chore(release): 4.18.0 [skip ci]

# [4.18.0](https://github.com/ezyang/htmlpurifier/compare/v4.17.0...v4.18.0) (2024-11-01) ### Bug Fixes * Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 ([#406](https://github.com/ezyang/htmlpurifier/issues/406)) ([d9fbef8](d9fbef8e27)) * Avoid a deprecated error when the attribute name is numeric and DirectLex is used ([#412](https://github.com/ezyang/htmlpurifier/issues/412)) ([f0fbf51](f0fbf51098)) * checking that node has property name ([#399](https://github.com/ezyang/htmlpurifier/issues/399)) ([9ca5a36](9ca5a3687b)) * Ignore conditional comments ([#401](https://github.com/ezyang/htmlpurifier/issues/401)) ([4828fdf](4828fdf45a)) * Support PHP 8.4 ([#396](https://github.com/ezyang/htmlpurifier/issues/396)) ([92da247](92da2473ff)) * undefined array key warning ([#419](https://github.com/ezyang/htmlpurifier/issues/419)) ([01be377](01be377f93)) ### Features * Add allowfullscreen attr for iframe ([#411](https://github.com/ezyang/htmlpurifier/issues/411)) ([70754a2](70754a2533)) * add directive for removing blank nodes ([#404](https://github.com/ezyang/htmlpurifier/issues/404)) ([c9d60c9](c9d60c96d7)) * Add support for CSS aspect-ratio ([#408](https://github.com/ezyang/htmlpurifier/issues/408)) ([93bee73](93bee73349)) * Allow universal CSS values for all properties ([#410](https://github.com/ezyang/htmlpurifier/issues/410)) ([9723267](972326785d))
fix: undefined array key warning (#419 )
2025-08-02 20:27:40 +02:00 · 2024-11-01 03:51:45 +00:00 · 2024-10-30 22:57:29 -04:00 · 2024-07-30 22:06:23 -04:00 · 2024-06-30 07:54:09 -04:00 · 2024-06-28 08:37:00 -04:00
33 changed files with 299 additions and 114 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
    strategy:
      fail-fast: true
      matrix:
-        php: ['5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3']
+        php: ['5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4']

    name: PHP ${{ matrix.php }}

--- a/2
+++ b/2
@@ -31,7 +31,7 @@ PROJECT_NAME           = HTMLPurifier
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         = 4.17.0
+PROJECT_NUMBER         = 4.18.0

 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
 # base path where the generated documentation will be put.
--- a/20
+++ b/20
@@ -1,3 +1,23 @@
+# [4.18.0](https://github.com/ezyang/htmlpurifier/compare/v4.17.0...v4.18.0) (2024-11-01)
+
+
+### Bug Fixes
+
+* Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 ([#406](https://github.com/ezyang/htmlpurifier/issues/406)) ([d9fbef8](https://github.com/ezyang/htmlpurifier/commit/d9fbef8e27f6a0848a8987a8534351de98eb0fa1))
+* Avoid a deprecated error when the attribute name is numeric and DirectLex is used ([#412](https://github.com/ezyang/htmlpurifier/issues/412)) ([f0fbf51](https://github.com/ezyang/htmlpurifier/commit/f0fbf510981b27fc03168efdb17d6bff48f521af))
+* checking that node has property name ([#399](https://github.com/ezyang/htmlpurifier/issues/399)) ([9ca5a36](https://github.com/ezyang/htmlpurifier/commit/9ca5a3687bd2e6e42ed9d5199b2cfb1dbd6dbdc2))
+* Ignore conditional comments ([#401](https://github.com/ezyang/htmlpurifier/issues/401)) ([4828fdf](https://github.com/ezyang/htmlpurifier/commit/4828fdf45a93eeeacfcbcc855f96f9a7e6b4ed44))
+* Support PHP 8.4 ([#396](https://github.com/ezyang/htmlpurifier/issues/396)) ([92da247](https://github.com/ezyang/htmlpurifier/commit/92da2473ffbb3ed5e894560d4166b1ca8032aeb3))
+* undefined array key warning ([#419](https://github.com/ezyang/htmlpurifier/issues/419)) ([01be377](https://github.com/ezyang/htmlpurifier/commit/01be377f93654fad4d3fbc8c81779f14316eaecf))
+
+
+### Features
+
+* Add allowfullscreen attr for iframe ([#411](https://github.com/ezyang/htmlpurifier/issues/411)) ([70754a2](https://github.com/ezyang/htmlpurifier/commit/70754a253342f67a67425cfa81029db3a5c1bd28))
+* add directive for removing blank nodes ([#404](https://github.com/ezyang/htmlpurifier/issues/404)) ([c9d60c9](https://github.com/ezyang/htmlpurifier/commit/c9d60c96d799c02bc357c88a49f422034b6914fd))
+* Add support for CSS aspect-ratio ([#408](https://github.com/ezyang/htmlpurifier/issues/408)) ([93bee73](https://github.com/ezyang/htmlpurifier/commit/93bee733497a098b65daf5910f1c435d347860a4))
+* Allow universal CSS values for all properties ([#410](https://github.com/ezyang/htmlpurifier/issues/410)) ([9723267](https://github.com/ezyang/htmlpurifier/commit/972326785d201b81e1095bc296b99bbcfa8c7fd4))
+
 # [4.17.0](https://github.com/ezyang/htmlpurifier/compare/v4.16.0...v4.17.0) (2023-11-17)


--- a/2
+++ b/2
@@ -1 +1 @@
-4.17.0
+4.18.0
--- a/composer.json
+++ b/composer.json
@@ -13,7 +13,7 @@
        }
    ],
    "require": {
-        "php": "~5.6.0 || ~7.0.0 || ~7.1.0 || ~7.2.0 || ~7.3.0 || ~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0"
+        "php": "~5.6.0 || ~7.0.0 || ~7.1.0 || ~7.2.0 || ~7.3.0 || ~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0"
    },
    "require-dev": {
        "cerdic/css-tidy": "^1.7 || ^2.0",
--- a/configdoc/usage.xml
+++ b/configdoc/usage.xml
@@ -6,7 +6,7 @@
  </file>
  <file name="HTMLPurifier/Lexer.php">
   <line>90</line>
-   <line>331</line>
+   <line>315</line>
  </file>
  <file name="HTMLPurifier/Lexer/DirectLex.php">
   <line>67</line>
@@ -19,37 +19,37 @@
 </directive>
 <directive id="CSS.MaxImgLength">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>256</line>
+   <line>253</line>
  </file>
 </directive>
 <directive id="CSS.Proprietary">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>398</line>
+   <line>397</line>
  </file>
 </directive>
 <directive id="CSS.AllowTricky">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>402</line>
+   <line>401</line>
  </file>
 </directive>
 <directive id="CSS.Trusted">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>406</line>
+   <line>405</line>
  </file>
 </directive>
 <directive id="CSS.AllowImportant">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>410</line>
+   <line>409</line>
  </file>
 </directive>
 <directive id="CSS.AllowedProperties">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>539</line>
+   <line>538</line>
  </file>
 </directive>
 <directive id="CSS.ForbiddenProperties">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>555</line>
+   <line>554</line>
  </file>
 </directive>
 <directive id="Cache.DefinitionImpl">
@@ -124,7 +124,7 @@
   <line>122</line>
  </file>
  <file name="HTMLPurifier/Lexer.php">
-   <line>313</line>
+   <line>299</line>
  </file>
 </directive>
 <directive id="Output.Newline">
@@ -172,12 +172,15 @@
   <line>234</line>
  </file>
  <file name="HTMLPurifier/Lexer.php">
-   <line>318</line>
-   <line>358</line>
+   <line>304</line>
+   <line>342</line>
  </file>
  <file name="HTMLPurifier/AttrDef/HTML/ContentEditable.php">
   <line>8</line>
  </file>
+  <file name="HTMLPurifier/HTMLModule/Iframe.php">
+   <line>43</line>
+  </file>
  <file name="HTMLPurifier/HTMLModule/Image.php">
   <line>37</line>
  </file>
@@ -267,22 +270,22 @@
 <directive id="Core.LegacyEntityDecoder">
  <file name="HTMLPurifier/Lexer.php">
   <line>220</line>
-   <line>342</line>
+   <line>326</line>
  </file>
 </directive>
 <directive id="Core.ConvertDocumentToFragment">
  <file name="HTMLPurifier/Lexer.php">
-   <line>329</line>
+   <line>313</line>
  </file>
 </directive>
 <directive id="Core.RemoveProcessingInstructions">
  <file name="HTMLPurifier/Lexer.php">
-   <line>352</line>
+   <line>336</line>
  </file>
 </directive>
 <directive id="Core.HiddenElements">
  <file name="HTMLPurifier/Lexer.php">
-   <line>356</line>
+   <line>340</line>
  </file>
  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
   <line>36</line>
@@ -290,12 +293,12 @@
 </directive>
 <directive id="Core.AggressivelyRemoveScript">
  <file name="HTMLPurifier/Lexer.php">
-   <line>357</line>
+   <line>341</line>
  </file>
 </directive>
 <directive id="Core.RemoveScriptContents">
  <file name="HTMLPurifier/Lexer.php">
-   <line>358</line>
+   <line>342</line>
  </file>
  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
   <line>35</line>
@@ -408,12 +411,12 @@
 </directive>
 <directive id="Core.AllowHostnameUnderscore">
  <file name="HTMLPurifier/AttrDef/URI/Host.php">
-   <line>77</line>
+   <line>71</line>
  </file>
 </directive>
 <directive id="Core.EnableIDNA">
  <file name="HTMLPurifier/AttrDef/URI/Host.php">
-   <line>109</line>
+   <line>103</line>
  </file>
 </directive>
 <directive id="Attr.DefaultTextDir">
@@ -470,17 +473,17 @@
 </directive>
 <directive id="Filter.ExtractStyleBlocks.TidyImpl">
  <file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
-   <line>94</line>
+   <line>106</line>
  </file>
 </directive>
 <directive id="Filter.ExtractStyleBlocks.Scope">
  <file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
-   <line>125</line>
+   <line>137</line>
  </file>
 </directive>
 <directive id="Filter.ExtractStyleBlocks.Escaping">
  <file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
-   <line>334</line>
+   <line>351</line>
  </file>
 </directive>
 <directive id="HTML.Forms">
@@ -552,6 +555,11 @@
   <line>72</line>
  </file>
 </directive>
+ <directive id="Core.RemoveBlanks">
+  <file name="HTMLPurifier/Lexer/DOMLex.php">
+   <line>75</line>
+  </file>
+ </directive>
 <directive id="Core.DirectLexLineNumberSyncInterval">
  <file name="HTMLPurifier/Lexer/DirectLex.php">
   <line>84</line>
--- a/library/HTMLPurifier.includes.php
+++ b/library/HTMLPurifier.includes.php
@@ -7,7 +7,7 @@
 * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
 * FILE, changes will be overwritten the next time the script is run.
 *
- * @version 4.17.0
+ * @version 4.18.0
 *
 * @warning
 *      You must *not* include any other HTML Purifier files before this file,
@@ -101,6 +101,7 @@ require 'HTMLPurifier/AttrDef/CSS/Length.php';
 require 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
 require 'HTMLPurifier/AttrDef/CSS/Multiple.php';
 require 'HTMLPurifier/AttrDef/CSS/Percentage.php';
+require 'HTMLPurifier/AttrDef/CSS/Ratio.php';
 require 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
 require 'HTMLPurifier/AttrDef/CSS/URI.php';
 require 'HTMLPurifier/AttrDef/HTML/Bool.php';
--- a/library/HTMLPurifier.php
+++ b/library/HTMLPurifier.php
@@ -19,7 +19,7 @@
 */

 /*
-    HTML Purifier 4.17.0 - Standards Compliant HTML Filtering
+    HTML Purifier 4.18.0 - Standards Compliant HTML Filtering
    Copyright (C) 2006-2008 Edward Z. Yang

    This library is free software; you can redistribute it and/or
@@ -58,12 +58,12 @@ class HTMLPurifier
     * Version of HTML Purifier.
     * @type string
     */
-    public $version = '4.17.0';
+    public $version = '4.18.0';

    /**
     * Constant with version of HTML Purifier.
     */
-    const VERSION = '4.17.0';
+    const VERSION = '4.18.0';

    /**
     * Global configuration object.
--- a/library/HTMLPurifier.safe-includes.php
+++ b/library/HTMLPurifier.safe-includes.php
@@ -95,6 +95,7 @@ require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Length.php';
 require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ListStyle.php';
 require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Multiple.php';
 require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Percentage.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Ratio.php';
 require_once $__dir . '/HTMLPurifier/AttrDef/CSS/TextDecoration.php';
 require_once $__dir . '/HTMLPurifier/AttrDef/CSS/URI.php';
 require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
--- a/library/HTMLPurifier/AttrDef/CSS.php
+++ b/library/HTMLPurifier/AttrDef/CSS.php
@@ -27,6 +27,13 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
        $definition = $config->getCSSDefinition();
        $allow_duplicates = $config->get("CSS.AllowDuplicates");

+        $universal_attrdef = new HTMLPurifier_AttrDef_Enum(
+            array(
+                'initial',
+                'inherit',
+                'unset',
+            )
+        );

        // According to the CSS2.1 spec, the places where a
        // non-delimiting semicolon can appear are in strings
@@ -96,16 +103,13 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
            if (!$ok) {
                continue;
            }
-            // inefficient call, since the validator will do this again
-            if (strtolower(trim($value)) !== 'inherit') {
-                // inherit works for everything (but only on the base property)
+            $result = $universal_attrdef->validate($value, $config, $context);
+            if ($result === false) {
                $result = $definition->info[$property]->validate(
                    $value,
                    $config,
                    $context
                );
-            } else {
-                $result = 'inherit';
            }
            if ($result === false) {
                continue;
--- a/library/HTMLPurifier/AttrDef/CSS/Ratio.php
+++ b/library/HTMLPurifier/AttrDef/CSS/Ratio.php
@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * Validates a ratio as defined by the CSS spec.
+ */
+class HTMLPurifier_AttrDef_CSS_Ratio extends HTMLPurifier_AttrDef
+{
+    /**
+     * @param   string               $ratio   Ratio to validate
+     * @param   HTMLPurifier_Config  $config  Configuration options
+     * @param   HTMLPurifier_Context $context Context
+     *
+     * @return  string|boolean
+     *
+     * @warning Some contexts do not pass $config, $context. These
+     *          variables should not be used without checking HTMLPurifier_Length
+     */
+    public function validate($ratio, $config, $context)
+    {
+        $ratio = $this->parseCDATA($ratio);
+
+        $parts = explode('/', $ratio, 2);
+        $length = count($parts);
+
+        if ($length < 1 || $length > 2) {
+            return false;
+        }
+
+        $num = new \HTMLPurifier_AttrDef_CSS_Number();
+
+        if ($length === 1) {
+            return $num->validate($parts[0], $config, $context);
+        }
+
+        $num1 = $num->validate($parts[0], $config, $context);
+        $num2 = $num->validate($parts[1], $config, $context);
+
+        if ($num1 === false || $num2 === false) {
+            return false;
+        }
+
+        return $num1 . '/' . $num2;
+    }
+}
+
+// vim: et sw=4 sts=4
--- a/library/HTMLPurifier/AttrDef/URI/Host.php
+++ b/library/HTMLPurifier/AttrDef/URI/Host.php
@@ -63,24 +63,18 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
        // This doesn't match I18N domain names, but we don't have proper IRI support,
        // so force users to insert Punycode.

-        // There is not a good sense in which underscores should be
-        // allowed, since it's technically not! (And if you go as
-        // far to allow everything as specified by the DNS spec...
-        // well, that's literally everything, modulo some space limits
-        // for the components and the overall name (which, by the way,
-        // we are NOT checking!).  So we (arbitrarily) decide this:
-        // let's allow underscores wherever we would have allowed
-        // hyphens, if they are enabled.  This is a pretty good match
-        // for browser behavior, for example, a large number of browsers
-        // cannot handle foo_.example.com, but foo_bar.example.com is
-        // fairly well supported.
+        // Underscores defined as Unreserved Characters in RFC 3986 are
+        // allowed in a URI. There are cases where we want to consider a
+        // URI containing "_" such as "_dmarc.example.com".
+        // Underscores are not allowed in the default. If you want to
+        // allow it, set Core.AllowHostnameUnderscore to true.
        $underscore = $config->get('Core.AllowHostnameUnderscore') ? '_' : '';

        // Based off of RFC 1738, but amended so that
        // as per RFC 3696, the top label need only not be all numeric.
        // The productions describing this are:
        $a   = '[a-z]';     // alpha
-        $an  = '[a-z0-9]';  // alphanum
+        $an  = "[a-z0-9$underscore]";  // alphanum
        $and = "[a-z0-9-$underscore]"; // alphanum | "-"
        // domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
        $domainlabel = "$an(?:$and*$an)?";
--- a/library/HTMLPurifier/CSSDefinition.php
+++ b/library/HTMLPurifier/CSSDefinition.php
@@ -116,8 +116,6 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
                        'auto',
                        'cover',
                        'contain',
-                        'initial',
-                        'inherit',
                    ]
                ),
                new HTMLPurifier_AttrDef_CSS_Percentage(),
@@ -236,21 +234,20 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
            [
                new HTMLPurifier_AttrDef_CSS_Length('0'),
                new HTMLPurifier_AttrDef_CSS_Percentage(true),
-                new HTMLPurifier_AttrDef_Enum(['auto', 'initial', 'inherit'])
+                new HTMLPurifier_AttrDef_Enum(['auto'])
            ]
        );
        $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite(
            [
                new HTMLPurifier_AttrDef_CSS_Length('0'),
                new HTMLPurifier_AttrDef_CSS_Percentage(true),
-                new HTMLPurifier_AttrDef_Enum(['initial', 'inherit'])
            ]
        );
        $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite(
            [
                new HTMLPurifier_AttrDef_CSS_Length('0'),
                new HTMLPurifier_AttrDef_CSS_Percentage(true),
-                new HTMLPurifier_AttrDef_Enum(['none', 'initial', 'inherit'])
+                new HTMLPurifier_AttrDef_Enum(['none'])
            ]
        );
        $max = $config->get('CSS.MaxImgLength');
@@ -278,12 +275,7 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
                new HTMLPurifier_AttrDef_Switch(
                    'img',
                    // For img tags:
-                    new HTMLPurifier_AttrDef_CSS_Composite(
-                        [
-                            new HTMLPurifier_AttrDef_CSS_Length('0', $max),
-                            new HTMLPurifier_AttrDef_Enum(['initial', 'inherit'])
-                        ]
-                    ),
+                    new HTMLPurifier_AttrDef_CSS_Length('0', $max),
                    // For everyone else:
                    $trusted_min_wh
                );
@@ -297,22 +289,29 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
                    new HTMLPurifier_AttrDef_CSS_Composite(
                        [
                            new HTMLPurifier_AttrDef_CSS_Length('0', $max),
-                            new HTMLPurifier_AttrDef_Enum(['none', 'initial', 'inherit'])
+                            new HTMLPurifier_AttrDef_Enum(['none'])
                        ]
                    ),
                    // For everyone else:
                    $trusted_max_wh
                );

+        $this->info['aspect-ratio'] = new HTMLPurifier_AttrDef_CSS_Multiple(
+            new HTMLPurifier_AttrDef_CSS_Composite([
+                new HTMLPurifier_AttrDef_CSS_Ratio(),
+                new HTMLPurifier_AttrDef_Enum(['auto']),
+            ])
+        );
+
        // text-decoration and related shorthands
        $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();

        $this->info['text-decoration-line'] = new HTMLPurifier_AttrDef_Enum(
-            ['none', 'underline', 'overline', 'line-through', 'initial', 'inherit']
+            ['none', 'underline', 'overline', 'line-through']
        );

        $this->info['text-decoration-style'] = new HTMLPurifier_AttrDef_Enum(
-            ['solid', 'double', 'dotted', 'dashed', 'wavy', 'initial', 'inherit']
+            ['solid', 'double', 'dotted', 'dashed', 'wavy']
        );

        $this->info['text-decoration-color'] = new HTMLPurifier_AttrDef_CSS_Color();
@@ -320,7 +319,7 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
        $this->info['text-decoration-thickness'] = new HTMLPurifier_AttrDef_CSS_Composite([
            new HTMLPurifier_AttrDef_CSS_Length(),
            new HTMLPurifier_AttrDef_CSS_Percentage(),
-            new HTMLPurifier_AttrDef_Enum(['auto', 'from-font', 'initial', 'inherit'])
+            new HTMLPurifier_AttrDef_Enum(['auto', 'from-font'])
        ]);

        $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
--- a/library/HTMLPurifier/ChildDef/Table.php
+++ b/library/HTMLPurifier/ChildDef/Table.php
@@ -190,6 +190,9 @@ class HTMLPurifier_ChildDef_Table extends HTMLPurifier_ChildDef
            $current_tr_tbody = null;

            foreach($content as $node) {
+                if (!isset($node->name)) {
+                    continue;
+                }
                switch ($node->name) {
                case 'tbody':
                    $current_tr_tbody = null;
--- a/library/HTMLPurifier/Config.php
+++ b/library/HTMLPurifier/Config.php
@@ -21,7 +21,7 @@ class HTMLPurifier_Config
     * HTML Purifier's version
     * @type string
     */
-    public $version = '4.17.0';
+    public $version = '4.18.0';

    /**
     * Whether or not to automatically finalize
--- a/library/HTMLPurifier/ConfigSchema/schema.ser
+++ b/library/HTMLPurifier/ConfigSchema/schema.ser
--- a/library/HTMLPurifier/ConfigSchema/schema/Core.RemoveBlanks.txt
+++ b/library/HTMLPurifier/ConfigSchema/schema/Core.RemoveBlanks.txt
@@ -0,0 +1,10 @@
+Core.RemoveBlanks
+TYPE: bool
+DEFAULT: false
+VERSION: 4.18
+--DESCRIPTION--
+<p>
+    If set to true, blank nodes will be removed. This can be useful for maintaining
+    backwards compatibility when upgrading from previous versions of PHP.
+</p>
+--# vim: et sw=4 sts=4
--- a/library/HTMLPurifier/EntityParser.php
+++ b/library/HTMLPurifier/EntityParser.php
@@ -116,8 +116,8 @@ class HTMLPurifier_EntityParser
    protected function entityCallback($matches)
    {
        $entity = $matches[0];
-        $hex_part = @$matches[1];
-        $dec_part = @$matches[2];
+        $hex_part = isset($matches[1]) ? $matches[1] : null;
+        $dec_part = isset($matches[2]) ? $matches[2] : null;
        $named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3];
        if ($hex_part !== NULL && $hex_part !== "") {
            return HTMLPurifier_Encoder::unichr(hexdec($hex_part));
--- a/library/HTMLPurifier/Filter/ExtractStyleBlocks.php
+++ b/library/HTMLPurifier/Filter/ExtractStyleBlocks.php
@@ -54,6 +54,11 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
     */
    private $_enum_attrdef;

+    /**
+     * @type HTMLPurifier_AttrDef_Enum
+     */
+    private $_universal_attrdef;
+
    public function __construct()
    {
        $this->_tidy = new csstidy();
@@ -70,6 +75,13 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
                'focus'
            )
        );
+        $this->_universal_attrdef = new HTMLPurifier_AttrDef_Enum(
+            array(
+                'initial',
+                'inherit',
+                'unset',
+            )
+        );
    }

    /**
@@ -307,6 +319,11 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
                            unset($style[$name]);
                            continue;
                        }
+                        $uni_ret = $this->_universal_attrdef->validate($value, $config, $context);
+                        if ($uni_ret !== false) {
+                            $style[$name] = $uni_ret;
+                            continue;
+                        }
                        $def = $css_definition->info[$name];
                        $ret = $def->validate($value, $config, $context);
                        if ($ret === false) {
--- a/library/HTMLPurifier/HTMLModule/Iframe.php
+++ b/library/HTMLPurifier/HTMLModule/Iframe.php
@@ -28,22 +28,28 @@ class HTMLPurifier_HTMLModule_Iframe extends HTMLPurifier_HTMLModule
        if ($config->get('HTML.SafeIframe')) {
            $this->safe = true;
        }
+        $attrs = array(
+            'src' => 'URI#embedded',
+            'width' => 'Length',
+            'height' => 'Length',
+            'name' => 'ID',
+            'scrolling' => 'Enum#yes,no,auto',
+            'frameborder' => 'Enum#0,1',
+            'longdesc' => 'URI',
+            'marginheight' => 'Pixels',
+            'marginwidth' => 'Pixels',
+        );
+
+        if ($config->get('HTML.Trusted')) {
+            $attrs['allowfullscreen'] = 'Bool#allowfullscreen';
+        }
+
        $this->addElement(
            'iframe',
            'Inline',
            'Flow',
            'Common',
-            array(
-                'src' => 'URI#embedded',
-                'width' => 'Length',
-                'height' => 'Length',
-                'name' => 'ID',
-                'scrolling' => 'Enum#yes,no,auto',
-                'frameborder' => 'Enum#0,1',
-                'longdesc' => 'URI',
-                'marginheight' => 'Pixels',
-                'marginwidth' => 'Pixels',
-            )
+            $attrs
        );
    }
 }
--- a/library/HTMLPurifier/Lexer.php
+++ b/library/HTMLPurifier/Lexer.php
@@ -269,20 +269,6 @@ class HTMLPurifier_Lexer
        );
    }

-    /**
-     * Special Internet Explorer conditional comments should be removed.
-     * @param string $string HTML string to process.
-     * @return string HTML with conditional comments removed.
-     */
-    protected static function removeIEConditional($string)
-    {
-        return preg_replace(
-            '#<!--\[if [^>]+\]>.*?<!\[endif\]-->#si', // probably should generalize for all strings
-            '',
-            $string
-        );
-    }
-
    /**
     * Callback function for escapeCDATA() that does the work.
     *
@@ -323,8 +309,6 @@ class HTMLPurifier_Lexer
        // escape CDATA
        $html = $this->escapeCDATA($html);

-        $html = $this->removeIEConditional($html);
-
        // extract body from document if applicable
        if ($config->get('Core.ConvertDocumentToFragment')) {
            $e = false;
--- a/library/HTMLPurifier/Lexer/DOMLex.php
+++ b/library/HTMLPurifier/Lexer/DOMLex.php
@@ -72,6 +72,9 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
        if ($config->get('Core.AllowParseManyTags') && defined('LIBXML_PARSEHUGE')) {
            $options |= LIBXML_PARSEHUGE;
        }
+        if ($config->get('Core.RemoveBlanks') && defined('LIBXML_NOBLANKS')) {
+            $options |= LIBXML_NOBLANKS;
+        }

        set_error_handler(array($this, 'muteErrorHandler'));
        // loadHTML() fails on PHP 5.3 when second parameter is given
--- a/library/HTMLPurifier/Token/Tag.php
+++ b/library/HTMLPurifier/Token/Tag.php
@@ -44,7 +44,7 @@ abstract class HTMLPurifier_Token_Tag extends HTMLPurifier_Token
        $this->name = ctype_lower($name) ? $name : strtolower($name);
        foreach ($attr as $key => $value) {
            // normalization only necessary when key is not lowercase
-            if (!ctype_lower($key)) {
+            if (!ctype_lower((string)$key)) {
                $new_key = strtolower($key);
                if (!isset($attr[$new_key])) {
                    $attr[$new_key] = $attr[$key];
--- a/plugins/phorum/config.default.php
+++ b/plugins/phorum/config.default.php
@@ -54,5 +54,6 @@ if (strtolower($GLOBALS['PHORUM']['DATA']['CHARSET']) !== 'utf-8') {
  $config->set('Core.EscapeNonASCIICharacters', true);
 }
 $config->set('Core.AllowParseManyTags', false);
+$config->set('Core.RemoveBlanks', false);

 // vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/AttrDef/CSS/RatioTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSS/RatioTest.php
@@ -0,0 +1,24 @@
+<?php
+
+class HTMLPurifier_AttrDef_CSS_RatioTest extends HTMLPurifier_AttrDefHarness
+{
+
+    public function test()
+    {
+        $this->def = new HTMLPurifier_AttrDef_CSS_Ratio();
+
+        $this->assertDef('1/2');
+        $this->assertDef('1 / 2', '1/2');
+        $this->assertDef('1');
+        $this->assertDef('1/0');
+        $this->assertDef('0/1');
+
+        $this->assertDef('1/2/3', false);
+        $this->assertDef('/2/3', false);
+        $this->assertDef('/12', false);
+        $this->assertDef('1/', false);
+        $this->assertDef('asdf', false);
+    }
+}
+
+// vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/AttrDef/CSSTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSSTest.php
@@ -72,6 +72,10 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('min-width:50rem;');
        $this->assertDef('min-width:50vw;');
        $this->assertDef('min-width:-50vw;', false);
+        $this->assertDef('aspect-ratio:16/9;');
+        $this->assertDef('aspect-ratio:auto;');
+        $this->assertDef('aspect-ratio:16/9 auto;');
+        $this->assertDef('aspect-ratio:auto 16/9;');
        $this->assertDef('text-decoration:underline;');
        $this->assertDef('text-decoration-line:overline;');
        $this->assertDef('text-decoration-style:dashed;');
@@ -116,8 +120,10 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('text-transform:capitalize;destroy:it;',
                         'text-transform:capitalize;');

-        // inherit works for everything
+        // universal values work for everything
        $this->assertDef('text-align:inherit;');
+        $this->assertDef('text-align:initial;');
+        $this->assertDef('text-align:unset;');

        // bad props
        $this->assertDef('nodice:foobar;', false);
--- a/tests/HTMLPurifier/AttrDef/URI/HostTest.php
+++ b/tests/HTMLPurifier/AttrDef/URI/HostTest.php
@@ -56,7 +56,8 @@ class HTMLPurifier_AttrDef_URI_HostTest extends HTMLPurifier_AttrDefHarness
    function testAllowUnderscore() {
        $this->config->set('Core.AllowHostnameUnderscore', true);
        $this->assertDef("foo_bar.example.com");
-        $this->assertDef("foo_.example.com", false);
+        $this->assertDef("foo_.example.com");
+        $this->assertDef("_dmarc.example.com");
    }

 }
--- a/tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php
+++ b/tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php
@@ -88,6 +88,13 @@ class HTMLPurifier_Filter_ExtractStyleBlocksTest extends HTMLPurifier_Harness
        $this->assertCleanCSS("a .foo #id div.cl#foo {\nfont-weight:700\n}");
    }

+    public function test_cleanCSS_universals()
+    {
+        $this->assertCleanCSS("a {\nfont-weight:inherit\n}");
+        $this->assertCleanCSS("a {\nfont-weight:initial\n}");
+        $this->assertCleanCSS("a {\nfont-weight:unset\n}");
+    }
+
    public function test_cleanCSS_angledBrackets()
    {
        // [Content] No longer can smuggle in angled brackets using
--- a/tests/HTMLPurifier/FixtureData/RemoveBlankTestCaseInput.html
+++ b/tests/HTMLPurifier/FixtureData/RemoveBlankTestCaseInput.html
@@ -0,0 +1,10 @@
+<table>
+  <caption>
+    Cool Table
+  </caption>
+  <tr>
+    <td>
+      Element 1
+    </td>
+  </tr>
+</table>
--- a/tests/HTMLPurifier/FixtureData/RemoveBlankTestCaseOutput.html
+++ b/tests/HTMLPurifier/FixtureData/RemoveBlankTestCaseOutput.html
@@ -0,0 +1,7 @@
+<table><caption>
+    Cool Table
+  </caption>
+  <tr><td>
+      Element 1
+    </td>
+  </tr></table>
--- a/tests/HTMLPurifier/HTMLDefinitionTest.php
+++ b/tests/HTMLPurifier/HTMLDefinitionTest.php
@@ -222,6 +222,17 @@ a[href|title]
        $this->assertPurification_AllowedAttributes_local_p_style();
    }

+    public function test_AllowedAttributes_invalidAttributeDueToConsistingOfNumbers_UsingDirectLex()
+    {
+        $this->config->set('HTML.AllowedElements', array('a'));
+        $this->config->set('HTML.AllowedAttributes', 'href');
+        $this->config->set('Core.LexerImpl', 'DirectLex');
+        $this->assertPurification(
+            '<a href="https://example.com/" 10="hoge">Test</a>',
+            '<a href="https://example.com/">Test</a>'
+        );
+    }
+
    public function test_ForbiddenElements()
    {
        $this->config->set('HTML.ForbiddenElements', 'b');
@@ -399,6 +410,19 @@ a[href|title]
        $this->assertIdentical($input, $output);
    }

+    public function test_removeBlanks()
+    {
+        $config = HTMLPurifier_Config::createDefault();
+        $config->set('Core.RemoveBlanks', true);
+
+        $input = file_get_contents(__DIR__ . '/FixtureData/RemoveBlankTestCaseInput.html');
+        $expected = file_get_contents(__DIR__ . '/FixtureData/RemoveBlankTestCaseOutput.html');
+
+        $purifier = new HTMLPurifier($config);
+        $actual = $purifier->purify($input);
+        $this->assertIdentical($expected, $actual);
+    }
+
 }

 // vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/HTMLT/safe-iframe-youtube-allowfullscreen.htmlt
+++ b/tests/HTMLPurifier/HTMLT/safe-iframe-youtube-allowfullscreen.htmlt
@@ -0,0 +1,9 @@
+--INI--
+HTML.SafeIframe = true
+HTML.Trusted = true
+URI.SafeIframeRegexp = "%^http://www.youtube.com/embed/%"
+--HTML--
+<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen></iframe>
+--EXPECT--
+<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
+--# vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/LexerTest.php
+++ b/tests/HTMLPurifier/LexerTest.php
@@ -380,6 +380,24 @@ class HTMLPurifier_LexerTest extends HTMLPurifier_Harness
        );
    }

+    /**
+     * Conditional comments are not supported by HTMLPurifier, but we
+     * should make sure they don't break the lexer.
+     */
+    public function test_tokenizeHTML_conditionalComments()
+    {
+        $this->assertTokenization(
+            '<!--[if mso]>A<![endif]-->B<!--[if !mso]><!---->C<!-- <![endif]-->',
+            array(
+                new HTMLPurifier_Token_Comment('[if mso]>A<![endif]'),
+                new HTMLPurifier_Token_Text("B"),
+                new HTMLPurifier_Token_Comment('[if !mso]><!--'),
+                new HTMLPurifier_Token_Text("C"),
+                new HTMLPurifier_Token_Comment(' <![endif]'),
+            )
+        );
+    }
+
    public function test_tokenizeHTML_unterminatedTag()
    {
        $this->assertTokenization(
@@ -785,14 +803,6 @@ div {}
        );
    }

-    public function test_tokenizeHTML_ignoreIECondComment()
-    {
-        $this->assertTokenization(
-            '<!--[if IE]>foo<a>bar<!-- baz --><![endif]-->',
-            array()
-        );
-    }
-
    public function test_tokenizeHTML_removeProcessingInstruction()
    {
        $this->config->set('Core.RemoveProcessingInstructions', true);
@@ -824,16 +834,6 @@ div {}
        );
     }

-    public function test_tokenizeHTML_conditionalCommentUngreedy()
-    {
-        $this->assertTokenization(
-            '<!--[if gte mso 9]>a<![endif]-->b<!--[if gte mso 9]>c<![endif]-->',
-            array(
-                new HTMLPurifier_Token_Text("b")
-            )
-        );
-    }
-
    public function test_tokenizeHTML_imgTag()
    {
        $start = array(
Author	SHA1	Message	Date
semantic-release-bot	cb56001e54	chore(release): 4.18.0 [skip ci] # [4.18.0](https://github.com/ezyang/htmlpurifier/compare/v4.17.0...v4.18.0) (2024-11-01) ### Bug Fixes * Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 ([#406](https://github.com/ezyang/htmlpurifier/issues/406)) ([`d9fbef8`](`d9fbef8e27`)) * Avoid a deprecated error when the attribute name is numeric and DirectLex is used ([#412](https://github.com/ezyang/htmlpurifier/issues/412)) ([`f0fbf51`](`f0fbf51098`)) * checking that node has property name ([#399](https://github.com/ezyang/htmlpurifier/issues/399)) ([`9ca5a36`](`9ca5a3687b`)) * Ignore conditional comments ([#401](https://github.com/ezyang/htmlpurifier/issues/401)) ([`4828fdf`](`4828fdf45a`)) * Support PHP 8.4 ([#396](https://github.com/ezyang/htmlpurifier/issues/396)) ([`92da247`](`92da2473ff`)) * undefined array key warning ([#419](https://github.com/ezyang/htmlpurifier/issues/419)) ([`01be377`](`01be377f93`)) ### Features * Add allowfullscreen attr for iframe ([#411](https://github.com/ezyang/htmlpurifier/issues/411)) ([`70754a2`](`70754a2533`)) * add directive for removing blank nodes ([#404](https://github.com/ezyang/htmlpurifier/issues/404)) ([`c9d60c9`](`c9d60c96d7`)) * Add support for CSS aspect-ratio ([#408](https://github.com/ezyang/htmlpurifier/issues/408)) ([`93bee73`](`93bee73349`)) * Allow universal CSS values for all properties ([#410](https://github.com/ezyang/htmlpurifier/issues/410)) ([`9723267`](`972326785d`))	2024-11-01 03:51:45 +00:00
Olek Kaim	01be377f93	fix: undefined array key warning (#419 )	2024-10-30 22:57:29 -04:00
Atsushi Matsuo	f0fbf51098	fix: Avoid a deprecated error when the attribute name is numeric and DirectLex is used (#412 )	2024-07-30 22:06:23 -04:00
John Flatness	70754a2533	feat: Add allowfullscreen attr for iframe (#411 )	2024-06-30 07:54:09 -04:00
John Flatness	972326785d	feat: Allow universal CSS values for all properties (#410 )	2024-06-28 08:37:00 -04:00
Erik	93bee73349	feat: Add support for CSS aspect-ratio (#408 )	2024-06-27 15:12:06 -04:00
Atsushi Matsuo	d9fbef8e27	fix: Adjust Core.AllowHostnameUnderscore to consider that "_" is defined as Unreserved Characters in RFC 3986 (#406 )	2024-04-18 21:48:20 -04:00
charlie-curtis	c9d60c96d7	feat: add directive for removing blank nodes (#404 )	2024-04-11 20:52:45 -04:00
Kent Oyer	4828fdf45a	fix: Ignore conditional comments (#401 )	2024-03-12 23:41:45 -04:00
Christian Castelli	9ca5a3687b	fix: checking that node has property name (#399 ) Co-authored-by: Christian Castelli <christian.castelli@docebo.com>	2024-03-05 10:58:42 -05:00
Edward Z. Yang	92da2473ff	fix: Support PHP 8.4 (#396 ) Signed-off-by: Edward Z. Yang <ezyang@meta.com>	2024-02-22 00:05:10 -05:00
@@ -1 +1 @@
 .17.0
 .18.0