0
0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-12-22 08:21:52 +00:00

- More TODO items

- Update comments

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1549 48356398-32a2-884e-a903-53898d9a118a
This commit is contained in:
Edward Z. Yang 2008-02-11 00:27:35 +00:00
parent 65d0e1fdfe
commit bf6de96bd0
10 changed files with 35 additions and 38 deletions

18
TODO
View File

@ -40,12 +40,23 @@ IMPORTANT
- Document that standalone doesn't load autoload by default, so you need
to include HTMLPurifier.autoload.php after it
- Simplify merge library script by removing recursion? (or other things)
- Optimize ConfigSchema by only caching things necessary for runtime
- Perhaps replace types with integer identifiers in ConfigSchema?
- Properly integrate new ConfigSchema system into configdoc (Configdoc
should directly read the configuration files)
- Reduce code duplication between Serializer and Adapter/ReverseAdapter
(we probably want to use ReverseAdapter for the long haul)
- Have configdoc use version and deprecated information (hide deprecated
info, for example)
- Update unit tests for ConfigSchema
- Implement file sniffing for configdoc, so we can easily figure out
which files use what configuration
3.1 release [Error'ed]
3.2 release [Error'ed]
# Error logging for filtering/cleanup procedures
- XSS-attempt detection
3.2 release [Do What I Mean, Not What I Say]
3.3 release [Do What I Mean, Not What I Say]
# Additional support for poorly written HTML
- Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
- Friendly strict handling of <address> (block -> <br>)
@ -61,7 +72,7 @@ IMPORTANT
dupe detector would also need to detect the suffix as well)
- Externalize inline CSS to promote clean HTML
3.3 release [It's All About Trust] (floating)
3.4 release [It's All About Trust] (floating)
# Implement untrusted, dangerous elements/attributes
# Implement IDREF support (harder than it seems, since you cannot have
IDREFs to non-existent IDs)
@ -72,6 +83,7 @@ IMPORTANT
AttrDef class). Probably will use CSSTidy class
# More control over allowed CSS properties (maybe modularize it in the
same fashion!)
# HTML 5 support
- Standardize token armor for all areas of processing
- Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
Also, enable disabling of directionality

View File

@ -1,9 +1,8 @@
<?php
// whitelisting allowed fonts would be nice
/**
* Validates a font family list according to CSS spec
* @todo whitelisting allowed fonts would be nice
*/
class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
{

View File

@ -1,9 +1,5 @@
<?php
// special case filtering directives
// disabling directives
/**
* Validates a URI as defined by RFC 3986.
* @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme

View File

@ -1,10 +1,25 @@
<?php
// constants are slow, but we'll make one exception
// constants are slow, so we use as few as possible
if (!defined('HTMLPURIFIER_PREFIX')) {
define('HTMLPURIFIER_PREFIX', realpath(dirname(__FILE__) . '/..'));
}
// accomodations for versions earlier than 5.0.2
// borrowed from PHP_Compat, LGPL licensed, by Aidan Lister <aidan@php.net>
if (!defined('PHP_EOL')) {
switch (strtoupper(substr(PHP_OS, 0, 3))) {
case 'WIN':
define('PHP_EOL', "\r\n");
break;
case 'DAR':
define('PHP_EOL', "\r");
break;
default:
define('PHP_EOL', "\n");
}
}
/**
* Bootstrap class that contains meta-functionality for HTML Purifier such as
* the autoload function.

View File

@ -1,10 +1,5 @@
<?php
// HTMLPurifier_ChildDef and inheritance have three types of output:
// true = leave nodes as is
// false = delete parent node and all children
// array(...) = replace children nodes with these
/**
* Defines allowed child nodes and validates tokens against it.
*/

View File

@ -1,21 +1,5 @@
<?php
// member variables
// accomodations for versions earlier than 4.3.10 and 5.0.2
// borrowed from PHP_Compat, LGPL licensed, by Aidan Lister <aidan@php.net>
if (!defined('PHP_EOL')) {
switch (strtoupper(substr(PHP_OS, 0, 3))) {
case 'WIN':
define('PHP_EOL', "\r\n");
break;
case 'DAR':
define('PHP_EOL', "\r");
break;
default:
define('PHP_EOL', "\n");
}
}
/**
* Configuration object that triggers customizable behavior.
*

View File

@ -1,6 +1,5 @@
<?php
// Legacy directives for doctype specification
class HTMLPurifier_DoctypeRegistry
{

View File

@ -1,6 +1,5 @@
<?php
// extension constraints could be factored into ConfigSchema
/**
* Generates HTML from tokens.
* @todo Refactor interface so that configuration/context is determined

View File

@ -1,8 +1,5 @@
<?php
// this definition and its modules MUST NOT define configuration directives
// outside of the HTML or Attr namespaces
/**
* Definition of the purified HTML that describes allowed children,
* attributes, and many other things.
@ -22,6 +19,9 @@
*
* @note This class is inspected by Printer_HTMLDefinition; please
* update that class if things here change.
*
* @warning Directives that change this object's structure must be in
* the HTML or Attr namespace!
*/
class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition
{

View File

@ -1,7 +1,5 @@
<?php
// informative URI directives
class HTMLPurifier_URIDefinition extends HTMLPurifier_Definition
{