mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2025-03-23 14:27:02 +00:00
Code Releases Activity

Implement CSS.AllowedFonts.

Browse Source 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
This commit is contained in:
Edward Z. Yang 2011-03-24 22:54:39 +00:00
parent 6a6c0ed5d7
commit 94ed3b1231
5 changed files with 32 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -22,6 +22,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
directory/file permissions directory/file permissions
! Fix longstanding bug in Flash support for non-IE browsers, and ! Fix longstanding bug in Flash support for non-IE browsers, and
allow more wmode attributes. allow more wmode attributes.
! Add %CSS.AllowedFonts to restrict permissible font names.
- Switch to an iterative traversal of the DOM, which prevents us - Switch to an iterative traversal of the DOM, which prevents us
from running out of stack space for deeply nested documents. from running out of stack space for deeply nested documents.
Thanks Maxim Krizhanovsky for contributing a patch. Thanks Maxim Krizhanovsky for contributing a patch.

10
library/HTMLPurifier/AttrDef/CSS/FontFamily.php
View File

@ -2,7 +2,6 @@
/** /**
* Validates a font family list according to CSS spec * Validates a font family list according to CSS spec
* @todo whitelisting allowed fonts would be nice
*/ */
class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
{ {
@ -15,6 +14,7 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
'fantasy' => true, 'fantasy' => true,
'cursive' => true 'cursive' => true
); );
$allowed_fonts = $config->get('CSS.AllowedFonts');
// assume that no font names contain commas in them // assume that no font names contain commas in them
$fonts = explode(',', $string); $fonts = explode(',', $string);
@ -24,7 +24,9 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
if ($font === '') continue; if ($font === '') continue;
// match a generic name // match a generic name
if (isset($generic_names[$font])) { if (isset($generic_names[$font])) {
$final .= $font . ', '; if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
$final .= $font . ', ';
}
continue; continue;
} }
// match a quoted name // match a quoted name
@ -40,6 +42,10 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
// $font is a pure representation of the font name // $font is a pure representation of the font name
if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) {
continue;
}
if (ctype_alnum($font) && $font !== '') { if (ctype_alnum($font) && $font !== '') {
// very simple font, allow it in unharmed // very simple font, allow it in unharmed
$final .= $font . ', '; $final .= $font . ', ';

BIN
library/HTMLPurifier/ConfigSchema/schema.ser
View File

Binary file not shown.

12
library/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt Normal file
View File

@ -0,0 +1,12 @@
CSS.AllowedFonts
TYPE: lookup/null
VERSION: 4.3.0
DEFAULT: NULL
--DESCRIPTION--
<p>
Allows you to manually specify a set of allowed fonts. If
<code>NULL</code>, all fonts are allowed. This directive
affects generic names (serif, sans-serif, monospace, cursive,
fantasy) as well as specific font families.
</p>
--# vim: et sw=4 sts=4

11
tests/HTMLPurifier/AttrDef/CSS/FontFamilyTest.php
View File

@ -34,6 +34,17 @@ class HTMLPurifier_AttrDef_CSS_FontFamilyTest extends HTMLPurifier_AttrDefHarnes
$this->assertDef("'\\\nf'", "f"); $this->assertDef("'\\\nf'", "f");
} }
function testAllowed() {
$this->config->set('CSS.AllowedFonts', array('serif', 'Times New Roman'));
$this->assertDef('serif');
$this->assertDef('sans-serif', false);
$this->assertDef('serif, sans-serif', 'serif');
$this->assertDef('Times New Roman', '"Times New Roman"');
$this->assertDef('"Times New Roman"');
$this->assertDef('foo', false);
}
} }
// vim: et sw=4 sts=4 // vim: et sw=4 sts=4