diff --git a/NEWS b/NEWS index 5442416a..2d4c55d0 100644 --- a/NEWS +++ b/NEWS @@ -22,6 +22,8 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier use on hand-written HTML. ! Add error-cases for unsupported elements in MakeWellFormed. This enables the strategy to be used, standalone, on untrusted input. +- Fix two bugs in %URI.MakeAbsolute; one involving empty paths in base URLs, + the other involving an undefined $is_folder error. . Strategy_MakeWellFormed now operates in-place, saving memory and allowing for more interesting filter-backtracking . New HTMLPurifier_Injector->rewind() functionality, allows injectors to rewind diff --git a/library/HTMLPurifier/URIFilter/MakeAbsolute.php b/library/HTMLPurifier/URIFilter/MakeAbsolute.php index 289db51a..515cd4af 100644 --- a/library/HTMLPurifier/URIFilter/MakeAbsolute.php +++ b/library/HTMLPurifier/URIFilter/MakeAbsolute.php @@ -51,10 +51,13 @@ class HTMLPurifier_URIFilter_MakeAbsolute extends HTMLPurifier_URIFilter } if ($uri->path === '') { $uri->path = $this->base->path; - }elseif ($uri->path[0] !== '/') { + } elseif ($uri->path[0] !== '/') { // relative path, needs more complicated processing $stack = explode('/', $uri->path); $new_stack = array_merge($this->basePathStack, $stack); + if ($new_stack[0] !== '' && !is_null($this->base->host)) { + array_unshift($new_stack, ''); + } $new_stack = $this->_collapseStack($new_stack); $uri->path = implode('/', $new_stack); } @@ -71,6 +74,7 @@ class HTMLPurifier_URIFilter_MakeAbsolute extends HTMLPurifier_URIFilter */ private function _collapseStack($stack) { $result = array(); + $is_folder = false; for ($i = 0; isset($stack[$i]); $i++) { $is_folder = false; // absorb an internally duplicated slash diff --git a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php index 1b88392b..82e694e9 100644 --- a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php +++ b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php @@ -114,6 +114,13 @@ class HTMLPurifier_URIFilter_MakeAbsoluteTest extends HTMLPurifier_URIFilterHarn $this->assertFiltering('javascript: window.location = \'http://www.example.com\';', false); } + // miscellaneous + + function testFilterDomainWithNoSlash() { + $this->setBase('http://example.com'); + $this->assertFiltering('foo', 'http://example.com/foo'); + } + // error case function testErrorNoBase() {