mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-12-22 16:31:53 +00:00
Code Releases Activity
1,542 Commits 7 Branches 66 Tags 9.5 MiB
9195cb7a2e
Commit Graph

535 Commits

Author SHA1 Message Date
Bastian Hofmann
8e4cacf0a7 Refactor HTML.Noopener to HTML.TargetNoopener so that it behaves like HTML.TargetNoreferrer and is active by default if a target is set 2017-02-03 16:54:51 -08:00
Bastian Hofmann
c82051c3e1 Add HTML.Noopener to add a noopener rel to every external link 
This has performance benefits https://jakearchibald.com/2016/performance-benefits-of-rel-noopener/ but most importantly also security benefits https://mathiasbynens.github.io/rel-noopener/

Adresses https://github.com/ezyang/htmlpurifier/issues/96
 2017-02-03 16:54:51 -08:00
Edward Z. Yang
5070404376 Handle semicolons in strings in CSS correctly. 
Fixes http://htmlpurifier.org/phorum/read.php?3,7522,8096

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-29 00:01:19 -07:00
Edward Z. Yang
cef27f750d Add missing changelog entries. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-27 17:31:10 -07:00
Edward Z. Yang
59463c5c39 Allow %URI.DefaultScheme to be null. 
Fixes #103.

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-10-27 17:30:44 -07:00
Edward Z. Yang
d0c392f77d Release 4.8.0 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-07-16 05:58:58 -07:00
Edward Z. Yang
d1c5d75027 Fix #73 with Attr.ID.HTML5 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-07-16 05:52:45 -07:00
Edward Z. Yang
ed180f595d Hack to fix #85 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-07-01 15:52:09 -04:00
Edward Z. Yang
44baee6a82 Partial border-radius support. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-06-30 22:22:13 -04:00
Cameron Ball
1675fc7caf Add %HTML.TargetNoreferrer, which adds rel="noreferrer" when target attribute is set 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-06-30 21:53:43 -04:00
Wes Cossick
cc35c8eb8c tel protocol support. 2016-06-30 21:19:49 -04:00
Edward Z. Yang
43a9f052fd Fix #57, make flashvars check (and others) case-insensitive. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-27 15:56:30 -07:00
Edward Z. Yang
b4981c3395 Fix #67, don't use <body> tags in comments for %Core.ConvertDocumentToFragment 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-27 15:19:32 -07:00
Edward Z. Yang
f14076dc3e Fix #49; prevent readdir infinite loop when cache directory not listable. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-27 14:53:31 -07:00
Edward Z. Yang
91fd55c857 Fix #45, errors when ul/ol allowed without li. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-26 22:41:54 -07:00
Chimpzee
6e00b443cd Bug with tempnam("/tmp", ""); 
Some hostings have a different temporary path than "/tmp".
 2016-03-24 20:19:57 -07:00
Edward Z. Yang
7e49ff3dcd Announce PHP 7 support. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-24 00:14:05 -07:00
Edward Z. Yang
1f3e282fde Fix a bounds error which now errors in PHP 7. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-24 00:13:08 -07:00
Edward Z. Yang
45161b4fb1 Accept leading digits in hostnames as per RFC 1123. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-23 22:42:21 -07:00
Edward Z. Yang
92aabf2b23 Fix #76, linkify includes dots at end of URL. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2016-03-02 02:05:54 -08:00
Edward Z. Yang
913ac6955b CSS.AllowDuplicates for duplicate properties. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2015-12-20 11:53:54 -08:00
Edward Z. Yang
958ba65595 Don't truncate alts. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2015-09-29 15:36:53 -07:00
Edward Z. Yang
ae1828d955 Release 4.7.0. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2015-08-04 18:03:42 -07:00
Edward Z. Yang
c67e4c2f7e All values, including empty, are valid HTML bools. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2015-02-11 16:36:44 -08:00
Edward Z. Yang
cd60294ada Fix rgb in border attribute with spaces, fixes #30. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 12:12:38 +01:00
Edward Z. Yang
39d3df1fd7 Add AutoFormat.RemoveEmpty.Predicate, fixes #35. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 12:12:17 +01:00
Edward Z. Yang
4da38aca80 Update YouTube embed code to new style, fixes #28 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 09:30:16 +01:00
Edward Z. Yang
bf84df4f7d Move opacity to tricky. Fixes #16. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 09:24:11 +01:00
Edward Z. Yang
15d1a3003a Don't truncate in DOMLex when seeing closing div 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2014-08-31 08:50:33 +01:00
Edward Z. Yang
6f389f0f25 Release 4.6.0. 
Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>
 2013-11-30 00:25:19 -08:00
Edward Z. Yang
0beecad78a Add Twitter handle to release notes. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-11-29 22:26:57 -08:00
Edward Z. Yang
54477c172b Fix infinite loop in Lexer. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-27 21:41:08 -07:00
Edward Z. Yang
0767bbc12d Rewrite FixNesting implementation to be tree-based. 
This mega-patch rips out the FixNesting implementation and the related
ChildDef components.  The primary algorithmic change is to convert from
use of tokens to tree nodes, which are far more amenable to the style
of processing that FixNesting uses.  Additionally, FixNesting has been
changed to go bottom-up rather than top-down, in order to avoid needing
to implement backtracking.

This patch simplifies a good deal of the relevant logic, since we no
longer need to continually recalculate the nesting structure when
processing things.  However, the conversion to the alternate format
incurs some overhead, so for small inputs these changes are not a win.
One possibility to greatly reduce the constant factors here is to switch
to entirely using libxml's representation, and never serializing tokens;
this would require one to rewrite injectors, however.

The iterative post-order traversal in FixNesting is a bit subtle, but
we have essentially reified the stack and continuations.

We've removed support for %Core.EscapeInvalidChildren.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-10-20 22:37:01 -07:00
Edward Z. Yang
412bae13b5 Fix quadratic behavior in DOMLex due to array_shift. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-09-17 00:48:42 -07:00
Edward Z. Yang
cf44f399f8 Properly use HMAC for secure munging. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-09-13 21:16:50 -07:00
Edward Z. Yang
53c2907706 New directive %Core.AllowHostnameUnderscore 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-07-26 21:33:39 -07:00
Edward Z. Yang
0680832d41 Use info_parent_def to get parent information, since it may not be present in info array. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-05-21 17:19:59 -07:00
Edward Z. Yang
19360ddb36 Ignore commas and nbsps for linkification. Thanks nAS for contributing. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-05-21 16:43:59 -07:00
Edward Z. Yang
6e37ecd1c8 Make URI parsing algorithm more strict. 
Thanks Michael Gusev <mgusev@sugarcrm.com> for contributing this patch.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-04-16 13:56:43 -07:00
Edward Z. Yang
20eff0a3a0 Fix NEWS entry. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-21 14:08:36 -08:00
Edward Z. Yang
d516e2f8de Release 4.5.0 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-17 16:04:08 -08:00
Edward Z. Yang
631021733b Add %Core.DisableExcludes directive 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2013-02-17 15:47:38 -08:00
Edward Z. Yang
62d2550e16 Use SHA-1 instead of MD5. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:33:22 -07:00
Edward Z. Yang
087145a71b Blacklist more tags from RemoveEmpty. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:32:48 -07:00
Edward Z. Yang
a44187a5c1 Cleanup after data validation. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-27 02:30:58 -07:00
Edward Z. Yang
3b537365a4 CSS properties page-break-* 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-10-11 11:39:52 -07:00
Edward Z. Yang
72db575446 Fix bug with non-lower case color names in HTML. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-07-30 10:54:32 -04:00
Edward Z. Yang
d8bb73ce46 Permit underscores in font-families. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-07-27 18:28:29 -04:00
Edward Z. Yang
f90372f8ab More support for white-space. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-06-16 17:10:36 -04:00
Edward Z. Yang
f38fca32a9 Don't lower-case components of background. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2012-06-02 11:22:58 -04:00