diff --git a/NEWS b/NEWS index f6c0ea5c..86520f65 100644 --- a/NEWS +++ b/NEWS @@ -17,6 +17,8 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier - Corrective blockquote definition now enabled for HTML 4.01 Strict - Fatal error when tag (or any other element with required attributes) has 'id' attribute fixed, thanks NykO18 for reporting +- Fix warning emitted when a non-supported URI scheme is passed to the + MakeAbsolute URIFilter, thanks NykO18 (again) . %Core.AcceptFullDocuments renamed to %Core.ConvertDocumentToFragment to better communicate its purpose diff --git a/library/HTMLPurifier/AttrDef/URI.php b/library/HTMLPurifier/AttrDef/URI.php index 365748c0..0e9a5f47 100644 --- a/library/HTMLPurifier/AttrDef/URI.php +++ b/library/HTMLPurifier/AttrDef/URI.php @@ -102,7 +102,7 @@ class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef $result = $uri->validate($config, $context); if (!$result) break; - // chained validation + // chained filtering $uri_def =& $config->getDefinition('URI'); $result = $uri_def->filter($uri, $config, $context); if (!$result) break; diff --git a/library/HTMLPurifier/URIFilter.php b/library/HTMLPurifier/URIFilter.php index e0066f3b..ca000ea5 100644 --- a/library/HTMLPurifier/URIFilter.php +++ b/library/HTMLPurifier/URIFilter.php @@ -1,10 +1,22 @@ host)) return true; $scheme_obj = $uri->getSchemeObj($config, $context); + if (!$scheme_obj) { + // scheme not recognized + return false; + } if (!$scheme_obj->hierarchical) { // non-hierarchal URI with explicit scheme, don't change return true; diff --git a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php index d509a6a1..51f47358 100644 --- a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php +++ b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php @@ -111,6 +111,12 @@ class HTMLPurifier_URIFilter_MakeAbsoluteTest extends HTMLPurifier_URIFilterHarn $this->assertFiltering('.', '../'); } + function testRemoveJavaScriptWithEmbeddedLink() { + // credits: NykO18 + $this->setBase('http://www.example.com/'); + $this->assertFiltering('javascript: window.location = \'http://www.example.com\';', false); + } + // error case function testErrorNoBase() {