htmlpurifier/docs/code-quality.txt

Code Quality Issues

Okay, face it.  Programmers can get lazy, cut corners, or make mistakes. They
also can do quick prototypes, and then forget to rewrite them later.  Well,
while I can't list mistakes in here, I can list prototype-like segments
of code that should be aggressively refactored.  This does not list
optimization issues, that needs to be done after intense profiling.

AttrDef
    Class - doesn't support Unicode characters (fringe); uses regular
        expressions
    Lang - code duplication; premature optimization; doesn't consult official
        lists (fringe)
    Length - easily mistaken for CSSLength
    URI - multiple regular expressions; missing validation for query,
        fragment and path
    CSS - parser doesn't accept advanced CSS (fringe)
    Number - constructor interface inconsistent with Integer
Config - "load configuration" hooks missing, rich set* accessors missing
ConfigSchema - redefinition is a mess
Strategy
    FixNesting - cannot bubble nodes out of structures
    MakeWellFormed - insufficient automatic closing definitions (check HTML
        spec for optional end tags, also, closing based on type (block/inline)
        might be efficient).
    RemoveForeignElements - should be run in parallel with MakeWellFormed
URIScheme - needs to have callable generic checks
    mailto - doesn't validate emails, doesn't validate querystring
    news - doesn't validate opaque path
    nntp - doesn't constrain path
EOL