mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-12-24 17:21:52 +00:00
49cb2a4a7c
# Invalid images are now removed, rather than replaced with a dud <img src="" alt="Invalid image" />. Previous behavior can be restored with new directive %Core.RemoveInvalidImg set to false. ! New directives %URI.DisableExternalResources and %URI.DisableResources ! New directive %Attr.DisableURI, which eliminates all hyperlinking - Missing "Available since" documentation added git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@575 48356398-32a2-884e-a903-53898d9a118a
83 lines
3.2 KiB
PHP
83 lines
3.2 KiB
PHP
<?php
|
|
|
|
require_once 'HTMLPurifier/Strategy.php';
|
|
require_once 'HTMLPurifier/HTMLDefinition.php';
|
|
require_once 'HTMLPurifier/Generator.php';
|
|
require_once 'HTMLPurifier/TagTransform.php';
|
|
|
|
HTMLPurifier_ConfigSchema::define(
|
|
'Core', 'RemoveInvalidImg', true, 'bool',
|
|
'This directive enables pre-emptive URI checking in <code>img</code> '.
|
|
'tags, as the attribute validation strategy is not authorized to '.
|
|
'remove elements from the document. This directive has been available '.
|
|
'since 1.3.0, revert to pre-1.3.0 behavior by setting to false.'
|
|
);
|
|
|
|
/**
|
|
* Removes all unrecognized tags from the list of tokens.
|
|
*
|
|
* This strategy iterates through all the tokens and removes unrecognized
|
|
* tokens. If a token is not recognized but a TagTransform is defined for
|
|
* that element, the element will be transformed accordingly.
|
|
*/
|
|
|
|
class HTMLPurifier_Strategy_RemoveForeignElements extends HTMLPurifier_Strategy
|
|
{
|
|
|
|
function execute($tokens, $config, &$context) {
|
|
$definition = $config->getHTMLDefinition();
|
|
$generator = new HTMLPurifier_Generator();
|
|
$result = array();
|
|
$escape_invalid_tags = $config->get('Core', 'EscapeInvalidTags');
|
|
foreach($tokens as $token) {
|
|
if (!empty( $token->is_tag )) {
|
|
// DEFINITION CALL
|
|
if (isset($definition->info[$token->name])) {
|
|
// leave untouched, except for a few special cases:
|
|
|
|
// hard-coded image special case, pre-emptively drop
|
|
// if not available. Probably not abstract-able
|
|
if ( $token->name == 'img' ) {
|
|
if (!isset($token->attr['src'])) continue;
|
|
if (!isset($definition->info['img']->attr['src'])) {
|
|
continue;
|
|
}
|
|
$token->attr['src'] =
|
|
$definition->
|
|
info['img']->
|
|
attr['src']->
|
|
validate($token->attr['src']);
|
|
if ($token->attr['src'] === false) continue;
|
|
}
|
|
|
|
} elseif (
|
|
isset($definition->info_tag_transform[$token->name])
|
|
) {
|
|
// there is a transformation for this tag
|
|
// DEFINITION CALL
|
|
$token = $definition->
|
|
info_tag_transform[$token->name]->
|
|
transform($token, $config, $context);
|
|
} elseif ($escape_invalid_tags) {
|
|
// invalid tag, generate HTML and insert in
|
|
$token = new HTMLPurifier_Token_Text(
|
|
$generator->generateFromToken($token, $config, $context)
|
|
);
|
|
} else {
|
|
continue;
|
|
}
|
|
} elseif ($token->type == 'comment') {
|
|
// strip comments
|
|
continue;
|
|
} elseif ($token->type == 'text') {
|
|
} else {
|
|
continue;
|
|
}
|
|
$result[] = $token;
|
|
}
|
|
return $result;
|
|
}
|
|
|
|
}
|
|
|
|
?>
|