mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-11-08 06:48:42 +00:00
Code Releases Activity
1,470 Commits 5 Branches 66 Tags 9.3 MiB
80ebd4322e
Commit Graph

506 Commits

Author SHA1 Message Date
Edward Z. Yang
6f389f0f25 Release 4.6.0. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2013-11-30 00:25:19 -08:00
Edward Z. Yang
0beecad78a Add Twitter handle to release notes. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-11-29 22:26:57 -08:00
Edward Z. Yang
54477c172b Fix infinite loop in Lexer. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-27 21:41:08 -07:00
Edward Z. Yang
0767bbc12d Rewrite FixNesting implementation to be tree-based. 
This mega-patch rips out the FixNesting implementation and the related
ChildDef components.  The primary algorithmic change is to convert from
use of tokens to tree nodes, which are far more amenable to the style
of processing that FixNesting uses.  Additionally, FixNesting has been
changed to go bottom-up rather than top-down, in order to avoid needing
to implement backtracking.

This patch simplifies a good deal of the relevant logic, since we no
longer need to continually recalculate the nesting structure when
processing things.  However, the conversion to the alternate format
incurs some overhead, so for small inputs these changes are not a win.
One possibility to greatly reduce the constant factors here is to switch
to entirely using libxml's representation, and never serializing tokens;
this would require one to rewrite injectors, however.

The iterative post-order traversal in FixNesting is a bit subtle, but
we have essentially reified the stack and continuations.

We've removed support for %Core.EscapeInvalidChildren.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-20 22:37:01 -07:00
Edward Z. Yang
412bae13b5 Fix quadratic behavior in DOMLex due to array_shift. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-09-17 00:48:42 -07:00
Edward Z. Yang
cf44f399f8 Properly use HMAC for secure munging. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-09-13 21:16:50 -07:00
Edward Z. Yang
53c2907706 New directive %Core.AllowHostnameUnderscore 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-07-26 21:33:39 -07:00
Edward Z. Yang
0680832d41 Use info_parent_def to get parent information, since it may not be present in info array. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-05-21 17:19:59 -07:00
Edward Z. Yang
19360ddb36 Ignore commas and nbsps for linkification. Thanks nAS for contributing. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-05-21 16:43:59 -07:00
Edward Z. Yang
6e37ecd1c8 Make URI parsing algorithm more strict. 
Thanks Michael Gusev <mgusev@sugarcrm.com> for contributing this patch.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-04-16 13:56:43 -07:00
Edward Z. Yang
20eff0a3a0 Fix NEWS entry. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-21 14:08:36 -08:00
Edward Z. Yang
d516e2f8de Release 4.5.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-17 16:04:08 -08:00
Edward Z. Yang
631021733b Add %Core.DisableExcludes directive 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-17 15:47:38 -08:00
Edward Z. Yang
62d2550e16 Use SHA-1 instead of MD5. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:33:22 -07:00
Edward Z. Yang
087145a71b Blacklist more tags from RemoveEmpty. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:32:48 -07:00
Edward Z. Yang
a44187a5c1 Cleanup after data validation. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:30:58 -07:00
Edward Z. Yang
3b537365a4 CSS properties page-break-* 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-11 11:39:52 -07:00
Edward Z. Yang
72db575446 Fix bug with non-lower case color names in HTML. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-07-30 10:54:32 -04:00
Edward Z. Yang
d8bb73ce46 Permit underscores in font-families. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-07-27 18:28:29 -04:00
Edward Z. Yang
f90372f8ab More support for white-space. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-06-16 17:10:36 -04:00
Edward Z. Yang
f38fca32a9 Don't lower-case components of background. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-06-02 11:22:58 -04:00
Edward Z. Yang
5a23004652 Support for inline-block. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-05-25 23:55:48 -04:00
Edward Z. Yang
6705140082 Fix in AttrTransform_Nofollow 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-05-14 23:07:27 -04:00
Edward Z. Yang
cb7162a995 Use prepend for autoloading on PHP 5.3+ 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-05-02 11:07:24 -04:00
Edward Z. Yang
7291f19347 Fix problem where stacked AttrTransforms clobber each other. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-03-16 23:12:16 -04:00
Edward Z. Yang
7291a9647e Update NEWS. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-25 07:06:30 -05:00
Edward Z. Yang
17af0e4fc1 Release 4.4.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-18 19:22:31 -05:00
Edward Z. Yang
1c7fedff5a Tighter CSS selector validation. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-17 15:36:26 -05:00
Edward Z. Yang
974fe3f25e Optional support for IDNAs with PEAR Net_IDNA2 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-06 05:28:00 -08:00
Edward Z. Yang
94468f3c24 Remove PEARSax3 lexer. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-01-03 20:40:17 +08:00
Edward Z. Yang
e0354fecd9 Make forms work for transitional doctypes. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-30 22:56:44 +08:00
Edward Z. Yang
5c9b5130c8 Bump minor version number to 4.4.0. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 21:55:14 +08:00
Bradley M. Froehle
4164b2eb2b Implement Iframe module, and provide %HTML.SafeIframe and %URI.SafeIframeRegexp for untrusted usage. 
The purpose of this addition is twofold. In trusted mode, iframes are
now unconditionally allowed.

However, many online video providers (YouTube, Vimeo) and other web
applications (Google Maps, Google Calendar, etc) provide embed code in
iframe format, which is useful functionality in untrusted mode.
You can specify iframes as trusted elements with %HTML.SafeIframe;
however, you need to additionally specify a whitelist mechanism such as
%URI.SafeIframeRegexp to say what iframe embeds are OK (by default
everything is rejected).

Note: As iframes are invalid in strict doctypes, you will not be able to
use them there.

We also added an always_load parameter to URIFilters in order to support
the strange nature of the SafeIframe URIFilter (it always needs to be
loaded, due to the inability of accessing the %HTML.SafeIframe directive
to see if it's needed!)  We expect this URIFilter can expand in the future
to offer more complex validation mechanisms.

Signed-off-by: Bradley M. Froehle <brad.froehle@gmail.com>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 21:50:53 +08:00
Edward Z. Yang
1e5293d9fe Add more attributions. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 15:45:41 +08:00
Edward Z. Yang
6b643ede02 Implement %HTML.AllowedComments and %HTML.AllowedCommentsRegexp 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 15:34:42 +08:00
Edward Z. Yang
e41af46a8b Fix broken table content model, easily seen in XHTML1.1 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 14:49:26 +08:00
Edward Z. Yang
3570c9985a Properly handle nested sublists by folding into previous list item. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 14:00:34 +08:00
Edward Z. Yang
8d572993b4 Implement %HTML.TargetBlank 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-26 08:36:00 +08:00
Edward Z. Yang
9b10515fa4 Core.EscapeNonASCIICharacters now always works, even if target is UTF-8. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 23:31:15 +08:00
Edward Z. Yang
1255d0f15d Add support for scope attribute on td and th. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 23:31:13 +08:00
Edward Z. Yang
94c15d1f56 Fix iconv truncation bug. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-25 02:31:06 -05:00
Edward Z. Yang
9f5f85952b Don't unset parser variable; plays poorly with serialize. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-12-18 13:27:51 -05:00
Edward Z. Yang
32c0ffde0c Don't add nofollow for matching hosts, generalize this code. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-08-24 09:56:49 -04:00
Edward Z. Yang
820d6e9097 Do not duplicate nofollow attribute in transform. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-08-24 09:56:13 -04:00
Edward Z. Yang
35b1fbce01 Explicitly initialize anonModule to null. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-04-19 22:46:17 +01:00
Edward Z. Yang
bcfbb8338c URI.Munge munges https to http URIs. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-04-10 13:09:24 +01:00
Edward Z. Yang
f51a6f7de9 Color keywords now case-insensitive. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-04-10 12:45:02 +01:00
Edward Z. Yang
f1439f0af5 Release 4.3.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 23:02:49 +01:00
Edward Z. Yang
0124605918 Fix CSS URL innerHTML/cssText escaping bug. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 21:24:32 +01:00
Edward Z. Yang
afb007d22f Protect against font family innerHTML/cssText attacks. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 20:35:43 +01:00