2006-08-12 19:11:21 +00:00
|
|
|
<?php
|
|
|
|
|
|
|
|
// VERY RELAXED! Shouldn't cause problems, not even Firefox checks if the
|
|
|
|
// email is valid, but be careful!
|
|
|
|
|
2006-08-20 22:06:11 +00:00
|
|
|
/**
|
|
|
|
* Validates mailto (for E-mail) according to RFC 2368
|
|
|
|
* @todo Validate the email address
|
|
|
|
* @todo Filter allowed query parameters
|
|
|
|
*/
|
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
class HTMLPurifier_URIScheme_mailto extends HTMLPurifier_URIScheme
|
|
|
|
{
|
|
|
|
/**
|
|
|
|
* @type bool
|
|
|
|
*/
|
2007-11-25 02:24:39 +00:00
|
|
|
public $browsable = false;
|
2013-07-16 11:56:14 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* @type bool
|
|
|
|
*/
|
Dramatically rewrite null host URI handling.
Basically, browsers don't parse what should be valid URIs correctly, so
we have to go through some backbends to accomodate them. Specifically,
for browseable URIs, the following URIs have unintended behavior:
- ///example.com
- http:/example.com
- http:///example.com
Furthermore, if the path begins with //, modifying these URLs must
be done with care, as if you remove the host-name component, the
parse tree changes.
I've modified the engine to follow correct URI semantics as much
as possible while outputting browser compatible code, and invalidate
the URI in cases where we can't deal. There has been a refactoring
of URIScheme so that this important check is always performed,
introducing a new member variable allow_empty_host which is true
on data, file, mailto and news schemes.
This also fixes bypass bugs on URI.Munge.
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
2011-01-25 18:56:46 +00:00
|
|
|
public $may_omit_host = true;
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
/**
|
|
|
|
* @param HTMLPurifier_URI $uri
|
|
|
|
* @param HTMLPurifier_Config $config
|
|
|
|
* @param HTMLPurifier_Context $context
|
|
|
|
* @return bool
|
|
|
|
*/
|
|
|
|
public function doValidate(&$uri, $config, $context)
|
|
|
|
{
|
2007-08-01 18:34:46 +00:00
|
|
|
$uri->userinfo = null;
|
|
|
|
$uri->host = null;
|
|
|
|
$uri->port = null;
|
2006-08-12 19:11:21 +00:00
|
|
|
// we need to validate path against RFC 2368's addr-spec
|
2007-08-01 18:34:46 +00:00
|
|
|
return true;
|
2006-08-12 19:11:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-12-06 09:24:59 +00:00
|
|
|
// vim: et sw=4 sts=4
|