mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-12-23 17:01:51 +00:00
Code Releases Activity
1,408 Commits 7 Branches 66 Tags 9.5 MiB
e0354fecd9
Commit Graph

40 Commits

Author SHA1 Message Date
Edward Z. Yang
afb007d22f Protect against font family innerHTML/cssText attacks. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2011-03-27 20:35:43 +01:00
Edward Z. Yang
cfc4ee1faf Add initial implementation of CSS.Trusted. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-11-12 18:45:03 +00:00
Edward Z. Yang
eac628f490 Add %CSS.ForbiddenProperties directive. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-09-04 02:59:03 -04:00
Edward Z. Yang
d3abcb90e3 Rewrite CSS url() and font-family output logic. 
The new logic is as follows:

* Given a URL to insert into url(), check that it is properly URL
  encoded (in particular, a doublequote and backslash never occurs
  within it) and then place it as url("http://example.com").

* Given a font name, if it is strictly alphanumeric, it is safe to omit
  quotes. Otherwise, wrap in double quotes and replace '"' with '\22 '
  (note trailing space) and '\' with '\5C ' (ditto).

We introduce expandCSSEscape() which is a hack for common parsing
idioms in CSS; this means that CSS escapes are now recognized inside
URLs as well as unquoted font names.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-05-31 18:45:21 -07:00
Edward Z. Yang
da94d3d6ac Always quote the contents of url() in CSS. 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
 2010-04-26 12:10:15 -04:00
Edward Z. Yang
86ca784da3 Convert all to new configuration get/set format. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2009-02-21 03:00:34 -05:00
Edward Z. Yang
12b811d749 Add vim modelines to all files. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-06 04:24:59 -05:00
Edward Z. Yang
2c955af135 Remove trailing whitespace. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-12-06 02:28:20 -05:00
Edward Z. Yang
f5cd2c07ea Implement 'overflow' CSS property. 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
 2008-11-27 16:14:50 -05:00
Edward Z. Yang
2cc535ad84 [3.1.0] Support for display/visibility CSS with %CSS.AllowTricky 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1579 48356398-32a2-884e-a903-53898d9a118a
 2008-02-25 22:05:49 +00:00
Edward Z. Yang
30eb982961 [3.1.0] Add support for !important, with %CSS.AllowImportant 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1578 48356398-32a2-884e-a903-53898d9a118a
 2008-02-25 21:58:17 +00:00
Edward Z. Yang
fbc595ebed Remove includes from unit tests. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1569 48356398-32a2-884e-a903-53898d9a118a
 2008-02-18 04:41:42 +00:00
Edward Z. Yang
0f961c6af4 [3.0.0] [BACKPORT] More work for hire from Chris 
! Experimental support for some proprietary CSS attributes allowed: opacity (and all of the browser-specific equivalents) and scrollbar colors. Enable by setting %CSS.Proprietary to true.
- Colors missing # but in hex form will be corrected
- CSS Number algorithm improved
. New classes:
  + HTMLPurifier_AttrDef_CSS_AlphaValue
  + HTMLPurifier_AttrDef_CSS_Filter

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1473 48356398-32a2-884e-a903-53898d9a118a
 2007-12-16 23:16:45 +00:00
Edward Z. Yang
7ddd9d0afe [3.0.0] [BACKPORT] Make CSS properties case-insensitive 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1461 48356398-32a2-884e-a903-53898d9a118a
 2007-12-01 17:00:55 +00:00
Edward Z. Yang
5b3c8c5534 [2.1.2] Implement border-spacing 
- Fix PH5P testing in PHP4

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1401 48356398-32a2-884e-a903-53898d9a118a
 2007-09-03 15:16:33 +00:00
Edward Z. Yang
a19f30fdcf [2.1.2] Fix silly little typo with border-collapse:separate 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1379 48356398-32a2-884e-a903-53898d9a118a
 2007-08-11 06:52:26 +00:00
Edward Z. Yang
e99520ab96 Remove trailing ?> in PHP library files, add trailing newlines to all other files. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1253 48356398-32a2-884e-a903-53898d9a118a
 2007-06-27 13:58:32 +00:00
Edward Z. Yang
d693c4ea09 [1.4.0] Implement 'background' shorthand CSS property. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@663 48356398-32a2-884e-a903-53898d9a118a
 2007-01-20 02:21:43 +00:00
Edward Z. Yang
a68b6afda1 [1.4.0] CSS property background-position implemented. Also: 
- Fixed some misinformation in Percentage
- Add support for lowercase CSS length units

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@661 48356398-32a2-884e-a903-53898d9a118a
 2007-01-20 01:40:56 +00:00
Edward Z. Yang
d60f345cab [1.4.0] Implemented background-image, background-repeat and background-attachment CSS properties. background shorthand property HAS NOT been extended to allow these, and background-position IS NOT implemented yet. 
- Also: fixed up some flaky behavior in list-style shorthand, introduced uri_or_none

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@643 48356398-32a2-884e-a903-53898d9a118a
 2007-01-15 01:14:24 +00:00
Edward Z. Yang
aefda60696 [1.4.0] Refactored ListStyle, since list-style-image was sort of tacked on and didn't really conform with the standard. Implementation is still a little flaky but conforms with W3C's validation service. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@642 48356398-32a2-884e-a903-53898d9a118a
 2007-01-15 00:48:54 +00:00
Edward Z. Yang
23d3490d49 [1.4.0] Implemented list-style-image, URIs now allowed in list-style 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@640 48356398-32a2-884e-a903-53898d9a118a
 2007-01-14 16:24:02 +00:00
Edward Z. Yang
a5b4ed2126 [1.0.1] Fixed rejection of inline style declarations that had lots of extra space in them. This manifested in TinyMCE. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@382 48356398-32a2-884e-a903-53898d9a118a
 2006-09-04 23:01:47 +00:00
Edward Z. Yang
670d298a87 Implement list-style shorthand. Also, updated devnetwork.html with more recent threads. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@337 48356398-32a2-884e-a903-53898d9a118a
 2006-08-29 02:01:58 +00:00
Edward Z. Yang
dd1b911183 Implement limited CSS property background, can only do colors (though this is desired behavior). 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@332 48356398-32a2-884e-a903-53898d9a118a
 2006-08-28 20:10:01 +00:00
Edward Z. Yang
78414abafd Implement all useful table properties. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@325 48356398-32a2-884e-a903-53898d9a118a
 2006-08-27 01:45:23 +00:00
Edward Z. Yang
692a9abc0f Implement shorthand CSS property border. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@324 48356398-32a2-884e-a903-53898d9a118a
 2006-08-27 00:49:34 +00:00
Edward Z. Yang
80e79d906a Implement CSS property Font. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@321 48356398-32a2-884e-a903-53898d9a118a
 2006-08-27 00:11:13 +00:00
Edward Z. Yang
ed7e72f2e3 Commit FontFamily implementation. It's a little flaky, but should be reasonable for 99% of all fonts. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@282 48356398-32a2-884e-a903-53898d9a118a
 2006-08-16 17:25:25 +00:00
Edward Z. Yang
cb463f9676 Commit text-decoration implementation. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@280 48356398-32a2-884e-a903-53898d9a118a
 2006-08-16 15:12:48 +00:00
Edward Z. Yang
3422378c32 Implement all "Multiple" CSS properties. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@273 48356398-32a2-884e-a903-53898d9a118a
 2006-08-16 01:39:06 +00:00
Edward Z. Yang
1388beb456 Implement all composite CSS definitions. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@271 48356398-32a2-884e-a903-53898d9a118a
 2006-08-16 00:18:58 +00:00
Edward Z. Yang
0170bb2120 Add Percentage, and font-size (not all styles fully realized yet though). 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@242 48356398-32a2-884e-a903-53898d9a118a
 2006-08-14 02:08:45 +00:00
Edward Z. Yang
b5ff592157 Add CSSLength support, and roll out to all applicable styles. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@237 48356398-32a2-884e-a903-53898d9a118a
 2006-08-13 23:08:38 +00:00
Edward Z. Yang
4ffb2da238 Implement the color AttrDef. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@230 48356398-32a2-884e-a903-53898d9a118a
 2006-08-13 21:23:57 +00:00
Edward Z. Yang
415b7d3913 Add more information to progress document, fix an invalid definition in CSSDefinition. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@229 48356398-32a2-884e-a903-53898d9a118a
 2006-08-13 19:08:14 +00:00
Edward Z. Yang
441a0cbe94 Minor formatting fixes. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@227 48356398-32a2-884e-a903-53898d9a118a
 2006-08-13 17:05:30 +00:00
Edward Z. Yang
1e2f853f4f Implemented CSS properties whose valid values were enumerated. Accept inherit for all properties. Some composite unit tests. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@226 48356398-32a2-884e-a903-53898d9a118a
 2006-08-13 16:52:31 +00:00
Edward Z. Yang
d721066d27 Make CSS validator drop duplicate declarations. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@225 48356398-32a2-884e-a903-53898d9a118a
 2006-08-13 04:52:40 +00:00
Edward Z. Yang
7c86e3cc0f Commit initial implementation of AttrDef_CSS, with text-align being the only defined property. Further development will be going on in AttrDef and CSSDefinition. 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@223 48356398-32a2-884e-a903-53898d9a118a
 2006-08-12 20:22:09 +00:00