb($string) {
         return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string);
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS.php

@@ -13,22 +13,28 @@
  */
 class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
 {
-    
+
     public function validate($css, $config, $context) {
-        
+
         $css = $this->parseCDATA($css);
-        
+
         $definition = $config->getCSSDefinition();
-        
+
         // we're going to break the spec and explode by semicolons.
         // This is because semicolon rarely appears in escaped form
         // Doing this is generally flaky but fast
         // IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI
         // for details
-        
+
         $declarations = explode(';', $css);
         $propvalues = array();
-        
+
+        /**
+         * Name of the current CSS property being validated.
+         */
+        $property = false;
+        $context->register('CurrentCSSProperty', $property);
+
         foreach ($declarations as $declaration) {
             if (!$declaration) continue;
             if (!strpos($declaration, ':')) continue;
@@ -60,19 +66,22 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
             if ($result === false) continue;
             $propvalues[$property] = $result;
         }
-        
+
+        $context->destroy('CurrentCSSProperty');
+
         // procedure does not write the new CSS simultaneously, so it's
         // slightly inefficient, but it's the only way of getting rid of
         // duplicates. Perhaps config to optimize it, but not now.
-        
+
         $new_declarations = '';
         foreach ($propvalues as $prop => $value) {
             $new_declarations .= "$prop:$value;";
         }
-        
+
         return $new_declarations ? $new_declarations : false;
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/AlphaValue.php

@@ -2,11 +2,11 @@
 
 class HTMLPurifier_AttrDef_CSS_AlphaValue extends HTMLPurifier_AttrDef_CSS_Number
 {
-    
+
     public function __construct() {
         parent::__construct(false); // opacity is non-negative, but we will clamp it
     }
-    
+
     public function validate($number, $config, $context) {
         $result = parent::validate($number, $config, $context);
         if ($result === false) return $result;
@@ -15,5 +15,7 @@ class HTMLPurifier_AttrDef_CSS_AlphaValue extends HTMLPurifier_AttrDef_CSS_Numbe
         if ($float > 1.0) $result = '1';
         return $result;
     }
-    
+
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Background.php

@@ -6,13 +6,13 @@
  */
 class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Local copy of component validators.
      * @note See HTMLPurifier_AttrDef_Font::$info for a similar impl.
      */
     protected $info;
-    
+
     public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['background-color'] = $def->info['background-color'];
@@ -21,29 +21,29 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
         $this->info['background-attachment'] = $def->info['background-attachment'];
         $this->info['background-position'] = $def->info['background-position'];
     }
-    
+
     public function validate($string, $config, $context) {
-        
+
         // regular pre-processing
         $string = $this->parseCDATA($string);
         if ($string === '') return false;
-        
+
         // munge rgb() decl if necessary
         $string = $this->mungeRgb($string);
-        
+
         // assumes URI doesn't have spaces in it
         $bits = explode(' ', strtolower($string)); // bits to process
-        
+
         $caught = array();
         $caught['color']    = false;
         $caught['image']    = false;
         $caught['repeat']   = false;
         $caught['attachment'] = false;
         $caught['position'] = false;
-        
+
         $i = 0; // number of catches
         $none = false;
-        
+
         foreach ($bits as $bit) {
             if ($bit === '') continue;
             foreach ($caught as $key => $status) {
@@ -64,23 +64,24 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
                 break;
             }
         }
-        
+
         if (!$i) return false;
         if ($caught['position'] !== false) {
             $caught['position'] = $this->info['background-position']->
                 validate($caught['position'], $config, $context);
         }
-        
+
         $ret = array();
         foreach ($caught as $value) {
             if ($value === false) continue;
             $ret[] = $value;
         }
-        
+
         if (empty($ret)) return false;
         return implode(' ', $ret);
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php

@@ -7,7 +7,7 @@
         [
             <percentage> | <length> | left | center | right
         ]
-        [ 
+        [
             <percentage> | <length> | top | center | bottom
         ]?
     ] |
@@ -28,10 +28,10 @@
 
 /* QuirksMode says:
     keyword + length/percentage must be ordered correctly, as per W3C
-    
+
     Internet Explorer and Opera, however, support arbitrary ordering. We
     should fix it up.
-    
+
     Minor issue though, not strictly necessary.
 */
 
@@ -43,27 +43,27 @@
  */
 class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
 {
-    
+
     protected $length;
     protected $percentage;
-    
+
     public function __construct() {
         $this->length     = new HTMLPurifier_AttrDef_CSS_Length();
         $this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage();
     }
-    
+
     public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
         $bits = explode(' ', $string);
-        
+
         $keywords = array();
         $keywords['h'] = false; // left, right
         $keywords['v'] = false; // top, bottom
         $keywords['c'] = false; // center
         $measures = array();
-        
+
         $i = 0;
-        
+
         $lookup = array(
             'top' => 'v',
             'bottom' => 'v',
@@ -71,10 +71,10 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
             'right' => 'h',
             'center' => 'c'
         );
-        
+
         foreach ($bits as $bit) {
             if ($bit === '') continue;
-            
+
             // test for keyword
             $lbit = ctype_lower($bit) ? $bit : strtolower($bit);
             if (isset($lookup[$lbit])) {
@@ -82,28 +82,28 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
                 $keywords[$status] = $lbit;
                 $i++;
             }
-            
+
             // test for length
             $r = $this->length->validate($bit, $config, $context);
             if ($r !== false) {
                 $measures[] = $r;
                 $i++;
             }
-            
+
             // test for percentage
             $r = $this->percentage->validate($bit, $config, $context);
             if ($r !== false) {
                 $measures[] = $r;
                 $i++;
             }
-            
+
         }
-        
+
         if (!$i) return false; // no valid values were caught
-        
+
-        
+
         $ret = array();
-        
+
         // first keyword
         if     ($keywords['h'])     $ret[] = $keywords['h'];
         elseif (count($measures))   $ret[] = array_shift($measures);
@@ -111,15 +111,16 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
             $ret[] = $keywords['c'];
             $keywords['c'] = false; // prevent re-use: center = center center
         }
-        
+
         if     ($keywords['v'])     $ret[] = $keywords['v'];
         elseif (count($measures))   $ret[] = array_shift($measures);
         elseif ($keywords['c'])     $ret[] = $keywords['c'];
-        
+
         if (empty($ret)) return false;
         return implode(' ', $ret);
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Border.php

@@ -5,19 +5,19 @@
  */
 class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Local copy of properties this property is shorthand for.
      */
     protected $info = array();
-    
+
     public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['border-width'] = $def->info['border-width'];
         $this->info['border-style'] = $def->info['border-style'];
         $this->info['border-top-color'] = $def->info['border-top-color'];
     }
-    
+
     public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
         $string = $this->mungeRgb($string);
@@ -37,6 +37,7 @@ class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef
         }
         return rtrim($ret);
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Color.php

@@ -5,18 +5,18 @@
  */
 class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
 {
-    
+
     public function validate($color, $config, $context) {
-        
+
         static $colors = null;
         if ($colors === null) $colors = $config->get('Core', 'ColorKeywords');
-        
+
         $color = trim($color);
         if ($color === '') return false;
-        
+
         $lower = strtolower($color);
         if (isset($colors[$lower])) return $colors[$lower];
-        
+
         if (strpos($color, 'rgb(') !== false) {
             // rgb literal handling
             $length = strlen($color);
@@ -68,10 +68,11 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
             if ($length !== 3 && $length !== 6) return false;
             if (!ctype_xdigit($hex)) return false;
         }
-        
+
         return $color;
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Composite.php

@@ -2,7 +2,7 @@
 
 /**
  * Allows multiple validators to attempt to validate attribute.
- * 
+ *
  * Composite is just what it sounds like: a composite of many validators.
  * This means that multiple HTMLPurifier_AttrDef objects will have a whack
  * at the string.  If one of them passes, that's what is returned.  This is
@@ -11,20 +11,20 @@
  */
 class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * List of HTMLPurifier_AttrDef objects that may process strings
      * @todo Make protected
      */
     public $defs;
-    
+
     /**
      * @param $defs List of HTMLPurifier_AttrDef objects
      */
     public function __construct($defs) {
         $this->defs = $defs;
     }
-    
+
     public function validate($string, $config, $context) {
         foreach ($this->defs as $i => $def) {
             $result = $this->defs[$i]->validate($string, $config, $context);
@@ -32,6 +32,7 @@ class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
         }
         return false;
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php

@@ -5,8 +5,8 @@
  */
 class HTMLPurifier_AttrDef_CSS_DenyElementDecorator extends HTMLPurifier_AttrDef
 {
-    protected $def, $element;
+    public $def, $element;
-    
+
     /**
      * @param $def Definition to wrap
      * @param $element Element to deny
@@ -24,3 +24,5 @@ class HTMLPurifier_AttrDef_CSS_DenyElementDecorator extends HTMLPurifier_AttrDef
         return $this->def->validate($string, $config, $context);
     }
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Filter.php

@@ -7,13 +7,13 @@
  */
 class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef
 {
-    
+
     protected $intValidator;
-    
+
     public function __construct() {
         $this->intValidator = new HTMLPurifier_AttrDef_Integer();
     }
-    
+
     public function validate($value, $config, $context) {
         $value = $this->parseCDATA($value);
         if ($value === 'none') return $value;
@@ -48,5 +48,7 @@ class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef
         $ret_function = "$function($ret_parameters)";
         return $ret_function;
     }
-    
+
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Font.php

@@ -5,17 +5,17 @@
  */
 class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Local copy of component validators.
-     * 
+     *
      * @note If we moved specific CSS property definitions to their own
      *       classes instead of having them be assembled at run time by
      *       CSSDefinition, this wouldn't be necessary.  We'd instantiate
      *       our own copies.
      */
     protected $info = array();
-    
+
     public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['font-style']   = $def->info['font-style'];
@@ -25,9 +25,9 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
         $this->info['line-height']  = $def->info['line-height'];
         $this->info['font-family']  = $def->info['font-family'];
     }
-    
+
     public function validate($string, $config, $context) {
-        
+
         static $system_fonts = array(
             'caption' => true,
             'icon' => true,
@@ -36,27 +36,27 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
             'small-caption' => true,
             'status-bar' => true
         );
-        
+
         // regular pre-processing
         $string = $this->parseCDATA($string);
         if ($string === '') return false;
-        
+
         // check if it's one of the keywords
         $lowercase_string = strtolower($string);
         if (isset($system_fonts[$lowercase_string])) {
             return $lowercase_string;
         }
-        
+
         $bits = explode(' ', $string); // bits to process
         $stage = 0; // this indicates what we're looking for
         $caught = array(); // which stage 0 properties have we caught?
         $stage_1 = array('font-style', 'font-variant', 'font-weight');
         $final = ''; // output
-        
+
         for ($i = 0, $size = count($bits); $i < $size; $i++) {
             if ($bits[$i] === '') continue;
             switch ($stage) {
-                
+
                 // attempting to catch font-style, font-variant or font-weight
                 case 0:
                     foreach ($stage_1 as $validator_name) {
@@ -72,7 +72,7 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
                     // all three caught, continue on
                     if (count($caught) >= 3) $stage = 1;
                     if ($r !== false) break;
-                
+
                 // attempting to catch font-size and perhaps line-height
                 case 1:
                     $found_slash = false;
@@ -126,7 +126,7 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
                         break;
                     }
                     return false;
-                
+
                 // attempting to catch font-family
                 case 2:
                     $font_family =
@@ -143,6 +143,7 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
         }
         return false;
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/FontFamily.php

@@ -6,7 +6,7 @@
  */
 class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
 {
-    
+
     public function validate($string, $config, $context) {
         static $generic_names = array(
             'serif' => true,
@@ -15,8 +15,7 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
             'fantasy' => true,
             'cursive' => true
         );
-        
+
-        $string = $this->parseCDATA($string);
         // assume that no font names contain commas in them
         $fonts = explode(',', $string);
         $final = '';
@@ -35,29 +34,57 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
                 $quote = $font[0];
                 if ($font[$length - 1] !== $quote) continue;
                 $font = substr($font, 1, $length - 2);
-                // double-backslash processing is buggy
+
-                $font = str_replace("\\$quote", $quote, $font); // de-escape quote
+                $new_font = '';
-                $font = str_replace("\\\n", "\n", $font);       // de-escape newlines
+                for ($i = 0, $c = strlen($font); $i < $c; $i++) {
+                    if ($font[$i] === '\\') {
+                        $i++;
+                        if ($i >= $c) {
+                            $new_font .= '\\';
+                            break;
+                        }
+                        if (ctype_xdigit($font[$i])) {
+                            $code = $font[$i];
+                            for ($a = 1, $i++; $i < $c && $a < 6; $i++, $a++) {
+                                if (!ctype_xdigit($font[$i])) break;
+                                $code .= $font[$i];
+                            }
+                            // We have to be extremely careful when adding
+                            // new characters, to make sure we're not breaking
+                            // the encoding.
+                            $char = HTMLPurifier_Encoder::unichr(hexdec($code));
+                            if (HTMLPurifier_Encoder::cleanUTF8($char) === '') continue;
+                            $new_font .= $char;
+                            if ($i < $c && trim($font[$i]) !== '') $i--;
+                            continue;
+                        }
+                        if ($font[$i] === "\n") continue;
+                    }
+                    $new_font .= $font[$i];
+                }
+
+                $font = $new_font;
             }
             // $font is a pure representation of the font name
-            
+
-            if (ctype_alnum($font)) {
+            if (ctype_alnum($font) && $font !== '') {
                 // very simple font, allow it in unharmed
                 $final .= $font . ', ';
                 continue;
             }
-            
+
             // complicated font, requires quoting
-            
+
             // armor single quotes and new lines
+            $font = str_replace("\\", "\\\\", $font);
             $font = str_replace("'", "\\'", $font);
-            $font = str_replace("\n", "\\\n", $font);
             $final .= "'$font', ";
         }
         $final = rtrim($final, ', ');
         if ($final === '') return false;
         return $final;
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php

@@ -5,8 +5,8 @@
  */
 class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef
 {
-    protected $def, $allow;
+    public $def, $allow;
-    
+
     /**
      * @param $def Definition to wrap
      * @param $allow Whether or not to allow !important
@@ -36,3 +36,5 @@ class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef
         return $string;
     }
 }
+
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Length.php

@@ -5,48 +5,43 @@
  */
 class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
 {
-    
+
+    protected $min, $max;
+
     /**
-     * Valid unit lookup table.
+     * @param HTMLPurifier_Length $max Minimum length, or null for no bound. String is also acceptable.
-     * @warning The code assumes all units are two characters long.  Be careful
+     * @param HTMLPurifier_Length $max Maximum length, or null for no bound. String is also acceptable.
-     *          if we have to change this behavior!
      */
-    protected $units = array('em' => true, 'ex' => true, 'px' => true, 'in' => true,
+    public function __construct($min = null, $max = null) {
-         'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true);
+        $this->min = $min !== null ? HTMLPurifier_Length::make($min) : null;
-    /**
+        $this->max = $max !== null ? HTMLPurifier_Length::make($max) : null;
-     * Instance of HTMLPurifier_AttrDef_Number to defer number validation to
-     */
-    protected $number_def;
-    
-    /**
-     * @param $non_negative Bool indication whether or not negative values are
-     *                      allowed.
-     */
-    public function __construct($non_negative = false) {
-        $this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
     }
-    
+
-    public function validate($length, $config, $context) {
+    public function validate($string, $config, $context) {
-        
+        $string = $this->parseCDATA($string);
-        $length = $this->parseCDATA($length);
+
-        if ($length === '') return false;
+        // Optimizations
-        if ($length === '0') return '0';
+        if ($string === '') return false;
-        $strlen = strlen($length);
+        if ($string === '0') return '0';
-        if ($strlen === 1) return false; // impossible!
+        if (strlen($string) === 1) return false;
-        
+
-        // we assume all units are two characters
+        $length = HTMLPurifier_Length::make($string);
-        $unit = substr($length, $strlen - 2);
+        if (!$length->isValid()) return false;
-        if (!ctype_lower($unit)) $unit = strtolower($unit);
+
-        $number = substr($length, 0, $strlen - 2);
+        if ($this->min) {
-        
+            $c = $length->compareTo($this->min);
-        if (!isset($this->units[$unit])) return false;
+            if ($c === false) return false;
-        
+            if ($c < 0) return false;
-        $number = $this->number_def->validate($number, $config, $context);
+        }
-        if ($number === false) return false;
+        if ($this->max) {
-        
+            $c = $length->compareTo($this->max);
-        return $number . $unit;
+            if ($c === false) return false;
-        
+            if ($c > 0) return false;
+        }
+
+        return $length->toString();
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/ListStyle.php

@@ -6,37 +6,37 @@
  */
 class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Local copy of component validators.
      * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
      */
     protected $info;
-    
+
     public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['list-style-type']     = $def->info['list-style-type'];
         $this->info['list-style-position'] = $def->info['list-style-position'];
         $this->info['list-style-image'] = $def->info['list-style-image'];
     }
-    
+
     public function validate($string, $config, $context) {
-        
+
         // regular pre-processing
         $string = $this->parseCDATA($string);
         if ($string === '') return false;
-        
+
         // assumes URI doesn't have spaces in it
         $bits = explode(' ', strtolower($string)); // bits to process
-        
+
         $caught = array();
         $caught['type']     = false;
         $caught['position'] = false;
         $caught['image']    = false;
-        
+
         $i = 0; // number of catches
         $none = false;
-        
+
         foreach ($bits as $bit) {
             if ($i >= 3) return; // optimization bit
             if ($bit === '') continue;
@@ -54,24 +54,25 @@ class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
                 break;
             }
         }
-        
+
         if (!$i) return false;
-        
+
         $ret = array();
-        
+
         // construct type
         if ($caught['type']) $ret[] = $caught['type'];
-        
+
         // construct image
         if ($caught['image']) $ret[] = $caught['image'];
-        
+
         // construct position
         if ($caught['position']) $ret[] = $caught['position'];
-        
+
         if (empty($ret)) return false;
         return implode(' ', $ret);
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Multiple.php

@@ -2,30 +2,30 @@
 
 /**
  * Framework class for strings that involve multiple values.
- * 
+ *
  * Certain CSS properties such as border-width and margin allow multiple
  * lengths to be specified.  This class can take a vanilla border-width
  * definition and multiply it, usually into a max of four.
- * 
+ *
  * @note Even though the CSS specification isn't clear about it, inherit
  *       can only be used alone: it will never manifest as part of a multi
  *       shorthand declaration.  Thus, this class does not allow inherit.
  */
 class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Instance of component definition to defer validation to.
      * @todo Make protected
      */
     public $single;
-    
+
     /**
      * Max number of values allowed.
      * @todo Make protected
      */
     public $max;
-    
+
     /**
      * @param $single HTMLPurifier_AttrDef to multiply
      * @param $max Max number of values allowed (usually four)
@@ -34,7 +34,7 @@ class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
         $this->single = $single;
         $this->max = $max;
     }
-    
+
     public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
         if ($string === '') return false;
@@ -52,6 +52,7 @@ class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
         if ($final === '') return false;
         return rtrim($final);
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Number.php

@@ -5,26 +5,30 @@
  */
 class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Bool indicating whether or not only positive values allowed.
      */
     protected $non_negative = false;
-    
+
     /**
      * @param $non_negative Bool indicating whether negatives are forbidden
      */
     public function __construct($non_negative = false) {
         $this->non_negative = $non_negative;
     }
-    
+
+    /**
+     * @warning Some contexts do not pass $config, $context. These
+     *          variables should not be used without checking HTMLPurifier_Length
+     */
     public function validate($number, $config, $context) {
-        
+
         $number = $this->parseCDATA($number);
-        
+
         if ($number === '') return false;
         if ($number === '0') return '0';
-        
+
         $sign = '';
         switch ($number[0]) {
             case '-':
@@ -33,32 +37,33 @@ class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
             case '+':
                 $number = substr($number, 1);
         }
-        
+
         if (ctype_digit($number)) {
             $number = ltrim($number, '0');
             return $number ? $sign . $number : '0';
         }
-        
+
         // Period is the only non-numeric character allowed
         if (strpos($number, '.') === false) return false;
-        
+
         list($left, $right) = explode('.', $number, 2);
-        
+
         if ($left === '' && $right === '') return false;
         if ($left !== '' && !ctype_digit($left)) return false;
-        
+
         $left  = ltrim($left,  '0');
         $right = rtrim($right, '0');
-        
+
         if ($right === '') {
             return $left ? $sign . $left : '0';
         } elseif (!ctype_digit($right)) {
             return false;
         }
-        
+
         return $sign . $left . '.' . $right;
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/Percentage.php

@@ -5,35 +5,36 @@
  */
 class HTMLPurifier_AttrDef_CSS_Percentage extends HTMLPurifier_AttrDef
 {
-    
+
     /**
      * Instance of HTMLPurifier_AttrDef_CSS_Number to defer number validation
      */
     protected $number_def;
-    
+
     /**
      * @param Bool indicating whether to forbid negative values
      */
     public function __construct($non_negative = false) {
         $this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
     }
-    
+
     public function validate($string, $config, $context) {
-        
+
         $string = $this->parseCDATA($string);
-        
+
         if ($string === '') return false;
         $length = strlen($string);
         if ($length === 1) return false;
         if ($string[$length - 1] !== '%') return false;
-        
+
         $number = substr($string, 0, $length - 1);
         $number = $this->number_def->validate($number, $config, $context);
-        
+
         if ($number === false) return false;
         return "$number%";
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4

library/HTMLPurifier/AttrDef/CSS/TextDecoration.php

@@ -7,16 +7,19 @@
  */
 class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
 {
-    
+
     public function validate($string, $config, $context) {
-        
+
         static $allowed_values = array(
             'line-through' => true,
             'overline' => true,
-            'underline' => true
+            'underline' => true,
         );
-        
+
         $string = strtolower($this->parseCDATA($string));
+
+        if ($string === 'none') return $string;
+
         $parts = explode(' ', $string);
         $final = '';
         foreach ($parts as $part) {
@@ -27,8 +30,9 @@ class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
         $final = rtrim($final);
         if ($final === '') return false;
         return $final;
-        
+
     }
-    
+
 }
 
+// vim: et sw=4 sts=4