mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2025-01-03 05:11:52 +00:00
Code Releases Activity

Fix some more attribute parsing things that could lead to infinite loops.

Browse Source 
git-svn-id: http://htmlpurifier.org/svnroot/html_purifier/trunk@25 48356398-32a2-884e-a903-53898d9a118a
This commit is contained in:
Edward Z. Yang 2006-04-16 00:23:35 +00:00
parent 92bfaafd20
commit 6372a16926
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
HTML_Lexer.php
View File

@ -58,6 +58,7 @@ class HTML_Lexer
$position_next_lt = strpos($string, '<', $cursor); $position_next_lt = strpos($string, '<', $cursor);
$position_next_gt = strpos($string, '>', $cursor); $position_next_gt = strpos($string, '>', $cursor);
// triggers on "<b>asdf</b>" but not "asdf <b></b>" // triggers on "<b>asdf</b>" but not "asdf <b></b>"
if ($position_next_lt === $cursor) { if ($position_next_lt === $cursor) {
$inside_tag = true; $inside_tag = true;
@ -184,6 +185,12 @@ class HTML_Lexer
$position_next_space = $this->nextWhiteSpace($string, $cursor); $position_next_space = $this->nextWhiteSpace($string, $cursor);
} }
// if we've hit the end, assign the key an empty value and abort
if ($cursor >= $size) {
$array[$key] = '';
break;
}
// find the next quote // find the next quote
$position_next_quote = $this->nextQuote($string, $cursor); $position_next_quote = $this->nextQuote($string, $cursor);
@ -201,6 +208,13 @@ class HTML_Lexer
// otherwise, regular attribute // otherwise, regular attribute
$quote = $string{$position_next_quote}; $quote = $string{$position_next_quote};
$position_end_quote = strpos($string, $quote, $position_next_quote + 1); $position_end_quote = strpos($string, $quote, $position_next_quote + 1);
// check if the ending quote is missing
if ($position_end_quote === false) {
// it is, assign it to the end of the string
$position_end_quote = $size;
}
$value = substr($string, $position_next_quote + 1, $value = substr($string, $position_next_quote + 1,
$position_end_quote - $position_next_quote - 1); $position_end_quote - $position_next_quote - 1);
if ($key) { if ($key) {

9
tests/HTML_Lexer.php
View File

@ -112,6 +112,12 @@ class TestCase_HTML_Lexer extends UnitTestCase
// however, we may want to change both styles // however, we may want to change both styles
// into parsed: '<b>'. SAX has an option for this // into parsed: '<b>'. SAX has an option for this
// [INVALID]
$input[10] = '<a "=>';
$expect[10] = array(
new MF_StartTag('a', array('"' => ''))
);
foreach($input as $i => $discard) { foreach($input as $i => $discard) {
$result = $this->HTML_Lexer->tokenizeHTML($input[$i]); $result = $this->HTML_Lexer->tokenizeHTML($input[$i]);
$this->assertEqual($expect[$i], $result); $this->assertEqual($expect[$i], $result);
@ -155,6 +161,9 @@ class TestCase_HTML_Lexer extends UnitTestCase
$input[] = 'missile=launch'; $input[] = 'missile=launch';
$expect[] = array('missile' => 'launch'); $expect[] = array('missile' => 'launch');
$input[] = 'href="foo';
$expect[] = array('href' => 'foo');
$size = count($input); $size = count($input);
for($i = 0; $i < $size; $i++) { for($i = 0; $i < $size; $i++) {
$result = $this->HTML_Lexer->tokenizeAttributeString($input[$i]); $result = $this->HTML_Lexer->tokenizeAttributeString($input[$i]);