mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-11-14 01:08:41 +00:00
Code Releases Activity
1,592 Commits 7 Branches 66 Tags 9.4 MiB
6d6d88512a
Commit Graph

909 Commits

Author SHA1 Message Date
Edward Z. Yang
d516e2f8de Release 4.5.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-17 16:04:08 -08:00
Edward Z. Yang
631021733b Add %Core.DisableExcludes directive 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-17 15:47:38 -08:00
Edward Z. Yang
62d2550e16 Use SHA-1 instead of MD5. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:33:22 -07:00
Edward Z. Yang
087145a71b Blacklist more tags from RemoveEmpty. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:32:48 -07:00
Edward Z. Yang
a44187a5c1 Cleanup after data validation. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:30:58 -07:00
Edward Z. Yang
c0ad68108a Do checks against iconvAvailable because PHP 5.4 has botched iconv support. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:27:57 -07:00
Edward Z. Yang
83a574491e Comment for bug that needs to get fixed. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-11 11:40:02 -07:00
Edward Z. Yang
3b537365a4 CSS properties page-break-* 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-11 11:39:52 -07:00
Edward Z. Yang
72db575446 Fix bug with non-lower case color names in HTML. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-07-30 10:54:32 -04:00
Edward Z. Yang
d8bb73ce46 Permit underscores in font-families. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-07-27 18:28:29 -04:00
Edward Z. Yang
f90372f8ab More support for white-space. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-06-16 17:10:36 -04:00
Edward Z. Yang
f38fca32a9 Don't lower-case components of background. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-06-02 11:22:58 -04:00
Edward Z. Yang
5a23004652 Support for inline-block. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-05-25 23:55:48 -04:00
Edward Z. Yang
6705140082 Fix in AttrTransform_Nofollow 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-05-14 23:07:27 -04:00
Edward Z. Yang
cb7162a995 Use prepend for autoloading on PHP 5.3+ 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-05-02 11:07:24 -04:00
Edward Z. Yang
2189a9430f Support for safe external scripts via explicit whitelist. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-04-27 17:44:49 -04:00
Edward Z. Yang
7291f19347 Fix problem where stacked AttrTransforms clobber each other. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-03-16 23:12:16 -04:00
Edward Z. Yang
31dce298ea Actually make URI.DisableResources do something. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-03-02 13:25:00 -05:00
Edward Z. Yang
8c9d461a62 Bugfix: _blank not blank. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-02-18 11:28:01 -05:00
Edward Z. Yang
17af0e4fc1 Release 4.4.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-18 19:22:31 -05:00
Edward Z. Yang
70028f83d6 Make all of the tests work on all PHP versions. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-18 18:57:13 -05:00
Edward Z. Yang
1c7fedff5a Tighter CSS selector validation. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-17 15:36:26 -05:00
Edward Z. Yang
9de0785448 Remark about bypassing host list with punycode. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-06 05:32:53 -08:00
Edward Z. Yang
974fe3f25e Optional support for IDNAs with PEAR Net_IDNA2 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-06 05:28:00 -08:00
Edward Z. Yang
94468f3c24 Remove PEARSax3 lexer. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-03 20:40:17 +08:00
Edward Z. Yang
e0354fecd9 Make forms work for transitional doctypes. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-30 22:56:44 +08:00
Edward Z. Yang
5c9b5130c8 Bump minor version number to 4.4.0. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 21:55:14 +08:00
Bradley M. Froehle
4164b2eb2b Implement Iframe module, and provide %HTML.SafeIframe and %URI.SafeIframeRegexp for untrusted usage. 
The purpose of this addition is twofold. In trusted mode, iframes are
now unconditionally allowed.

However, many online video providers (YouTube, Vimeo) and other web
applications (Google Maps, Google Calendar, etc) provide embed code in
iframe format, which is useful functionality in untrusted mode.
You can specify iframes as trusted elements with %HTML.SafeIframe;
however, you need to additionally specify a whitelist mechanism such as
%URI.SafeIframeRegexp to say what iframe embeds are OK (by default
everything is rejected).

Note: As iframes are invalid in strict doctypes, you will not be able to
use them there.

We also added an always_load parameter to URIFilters in order to support
the strange nature of the SafeIframe URIFilter (it always needs to be
loaded, due to the inability of accessing the %HTML.SafeIframe directive
to see if it's needed!)  We expect this URIFilter can expand in the future
to offer more complex validation mechanisms.

Signed-off-by: Bradley M. Froehle <brad.froehle@gmail.com>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 21:50:53 +08:00
Edward Z. Yang
6b643ede02 Implement %HTML.AllowedComments and %HTML.AllowedCommentsRegexp 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 15:34:42 +08:00
Edward Z. Yang
e41af46a8b Fix broken table content model, easily seen in XHTML1.1 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 14:49:26 +08:00
Edward Z. Yang
3570c9985a Properly handle nested sublists by folding into previous list item. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 14:00:34 +08:00
Edward Z. Yang
8d572993b4 Implement %HTML.TargetBlank 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 08:36:00 +08:00
Edward Z. Yang
1bacbc0563 Add isBenign and getDefaultScheme methods. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 23:31:15 +08:00
Edward Z. Yang
bfe2c10d07 Add a little bit of documentation about contexts for URIFilters. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 23:31:15 +08:00
Edward Z. Yang
9b10515fa4 Core.EscapeNonASCIICharacters now always works, even if target is UTF-8. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 23:31:15 +08:00
Edward Z. Yang
1255d0f15d Add support for scope attribute on td and th. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 23:31:13 +08:00
Edward Z. Yang
94c15d1f56 Fix iconv truncation bug. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 02:31:06 -05:00
Edward Z. Yang
ce68cfe484 Remove spurious abstract definition; PHP 5.4 doesn't like that. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-18 13:28:07 -05:00
Edward Z. Yang
9f5f85952b Don't unset parser variable; plays poorly with serialize. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-18 13:27:51 -05:00
Edward Z. Yang
32c0ffde0c Don't add nofollow for matching hosts, generalize this code. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-08-24 09:56:49 -04:00
Edward Z. Yang
820d6e9097 Do not duplicate nofollow attribute in transform. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-08-24 09:56:13 -04:00
Edward Z. Yang
35b1fbce01 Explicitly initialize anonModule to null. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-04-19 22:46:17 +01:00
Edward Z. Yang
bcfbb8338c URI.Munge munges https to http URIs. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-04-10 13:09:24 +01:00
Edward Z. Yang
f51a6f7de9 Color keywords now case-insensitive. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-04-10 12:45:02 +01:00
Edward Z. Yang
f1439f0af5 Release 4.3.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 23:02:49 +01:00
Edward Z. Yang
0124605918 Fix CSS URL innerHTML/cssText escaping bug. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 21:24:32 +01:00
Edward Z. Yang
afb007d22f Protect against font family innerHTML/cssText attacks. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 20:35:43 +01:00
Edward Z. Yang
0dd9e4faf4 Fix Internet Explorer innerHTML bug. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 11:50:52 +01:00
Edward Z. Yang
94ed3b1231 Implement CSS.AllowedFonts. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-24 22:54:39 +00:00
Edward Z. Yang
6a6c0ed5d7 Don't autoclose if no parents support the tag. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-22 00:26:41 +00:00
Edward Z. Yang
ee9c70ab7f Fix E_NOTICE from indexing into empty string. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-17 17:33:11 +00:00
Edward Z. Yang
b4469f17aa Fix missing numeric entities (shows up when DirectLexing). 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-02-27 11:58:37 +00:00
Edward Z. Yang
e76f4b45d0 Dramatically rewrite null host URI handling. 
Basically, browsers don't parse what should be valid URIs correctly, so
we have to go through some backbends to accomodate them.  Specifically,
for browseable URIs, the following URIs have unintended behavior:

    - ///example.com
    - http:/example.com
    - http:///example.com

Furthermore, if the path begins with //, modifying these URLs must
be done with care, as if you remove the host-name component, the
parse tree changes.

I've modified the engine to follow correct URI semantics as much
as possible while outputting browser compatible code, and invalidate
the URI in cases where we can't deal.  There has been a refactoring
of URIScheme so that this important check is always performed,
introducing a new member variable allow_empty_host which is true
on data, file, mailto and news schemes.

This also fixes bypass bugs on URI.Munge.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-01-25 18:56:46 +00:00
Edward Z. Yang
a32d5b52e1 Fix embedding flash on non-IE browsers and allow more wmode. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-01-22 12:28:57 +00:00
Maxim Krizhanovsky
a3d71fe606 Iterative traversal of DOM. 
There are some deep DOMs you can hit the maximum nesting level
limit in tokenizeDOM (we've experienced this even with maximum nesting
level of 300). Here is an iterative version of the same function with
simple queue/dequeue approach.

Signed-off-by: Maxim Krizhanovsky <darhazer@gmail.com>
 2011-01-19 22:06:40 +00:00
Edward Z. Yang
77982bd61d Bump version number for Cache.SerializerPermissions. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-01-14 00:40:39 +00:00
Petr Skoda
78c4e62245 Add new Cache.SerializerPermissions option. 2011-01-13 22:57:40 +00:00
Edward Z. Yang
b63569ac22 Fix bad interaction between bootstrap autoloader and Zend Debugger/APC. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-12-31 09:48:28 +00:00
Edward Z. Yang
f3d050c517 Fix two bugs with caching of customized raw definitions. 
The first bug is that we will repeatedly write out the result
of a customized raw definition to the filesystem, even when a cache
entry already exists.

The second bug is that caching these definitions doesn't actually
work (the cache entry is written but never used.)  A new API
for retrieving raw definitions permits the user to take advantage
of caching.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-12-30 23:51:53 +00:00
Edward Z. Yang
cfc4ee1faf Add initial implementation of CSS.Trusted. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-11-12 18:45:03 +00:00
Edward Z. Yang
feeffe6ed2 Check if schema.ser was corrupted. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-10-29 14:47:40 +01:00
Edward Z. Yang
4754d407aa Fix removal of id with DirectLex by preserving armor. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-10-28 17:25:31 +01:00
Nick Pope
0b9db1f54b Allow non-static autoload methods w/ PHP >= 5.2.11 
HTML Purifier loads itself as the first autoload function by
unregistering all existing functions and re-registering them after
registering itself.

Originally an exception was thrown when a non-static object method was
encountered as the behaviour of spl_autoload_functions() did not return
the object instance, but only the class name.  This was filed on PHP
bugs (#44144).

The bug was fixed for PHP >= 5.2.11 and >= 5.3

Signed-off-by: Nick Pope <nick@nickpope.me.uk>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-10-28 17:25:17 +01:00
Edward Z. Yang
1d4a38d055 Escape CDATA before handling conditional comments. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-28 12:11:26 -04:00
Edward Z. Yang
8c80349f9d Implement HTML.Nofollow for external links. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-28 12:01:57 -04:00
Edward Z. Yang
d848c99b74 Make IE conditional comment matching ungreedy. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-28 10:22:38 -04:00
Edward Z. Yang
882ffed9ba Release 4.2.0. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-15 02:52:57 -04:00
Edward Z. Yang
86990a21f1 Rename newline normalization directive to something better. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-15 02:50:39 -04:00
Tomasz Muras
9573f0933d Make newline normalization optional. 2010-09-14 23:49:28 -04:00
Edward Z. Yang
632bf2bbd4 Shift to 4.2.0 release cycle. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-14 23:38:51 -04:00
Edward Z. Yang
ec86598446 Add support for file:// URI scheme. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-09 00:01:26 -04:00
Edward Z. Yang
7c91104532 Implement HTML.FlashAllowFullScreen. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-08 23:39:20 -04:00
Edward Z. Yang
eac628f490 Add %CSS.ForbiddenProperties directive. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-04 02:59:03 -04:00
Edward Z. Yang
92913bc816 Add documentation about configuration directive types. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-04 02:28:53 -04:00
Edward Z. Yang
479d793562 Reword documentation to be clearer, and give warning on common user error. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-04 01:31:20 -04:00
Edward Z. Yang
e2c15f1c98 Fix Mac Snow Leopard APC bug. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-08-26 21:40:58 -07:00
Edward Z. Yang
c04a441b3e Actually make URI.DisableResources do something. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-06-30 05:59:17 -07:00
Edward Z. Yang
1bed8b6d5f Added %Core.RemoveProcessingInstructions. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-06-20 18:26:44 -07:00
Edward Z. Yang
33afd7d9e0 Fix improper handling of IE conditional comments. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-06-18 06:08:54 -07:00
Edward Z. Yang
18e538317a Release 4.1.1. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-31 20:17:31 -07:00
Edward Z. Yang
00c66fa9cb Fix bug in parsing single attribute with entities. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-31 19:44:18 -07:00
Edward Z. Yang
d3abcb90e3 Rewrite CSS url() and font-family output logic. 
The new logic is as follows:

* Given a URL to insert into url(), check that it is properly URL
  encoded (in particular, a doublequote and backslash never occurs
  within it) and then place it as url("http://example.com").

* Given a font name, if it is strictly alphanumeric, it is safe to omit
  quotes. Otherwise, wrap in double quotes and replace '"' with '\22 '
  (note trailing space) and '\' with '\5C ' (ditto).

We introduce expandCSSEscape() which is a hack for common parsing
idioms in CSS; this means that CSS escapes are now recognized inside
URLs as well as unquoted font names.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-31 18:45:21 -07:00
Edward Z. Yang
875b0febde Fix infinite loop involving wrapping formedness. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-17 23:22:51 -04:00
Edward Z. Yang
3166b8a10f Fix bug in background-position with center keyword. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-05 15:08:57 -04:00
Edward Z. Yang
1a70bffd5a Emit errors when body is extracted. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-04 13:41:09 -04:00
Edward Z. Yang
f4c6e10ff7 Release 4.1.0. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-04-26 18:31:40 -04:00
Edward Z. Yang
da94d3d6ac Always quote the contents of url() in CSS. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-04-26 12:10:15 -04:00
Edward Z. Yang
80793e925e Remove +x bit from RemoveSpansWithoutAttributes.php 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-04-17 00:23:09 -04:00
Edward Z. Yang
8ef4fb22db Support for flashvars in HTML.SafeEmbed. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-30 13:33:13 -04:00
Edward Z. Yang
70a7a3f5dd Handle <ol><ol> properly by adding missing <li> tag. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-10 00:58:37 -05:00
Edward Z. Yang
4d612d5a77 Improve handling of malformed object parameters. 
When specifying source material for <object> tags, you must use
data inside the object tag as well as specify movie in a param.
If you specify a src (which is the appropriate markup for <embed>)
we now convert and fill in the other attributes appropriately.

Also, fix a PHP warning in Generator code.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-09 17:29:38 -05:00
Edward Z. Yang
63a854ee5d Remove call-time pass-by-reference. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-08 03:45:11 -05:00
Edward Z. Yang
0229458f8f Implement Internet Explorer compatibility code for embedded content. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-08 01:56:40 -05:00
Edward Z. Yang
baa477ac08 Truncate alt text from src if it's too long. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-08 01:22:21 -05:00
Edward Z. Yang
dc90e8e85b Support flashvars. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-08 01:16:57 -05:00
Edward Z. Yang
97125ed18b Implement data URI scheme. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-07 21:45:39 -05:00
Paul Stone
9a9036c689 Implement auto-formatter that removes empty span tags. 
Signed-off-by: Paul Stone <patches@pdjs.co.uk>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-07 18:59:33 -05:00
Edward Z. Yang
aea7d02dfe Support YouTube slideshow embedding. 
YouTube slideshows contain a /cp/, not a /v/, in their URL;
relax the YouTube filter to allow them.

Signed-off-by: Nigel McNie <nigel@catalyst.net.nz>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-03-07 18:57:22 -05:00
Brian DeRocher
b3ca1498c2 Add boolean value flag for PEARSax3 for testing if a token is empty. 
Signed-off-by: Brian DeRocher <brian@derocher.org>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-02-26 21:36:51 -05:00
Edward Z. Yang
ac18672aba Fix extant broken PEARSax3 parsing patterns. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-02-26 21:14:52 -05:00
Edward Z. Yang
faf28682ad Manually work around PEARSax3 E_STRICT errors. 
Previously, my development environment was not running the PEARSax3
tests because my environment was set to E_STRICT error handling, and
thus the tests were skipped.  Relax this requirement by making the
wrapper class E_STRICT safe.  This introduces a few failing tests.

Also update TODO and add another fresh test.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-02-26 20:42:42 -05:00
Edward Z. Yang
694583259c Fix autoparagraph bug with non-inline elements. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-02-15 02:55:33 -05:00
Edward Z. Yang
5b4e5c983e Support proprietary height attribute on table. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2009-08-27 20:17:24 -04:00
Edward Z. Yang
1ad8fd5ce9 Gracefully deal with null injectors. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2009-08-27 20:03:31 -04:00
Edward Z. Yang
53ff3e2744 Release 4.0.0. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2009-07-07 22:41:01 -04:00
Edward Z. Yang
ba9fd175d7 Make extractBody not terminate prematurely on first </body>. 
Previously, if two </body> tags were present, HTML Purifier
would truncate everything after the first </body>.  This is
not ideal behavior; so HTML Purifier has been changed to
match up to the last </body>.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2009-07-07 22:19:04 -04:00
Edward Z. Yang
4d27906b02 Make %URI.Munge respect %URI.Host (don't munge). 
%URI.Munge incorrectly munged URIs that pointed to the
same host as the current website (it did, however, have
the correct behavior for when the munge URL was on the
same server).

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2009-07-06 22:04:51 -04:00
Edward Z. Yang
c7594487a2 Fix inability to totally override content model. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-06-10 18:24:52 -04:00
Edward Z. Yang
733a5ce5c3 Fix allowsElement() bug manifesting in LinkifyTest. 
Thanks frank farmer for reporting.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-06-10 18:11:34 -04:00
Edward Z. Yang
e8abd5953c Fix prototype impedance in HTMLDefinition and typo in 
docs/enduser-customize.html
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-06-07 16:05:46 -04:00
Edward Z. Yang
1b8c8865b2 Fix PHP 5.3.0 problem with numeric indices causing -0 problem. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-06-07 16:04:07 -04:00
Edward Z. Yang
6e66dc9cad Add HTMLPurifier_config->serialize() 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-30 00:25:14 -04:00
Edward Z. Yang
5bf7ac4e9f Add docs and facilities for having separate directories of schemas. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-29 22:16:35 -04:00
Edward Z. Yang
a025203b18 Minor updates to Config and TODO items thereof. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-29 18:03:57 -04:00
Edward Z. Yang
777781a95c Don't have mute error handler be private. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-29 17:59:30 -04:00
Edward Z. Yang
4a87f732ca Fix two minor bugs, updating Phorum and removing unused $dir variable. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-27 01:17:23 -04:00
Edward Z. Yang
84abae08f5 Relax allowed values of class for certain doctypes, see %Attr.ClassUseCDATA 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-26 01:07:40 -04:00
Edward Z. Yang
10e2d32a79 Lock configuration objects to a single namespace, to help prevent bugs. 
* Also, fix a slight bug with URI definition clearing.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-25 23:38:49 -04:00
Edward Z. Yang
baf053b016 Implement %Attr.AllowedClasses and %Attr.ForbiddenClasses. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-25 22:08:45 -04:00
Edward Z. Yang
bfbe29d5a1 Rename ExtractStyleBlocks configuration parameters. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-25 21:54:39 -04:00
Edward Z. Yang
e194b8efc6 Rename AutoFormatParam.PurifierLinkifyDocURL. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-25 21:51:08 -04:00
Edward Z. Yang
24f761d84a Remove PHP4 cruft from URISchemeRegistry. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-05-13 16:14:57 -04:00
Edward Z. Yang
e3c2063f69 Implement %AutoFormat.RemoveEmpty.RemoveNbsp, by popular demand. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-04-09 00:53:19 -04:00
Edward Z. Yang
398a02039e Implement %HTML.Attr.Name.UseCDATA which relaxes name validation rules. 
Sponsored-by: Ian Cook <thinkspill@gmail.com>
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-03-20 19:34:38 -04:00
Edward Z. Yang
eaa906f8fc Implement configuration inheritance. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-21 03:01:02 -05:00
Edward Z. Yang
86ca784da3 Convert all to new configuration get/set format. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-21 03:00:34 -05:00
Edward Z. Yang
b107eec452 Revamp configuration backend. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-21 03:00:33 -05:00
Edward Z. Yang
fcbf724e6e Make name="" and id="" play nicely together. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-21 02:58:30 -05:00
Edward Z. Yang
e9f529e78f Release 3.3.0. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-16 17:18:31 -05:00
Edward Z. Yang
77f57aa264 Fix CSSDefinition Printer problems with important decorator. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-15 14:11:22 -05:00
Edward Z. Yang
db218c7b2b Fix YouTube rendering problem on versions of Firefox. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-15 14:11:21 -05:00
Edward Z. Yang
07ed1bbf8c Fix broken trusted comments functionality. 
This fix is slightly hackish, as we simply treat comments as whitespace.
This should largely be correct, and breaks no current test cases,
although it could result in noncompliant behavior.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-05 18:04:10 -05:00
Edward Z. Yang
b9094d5ec8 Convert HTMLPurifier_Config to use property list backend. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-02 18:42:23 -05:00
Edward Z. Yang
1b962e68f0 Downgrade directory not found and permissions errors to warnings. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-02 10:08:37 -05:00
Edward Z. Yang
bfe474042f Implement "carryover" functionality, requested by Kinderlehrer <bitweaver@7doves.com> 
This commit is a limited implementation of the "active formatting
elements" algorithm implemented in HTML5, which preserves certain
formatting elements such as <a> and <b> when exiting or entering nodes.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-20 13:06:00 -05:00
Edward Z. Yang
3dfcd016d3 Fix standards-compliance issue with YouTube filter with double hyphens. 
Thanks Pierre Attar for reporting.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-12 16:27:23 -05:00
Edward Z. Yang
12b811d749 Add vim modelines to all files. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-06 04:24:59 -05:00
Edward Z. Yang
2c955af135 Remove trailing whitespace. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-06 02:28:20 -05:00
Edward Z. Yang
3a6b63dff1 Generic implementation of property-lists. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-06 00:43:42 -05:00
Edward Z. Yang
5cfecebb33 Fix bug involving whitespace-only nodes. Thanks Eric Wald for reporting. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-02 20:13:47 -05:00
Edward Z. Yang
f5cd2c07ea Implement 'overflow' CSS property. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-11-27 16:14:50 -05:00
Edward Z. Yang
e128c09132 Fix bug with testEncodingSupportsASCII() with strange iconv 
implementations.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-11-26 15:17:09 -05:00
Edward Z. Yang
c5d4b1ec93 Fix missing version number in config directive, and add TODO item. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-11-05 02:56:13 -05:00
Edward Z. Yang
280211f70b Release 3.2.0. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-31 16:30:54 -04:00
Edward Z. Yang
0e6e2c4edf Bump descriptions to 3.2.0. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-31 12:25:43 -04:00
Edward Z. Yang
3a2fd0b5db Improve floating point scaling in UnitConverter. 
When precision dictates that a number be zero padded, we cannot give sprintf()
a negative precision specifier.  This commit implements manual negative precision
printing of floats, taking into account common rounding errors with floating
point numbers.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-24 12:50:59 -04:00
David Morton
0b6ae1c3c1 Custom Injector to display URL address along with link text. 
When viewing potentially hostile html, it may be helpful to see what
a given link was pointing to.  This new injector takes the href
attribute and adds the text after the link, and deletes the href
attribute.

Other forms of display could easily be contrived, but this seems to be
a good basic way to present the information.

Signed-off-by: David Morton <mortonda@dgrmm.net>
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-23 17:11:29 -04:00
Edward Z. Yang
d304c5c976 Detect if domxml extension is loaded, and use DirectLex accordingly. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-08 17:06:10 -04:00
Edward Z. Yang
f7bc0b0875 Implement %Attr.DefaultImageAlt, allowing overriding default behavior for alt attributes. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-06 14:51:03 -04:00
Edward Z. Yang
70515dd48f Increase test coverage, and modify handleEnd behavior to only see correct tokens. 
Previously, handleEnd was called for any end tag, except ones that were obviously
spurious because there were no parent tags. Now, it is only called for end tags
that are "approved." If an injector operates on the end tag, we automatically
punt. There may be some optimizations that could be made to this procedure,
but for now it's much more consistent.

Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-10-01 15:40:31 -04:00