diff --git a/library/HTMLPurifier/URIFilter/SecureMunge.php b/library/HTMLPurifier/URIFilter/SecureMunge.php index fe74ac53..f131ad4e 100644 --- a/library/HTMLPurifier/URIFilter/SecureMunge.php +++ b/library/HTMLPurifier/URIFilter/SecureMunge.php @@ -17,6 +17,7 @@ class HTMLPurifier_URIFilter_SecureMunge extends HTMLPurifier_URIFilter } public function filter(&$uri, $config, $context) { if (!$this->target || !$this->secretKey) return true; + if ($context->get('EmbeddedURI', true)) return true; // abort for embedded URIs $scheme_obj = $uri->getSchemeObj($config, $context); if (!$scheme_obj) return true; // ignore unknown schemes, maybe another postfilter did it if (is_null($uri->host) || empty($scheme_obj->browsable)) { diff --git a/tests/HTMLPurifier/URIFilter/SecureMungeTest.php b/tests/HTMLPurifier/URIFilter/SecureMungeTest.php index dd55dd5e..4a71ce04 100644 --- a/tests/HTMLPurifier/URIFilter/SecureMungeTest.php +++ b/tests/HTMLPurifier/URIFilter/SecureMungeTest.php @@ -22,6 +22,12 @@ class HTMLPurifier_URIFilter_SecureMungeTest extends HTMLPurifier_URIFilterHarne $this->assertFiltering('/local'); } + function testPreserveEmbedded() { + $embedded = true; + $this->context->register('EmbeddedURI', $embedded); + $this->assertFiltering('http://google.com'); + } + function testStandardMunge() { $this->assertFiltering('http://google.com', '/redirect.php?url=http%3A%2F%2Fgoogle.com&checksum=0072e2f817fd2844825def74e54443debecf0892'); } diff --git a/tests/HTMLPurifierTest.php b/tests/HTMLPurifierTest.php index 181acaa7..d6c86584 100644 --- a/tests/HTMLPurifierTest.php +++ b/tests/HTMLPurifierTest.php @@ -189,8 +189,8 @@ alert(""); $this->config->set('URI', 'SecureMunge', '/redirect.php?url=%s&check=%t'); $this->config->set('URI', 'SecureMungeSecretKey', 'foo'); $this->assertPurification( - 'foo', - 'foo' + 'foolocal', + 'foolocal' ); }