mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-12-22 16:31:53 +00:00
- More TODO items
- Update comments git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1549 48356398-32a2-884e-a903-53898d9a118a
This commit is contained in:
parent
65d0e1fdfe
commit
bf6de96bd0
18
TODO
18
TODO
@ -40,12 +40,23 @@ IMPORTANT
|
|||||||
- Document that standalone doesn't load autoload by default, so you need
|
- Document that standalone doesn't load autoload by default, so you need
|
||||||
to include HTMLPurifier.autoload.php after it
|
to include HTMLPurifier.autoload.php after it
|
||||||
- Simplify merge library script by removing recursion? (or other things)
|
- Simplify merge library script by removing recursion? (or other things)
|
||||||
|
- Optimize ConfigSchema by only caching things necessary for runtime
|
||||||
|
- Perhaps replace types with integer identifiers in ConfigSchema?
|
||||||
|
- Properly integrate new ConfigSchema system into configdoc (Configdoc
|
||||||
|
should directly read the configuration files)
|
||||||
|
- Reduce code duplication between Serializer and Adapter/ReverseAdapter
|
||||||
|
(we probably want to use ReverseAdapter for the long haul)
|
||||||
|
- Have configdoc use version and deprecated information (hide deprecated
|
||||||
|
info, for example)
|
||||||
|
- Update unit tests for ConfigSchema
|
||||||
|
- Implement file sniffing for configdoc, so we can easily figure out
|
||||||
|
which files use what configuration
|
||||||
|
|
||||||
3.1 release [Error'ed]
|
3.2 release [Error'ed]
|
||||||
# Error logging for filtering/cleanup procedures
|
# Error logging for filtering/cleanup procedures
|
||||||
- XSS-attempt detection
|
- XSS-attempt detection
|
||||||
|
|
||||||
3.2 release [Do What I Mean, Not What I Say]
|
3.3 release [Do What I Mean, Not What I Say]
|
||||||
# Additional support for poorly written HTML
|
# Additional support for poorly written HTML
|
||||||
- Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
|
- Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
|
||||||
- Friendly strict handling of <address> (block -> <br>)
|
- Friendly strict handling of <address> (block -> <br>)
|
||||||
@ -61,7 +72,7 @@ IMPORTANT
|
|||||||
dupe detector would also need to detect the suffix as well)
|
dupe detector would also need to detect the suffix as well)
|
||||||
- Externalize inline CSS to promote clean HTML
|
- Externalize inline CSS to promote clean HTML
|
||||||
|
|
||||||
3.3 release [It's All About Trust] (floating)
|
3.4 release [It's All About Trust] (floating)
|
||||||
# Implement untrusted, dangerous elements/attributes
|
# Implement untrusted, dangerous elements/attributes
|
||||||
# Implement IDREF support (harder than it seems, since you cannot have
|
# Implement IDREF support (harder than it seems, since you cannot have
|
||||||
IDREFs to non-existent IDs)
|
IDREFs to non-existent IDs)
|
||||||
@ -72,6 +83,7 @@ IMPORTANT
|
|||||||
AttrDef class). Probably will use CSSTidy class
|
AttrDef class). Probably will use CSSTidy class
|
||||||
# More control over allowed CSS properties (maybe modularize it in the
|
# More control over allowed CSS properties (maybe modularize it in the
|
||||||
same fashion!)
|
same fashion!)
|
||||||
|
# HTML 5 support
|
||||||
- Standardize token armor for all areas of processing
|
- Standardize token armor for all areas of processing
|
||||||
- Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
|
- Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
|
||||||
Also, enable disabling of directionality
|
Also, enable disabling of directionality
|
||||||
|
@ -1,9 +1,8 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// whitelisting allowed fonts would be nice
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Validates a font family list according to CSS spec
|
* Validates a font family list according to CSS spec
|
||||||
|
* @todo whitelisting allowed fonts would be nice
|
||||||
*/
|
*/
|
||||||
class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
|
class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
|
||||||
{
|
{
|
||||||
|
@ -1,9 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// special case filtering directives
|
|
||||||
|
|
||||||
// disabling directives
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Validates a URI as defined by RFC 3986.
|
* Validates a URI as defined by RFC 3986.
|
||||||
* @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme
|
* @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme
|
||||||
|
@ -1,10 +1,25 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// constants are slow, but we'll make one exception
|
// constants are slow, so we use as few as possible
|
||||||
if (!defined('HTMLPURIFIER_PREFIX')) {
|
if (!defined('HTMLPURIFIER_PREFIX')) {
|
||||||
define('HTMLPURIFIER_PREFIX', realpath(dirname(__FILE__) . '/..'));
|
define('HTMLPURIFIER_PREFIX', realpath(dirname(__FILE__) . '/..'));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// accomodations for versions earlier than 5.0.2
|
||||||
|
// borrowed from PHP_Compat, LGPL licensed, by Aidan Lister <aidan@php.net>
|
||||||
|
if (!defined('PHP_EOL')) {
|
||||||
|
switch (strtoupper(substr(PHP_OS, 0, 3))) {
|
||||||
|
case 'WIN':
|
||||||
|
define('PHP_EOL', "\r\n");
|
||||||
|
break;
|
||||||
|
case 'DAR':
|
||||||
|
define('PHP_EOL', "\r");
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
define('PHP_EOL', "\n");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Bootstrap class that contains meta-functionality for HTML Purifier such as
|
* Bootstrap class that contains meta-functionality for HTML Purifier such as
|
||||||
* the autoload function.
|
* the autoload function.
|
||||||
|
@ -1,10 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// HTMLPurifier_ChildDef and inheritance have three types of output:
|
|
||||||
// true = leave nodes as is
|
|
||||||
// false = delete parent node and all children
|
|
||||||
// array(...) = replace children nodes with these
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Defines allowed child nodes and validates tokens against it.
|
* Defines allowed child nodes and validates tokens against it.
|
||||||
*/
|
*/
|
||||||
|
@ -1,21 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// member variables
|
|
||||||
// accomodations for versions earlier than 4.3.10 and 5.0.2
|
|
||||||
// borrowed from PHP_Compat, LGPL licensed, by Aidan Lister <aidan@php.net>
|
|
||||||
if (!defined('PHP_EOL')) {
|
|
||||||
switch (strtoupper(substr(PHP_OS, 0, 3))) {
|
|
||||||
case 'WIN':
|
|
||||||
define('PHP_EOL', "\r\n");
|
|
||||||
break;
|
|
||||||
case 'DAR':
|
|
||||||
define('PHP_EOL', "\r");
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
define('PHP_EOL', "\n");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Configuration object that triggers customizable behavior.
|
* Configuration object that triggers customizable behavior.
|
||||||
*
|
*
|
||||||
|
@ -1,6 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// Legacy directives for doctype specification
|
|
||||||
class HTMLPurifier_DoctypeRegistry
|
class HTMLPurifier_DoctypeRegistry
|
||||||
{
|
{
|
||||||
|
|
||||||
|
@ -1,6 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// extension constraints could be factored into ConfigSchema
|
|
||||||
/**
|
/**
|
||||||
* Generates HTML from tokens.
|
* Generates HTML from tokens.
|
||||||
* @todo Refactor interface so that configuration/context is determined
|
* @todo Refactor interface so that configuration/context is determined
|
||||||
|
@ -1,8 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// this definition and its modules MUST NOT define configuration directives
|
|
||||||
// outside of the HTML or Attr namespaces
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Definition of the purified HTML that describes allowed children,
|
* Definition of the purified HTML that describes allowed children,
|
||||||
* attributes, and many other things.
|
* attributes, and many other things.
|
||||||
@ -22,6 +19,9 @@
|
|||||||
*
|
*
|
||||||
* @note This class is inspected by Printer_HTMLDefinition; please
|
* @note This class is inspected by Printer_HTMLDefinition; please
|
||||||
* update that class if things here change.
|
* update that class if things here change.
|
||||||
|
*
|
||||||
|
* @warning Directives that change this object's structure must be in
|
||||||
|
* the HTML or Attr namespace!
|
||||||
*/
|
*/
|
||||||
class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition
|
class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition
|
||||||
{
|
{
|
||||||
|
@ -1,7 +1,5 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
// informative URI directives
|
|
||||||
|
|
||||||
class HTMLPurifier_URIDefinition extends HTMLPurifier_Definition
|
class HTMLPurifier_URIDefinition extends HTMLPurifier_Definition
|
||||||
{
|
{
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user