mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-12-23 00:41:52 +00:00
Code Releases Activity
1,605 Commits 7 Branches 66 Tags 9.5 MiB
5a01e6535d
Commit Graph

645 Commits

Author SHA1 Message Date
Dimitri Gritsajuk
5a01e6535d [SafeScripting] disable autoclosing of <script /> tag (#198) 2018-11-11 15:04:11 -05:00
Jan Dageförde
67c3798922 Add relative length units from CSS 3 
cf. https://www.w3schools.com/cssref/css_units.asp
 2017-12-22 21:59:47 -05:00
Marina Glancy
ce0ede24de Use IDNA2008 for converting domains to ASCII 2017-10-03 11:19:50 -04:00
Edward Z. Yang
5bc7c72608 Add tests for new entity decoding codepath. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2017-03-12 20:05:09 -07:00
Edward Z. Yang
9d2d75d8bc Add test case for removing empty list items. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2017-03-08 00:11:32 -08:00
Edward Z. Yang
7e11c271b9 Revamp entity decoding to be more like HTML5. 
See %Core.LegacyEntityDecoder for more details.

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2017-03-07 17:34:59 -08:00
Edward Z. Yang
5886326cd0 Test for catastrophic backtracking. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2017-03-06 23:26:55 -08:00
Edward Z. Yang
0c31b22240 Merge pull request #118 from fxbt/master 
Add hsl, hsla and rgba support for css color attribute definition
 2017-03-06 23:01:06 -08:00
Edward Z. Yang
5662efc936 Fix #78. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2017-03-06 22:54:54 -08:00
mpyw
d16e73e63e
Add test for #122 2017-03-04 15:40:44 +09:00
f.godfrin
0bab4b9fd0 Fix mungeRgb to handle percent, float and hsl values 2017-02-10 00:38:05 +01:00
f.godfrin
bd92f3531b Remove double % 2017-02-09 23:37:36 +01:00
f.godfrin
0d5ab2fe13 Include hsl and hsla support 2017-02-09 23:34:19 +01:00
f.godfrin
d41a59e422 Add rgba support for css color attribute definition 2017-02-09 22:18:15 +01:00
Bastian Hofmann
8e4cacf0a7 Refactor HTML.Noopener to HTML.TargetNoopener so that it behaves like HTML.TargetNoreferrer and is active by default if a target is set 2017-02-03 16:54:51 -08:00
Bastian Hofmann
c82051c3e1 Add HTML.Noopener to add a noopener rel to every external link 
This has performance benefits https://jakearchibald.com/2016/performance-benefits-of-rel-noopener/ but most importantly also security benefits https://mathiasbynens.github.io/rel-noopener/

Adresses https://github.com/ezyang/htmlpurifier/issues/96
 2017-02-03 16:54:51 -08:00
Edward Z. Yang
5070404376 Handle semicolons in strings in CSS correctly. 
Fixes http://htmlpurifier.org/phorum/read.php?3,7522,8096

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-29 00:01:19 -07:00
Edward Z. Yang
59463c5c39 Allow %URI.DefaultScheme to be null. 
Fixes #103.

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-27 17:30:44 -07:00
Edward Z. Yang
8b28e571fe Handle case when IDNAs are supported. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-27 02:00:46 -07:00
Edward Z. Yang
3ae21ce511 PHP 7.0 warnings fix: don't pass rvalue by reference. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-27 02:00:46 -07:00
zema
246fc8946a css properties: min-width, max-width, min-height, max-height 2016-09-05 10:45:58 +03:00
Edward Z. Yang
d1c5d75027 Fix #73 with Attr.ID.HTML5 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-07-16 05:52:45 -07:00
Bart Butler
3747cb7efb avoid exif_imagetype exception with small files/corrupt data URI 2016-07-16 05:23:17 -07:00
Edward Z. Yang
44baee6a82 Partial border-radius support. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-06-30 22:22:13 -04:00
Cameron Ball
1675fc7caf Add %HTML.TargetNoreferrer, which adds rel="noreferrer" when target attribute is set 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-06-30 21:53:43 -04:00
Wes Cossick
cc35c8eb8c tel protocol support. 2016-06-30 21:19:49 -04:00
Edward Z. Yang
43a9f052fd Fix #57, make flashvars check (and others) case-insensitive. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-27 15:56:30 -07:00
Edward Z. Yang
b4981c3395 Fix #67, don't use <body> tags in comments for %Core.ConvertDocumentToFragment 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-27 15:19:32 -07:00
Edward Z. Yang
f14076dc3e Fix #49; prevent readdir infinite loop when cache directory not listable. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-27 14:53:31 -07:00
Edward Z. Yang
91fd55c857 Fix #45, errors when ul/ol allowed without li. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-26 22:41:54 -07:00
Edward Z. Yang
753c830239 Update to work with Git version of SimpleTest. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-24 00:08:03 -07:00
Edward Z. Yang
72123e23c9 Update ExtractStyleBlocks tests for modern CSSTidy at https://github.com/Cerdic/CSSTidy 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-23 23:39:38 -07:00
Edward Z. Yang
45161b4fb1 Accept leading digits in hostnames as per RFC 1123. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-23 22:42:21 -07:00
Synchro
25db9e1dd0 Don't use PHP4-style constructors 2016-03-16 17:09:41 -07:00
Edward Z. Yang
92aabf2b23 Fix #76, linkify includes dots at end of URL. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-02 02:05:54 -08:00
Edward Z. Yang
aebe1c02a2 Use idn_to_ascii when available. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-02 01:35:07 -08:00
Edward Z. Yang
913ac6955b CSS.AllowDuplicates for duplicate properties. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2015-12-20 11:53:54 -08:00
Edward Z. Yang
c67e4c2f7e All values, including empty, are valid HTML bools. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2015-02-11 16:36:44 -08:00
Edward Z. Yang
0c3e68dd03 Stop using umask to make definition cache. Fixes #32 
This is not really the right way to solve the ACL problem,
but there isn't really any reason we should be mucking about
with the umask.

Mucked around with the test case to make it pass, but I think
it's probably a bit delicate now.

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-12-08 18:30:54 -08:00
Edward Z. Yang
cd60294ada Fix rgb in border attribute with spaces, fixes #30. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 12:12:38 +01:00
Edward Z. Yang
39d3df1fd7 Add AutoFormat.RemoveEmpty.Predicate, fixes #35. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 12:12:17 +01:00
Edward Z. Yang
b8704535a3 Update test. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 11:10:11 +01:00
Edward Z. Yang
15d1a3003a Don't truncate in DOMLex when seeing closing div 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 08:50:33 +01:00
Edward Z. Yang
8cd08620dc Conditionalize hash_hmac tests for 5.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-11-29 22:27:01 -08:00
Edward Z. Yang
54477c172b Fix infinite loop in Lexer. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-27 21:41:08 -07:00
Edward Z. Yang
0767bbc12d Rewrite FixNesting implementation to be tree-based. 
This mega-patch rips out the FixNesting implementation and the related
ChildDef components.  The primary algorithmic change is to convert from
use of tokens to tree nodes, which are far more amenable to the style
of processing that FixNesting uses.  Additionally, FixNesting has been
changed to go bottom-up rather than top-down, in order to avoid needing
to implement backtracking.

This patch simplifies a good deal of the relevant logic, since we no
longer need to continually recalculate the nesting structure when
processing things.  However, the conversion to the alternate format
incurs some overhead, so for small inputs these changes are not a win.
One possibility to greatly reduce the constant factors here is to switch
to entirely using libxml's representation, and never serializing tokens;
this would require one to rewrite injectors, however.

The iterative post-order traversal in FixNesting is a bit subtle, but
we have essentially reified the stack and continuations.

We've removed support for %Core.EscapeInvalidChildren.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-20 22:37:01 -07:00
Edward Z. Yang
8f401f769e Use a Zipper to process MakeWellFormed, removing quadratic behavior. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-13 13:21:02 -07:00
Edward Z. Yang
82bcc62058 Properly handle context variables that are NULL. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-13 13:21:02 -07:00
Edward Z. Yang
f17490f009 Implementation of a Zipper, for efficient splice. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-13 01:16:32 -07:00
Edward Z. Yang
a5fc37d8c3 Improve gitignore. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-13 00:18:11 -07:00