diff --git a/NEWS b/NEWS index dc059946..a098fb46 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier 4.8.0, unknown release date ! Full PHP 7 compatibility, the test suite is ALL GO. ! %CSS.AllowDuplicates permits duplicate CSS properties. +! Support for 'tel' URIs. - alt truncation could result in malformed UTF-8 sequence. Don't truncate. Thanks Brandon Farber for reporting. - Linkify regex is smarter, based off of Gruber's regex. diff --git a/configdoc/usage.xml b/configdoc/usage.xml index 97bc34cb..afdea088 100644 --- a/configdoc/usage.xml +++ b/configdoc/usage.xml @@ -296,6 +296,11 @@ 49 + + + 28 + + 47 @@ -362,7 +367,7 @@ - 96 + 105 @@ -390,7 +395,7 @@ - 41 + 40 @@ -408,13 +413,13 @@ - 171 + 183 - 188 - 206 + 200 + 218 diff --git a/docs/dev-code-quality.txt b/docs/dev-code-quality.txt index bceedebc..6c4deb17 100644 --- a/docs/dev-code-quality.txt +++ b/docs/dev-code-quality.txt @@ -25,5 +25,6 @@ URIScheme - needs to have callable generic checks mailto - doesn't validate emails, doesn't validate querystring news - doesn't validate opaque path nntp - doesn't constrain path + tel - doesn't validate phone numbers, only allows characters '+', '1-9', and 'x' vim: et sw=4 sts=4 diff --git a/library/HTMLPurifier.includes.php b/library/HTMLPurifier.includes.php index fdb58c2d..bc28112c 100644 --- a/library/HTMLPurifier.includes.php +++ b/library/HTMLPurifier.includes.php @@ -225,5 +225,6 @@ require 'HTMLPurifier/URIScheme/https.php'; require 'HTMLPurifier/URIScheme/mailto.php'; require 'HTMLPurifier/URIScheme/news.php'; require 'HTMLPurifier/URIScheme/nntp.php'; +require 'HTMLPurifier/URIScheme/tel.php'; require 'HTMLPurifier/VarParser/Flexible.php'; require 'HTMLPurifier/VarParser/Native.php'; diff --git a/library/HTMLPurifier.safe-includes.php b/library/HTMLPurifier.safe-includes.php index 9dea6d1e..c58a9403 100644 --- a/library/HTMLPurifier.safe-includes.php +++ b/library/HTMLPurifier.safe-includes.php @@ -219,5 +219,6 @@ require_once $__dir . '/HTMLPurifier/URIScheme/https.php'; require_once $__dir . '/HTMLPurifier/URIScheme/mailto.php'; require_once $__dir . '/HTMLPurifier/URIScheme/news.php'; require_once $__dir . '/HTMLPurifier/URIScheme/nntp.php'; +require_once $__dir . '/HTMLPurifier/URIScheme/tel.php'; require_once $__dir . '/HTMLPurifier/VarParser/Flexible.php'; require_once $__dir . '/HTMLPurifier/VarParser/Native.php'; diff --git a/library/HTMLPurifier/ConfigSchema/schema.ser b/library/HTMLPurifier/ConfigSchema/schema.ser index 30785dcf..98fd412a 100644 Binary files a/library/HTMLPurifier/ConfigSchema/schema.ser and b/library/HTMLPurifier/ConfigSchema/schema.ser differ diff --git a/library/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt b/library/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt index 666635a5..eb97307e 100644 --- a/library/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt +++ b/library/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt @@ -8,6 +8,7 @@ array ( 'ftp' => true, 'nntp' => true, 'news' => true, + 'tel' => true, ) --DESCRIPTION-- Whitelist that defines the schemes that a URI is allowed to have. This diff --git a/library/HTMLPurifier/URIScheme/tel.php b/library/HTMLPurifier/URIScheme/tel.php new file mode 100644 index 00000000..8cd19335 --- /dev/null +++ b/library/HTMLPurifier/URIScheme/tel.php @@ -0,0 +1,46 @@ +userinfo = null; + $uri->host = null; + $uri->port = null; + + // Delete all non-numeric characters, non-x characters + // from phone number, EXCEPT for a leading plus sign. + $uri->path = preg_replace('/(?!^\+)[^\dx]/', '', + // Normalize e(x)tension to lower-case + str_replace('X', 'x', $uri->path)); + + return true; + } +} + +// vim: et sw=4 sts=4 diff --git a/tests/HTMLPurifier/AttrDef/URITest.php b/tests/HTMLPurifier/AttrDef/URITest.php index 01274ca2..d2c5d7ab 100644 --- a/tests/HTMLPurifier/AttrDef/URITest.php +++ b/tests/HTMLPurifier/AttrDef/URITest.php @@ -22,6 +22,7 @@ class HTMLPurifier_AttrDef_URITest extends HTMLPurifier_AttrDefHarness $this->assertDef('news:rec.alt'); $this->assertDef('nntp://news.example.com/324234'); $this->assertDef('mailto:bob@example.com'); + $this->assertDef('tel:+15555555555'); } public function testIntegrationWithPercentEncoder() diff --git a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php index f357ce05..19b65b3b 100644 --- a/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php +++ b/tests/HTMLPurifier/URIFilter/MakeAbsoluteTest.php @@ -37,6 +37,11 @@ class HTMLPurifier_URIFilter_MakeAbsoluteTest extends HTMLPurifier_URIFilterHarn $this->assertFiltering('mailto:bob@example.com'); } + public function testPreserveAltSchemeWithTel() + { + $this->assertFiltering('tel:+15555555555'); + } + public function testFilterIgnoreHTTPSpecialCase() { $this->assertFiltering('http:/', 'http://example.com/'); diff --git a/tests/HTMLPurifier/URIParserTest.php b/tests/HTMLPurifier/URIParserTest.php index a188862c..4bc21b76 100644 --- a/tests/HTMLPurifier/URIParserTest.php +++ b/tests/HTMLPurifier/URIParserTest.php @@ -69,6 +69,14 @@ class HTMLPurifier_URIParserTest extends HTMLPurifier_Harness ); } + public function testTelURI() + { + $this->assertParsing( + 'tel:+1 (555) 555-5555', + 'tel', null, null, null, '+1 (555) 555-5555', null, null + ); + } + public function testIPv4Address() { $this->assertParsing( diff --git a/tests/HTMLPurifier/URISchemeTest.php b/tests/HTMLPurifier/URISchemeTest.php index 99a46548..867e845e 100644 --- a/tests/HTMLPurifier/URISchemeTest.php +++ b/tests/HTMLPurifier/URISchemeTest.php @@ -172,6 +172,42 @@ class HTMLPurifier_URISchemeTest extends HTMLPurifier_URIHarness ); } + public function test_tel_strip_punctuation() + { + $this->assertValidation( + 'tel:+1 (555) 555-5555', 'tel:+15555555555' + ); + } + + public function test_tel_regular() + { + $this->assertValidation( + 'tel:+15555555555' + ); + } + + public function test_tel_with_extension() + { + $this->assertValidation( + 'tel:+1-555-555-5555x123', 'tel:+15555555555x123' + ); + } + + public function test_tel_no_plus() + { + $this->assertValidation( + 'tel:555-555-5555', 'tel:5555555555' + ); + } + + public function test_tel_strip_letters() + { + $this->assertValidation( + 'tel:abcd1234', + 'tel:1234' + ); + } + public function test_data_png() { $this->assertValidation(