mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-12-23 00:41:52 +00:00
e180b7689e
- Add extra protection in AttrDef_URI against phantom Schemes - Doctype moved from config to HTMLDefinition - AttrDef_URITest mocks have more generic object parameters to deal with PHP4's copy-happy behavior git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1089 48356398-32a2-884e-a903-53898d9a118a
107 lines
4.6 KiB
Plaintext
107 lines
4.6 KiB
Plaintext
|
|
TODO List
|
|
|
|
= KEY ====================
|
|
# Flagship
|
|
- Regular
|
|
? Maybe I'll Do It
|
|
==========================
|
|
|
|
1.7 release [Advanced API]
|
|
# Complete advanced API, and fully document it
|
|
- Add framework for unsafe attributes
|
|
- Reorganize configuration directives
|
|
- Set up anonymous module management by HTMLDefinition (Advanced API)
|
|
- Get all AttrTypes into string form
|
|
# Clean up HTMLDefinition caching, need easy cache invalidation,
|
|
versioning of caches, etc.
|
|
# Implement all deprecated tags and attributes
|
|
# Create parsing/standards compliance smoketest
|
|
# Reorganize Unit Tests
|
|
- Refactor loop tests (esp. AttrDef_URI)
|
|
- Parse TinyMCE-style whitelist into our %HTML.Allow* whitelists
|
|
? HTML interface for tweaking configuration to see changes
|
|
|
|
1.8 release [Refactor, refactor!]
|
|
# URI validation routines tighter (see docs/dev-code-quality.html) (COMPLEX)
|
|
# Advanced URI filtering schemes (see docs/proposal-new-directives.txt)
|
|
- Configuration profiles: predefined directives set with one func call
|
|
- Implement IDREF support (harder than it seems, since you cannot have
|
|
IDREFs to non-existent IDs)
|
|
- Allow non-ASCII characters in font names
|
|
|
|
1.9 release [Error'ed]
|
|
# Error logging for filtering/cleanup procedures
|
|
- Requires I18N facilities to be created first (COMPLEX)
|
|
- XSS-attempt detection
|
|
- More fine-grained control over escaping behavior
|
|
- Silently drop content inbetween SCRIPT tags (can be generalized to allow
|
|
specification of elements that, when detected as foreign, trigger removal
|
|
of children, although unbalanced tags could wreck havoc (or at least
|
|
delete the rest of the document)).
|
|
|
|
1.10 release [Do What I Mean, Not What I Say]
|
|
# Additional support for poorly written HTML
|
|
- Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
|
|
- Friendly strict handling of <address> (block -> <br>)
|
|
- Remove redundant tags, ex. <u><u>Underlined</u></u>. Implementation notes:
|
|
1. Analyzing which tags to remove duplicants
|
|
2. Ensure attributes are merged into the parent tag
|
|
3. Extend the tag exclusion system to specify whether or not the
|
|
contents should be dropped or not (currently, there's code that could do
|
|
something like this if it didn't drop the inner text too.)
|
|
- Remove <span> tags that don't do anything (no attributes)
|
|
- Remove empty inline tags<i></i>
|
|
- Append something to duplicate IDs so they're still usable (impl. note: the
|
|
dupe detector would also need to detect the suffix as well)
|
|
|
|
2.0 release [Beyond HTML]
|
|
# Legit token based CSS parsing (will require revamping almost every
|
|
AttrDef class)
|
|
# More control over allowed CSS properties (maybe modularize it in the
|
|
same fashion!)
|
|
# Formatters for plaintext (COMPLEX)
|
|
- Auto-paragraphing (be sure to leverage fact that we know when things
|
|
shouldn't be paragraphed, such as lists and tables).
|
|
- Linkify URLs
|
|
- Smileys
|
|
- Linkification for HTML Purifier docs: notably configuration and classes
|
|
- Allow tags to be "armored", an internal flag that protects them
|
|
from validation and passes them out unharmed
|
|
- Fixes for Firefox's inability to handle COL alignment props (Bug 915)
|
|
- Automatically add non-breaking spaces to empty table cells when
|
|
empty-cells:show is applied to have compatibility with Internet Explorer
|
|
- Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
|
|
Also, enable disabling of directionality
|
|
|
|
3.0 release [To XML and Beyond]
|
|
- Extended HTML capabilities based on namespacing and tag transforms (COMPLEX)
|
|
- Hooks for adding custom processors to custom namespaced tags and
|
|
attributes, offer default implementation
|
|
- Lots of documentation and samples
|
|
- XHTML 1.1 support
|
|
|
|
Ongoing
|
|
- Lots of profiling, make it faster!
|
|
- Plugins for major CMSes (COMPLEX)
|
|
- WordPress (mostly written, needs beta-testing)
|
|
- eFiction
|
|
- more! (look for ones that use WYSIWYGs)
|
|
|
|
Unknown release (on a scratch-an-itch basis)
|
|
? Semi-lossy dumb alternate character encoding transfor
|
|
? Have 'lang' attribute be checked against official lists, achieved by
|
|
encoding all characters that have string entity equivalents
|
|
- Explain how to use HTML Purifier in non-PHP languages
|
|
- Abstract ChildDef_BlockQuote to work with all elements that only
|
|
allow blocks in them, required or optional
|
|
|
|
Requested
|
|
? Native content compression, whitespace stripping (don't rely on Tidy, make
|
|
sure we don't remove from <pre> or related tags)
|
|
|
|
Wontfix
|
|
- Non-lossy smart alternate character encoding transformations (unless
|
|
patch provided)
|
|
- Pretty-printing HTML, users can use Tidy on the output on entire page
|