to
- foreach ($definition->info[$token->name]->attr_transform_pre as $transform) { - $attr = $transform->transform($o = $attr, $config, $context); - if ($e) { - if ($attr != $o) { - $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); - } - } - } - - // create alias to this element's attribute definition array, see - // also $d_defs (global attribute definition array) - // DEFINITION CALL - $defs = $definition->info[$token->name]->attr; - - $attr_key = false; - $context->register('CurrentAttr', $attr_key); - - // iterate through all the attribute keypairs - // Watch out for name collisions: $key has previously been used - foreach ($attr as $attr_key => $value) { - - // call the definition - if (isset($defs[$attr_key])) { - // there is a local definition defined - if ($defs[$attr_key] === false) { - // We've explicitly been told not to allow this element. - // This is usually when there's a global definition - // that must be overridden. - // Theoretically speaking, we could have a - // AttrDef_DenyAll, but this is faster! - $result = false; - } else { - // validate according to the element's definition - $result = $defs[$attr_key]->validate( - $value, - $config, - $context - ); - } - } elseif (isset($d_defs[$attr_key])) { - // there is a global definition defined, validate according - // to the global definition - $result = $d_defs[$attr_key]->validate( - $value, - $config, - $context - ); - } else { - // system never heard of the attribute? DELETE! - $result = false; - } - - // put the results into effect - if ($result === false || $result === null) { - // this is a generic error message that should replaced - // with more specific ones when possible - if ($e) { - $e->send(E_ERROR, 'AttrValidator: Attribute removed'); - } - - // remove the attribute - unset($attr[$attr_key]); - } elseif (is_string($result)) { - // generally, if a substitution is happening, there - // was some sort of implicit correction going on. We'll - // delegate it to the attribute classes to say exactly what. - - // simple substitution - $attr[$attr_key] = $result; - } else { - // nothing happens - } - - // we'd also want slightly more complicated substitution - // involving an array as the return value, - // although we're not sure how colliding attributes would - // resolve (certain ones would be completely overriden, - // others would prepend themselves). - } - - $context->destroy('CurrentAttr'); - - // post transforms - - // global (error reporting untested) - foreach ($definition->info_attr_transform_post as $transform) { - $attr = $transform->transform($o = $attr, $config, $context); - if ($e) { - if ($attr != $o) { - $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); - } - } - } - - // local (error reporting untested) - foreach ($definition->info[$token->name]->attr_transform_post as $transform) { - $attr = $transform->transform($o = $attr, $config, $context); - if ($e) { - if ($attr != $o) { - $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); - } - } - } - - $token->attr = $attr; - - // destroy CurrentToken if we made it ourselves - if (!$current_token) { - $context->destroy('CurrentToken'); - } - - } - - -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Bootstrap.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Bootstrap.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Bootstrap.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Bootstrap.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,124 +0,0 @@ - -if (!defined('PHP_EOL')) { - switch (strtoupper(substr(PHP_OS, 0, 3))) { - case 'WIN': - define('PHP_EOL', "\r\n"); - break; - case 'DAR': - define('PHP_EOL', "\r"); - break; - default: - define('PHP_EOL', "\n"); - } -} - -/** - * Bootstrap class that contains meta-functionality for HTML Purifier such as - * the autoload function. - * - * @note - * This class may be used without any other files from HTML Purifier. - */ -class HTMLPurifier_Bootstrap -{ - - /** - * Autoload function for HTML Purifier - * @param string $class Class to load - * @return bool - */ - public static function autoload($class) - { - $file = HTMLPurifier_Bootstrap::getPath($class); - if (!$file) { - return false; - } - // Technically speaking, it should be ok and more efficient to - // just do 'require', but Antonio Parraga reports that with - // Zend extensions such as Zend debugger and APC, this invariant - // may be broken. Since we have efficient alternatives, pay - // the cost here and avoid the bug. - require_once HTMLPURIFIER_PREFIX . '/' . $file; - return true; - } - - /** - * Returns the path for a specific class. - * @param string $class Class path to get - * @return string - */ - public static function getPath($class) - { - if (strncmp('HTMLPurifier', $class, 12) !== 0) { - return false; - } - // Custom implementations - if (strncmp('HTMLPurifier_Language_', $class, 22) === 0) { - $code = str_replace('_', '-', substr($class, 22)); - $file = 'HTMLPurifier/Language/classes/' . $code . '.php'; - } else { - $file = str_replace('_', '/', $class) . '.php'; - } - if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) { - return false; - } - return $file; - } - - /** - * "Pre-registers" our autoloader on the SPL stack. - */ - public static function registerAutoload() - { - $autoload = array('HTMLPurifier_Bootstrap', 'autoload'); - if (($funcs = spl_autoload_functions()) === false) { - spl_autoload_register($autoload); - } elseif (function_exists('spl_autoload_unregister')) { - if (version_compare(PHP_VERSION, '5.3.0', '>=')) { - // prepend flag exists, no need for shenanigans - spl_autoload_register($autoload, true, true); - } else { - $buggy = version_compare(PHP_VERSION, '5.2.11', '<'); - $compat = version_compare(PHP_VERSION, '5.1.2', '<=') && - version_compare(PHP_VERSION, '5.1.0', '>='); - foreach ($funcs as $func) { - if ($buggy && is_array($func)) { - // :TRICKY: There are some compatibility issues and some - // places where we need to error out - $reflector = new ReflectionMethod($func[0], $func[1]); - if (!$reflector->isStatic()) { - throw new Exception( - 'HTML Purifier autoloader registrar is not compatible - with non-static object methods due to PHP Bug #44144; - Please do not use HTMLPurifier.autoload.php (or any - file that includes this file); instead, place the code: - spl_autoload_register(array(\'HTMLPurifier_Bootstrap\', \'autoload\')) - after your own autoloaders.' - ); - } - // Suprisingly, spl_autoload_register supports the - // Class::staticMethod callback format, although call_user_func doesn't - if ($compat) { - $func = implode('::', $func); - } - } - spl_autoload_unregister($func); - } - spl_autoload_register($autoload); - foreach ($funcs as $func) { - spl_autoload_register($func); - } - } - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Chameleon.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Chameleon.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Chameleon.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Chameleon.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,67 +0,0 @@ -inline = new HTMLPurifier_ChildDef_Optional($inline); - $this->block = new HTMLPurifier_ChildDef_Optional($block); - $this->elements = $this->block->elements; - } - - /** - * @param HTMLPurifier_Node[] $children - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function validateChildren($children, $config, $context) - { - if ($context->get('IsInline') === false) { - return $this->block->validateChildren( - $children, - $config, - $context - ); - } else { - return $this->inline->validateChildren( - $children, - $config, - $context - ); - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Custom.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Custom.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Custom.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Custom.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,102 +0,0 @@ -dtd_regex = $dtd_regex; - $this->_compileRegex(); - } - - /** - * Compiles the PCRE regex from a DTD regex ($dtd_regex to $_pcre_regex) - */ - protected function _compileRegex() - { - $raw = str_replace(' ', '', $this->dtd_regex); - if ($raw{0} != '(') { - $raw = "($raw)"; - } - $el = '[#a-zA-Z0-9_.-]+'; - $reg = $raw; - - // COMPLICATED! AND MIGHT BE BUGGY! I HAVE NO CLUE WHAT I'M - // DOING! Seriously: if there's problems, please report them. - - // collect all elements into the $elements array - preg_match_all("/$el/", $reg, $matches); - foreach ($matches[0] as $match) { - $this->elements[$match] = true; - } - - // setup all elements as parentheticals with leading commas - $reg = preg_replace("/$el/", '(,\\0)', $reg); - - // remove commas when they were not solicited - $reg = preg_replace("/([^,(|]\(+),/", '\\1', $reg); - - // remove all non-paranthetical commas: they are handled by first regex - $reg = preg_replace("/,\(/", '(', $reg); - - $this->_pcre_regex = $reg; - } - - /** - * @param HTMLPurifier_Node[] $children - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function validateChildren($children, $config, $context) - { - $list_of_children = ''; - $nesting = 0; // depth into the nest - foreach ($children as $node) { - if (!empty($node->is_whitespace)) { - continue; - } - $list_of_children .= $node->name . ','; - } - // add leading comma to deal with stray comma declarations - $list_of_children = ',' . rtrim($list_of_children, ','); - $okay = - preg_match( - '/^,?' . $this->_pcre_regex . '$/', - $list_of_children - ); - return (bool)$okay; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Empty.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Empty.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Empty.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Empty.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,38 +0,0 @@ - true, 'ul' => true, 'ol' => true); - - /** - * @param array $children - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return array - */ - public function validateChildren($children, $config, $context) - { - // Flag for subclasses - $this->whitespace = false; - - // if there are no tokens, delete parent node - if (empty($children)) { - return false; - } - - // if li is not allowed, delete parent node - if (!isset($config->getHTMLDefinition()->info['li'])) { - trigger_error("Cannot allow ul/ol without allowing li", E_USER_WARNING); - return false; - } - - // the new set of children - $result = array(); - - // a little sanity check to make sure it's not ALL whitespace - $all_whitespace = true; - - $current_li = null; - - foreach ($children as $node) { - if (!empty($node->is_whitespace)) { - $result[] = $node; - continue; - } - $all_whitespace = false; // phew, we're not talking about whitespace - - if ($node->name === 'li') { - // good - $current_li = $node; - $result[] = $node; - } else { - // we want to tuck this into the previous li - // Invariant: we expect the node to be ol/ul - // ToDo: Make this more robust in the case of not ol/ul - // by distinguishing between existing li and li created - // to handle non-list elements; non-list elements should - // not be appended to an existing li; only li created - // for non-list. This distinction is not currently made. - if ($current_li === null) { - $current_li = new HTMLPurifier_Node_Element('li'); - $result[] = $current_li; - } - $current_li->children[] = $node; - $current_li->empty = false; // XXX fascinating! Check for this error elsewhere ToDo - } - } - if (empty($result)) { - return false; - } - if ($all_whitespace) { - return false; - } - return $result; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Optional.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Optional.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Optional.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Optional.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,45 +0,0 @@ -whitespace) { - return $children; - } else { - return array(); - } - } - return $result; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Required.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Required.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Required.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Required.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,118 +0,0 @@ - $x) { - $elements[$i] = true; - if (empty($i)) { - unset($elements[$i]); - } // remove blank - } - } - $this->elements = $elements; - } - - /** - * @type bool - */ - public $allow_empty = false; - - /** - * @type string - */ - public $type = 'required'; - - /** - * @param array $children - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return array - */ - public function validateChildren($children, $config, $context) - { - // Flag for subclasses - $this->whitespace = false; - - // if there are no tokens, delete parent node - if (empty($children)) { - return false; - } - - // the new set of children - $result = array(); - - // whether or not parsed character data is allowed - // this controls whether or not we silently drop a tag - // or generate escaped HTML from it - $pcdata_allowed = isset($this->elements['#PCDATA']); - - // a little sanity check to make sure it's not ALL whitespace - $all_whitespace = true; - - $stack = array_reverse($children); - while (!empty($stack)) { - $node = array_pop($stack); - if (!empty($node->is_whitespace)) { - $result[] = $node; - continue; - } - $all_whitespace = false; // phew, we're not talking about whitespace - - if (!isset($this->elements[$node->name])) { - // special case text - // XXX One of these ought to be redundant or something - if ($pcdata_allowed && $node instanceof HTMLPurifier_Node_Text) { - $result[] = $node; - continue; - } - // spill the child contents in - // ToDo: Make configurable - if ($node instanceof HTMLPurifier_Node_Element) { - for ($i = count($node->children) - 1; $i >= 0; $i--) { - $stack[] = $node->children[$i]; - } - continue; - } - continue; - } - $result[] = $node; - } - if (empty($result)) { - return false; - } - if ($all_whitespace) { - $this->whitespace = true; - return false; - } - return $result; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/StrictBlockquote.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/StrictBlockquote.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/StrictBlockquote.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/StrictBlockquote.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,110 +0,0 @@ -init($config); - return $this->fake_elements; - } - - /** - * @param array $children - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return array - */ - public function validateChildren($children, $config, $context) - { - $this->init($config); - - // trick the parent class into thinking it allows more - $this->elements = $this->fake_elements; - $result = parent::validateChildren($children, $config, $context); - $this->elements = $this->real_elements; - - if ($result === false) { - return array(); - } - if ($result === true) { - $result = $children; - } - - $def = $config->getHTMLDefinition(); - $block_wrap_name = $def->info_block_wrapper; - $block_wrap = false; - $ret = array(); - - foreach ($result as $node) { - if ($block_wrap === false) { - if (($node instanceof HTMLPurifier_Node_Text && !$node->is_whitespace) || - ($node instanceof HTMLPurifier_Node_Element && !isset($this->elements[$node->name]))) { - $block_wrap = new HTMLPurifier_Node_Element($def->info_block_wrapper); - $ret[] = $block_wrap; - } - } else { - if ($node instanceof HTMLPurifier_Node_Element && isset($this->elements[$node->name])) { - $block_wrap = false; - - } - } - if ($block_wrap) { - $block_wrap->children[] = $node; - } else { - $ret[] = $node; - } - } - return $ret; - } - - /** - * @param HTMLPurifier_Config $config - */ - private function init($config) - { - if (!$this->init) { - $def = $config->getHTMLDefinition(); - // allow all inline elements - $this->real_elements = $this->elements; - $this->fake_elements = $def->info_content_sets['Flow']; - $this->fake_elements['#PCDATA'] = true; - $this->init = true; - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Table.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Table.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Table.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ChildDef/Table.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,224 +0,0 @@ - true, - 'tbody' => true, - 'thead' => true, - 'tfoot' => true, - 'caption' => true, - 'colgroup' => true, - 'col' => true - ); - - public function __construct() - { - } - - /** - * @param array $children - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return array - */ - public function validateChildren($children, $config, $context) - { - if (empty($children)) { - return false; - } - - // only one of these elements is allowed in a table - $caption = false; - $thead = false; - $tfoot = false; - - // whitespace - $initial_ws = array(); - $after_caption_ws = array(); - $after_thead_ws = array(); - $after_tfoot_ws = array(); - - // as many of these as you want - $cols = array(); - $content = array(); - - $tbody_mode = false; // if true, then we need to wrap any stray - //
- This directive turns on auto-paragraphing, where double newlines are - converted in to paragraphs whenever possible. Auto-paragraphing: -
--
-
- Always applies to inline elements or text in the root node, -
- Applies to inline elements or text with double newlines in nodes - that allow paragraph tags, -
- Applies to double newlines in paragraph tags -
- p tags must be allowed for this directive to take effect.
- We do not use br tags for paragraphing, as that is
- semantically incorrect.
-
- To prevent auto-paragraphing as a content-producer, refrain from using
- double-newlines except to specify a new paragraph or in contexts where
- it has special meaning (whitespace usually has no meaning except in
- tags like pre, so this should not be difficult.) To prevent
- the paragraphing of inline text adjacent to block elements, wrap them
- in div tags (the behavior is slightly different outside of
- the root node.)
-
- This directive can be used to add custom auto-format injectors. - Specify an array of injector names (class name minus the prefix) - or concrete implementations. Injector class must exist. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -AutoFormat.DisplayLinkURI -TYPE: bool -VERSION: 3.2.0 -DEFAULT: false ---DESCRIPTION-- -- This directive turns on the in-text display of URIs in <a> tags, and disables - those links. For example, example becomes - example (http://example.com). -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,12 +0,0 @@ -AutoFormat.Linkify -TYPE: bool -VERSION: 2.0.1 -DEFAULT: false ---DESCRIPTION-- - -
- This directive turns on linkification, auto-linking http, ftp and
- https URLs. a tags with the href attribute
- must be allowed.
-
- Location of configuration documentation to link to, let %s substitute - into the configuration's namespace and directive names sans the percent - sign. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,12 +0,0 @@ -AutoFormat.PurifierLinkify -TYPE: bool -VERSION: 2.0.1 -DEFAULT: false ---DESCRIPTION-- - -
- Internal auto-formatter that converts configuration directives in
- syntax %Namespace.Directive to links. a tags
- with the href attribute must be allowed.
-
- Given that an element has no contents, it will be removed by default, unless
- this predicate dictates otherwise. The predicate can either be an associative
- map from tag name to list of attributes that must be present for the element
- to be considered preserved: thus, the default always preserves colgroup,
- th and td, and also iframe if it
- has a src.
-
- When %AutoFormat.RemoveEmpty and %AutoFormat.RemoveEmpty.RemoveNbsp - are enabled, this directive defines what HTML elements should not be - removede if they have only a non-breaking space in them. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -AutoFormat.RemoveEmpty.RemoveNbsp -TYPE: bool -VERSION: 4.0.0 -DEFAULT: false ---DESCRIPTION-- -- When enabled, HTML Purifier will treat any elements that contain only - non-breaking spaces as well as regular whitespace as empty, and remove - them when %AutoForamt.RemoveEmpty is enabled. -
-- See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements - that don't have this behavior applied to them. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,46 +0,0 @@ -AutoFormat.RemoveEmpty -TYPE: bool -VERSION: 3.2.0 -DEFAULT: false ---DESCRIPTION-- -- When enabled, HTML Purifier will attempt to remove empty elements that - contribute no semantic information to the document. The following types - of nodes will be removed: -
--
- Tags with no attributes and no content, and that are not empty
- elements (remove
<a></a>but not -<br />), and -
- -
- Tags with no content, except for:
-
-
- The
colgroupelement, or
- -
- Elements with the
idornameattribute, - when those attributes are permitted on those elements. -
-
- - The
- Please be very careful when using this functionality; while it may not - seem that empty elements contain useful information, they can alter the - layout of a document given appropriate styling. This directive is most - useful when you are processing machine-generated HTML, please avoid using - it on regular user HTML. -
-- Elements that contain only whitespace will be treated as empty. Non-breaking - spaces, however, do not count as whitespace. See - %AutoFormat.RemoveEmpty.RemoveNbsp for alternate behavior. -
-- This algorithm is not perfect; you may still notice some empty tags, - particularly if a node had elements, but those elements were later removed - because they were not permitted in that context, or tags that, after - being auto-closed by another tag, where empty. This is for safety reasons - to prevent clever code from breaking validation. The general rule of thumb: - if a tag looked empty on the way in, it will get removed; if HTML Purifier - made it empty, it will stay. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -AutoFormat.RemoveSpansWithoutAttributes -TYPE: bool -VERSION: 4.0.1 -DEFAULT: false ---DESCRIPTION-- -
- This directive causes span tags without any attributes
- to be removed. It will also remove spans that had all attributes
- removed during processing.
-
- Absolute path with no trailing slash to store serialized definitions in. - Default is within the - HTML Purifier library inside DefinitionCache/Serializer. This - path must be writable by the webserver. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -Cache.SerializerPermissions -TYPE: int/null -VERSION: 4.3.0 -DEFAULT: 0755 ---DESCRIPTION-- - -- Directory permissions of the files and directories created inside - the DefinitionCache/Serializer or other custom serializer path. -
-
- In HTML Purifier 4.8.0, this also supports NULL,
- which means that no chmod'ing or directory creation shall
- occur.
-
- This directive enables aggressive pre-filter fixes HTML Purifier can - perform in order to ensure that open angled-brackets do not get killed - during parsing stage. Enabling this will result in two preg_replace_callback - calls and at least two preg_replace calls for every HTML document parsed; - if your users make very well-formed HTML, you can set this directive false. - This has no effect when DirectLex is used. -
-- Notice: This directive's default turned from false to true - in HTML Purifier 3.2.0. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -Core.AggressivelyRemoveScript -TYPE: bool -VERSION: 4.9.0 -DEFAULT: true ---DESCRIPTION-- -- This directive enables aggressive pre-filter removal of - script tags. This is not necessary for security, - but it can help work around a bug in libxml where embedded - HTML elements inside script sections cause the parser to - choke. To revert to pre-4.9.0 behavior, set this to false. - This directive has no effect if %Core.Trusted is true, - %Core.RemoveScriptContents is false, or %Core.HiddenElements - does not contain script. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -Core.AllowHostnameUnderscore -TYPE: bool -VERSION: 4.6.0 -DEFAULT: false ---DESCRIPTION-- -- By RFC 1123, underscores are not permitted in host names. - (This is in contrast to the specification for DNS, RFC - 2181, which allows underscores.) - However, most browsers do the right thing when faced with - an underscore in the host name, and so some poorly written - websites are written with the expectation this should work. - Setting this parameter to true relaxes our allowed character - check so that underscores are permitted. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,12 +0,0 @@ -Core.CollectErrors -TYPE: bool -VERSION: 2.0.0 -DEFAULT: false ---DESCRIPTION-- - -Whether or not to collect errors found while filtering the document. This -is a useful way to give feedback to your users. Warning: -Currently this feature is very patchy and experimental, with lots of -possible error messages not yet implemented. It will not cause any -problems, but it may not help your users either. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,29 +0,0 @@ -Core.ColorKeywords -TYPE: hash -VERSION: 2.0.0 ---DEFAULT-- -array ( - 'maroon' => '#800000', - 'red' => '#FF0000', - 'orange' => '#FFA500', - 'yellow' => '#FFFF00', - 'olive' => '#808000', - 'purple' => '#800080', - 'fuchsia' => '#FF00FF', - 'white' => '#FFFFFF', - 'lime' => '#00FF00', - 'green' => '#008000', - 'navy' => '#000080', - 'blue' => '#0000FF', - 'aqua' => '#00FFFF', - 'teal' => '#008080', - 'black' => '#000000', - 'silver' => '#C0C0C0', - 'gray' => '#808080', -) ---DESCRIPTION-- - -Lookup array of color names to six digit hexadecimal number corresponding -to color, with preceding hash mark. Used when parsing colors. The lookup -is done in a case-insensitive manner. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,14 +0,0 @@ -Core.ConvertDocumentToFragment -TYPE: bool -DEFAULT: true ---DESCRIPTION-- - -This parameter determines whether or not the filter should convert -input that is a full document with html and body tags to a fragment -of just the contents of a body tag. This parameter is simply something -HTML Purifier can do during an edge-case: for most inputs, this -processing is not necessary. - ---ALIASES-- -Core.AcceptFullDocuments ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,17 +0,0 @@ -Core.DirectLexLineNumberSyncInterval -TYPE: int -VERSION: 2.0.0 -DEFAULT: 0 ---DESCRIPTION-- - -- Specifies the number of tokens the DirectLex line number tracking - implementations should process before attempting to resyncronize the - current line count by manually counting all previous new-lines. When - at 0, this functionality is disabled. Lower values will decrease - performance, and this is only strictly necessary if the counting - algorithm is buggy (in which case you should report it as a bug). - This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is - not being used. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,14 +0,0 @@ -Core.DisableExcludes -TYPE: bool -DEFAULT: false -VERSION: 4.5.0 ---DESCRIPTION-- -
- This directive disables SGML-style exclusions, e.g. the exclusion of
- <object> in any descendant of a
- <pre> tag. Disabling excludes will allow some
- invalid documents to pass through HTML Purifier, but HTML Purifier
- will also be less likely to accidentally remove large documents during
- processing.
-
Warning: this configuration option is no longer does anything as of 4.6.0.
- -When true, a child is found that is not allowed in the context of the -parent element will be transformed into text as if it were ASCII. When -false, that element and all internal tags will be dropped, though text will -be preserved. There is no option for dropping the element but preserving -child nodes.
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,7 +0,0 @@ -Core.EscapeInvalidTags -TYPE: bool -DEFAULT: false ---DESCRIPTION-- -When true, invalid tags will be written back to the document as plain text. -Otherwise, they are silently dropped. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -Core.EscapeNonASCIICharacters -TYPE: bool -VERSION: 1.4.0 -DEFAULT: false ---DESCRIPTION-- -This directive overcomes a deficiency in %Core.Encoding by blindly -converting all non-ASCII characters into decimal numeric entities before -converting it to its native encoding. This means that even characters that -can be expressed in the non-UTF-8 encoding will be entity-ized, which can -be a real downer for encodings like Big5. It also assumes that the ASCII -repetoire is available, although this is the case for almost all encodings. -Anyway, use UTF-8! ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,19 +0,0 @@ -Core.HiddenElements -TYPE: lookup ---DEFAULT-- -array ( - 'script' => true, - 'style' => true, -) ---DESCRIPTION-- - -
- This directive is a lookup array of elements which should have their
- contents removed when they are not allowed by the HTML definition.
- For example, the contents of a script tag are not
- normally shown in a document, so if script tags are to be removed,
- their contents should be removed to. This is opposed to a b
- tag, which defines some presentational changes but does not hide its
- contents.
-
- Prior to HTML Purifier 4.9.0, entities were decoded by performing - a global search replace for all entities whose decoded versions - did not have special meanings under HTML, and replaced them with - their decoded versions. We would match all entities, even if they did - not have a trailing semicolon, but only if there weren't any trailing - alphanumeric characters. -
-| Original | Text | Attribute |
|---|---|---|
| ¥ | ¥ | ¥ |
| ¥ | ¥ | ¥ |
| ¥a | ¥a | ¥a |
| ¥= | ¥= | ¥= |
- In HTML Purifier 4.9.0, we changed the behavior of entity parsing - to match entities that had missing trailing semicolons in less - cases, to more closely match HTML5 parsing behavior: -
-| Original | Text | Attribute |
|---|---|---|
| ¥ | ¥ | ¥ |
| ¥ | ¥ | ¥ |
| ¥a | ¥a | ¥a |
| ¥= | ¥= | ¥= |
- This flag reverts back to pre-HTML Purifier 4.9.0 behavior. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,34 +0,0 @@ -Core.LexerImpl -TYPE: mixed/null -VERSION: 2.0.0 -DEFAULT: NULL ---DESCRIPTION-- - -- This parameter determines what lexer implementation can be used. The - valid values are: -
--
-
- null -
- - Recommended, the lexer implementation will be auto-detected based on - your PHP-version and configuration. - -
- string lexer identifier -
- - This is a slim way of manually overridding the implementation. - Currently recognized values are: DOMLex (the default PHP5 -implementation) - and DirectLex (the default PHP4 implementation). Only use this if - you know what you are doing: usually, the auto-detection will - manage things for cases you aren't even aware of. - -
- object lexer instance -
-
- Super-advanced: you can specify your own, custom, implementation that
- implements the interface defined by
HTMLPurifier_Lexer. - I may remove this option simply because I don't expect anyone - to use it. -
-
- If true, HTML Purifier will add line number information to all tokens. - This is useful when error reporting is turned on, but can result in - significant performance degradation and should not be used when - unnecessary. This directive must be used with the DirectLex lexer, - as the DOMLex lexer does not (yet) support this functionality. - If the value is null, an appropriate value will be selected based - on other configuration. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -Core.NormalizeNewlines -TYPE: bool -VERSION: 4.2.0 -DEFAULT: true ---DESCRIPTION-- -
- Whether or not to normalize newlines to the operating
- system default. When false, HTML Purifier
- will attempt to preserve mixed newline files.
-
- This directive enables pre-emptive URI checking in img
- tags, as the attribute validation strategy is not authorized to
- remove elements from the document. Revert to pre-1.3.0 behavior by setting to false.
-
<? ...
-?>, remove it out-right. This may be useful if the HTML
-you are validating contains XML processing instruction gunk, however,
-it can also be user-unfriendly for people attempting to post PHP
-snippets.
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,12 +0,0 @@
-Core.RemoveScriptContents
-TYPE: bool/null
-DEFAULT: NULL
-VERSION: 2.0.0
-DEPRECATED-VERSION: 2.1.0
-DEPRECATED-USE: Core.HiddenElements
---DESCRIPTION--
-- This directive enables HTML Purifier to remove not only script tags - but all of their contents. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -CSS.AllowDuplicates -TYPE: bool -DEFAULT: false -VERSION: 4.8.0 ---DESCRIPTION-- -
- By default, HTML Purifier removes duplicate CSS properties,
- like color:red; color:blue. If this is set to
- true, duplicate properties are allowed.
-
- Allows you to manually specify a set of allowed fonts. If
- NULL, all fonts are allowed. This directive
- affects generic names (serif, sans-serif, monospace, cursive,
- fantasy) as well as specific font families.
-
- If HTML Purifier's style attributes set is unsatisfactory for your needs, - you can overload it with your own list of tags to allow. Note that this - method is subtractive: it does its job by taking away from HTML Purifier - usual feature set, so you cannot add an attribute that HTML Purifier never - supported in the first place. -
-- Warning: If another directive conflicts with the - elements here, that directive will win and override. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,8 +0,0 @@ -CSS.AllowImportant -TYPE: bool -DEFAULT: false -VERSION: 3.1.0 ---DESCRIPTION-- -This parameter determines whether or not !important cascade modifiers should -be allowed in user CSS. If false, !important will stripped. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -CSS.AllowTricky -TYPE: bool -DEFAULT: false -VERSION: 3.1.0 ---DESCRIPTION-- -This parameter determines whether or not to allow "tricky" CSS properties and -values. Tricky CSS properties/values can drastically modify page layout or -be used for deceptive practices but do not directly constitute a security risk. -For example,display:none; is considered a tricky property that
-will only be allowed if this directive is set to true.
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,11 +0,0 @@
-CSS.DefinitionRev
-TYPE: int
-VERSION: 2.0.0
-DEFAULT: 1
---DESCRIPTION--
-
-- Revision identifier for your custom definition. See - %HTML.DefinitionRev for details. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -CSS.ForbiddenProperties -TYPE: lookup -VERSION: 4.2.0 -DEFAULT: array() ---DESCRIPTION-- -- This is the logical inverse of %CSS.AllowedProperties, and it will - override that directive or any other directive. If possible, - %CSS.AllowedProperties is recommended over this directive, - because it can sometimes be difficult to tell whether or not you've - forbidden all of the CSS properties you truly would like to disallow. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -CSS.MaxImgLength -TYPE: string/null -DEFAULT: '1200px' -VERSION: 3.1.1 ---DESCRIPTION-- -
- This parameter sets the maximum allowed length on img tags,
- effectively the width and height properties.
- Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is
- in place to prevent imagecrash attacks, disable with null at your own risk.
- This directive is similar to %HTML.MaxImgLength, and both should be
- concurrently edited, although there are
- subtle differences in the input format (the CSS max is a number with
- a unit).
-
- Whether or not to allow safe, proprietary CSS values. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,9 +0,0 @@ -CSS.Trusted -TYPE: bool -VERSION: 4.2.1 -DEFAULT: false ---DESCRIPTION-- -Indicates whether or not the user's CSS input is trusted or not. If the -input is trusted, a more expansive set of allowed properties. See -also %HTML.Trusted. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -Filter.Custom -TYPE: list -VERSION: 3.1.0 -DEFAULT: array() ---DESCRIPTION-- -
- This directive can be used to add custom filters; it is nearly the
- equivalent of the now deprecated HTMLPurifier->addFilter()
- method. Specify an array of concrete implementations.
-
- Whether or not to escape the dangerous characters <, > and & - as \3C, \3E and \26, respectively. This is can be safely set to false - if the contents of StyleBlocks will be placed in an external stylesheet, - where there is no risk of it being interpreted as HTML. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,29 +0,0 @@ -Filter.ExtractStyleBlocks.Scope -TYPE: string/null -VERSION: 3.0.0 -DEFAULT: NULL -ALIASES: Filter.ExtractStyleBlocksScope, FilterParam.ExtractStyleBlocksScope ---DESCRIPTION-- - -
- If you would like users to be able to define external stylesheets, but
- only allow them to specify CSS declarations for a specific node and
- prevent them from fiddling with other elements, use this directive.
- It accepts any valid CSS selector, and will prepend this to any
- CSS declaration extracted from the document. For example, if this
- directive is set to #user-content and a user uses the
- selector a:hover, the final selector will be
- #user-content a:hover.
-
- The comma shorthand may be used; consider the above example, with
- #user-content, #user-content2, the final selector will
- be #user-content a:hover, #user-content2 a:hover.
-
- Warning: It is possible for users to bypass this measure - using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML - Purifier, and I am working to get it fixed. Until then, HTML Purifier - performs a basic check to prevent this. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -Filter.ExtractStyleBlocks.TidyImpl -TYPE: mixed/null -VERSION: 3.1.0 -DEFAULT: NULL -ALIASES: FilterParam.ExtractStyleBlocksTidyImpl ---DESCRIPTION-- -
- If left NULL, HTML Purifier will attempt to instantiate a csstidy
- class to use for internal cleaning. This will usually be good enough.
-
- However, for trusted user input, you can set this to false to
- disable cleaning. In addition, you can supply your own concrete implementation
- of Tidy's interface to use, although I don't know why you'd want to do that.
-
- This directive turns on the style block extraction filter, which removes
- style blocks from input HTML, cleans them up with CSSTidy,
- and places them in the StyleBlocks context variable, for further
- use by you, usually to be placed in an external stylesheet, or a
- style block in the head of your document.
-
- Sample usage: -
-'; -?> - - - --Filter.ExtractStyleBlocks -body {color:#F00;} Some text'; - - $config = HTMLPurifier_Config::createDefault(); - $config->set('Filter', 'ExtractStyleBlocks', true); - $purifier = new HTMLPurifier($config); - - $html = $purifier->purify($dirty); - - // This implementation writes the stylesheets to the styles/ directory. - // You can also echo the styles inside the document, but it's a bit - // more difficult to make sure they get interpreted properly by - // browsers; try the usual CSS armoring techniques. - $styles = $purifier->context->get('StyleBlocks'); - $dir = 'styles/'; - if (!is_dir($dir)) mkdir($dir); - $hash = sha1($_GET['html']); - foreach ($styles as $i => $style) { - file_put_contents($name = $dir . $hash . "_$i"); - echo ''; - } -?> - - -- -- - -]]>
- Warning: It is possible for a user to mount an - imagecrash attack using this CSS. Counter-measures are difficult; - it is not simply enough to limit the range of CSS lengths (using - relative lengths with many nesting levels allows for large values - to be attained without actually specifying them in the stylesheet), - and the flexible nature of selectors makes it difficult to selectively - disable lengths on image tags (HTML Purifier, however, does disable - CSS width and height in inline styling). There are probably two effective - counter measures: an explicit width and height set to auto in all - images in your document (unlikely) or the disabling of width and - height (somewhat reasonable). Whether or not these measures should be - used is left to the reader. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -Filter.YouTube -TYPE: bool -VERSION: 3.1.0 -DEFAULT: false ---DESCRIPTION-- -- Warning: Deprecated in favor of %HTML.SafeObject and - %Output.FlashCompat (turn both on to allow YouTube videos and other - Flash content). -
-- This directive enables YouTube video embedding in HTML Purifier. Check - this document - on embedding videos for more information on what this filter does. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,19 +0,0 @@ -HTML.AllowedAttributes -TYPE: lookup/null -VERSION: 1.3.0 -DEFAULT: NULL ---DESCRIPTION-- - -- If HTML Purifier's attribute set is unsatisfactory, overload it! - The syntax is "tag.attr" or "*.attr" for the global attributes - (style, id, class, dir, lang, xml:lang). -
-- Warning: If another directive conflicts with the - elements here, that directive will win and override. For - example, %HTML.EnableAttrID will take precedence over *.id in this - directive. You must set that directive to true before you can use - IDs at all. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -HTML.AllowedCommentsRegexp -TYPE: string/null -VERSION: 4.4.0 -DEFAULT: NULL ---DESCRIPTION-- -A regexp, which if it matches the body of a comment, indicates that -it should be allowed. Trailing and leading spaces are removed prior -to running this regular expression. -Warning: Make sure you specify -correct anchor metacharacters^regex$, otherwise you may accept
-comments that you did not mean to! In particular, the regex /foo|bar/
-is probably not sufficiently strict, since it also allows foobar.
-See also %HTML.AllowedComments (these directives are union'ed together,
-so a comment is considered valid if any directive deems it valid.)
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,10 +0,0 @@
-HTML.AllowedComments
-TYPE: lookup
-VERSION: 4.4.0
-DEFAULT: array()
---DESCRIPTION--
-A whitelist which indicates what explicit comment bodies should be
-allowed, modulo leading and trailing whitespace. See also %HTML.AllowedCommentsRegexp
-(these directives are union'ed together, so a comment is considered
-valid if any directive deems it valid.)
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,23 +0,0 @@
-HTML.AllowedElements
-TYPE: lookup/null
-VERSION: 1.3.0
-DEFAULT: NULL
---DESCRIPTION--
-- If HTML Purifier's tag set is unsatisfactory for your needs, you can - overload it with your own list of tags to allow. If you change - this, you probably also want to change %HTML.AllowedAttributes; see - also %HTML.Allowed which lets you set allowed elements and - attributes at the same time. -
-- If you attempt to allow an element that HTML Purifier does not know - about, HTML Purifier will raise an error. You will need to manually - tell HTML Purifier about this element by using the - advanced customization features. -
-- Warning: If another directive conflicts with the - elements here, that directive will win and override. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,20 +0,0 @@ -HTML.AllowedModules -TYPE: lookup/null -VERSION: 2.0.0 -DEFAULT: NULL ---DESCRIPTION-- - -- A doctype comes with a set of usual modules to use. Without having - to mucking about with the doctypes, you can quickly activate or - disable these modules by specifying which modules you wish to allow - with this directive. This is most useful for unit testing specific - modules, although end users may find it useful for their own ends. -
-- If you specify a module that does not exist, the manager will silently - fail to use it, so be careful! User-defined modules are not affected - by this directive. Modules defined in %HTML.CoreModules are not - affected by this directive. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,25 +0,0 @@ -HTML.Allowed -TYPE: itext/null -VERSION: 2.0.0 -DEFAULT: NULL ---DESCRIPTION-- - -
- This is a preferred convenience directive that combines
- %HTML.AllowedElements and %HTML.AllowedAttributes.
- Specify elements and attributes that are allowed using:
- element1[attr1|attr2],element2.... For example,
- if you would like to only allow paragraphs and links, specify
- a[href],p. You can specify attributes that apply
- to all elements using an asterisk, e.g. *[lang].
- You can also use newlines instead of commas to separate elements.
-
- Warning:
- All of the constraints on the component directives are still enforced.
- The syntax is a subset of TinyMCE's valid_elements
- whitelist: directly copy-pasting it here will probably result in
- broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
- are set, this directive has no effect.
-
- String name of element to wrap inline elements that are inside a block - context. This only occurs in the children of blockquote in strict mode. -
-
- Example: by default value,
- <blockquote>Foo</blockquote> would become
- <blockquote><p>Foo</p></blockquote>.
- The <p> tags can be replaced with whatever you desire,
- as long as it is a block level element.
-
- Certain modularized doctypes (XHTML, namely), have certain modules - that must be included for the doctype to be an conforming document - type: put those modules here. By default, XHTML's core modules - are used. You can set this to a blank array to disable core module - protection, but this is not recommended. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,9 +0,0 @@ -HTML.CustomDoctype -TYPE: string/null -VERSION: 2.0.1 -DEFAULT: NULL ---DESCRIPTION-- - -A custom doctype for power-users who defined their own document -type. This directive only applies when %HTML.Doctype is blank. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,33 +0,0 @@ -HTML.DefinitionID -TYPE: string/null -DEFAULT: NULL -VERSION: 2.0.0 ---DESCRIPTION-- - -- Unique identifier for a custom-built HTML definition. If you edit - the raw version of the HTMLDefinition, introducing changes that the - configuration object does not reflect, you must specify this variable. - If you change your custom edits, you should change this directive, or - clear your cache. Example: -
-
-$config = HTMLPurifier_Config::createDefault();
-$config->set('HTML', 'DefinitionID', '1');
-$def = $config->getHTMLDefinition();
-$def->addAttribute('a', 'tabindex', 'Number');
-
-- In the above example, the configuration is still at the defaults, but - using the advanced API, an extra attribute has been added. The - configuration object normally has no way of knowing that this change - has taken place, so it needs an extra directive: %HTML.DefinitionID. - If someone else attempts to use the default configuration, these two - pieces of code will not clobber each other in the cache, since one has - an extra directive attached to it. -
-- You must specify a value to this directive to use the - advanced API features. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,16 +0,0 @@ -HTML.DefinitionRev -TYPE: int -VERSION: 2.0.0 -DEFAULT: 1 ---DESCRIPTION-- - -- Revision identifier for your custom definition specified in - %HTML.DefinitionID. This serves the same purpose: uniquely identifying - your custom definition, but this one does so in a chronological - context: revision 3 is more up-to-date then revision 2. Thus, when - this gets incremented, the cache handling is smart enough to clean - up any older revisions of your definition as well as flush the - cache. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -HTML.Doctype -TYPE: string/null -DEFAULT: NULL ---DESCRIPTION-- -Doctype to use during filtering. Technically speaking this is not actually -a doctype (as it does not identify a corresponding DTD), but we are using -this name for sake of simplicity. When non-blank, this will override any -older directives like %HTML.XHTML or %HTML.Strict. ---ALLOWED-- -'HTML 4.01 Transitional', 'HTML 4.01 Strict', 'XHTML 1.0 Transitional', 'XHTML 1.0 Strict', 'XHTML 1.1' ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -HTML.FlashAllowFullScreen -TYPE: bool -VERSION: 4.2.0 -DEFAULT: false ---DESCRIPTION-- -
- Whether or not to permit embedded Flash content from
- %HTML.SafeObject to expand to the full screen. Corresponds to
- the allowFullScreen parameter.
-
- While this directive is similar to %HTML.AllowedAttributes, for
- forwards-compatibility with XML, this attribute has a different syntax. Instead of
- tag.attr, use tag@attr. To disallow href
- attributes in a tags, set this directive to
- a@href. You can also disallow an attribute globally with
- attr or *@attr (either syntax is fine; the latter
- is provided for consistency with %HTML.AllowedAttributes).
-
- Warning: This directive complements %HTML.ForbiddenElements, - accordingly, check - out that directive for a discussion of why you - should think twice before using this directive. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,20 +0,0 @@ -HTML.ForbiddenElements -TYPE: lookup -VERSION: 3.1.0 -DEFAULT: array() ---DESCRIPTION-- -- This was, perhaps, the most requested feature ever in HTML - Purifier. Please don't abuse it! This is the logical inverse of - %HTML.AllowedElements, and it will override that directive, or any - other directive. -
-
- If possible, %HTML.Allowed is recommended over this directive, because it
- can sometimes be difficult to tell whether or not you've forbidden all of
- the behavior you would like to disallow. If you forbid img
- with the expectation of preventing images on your site, you'll be in for
- a nasty surprise when people start using the background-image
- CSS property.
-
- This directive controls the maximum number of pixels in the width and
- height attributes in img tags. This is
- in place to prevent imagecrash attacks, disable with null at your own risk.
- This directive is similar to %CSS.MaxImgLength, and both should be
- concurrently edited, although there are
- subtle differences in the input format (the HTML max is an integer).
-
- String name of element that HTML fragment passed to library will be - inserted in. An interesting variation would be using span as the - parent element, meaning that only inline tags would be allowed. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,12 +0,0 @@ -HTML.Proprietary -TYPE: bool -VERSION: 3.1.0 -DEFAULT: false ---DESCRIPTION-- -
- Whether or not to allow proprietary elements and attributes in your
- documents, as per HTMLPurifier_HTMLModule_Proprietary.
- Warning: This can cause your documents to stop
- validating!
-
- Whether or not to permit embed tags in documents, with a number of extra - security features added to prevent script execution. This is similar to - what websites like MySpace do to embed tags. Embed is a proprietary - element and will cause your website to stop validating; you should - see if you can use %Output.FlashCompat with %HTML.SafeObject instead - first.
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -HTML.SafeIframe -TYPE: bool -VERSION: 4.4.0 -DEFAULT: false ---DESCRIPTION-- -- Whether or not to permit iframe tags in untrusted documents. This - directive must be accompanied by a whitelist of permitted iframes, - such as %URI.SafeIframeRegexp, otherwise it will fatally error. - This directive has no effect on strict doctypes, as iframes are not - valid. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -HTML.SafeObject -TYPE: bool -VERSION: 3.1.1 -DEFAULT: false ---DESCRIPTION-- -- Whether or not to permit object tags in documents, with a number of extra - security features added to prevent script execution. This is similar to - what websites like MySpace do to object tags. You should also enable - %Output.FlashCompat in order to generate Internet Explorer - compatibility code for your object tags. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,10 +0,0 @@ -HTML.SafeScripting -TYPE: lookup -VERSION: 4.5.0 -DEFAULT: array() ---DESCRIPTION-- -- Whether or not to permit script tags to external scripts in documents. - Inline scripting is not allowed, and the script must match an explicit whitelist. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,9 +0,0 @@ -HTML.Strict -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false -DEPRECATED-VERSION: 1.7.0 -DEPRECATED-USE: HTML.Doctype ---DESCRIPTION-- -Determines whether or not to use Transitional (loose) or Strict rulesets. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,8 +0,0 @@ -HTML.TargetBlank -TYPE: bool -VERSION: 4.4.0 -DEFAULT: FALSE ---DESCRIPTION-- -If enabled,target=blank attributes are added to all outgoing links.
-(This includes links from an HTTPS version of a page to an HTTP version.)
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,10 +0,0 @@
---# vim: et sw=4 sts=4
-HTML.TargetNoopener
-TYPE: bool
-VERSION: 4.8.0
-DEFAULT: TRUE
---DESCRIPTION--
-If enabled, noopener rel attributes are added to links which have
-a target attribute associated with them. This prevents malicious
-destinations from overwriting the original window.
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,9 +0,0 @@
-HTML.TargetNoreferrer
-TYPE: bool
-VERSION: 4.8.0
-DEFAULT: TRUE
---DESCRIPTION--
-If enabled, noreferrer rel attributes are added to links which have
-a target attribute associated with them. This prevents malicious
-destinations from overwriting the original window.
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,8 +0,0 @@
-HTML.TidyAdd
-TYPE: lookup
-VERSION: 2.0.0
-DEFAULT: array()
---DESCRIPTION--
-
-Fixes to add to the default set of Tidy fixes as per your level.
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,24 +0,0 @@
-HTML.TidyLevel
-TYPE: string
-VERSION: 2.0.0
-DEFAULT: 'medium'
---DESCRIPTION--
-
-General level of cleanliness the Tidy module should enforce. -There are four allowed values:
--
-
- none -
- No extra tidying should be done -
- light -
- Only fix elements that would be discarded otherwise due to - lack of support in doctype -
- medium -
- Enforce best practices -
- heavy -
- Transform all deprecated elements and attributes to standards - compliant equivalents -
- If true, HTML Purifier will protect against Internet Explorer's
- mishandling of the innerHTML attribute by appending
- a space to any attribute that does not contain angled brackets, spaces
- or quotes, but contains a backtick. This slightly changes the
- semantics of any given attribute, so if this is unacceptable and
- you do not use innerHTML on any of your pages, you can
- turn this directive off.
-
- If true, HTML Purifier will generate Internet Explorer compatibility - code for all object code. This is highly recommended if you enable - %HTML.SafeObject. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -Output.Newline -TYPE: string/null -VERSION: 2.0.1 -DEFAULT: NULL ---DESCRIPTION-- - -- Newline string to format final output with. If left null, HTML Purifier - will auto-detect the default newline type of the system and use that; - you can manually override it here. Remember, \r\n is Windows, \r - is Mac, and \n is Unix. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,14 +0,0 @@ -Output.SortAttr -TYPE: bool -VERSION: 3.2.0 -DEFAULT: false ---DESCRIPTION-- -
- If true, HTML Purifier will sort attributes by name before writing them back
- to the document, converting a tag like: <el b="" a="" c="" />
- to <el a="" b="" c="" />. This is a workaround for
- a bug in FCKeditor which causes it to swap attributes order, adding noise
- to text diffs. If you're not seeing this bug, chances are, you don't need
- this directive.
-
- Determines whether or not to run Tidy on the final output for pretty - formatting reasons, such as indentation and wrap. -
-- This can greatly improve readability for editors who are hand-editing - the HTML, but is by no means necessary as HTML Purifier has already - fixed all major errors the HTML may have had. Tidy is a non-default - extension, and this directive will silently fail if Tidy is not - available. -
-- If you are looking to make the overall look of your page's source - better, I recommend running Tidy on the entire page rather than just - user-content (after all, the indentation relative to the containing - blocks will be incorrect). -
---ALIASES-- -Core.TidyFormat ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,7 +0,0 @@ -Test.ForceNoIconv -TYPE: bool -DEFAULT: false ---DESCRIPTION-- -When set to true, HTMLPurifier_Encoder will act as if iconv does not exist -and use only pure PHP implementations. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,18 +0,0 @@ -URI.AllowedSchemes -TYPE: lookup ---DEFAULT-- -array ( - 'http' => true, - 'https' => true, - 'mailto' => true, - 'ftp' => true, - 'nntp' => true, - 'news' => true, - 'tel' => true, -) ---DESCRIPTION-- -Whitelist that defines the schemes that a URI is allowed to have. This -prevents XSS attacks from using pseudo-schemes like javascript or mocha. -There is also support for thedata and file
-URI schemes, but they are not enabled by default.
---# vim: et sw=4 sts=4
diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt
--- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt 2018-02-23 02:08:20.000000000 +0000
+++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt 1970-01-01 00:00:00.000000000 +0000
@@ -1,17 +0,0 @@
-URI.Base
-TYPE: string/null
-VERSION: 2.1.0
-DEFAULT: NULL
---DESCRIPTION--
-
-- The base URI is the URI of the document this purified HTML will be - inserted into. This information is important if HTML Purifier needs - to calculate absolute URIs from relative URIs, such as when %URI.MakeAbsolute - is on. You may use a non-absolute URI for this value, but behavior - may vary (%URI.MakeAbsolute deals nicely with both absolute and - relative paths, but forwards-compatibility is not guaranteed). - Warning: If set, the scheme on this URI - overrides the one specified by %URI.DefaultScheme. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -URI.DefaultScheme -TYPE: string/null -DEFAULT: 'http' ---DESCRIPTION-- - -- Defines through what scheme the output will be served, in order to - select the proper object validator when no scheme information is present. -
- -- Starting with HTML Purifier 4.9.0, the default scheme can be null, in - which case we reject all URIs which do not have explicit schemes. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -URI.DefinitionID -TYPE: string/null -VERSION: 2.1.0 -DEFAULT: NULL ---DESCRIPTION-- - -- Unique identifier for a custom-built URI definition. If you want - to add custom URIFilters, you must specify this value. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -URI.DefinitionRev -TYPE: int -VERSION: 2.1.0 -DEFAULT: 1 ---DESCRIPTION-- - -- Revision identifier for your custom definition. See - %HTML.DefinitionRev for details. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -URI.DisableExternalResources -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false ---DESCRIPTION-- -Disables the embedding of external resources, preventing users from -embedding things like images from other hosts. This prevents access -tracking (good for email viewers), bandwidth leeching, cross-site request -forging, goatse.cx posting, and other nasties, but also results in a loss -of end-user functionality (they can't directly post a pic they posted from -Flickr anymore). Use it if you don't have a robust user-content moderation -team. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ -URI.DisableExternal -TYPE: bool -VERSION: 1.2.0 -DEFAULT: false ---DESCRIPTION-- -Disables links to external websites. This is a highly effective anti-spam -and anti-pagerank-leech measure, but comes at a hefty price: nolinks or -images outside of your domain will be allowed. Non-linkified URIs will -still be preserved. If you want to be able to link to subdomains or use -absolute URIs, specify %URI.Host for your website. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -URI.DisableResources -TYPE: bool -VERSION: 4.2.0 -DEFAULT: false ---DESCRIPTION-- -- Disables embedding resources, essentially meaning no pictures. You can - still link to them though. See %URI.DisableExternalResources for why - this might be a good idea. -
-- Note: While this directive has been available since 1.3.0, - it didn't actually start doing anything until 4.2.0. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,14 +0,0 @@ -URI.Disable -TYPE: bool -VERSION: 1.3.0 -DEFAULT: false ---DESCRIPTION-- - -- Disables all URIs in all forms. Not sure why you'd want to do that - (after all, the Internet's founded on the notion of a hyperlink). -
- ---ALIASES-- -Attr.DisableURI ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,9 +0,0 @@ -URI.HostBlacklist -TYPE: list -VERSION: 1.3.0 -DEFAULT: array() ---DESCRIPTION-- -List of strings that are forbidden in the host of any URI. Use it to kill -domain names of spam, etc. Note that it will catch anything in the domain, -so moo.com will catch moo.com.example.com. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,19 +0,0 @@ -URI.Host -TYPE: string/null -VERSION: 1.2.0 -DEFAULT: NULL ---DESCRIPTION-- - -- Defines the domain name of the server, so we can determine whether or - an absolute URI is from your website or not. Not strictly necessary, - as users should be using relative URIs to reference resources on your - website. It will, however, let you use absolute URIs to link to - subdomains of the domain you post here: i.e. example.com will allow - sub.example.com. However, higher up domains will still be excluded: - if you set %URI.Host to sub.example.com, example.com will be blocked. - Note: This directive overrides %URI.Base because - a given page may be on a sub-domain, but you wish HTML Purifier to be - more relaxed and allow some of the parent domains too. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,13 +0,0 @@ -URI.MakeAbsolute -TYPE: bool -VERSION: 2.1.0 -DEFAULT: false ---DESCRIPTION-- - -- Converts all URIs into absolute forms. This is useful when the HTML - being filtered assumes a specific base path, but will actually be - viewed in a different context (and setting an alternate base URI is - not possible). %URI.Base must be set for this directive to work. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,17 +0,0 @@ -URI.MungeResources -TYPE: bool -VERSION: 3.1.1 -DEFAULT: false ---DESCRIPTION-- -
- If true, any URI munging directives like %URI.Munge
- will also apply to embedded resources, such as <img src="">.
- Be careful enabling this directive if you have a redirector script
- that does not use the Location HTTP header; all of your images
- and other embedded resources will break.
-
- Warning: It is strongly advised you use this in conjunction - %URI.MungeSecretKey to mitigate the security risk of an open redirector. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,30 +0,0 @@ -URI.MungeSecretKey -TYPE: string/null -VERSION: 3.1.1 -DEFAULT: NULL ---DESCRIPTION-- -- This directive enables secure checksum generation along with %URI.Munge. - It should be set to a secure key that is not shared with anyone else. - The checksum can be placed in the URI using %t. Use of this checksum - affords an additional level of protection by allowing a redirector - to check if a URI has passed through HTML Purifier with this line: -
- -$checksum === hash_hmac("sha256", $url, $secret_key)
-
-- If the output is TRUE, the redirector script should accept the URI. -
- -- Please note that it would still be possible for an attacker to procure - secure hashes en-mass by abusing your website's Preview feature or the - like, but this service affords an additional level of protection - that should be combined with website blacklisting. -
- -- Remember this has no effect if %URI.Munge is not on. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,83 +0,0 @@ -URI.Munge -TYPE: string/null -VERSION: 1.3.0 -DEFAULT: NULL ---DESCRIPTION-- - -
- Munges all browsable (usually http, https and ftp)
- absolute URIs into another URI, usually a URI redirection service.
- This directive accepts a URI, formatted with a %s where
- the url-encoded original URI should be inserted (sample:
- http://www.google.com/url?q=%s).
-
- Uses for this directive: -
--
-
- - Prevent PageRank leaks, while being fairly transparent - to users (you may also want to add some client side JavaScript to - override the text in the statusbar). Notice: - Many security experts believe that this form of protection does not deter spam-bots. - -
- - Redirect users to a splash page telling them they are leaving your - website. While this is poor usability practice, it is often mandated - in corporate environments. - -
- Prior to HTML Purifier 3.1.1, this directive also enabled the munging
- of browsable external resources, which could break things if your redirection
- script was a splash page or used meta tags. To revert to
- previous behavior, please use %URI.MungeResources.
-
- You may want to also use %URI.MungeSecretKey along with this directive - in order to enforce what URIs your redirector script allows. Open - redirector scripts can be a security risk and negatively affect the - reputation of your domain name. -
-- Starting with HTML Purifier 3.1.1, there is also these substitutions: -
-| Key | -Description | -Example <a href=""> |
-
|---|---|---|
| %r | -1 - The URI embeds a resource (blank) - The URI is merely a link |
- - |
| %n | -The name of the tag this URI came from | -a | -
| %m | -The name of the attribute this URI came from | -href | -
| %p | -The name of the CSS property this URI came from, or blank if irrelevant | -- |
- Admittedly, these letters are somewhat arbitrary; the only stipulation - was that they couldn't be a through f. r is for resource (I would have preferred - e, but you take what you can get), n is for name, m - was picked because it came after n (and I couldn't use a), p is for - property. -
---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,9 +0,0 @@ -URI.OverrideAllowedSchemes -TYPE: bool -DEFAULT: true ---DESCRIPTION-- -If this is set to true (which it is by default), you can override -%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme to the -registry. If false, you will also have to update that directive in order -to add more schemes. ---# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,22 +0,0 @@ -URI.SafeIframeRegexp -TYPE: string/null -VERSION: 4.4.0 -DEFAULT: NULL ---DESCRIPTION-- -- A PCRE regular expression that will be matched against an iframe URI. This is - a relatively inflexible scheme, but works well enough for the most common - use-case of iframes: embedded video. This directive only has an effect if - %HTML.SafeIframe is enabled. Here are some example values: -
--
-
%^http://www.youtube.com/embed/%- Allow YouTube videos
- %^http://player.vimeo.com/video/%- Allow Vimeo videos
- %^http://(www.youtube.com/embed/|player.vimeo.com/video/)%- Allow both
-
- Note that this directive does not give you enough granularity to, say, disable
- all autoplay videos. Pipe up on the HTML Purifier forums if this
- is a capability you want.
-
' . $this->locale->getMessage('ErrorCollector: No errors') . '
'; - } else { - return '- ' . implode('
- ', $ret) . '
';
- // W3C uses an icon to indicate the severity of the error.
- $error = $this->locale->getErrorName($severity);
- $string .= "$error ";
- if (!is_null($line) && !is_null($col)) {
- $string .= "Line $line, Column $col: ";
- } else {
- $string .= 'End of Document: ';
- }
- $string .= '' . $this->generator->escape($msg) . ' ';
- $string .= '
';
- // Here, have a marker for the character on the column appropriate.
- // Be sure to clip extremely long lines.
- //$string .= ''; - //$string .= ''; - //$string .= ''; - $ret[] = $string; - } - foreach ($current->children as $array) { - $context[] = $current; - $stack = array_merge($stack, array_reverse($array, true)); - for ($i = count($array); $i > 0; $i--) { - $context_stack[] = $context; - } - } - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ErrorStruct.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ErrorStruct.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/ErrorStruct.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/ErrorStruct.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,74 +0,0 @@ -children[$type][$id])) { - $this->children[$type][$id] = new HTMLPurifier_ErrorStruct(); - $this->children[$type][$id]->type = $type; - } - return $this->children[$type][$id]; - } - - /** - * @param int $severity - * @param string $message - */ - public function addError($severity, $message) - { - $this->errors[] = array($severity, $message); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Exception.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Exception.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Exception.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Exception.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,12 +0,0 @@ - blocks from input HTML, cleans them up - * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks') - * so they can be used elsewhere in the document. - * - * @note - * See tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php for - * sample usage. - * - * @note - * This filter can also be used on stylesheets not included in the - * document--something purists would probably prefer. Just directly - * call HTMLPurifier_Filter_ExtractStyleBlocks->cleanCSS() - */ -class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter -{ - /** - * @type string - */ - public $name = 'ExtractStyleBlocks'; - - /** - * @type array - */ - private $_styleMatches = array(); - - /** - * @type csstidy - */ - private $_tidy; - - /** - * @type HTMLPurifier_AttrDef_HTML_ID - */ - private $_id_attrdef; - - /** - * @type HTMLPurifier_AttrDef_CSS_Ident - */ - private $_class_attrdef; - - /** - * @type HTMLPurifier_AttrDef_Enum - */ - private $_enum_attrdef; - - public function __construct() - { - $this->_tidy = new csstidy(); - $this->_tidy->set_cfg('lowercase_s', false); - $this->_id_attrdef = new HTMLPurifier_AttrDef_HTML_ID(true); - $this->_class_attrdef = new HTMLPurifier_AttrDef_CSS_Ident(); - $this->_enum_attrdef = new HTMLPurifier_AttrDef_Enum( - array( - 'first-child', - 'link', - 'visited', - 'active', - 'hover', - 'focus' - ) - ); - } - - /** - * Save the contents of CSS blocks to style matches - * @param array $matches preg_replace style $matches array - */ - protected function styleCallback($matches) - { - $this->_styleMatches[] = $matches[1]; - } - - /** - * Removes inline - // we must not grab foo in a font-family prop). - if ($config->get('Filter.ExtractStyleBlocks.Escaping')) { - $css = str_replace( - array('<', '>', '&'), - array('\3C ', '\3E ', '\26 '), - $css - ); - } - return $css; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter/YouTube.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter/YouTube.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter/YouTube.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter/YouTube.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,65 +0,0 @@ -]+>.+?' . - '(?:http:)?//www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?#s'; - $pre_replace = ''; - return preg_replace($pre_regex, $pre_replace, $html); - } - - /** - * @param string $html - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return string - */ - public function postFilter($html, $config, $context) - { - $post_regex = '##'; - return preg_replace_callback($post_regex, array($this, 'postFilterCallback'), $html); - } - - /** - * @param $url - * @return string - */ - protected function armorUrl($url) - { - return str_replace('--', '--', $url); - } - - /** - * @param array $matches - * @return string - */ - protected function postFilterCallback($matches) - { - $url = $this->armorUrl($matches[1]); - return ''; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Filter.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,56 +0,0 @@ -preFilter, - * 2->preFilter, 3->preFilter, purify, 3->postFilter, 2->postFilter, - * 1->postFilter. - * - * @note Methods are not declared abstract as it is perfectly legitimate - * for an implementation not to want anything to happen on a step - */ - -class HTMLPurifier_Filter -{ - - /** - * Name of the filter for identification purposes. - * @type string - */ - public $name; - - /** - * Pre-processor function, handles HTML before HTML Purifier - * @param string $html - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return string - */ - public function preFilter($html, $config, $context) - { - return $html; - } - - /** - * Post-processor function, handles HTML after HTML Purifier - * @param string $html - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return string - */ - public function postFilter($html, $config, $context) - { - return $html; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Generator.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Generator.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Generator.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Generator.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,286 +0,0 @@ - tags. - * @type bool - */ - private $_scriptFix = false; - - /** - * Cache of HTMLDefinition during HTML output to determine whether or - * not attributes should be minimized. - * @type HTMLPurifier_HTMLDefinition - */ - private $_def; - - /** - * Cache of %Output.SortAttr. - * @type bool - */ - private $_sortAttr; - - /** - * Cache of %Output.FlashCompat. - * @type bool - */ - private $_flashCompat; - - /** - * Cache of %Output.FixInnerHTML. - * @type bool - */ - private $_innerHTMLFix; - - /** - * Stack for keeping track of object information when outputting IE - * compatibility code. - * @type array - */ - private $_flashStack = array(); - - /** - * Configuration for the generator - * @type HTMLPurifier_Config - */ - protected $config; - - /** - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - */ - public function __construct($config, $context) - { - $this->config = $config; - $this->_scriptFix = $config->get('Output.CommentScriptContents'); - $this->_innerHTMLFix = $config->get('Output.FixInnerHTML'); - $this->_sortAttr = $config->get('Output.SortAttr'); - $this->_flashCompat = $config->get('Output.FlashCompat'); - $this->_def = $config->getHTMLDefinition(); - $this->_xhtml = $this->_def->doctype->xml; - } - - /** - * Generates HTML from an array of tokens. - * @param HTMLPurifier_Token[] $tokens Array of HTMLPurifier_Token - * @return string Generated HTML - */ - public function generateFromTokens($tokens) - { - if (!$tokens) { - return ''; - } - - // Basic algorithm - $html = ''; - for ($i = 0, $size = count($tokens); $i < $size; $i++) { - if ($this->_scriptFix && $tokens[$i]->name === 'script' - && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) { - // script special case - // the contents of the script block must be ONE token - // for this to work. - $html .= $this->generateFromToken($tokens[$i++]); - $html .= $this->generateScriptFromToken($tokens[$i++]); - } - $html .= $this->generateFromToken($tokens[$i]); - } - - // Tidy cleanup - if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) { - $tidy = new Tidy; - $tidy->parseString( - $html, - array( - 'indent'=> true, - 'output-xhtml' => $this->_xhtml, - 'show-body-only' => true, - 'indent-spaces' => 2, - 'wrap' => 68, - ), - 'utf8' - ); - $tidy->cleanRepair(); - $html = (string) $tidy; // explicit cast necessary - } - - // Normalize newlines to system defined value - if ($this->config->get('Core.NormalizeNewlines')) { - $nl = $this->config->get('Output.Newline'); - if ($nl === null) { - $nl = PHP_EOL; - } - if ($nl !== "\n") { - $html = str_replace("\n", $nl, $html); - } - } - return $html; - } - - /** - * Generates HTML from a single token. - * @param HTMLPurifier_Token $token HTMLPurifier_Token object. - * @return string Generated HTML - */ - public function generateFromToken($token) - { - if (!$token instanceof HTMLPurifier_Token) { - trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); - return ''; - - } elseif ($token instanceof HTMLPurifier_Token_Start) { - $attr = $this->generateAttributes($token->attr, $token->name); - if ($this->_flashCompat) { - if ($token->name == "object") { - $flash = new stdClass(); - $flash->attr = $token->attr; - $flash->param = array(); - $this->_flashStack[] = $flash; - } - } - return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; - - } elseif ($token instanceof HTMLPurifier_Token_End) { - $_extra = ''; - if ($this->_flashCompat) { - if ($token->name == "object" && !empty($this->_flashStack)) { - // doesn't do anything for now - } - } - return $_extra . 'name . '>'; - - } elseif ($token instanceof HTMLPurifier_Token_Empty) { - if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) { - $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value']; - } - $attr = $this->generateAttributes($token->attr, $token->name); - return '<' . $token->name . ($attr ? ' ' : '') . $attr . - ( $this->_xhtml ? ' /': '' ) //
v.
- . '>'; - - } elseif ($token instanceof HTMLPurifier_Token_Text) { - return $this->escape($token->data, ENT_NOQUOTES); - - } elseif ($token instanceof HTMLPurifier_Token_Comment) { - return ''; - } else { - return ''; - - } - } - - /** - * Special case processor for the contents of script tags - * @param HTMLPurifier_Token $token HTMLPurifier_Token object. - * @return string - * @warning This runs into problems if there's already a literal - * --> somewhere inside the script contents. - */ - public function generateScriptFromToken($token) - { - if (!$token instanceof HTMLPurifier_Token_Text) { - return $this->generateFromToken($token); - } - // Thanks
tags? - if ($this->allowsElement('p')) { - if (empty($this->currentNesting) || strpos($text, "\n\n") !== false) { - // Note that we have differing behavior when dealing with text - // in the anonymous root node, or a node inside the document. - // If the text as a double-newline, the treatment is the same; - // if it doesn't, see the next if-block if you're in the document. - - $i = $nesting = null; - if (!$this->forwardUntilEndToken($i, $current, $nesting) && $token->is_whitespace) { - // State 1.1: ... ^ (whitespace, then document end) - // ---- - // This is a degenerate case - } else { - if (!$token->is_whitespace || $this->_isInline($current)) { - // State 1.2: PAR1 - // ---- - - // State 1.3: PAR1\n\nPAR2 - // ------------ - - // State 1.4:
PAR1\n\nPAR2 (see State 2)
- // ------------
- $token = array($this->_pStart());
- $this->_splitText($text, $token);
- } else {
- // State 1.5: \n
- // -- - } - } - } else { - // State 2:
- // -- - } - } - } else { - // State 2:
PAR1... (similar to 1.4)
- // ----
-
- // We're in an element that allows paragraph tags, but we're not
- // sure if we're going to need them.
- if ($this->_pLookAhead()) {
- // State 2.1:
PAR1PAR1\n\nPAR2
- // ----
- // Note: This will always be the first child, since any
- // previous inline element would have triggered this very
- // same routine, and found the double newline. One possible
- // exception would be a comment.
- $token = array($this->_pStart(), $token);
- } else {
- // State 2.2.1:
PAR1
- // ----
-
- // State 2.2.2:
PAR1PAR1
- // ----
- }
- }
- // Is the current parent a tag? - } elseif (!empty($this->currentNesting) && - $this->currentNesting[count($this->currentNesting) - 1]->name == 'p') { - // State 3.1: ...
PAR1 - // ---- - - // State 3.2: ...
PAR1\n\nPAR2 - // ------------ - $token = array(); - $this->_splitText($text, $token); - // Abort! - } else { - // State 4.1: ...PAR1 - // ---- - - // State 4.2: ...PAR1\n\nPAR2 - // ------------ - } - } - - /** - * @param HTMLPurifier_Token $token - */ - public function handleElement(&$token) - { - // We don't have to check if we're already in a
tag for block - // tokens, because the tag would have been autoclosed by MakeWellFormed. - if ($this->allowsElement('p')) { - if (!empty($this->currentNesting)) { - if ($this->_isInline($token)) { - // State 1:
...
- // ---
- // Check if this token is adjacent to the parent token
- // (seek backwards until token isn't whitespace)
- $i = null;
- $this->backward($i, $prev);
-
- if (!$prev instanceof HTMLPurifier_Token_Start) {
- // Token wasn't adjacent
- if ($prev instanceof HTMLPurifier_Token_Text &&
- substr($prev->data, -2) === "\n\n"
- ) {
- // State 1.1.4:
- // --- - // State 1.1.3:
PAR1
\n\n - // --- - // Quite frankly, this should be handled by splitText - $token = array($this->_pStart(), $token); - } else { - // State 1.1.1:PAR1
- // --- - // State 1.1.2:- // --- - // State 1.1.3:
PAR
- // ---
- }
- } else {
- // State 1.2.1:
- // ---
- // Lookahead to see if
is needed. - if ($this->_pLookAhead()) { - // State 1.3.1:
PAR1\n\nPAR2
- // ---
- $token = array($this->_pStart(), $token);
- } else {
- // State 1.3.2:
PAR1
- // ---
-
- // State 1.3.3: PAR1\n\n
- // ---
- }
- }
- } else {
- // State 2.3: ...
- // -----
- }
- } else {
- if ($this->_isInline($token)) {
- // State 3.1:
- // ---
- // This is where the {p} tag is inserted, not reflected in
- // inputTokens yet, however.
- $token = array($this->_pStart(), $token);
- } else {
- // State 3.2:
- // -----
- }
-
- $i = null;
- if ($this->backward($i, $prev)) {
- if (!$prev instanceof HTMLPurifier_Token_Text) {
- // State 3.1.1: ...{p}
- // ---
- // State 3.2.1: ...
- // -----
- if (!is_array($token)) {
- $token = array($token);
- }
- array_unshift($token, new HTMLPurifier_Token_Text("\n\n"));
- } else {
- // State 3.1.2: ...\n\n{p}
- // ---
- // State 3.2.2: ...\n\n
- // -----
- // Note: PAR cannot occur because PAR would have been
- // wrapped in
tags. - } - } - } - } else { - // State 2.2:
-
- // ----
- // State 2.4:
- // --- - } - } - - /** - * Splits up a text in paragraph tokens and appends them - * to the result stream that will replace the original - * @param string $data String text data that will be processed - * into paragraphs - * @param HTMLPurifier_Token[] $result Reference to array of tokens that the - * tags will be appended onto - */ - private function _splitText($data, &$result) - { - $raw_paragraphs = explode("\n\n", $data); - $paragraphs = array(); // without empty paragraphs - $needs_start = false; - $needs_end = false; - - $c = count($raw_paragraphs); - if ($c == 1) { - // There were no double-newlines, abort quickly. In theory this - // should never happen. - $result[] = new HTMLPurifier_Token_Text($data); - return; - } - for ($i = 0; $i < $c; $i++) { - $par = $raw_paragraphs[$i]; - if (trim($par) !== '') { - $paragraphs[] = $par; - } else { - if ($i == 0) { - // Double newline at the front - if (empty($result)) { - // The empty result indicates that the AutoParagraph - // injector did not add any start paragraph tokens. - // This means that we have been in a paragraph for - // a while, and the newline means we should start a new one. - $result[] = new HTMLPurifier_Token_End('p'); - $result[] = new HTMLPurifier_Token_Text("\n\n"); - // However, the start token should only be added if - // there is more processing to be done (i.e. there are - // real paragraphs in here). If there are none, the - // next start paragraph tag will be handled by the - // next call to the injector - $needs_start = true; - } else { - // We just started a new paragraph! - // Reinstate a double-newline for presentation's sake, since - // it was in the source code. - array_unshift($result, new HTMLPurifier_Token_Text("\n\n")); - } - } elseif ($i + 1 == $c) { - // Double newline at the end - // There should be a trailing
when we're finally done. - $needs_end = true; - } - } - } - - // Check if this was just a giant blob of whitespace. Move this earlier, - // perhaps? - if (empty($paragraphs)) { - return; - } - - // Add the start tag indicated by \n\n at the beginning of $data - if ($needs_start) { - $result[] = $this->_pStart(); - } - - // Append the paragraphs onto the result - foreach ($paragraphs as $par) { - $result[] = new HTMLPurifier_Token_Text($par); - $result[] = new HTMLPurifier_Token_End('p'); - $result[] = new HTMLPurifier_Token_Text("\n\n"); - $result[] = $this->_pStart(); - } - - // Remove trailing start token; Injector will handle this later if - // it was indeed needed. This prevents from needing to do a lookahead, - // at the cost of a lookbehind later. - array_pop($result); - - // If there is no need for an end tag, remove all of it and let - // MakeWellFormed close it later. - if (!$needs_end) { - array_pop($result); // removes \n\n - array_pop($result); // removes - } - } - - /** - * Returns true if passed token is inline (and, ergo, allowed in - * paragraph tags) - * @param HTMLPurifier_Token $token - * @return bool - */ - private function _isInline($token) - { - return isset($this->htmlDefinition->info['p']->child->elements[$token->name]); - } - - /** - * Looks ahead in the token list and determines whether or not we need - * to insert atag. - * @return bool - */ - private function _pLookAhead() - { - if ($this->currentToken instanceof HTMLPurifier_Token_Start) { - $nesting = 1; - } else { - $nesting = 0; - } - $ok = false; - $i = null; - while ($this->forwardUntilEndToken($i, $current, $nesting)) { - $result = $this->_checkNeedsP($current); - if ($result !== null) { - $ok = $result; - break; - } - } - return $ok; - } - - /** - * Determines if a particular token requires an earlier inline token - * to get a paragraph. This should be used with _forwardUntilEndToken - * @param HTMLPurifier_Token $current - * @return bool - */ - private function _checkNeedsP($current) - { - if ($current instanceof HTMLPurifier_Token_Start) { - if (!$this->_isInline($current)) { - //
PAR1- // ---- - // Terminate early, since we hit a block element - return false; - } - } elseif ($current instanceof HTMLPurifier_Token_Text) { - if (strpos($current->data, "\n\n") !== false) { - //PAR1PAR1\n\nPAR2 - // ---- - return true; - } else { - //PAR1PAR1... - // ---- - } - } - return null; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/DisplayLinkURI.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/DisplayLinkURI.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/DisplayLinkURI.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/DisplayLinkURI.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,40 +0,0 @@ -start->attr['href'])) { - $url = $token->start->attr['href']; - unset($token->start->attr['href']); - $token = array($token, new HTMLPurifier_Token_Text(" ($url)")); - } else { - // nothing to display - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/Linkify.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/Linkify.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/Linkify.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/Linkify.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,64 +0,0 @@ - array('href')); - - /** - * @param HTMLPurifier_Token $token - */ - public function handleText(&$token) - { - if (!$this->allowsElement('a')) { - return; - } - - if (strpos($token->data, '://') === false) { - // our really quick heuristic failed, abort - // this may not work so well if we want to match things like - // "google.com", but then again, most people don't - return; - } - - // there is/are URL(s). Let's split the string. - // We use this regex: - // https://gist.github.com/gruber/249502 - // but with @cscott's backtracking fix and also - // the Unicode characters un-Unicodified. - $bits = preg_split( - '/\\b((?:[a-z][\\w\\-]+:(?:\\/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}\\/)(?:[^\\s()<>]|\\((?:[^\\s()<>]|(?:\\([^\\s()<>]+\\)))*\\))+(?:\\((?:[^\\s()<>]|(?:\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:\'".,<>?\x{00ab}\x{00bb}\x{201c}\x{201d}\x{2018}\x{2019}]))/iu', - $token->data, -1, PREG_SPLIT_DELIM_CAPTURE); - - - $token = array(); - - // $i = index - // $c = count - // $l = is link - for ($i = 0, $c = count($bits), $l = false; $i < $c; $i++, $l = !$l) { - if (!$l) { - if ($bits[$i] === '') { - continue; - } - $token[] = new HTMLPurifier_Token_Text($bits[$i]); - } else { - $token[] = new HTMLPurifier_Token_Start('a', array('href' => $bits[$i])); - $token[] = new HTMLPurifier_Token_Text($bits[$i]); - $token[] = new HTMLPurifier_Token_End('a'); - } - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/PurifierLinkify.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/PurifierLinkify.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/PurifierLinkify.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/PurifierLinkify.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,71 +0,0 @@ - array('href')); - - /** - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return string - */ - public function prepare($config, $context) - { - $this->docURL = $config->get('AutoFormat.PurifierLinkify.DocURL'); - return parent::prepare($config, $context); - } - - /** - * @param HTMLPurifier_Token $token - */ - public function handleText(&$token) - { - if (!$this->allowsElement('a')) { - return; - } - if (strpos($token->data, '%') === false) { - return; - } - - $bits = preg_split('#%([a-z0-9]+\.[a-z0-9]+)#Si', $token->data, -1, PREG_SPLIT_DELIM_CAPTURE); - $token = array(); - - // $i = index - // $c = count - // $l = is link - for ($i = 0, $c = count($bits), $l = false; $i < $c; $i++, $l = !$l) { - if (!$l) { - if ($bits[$i] === '') { - continue; - } - $token[] = new HTMLPurifier_Token_Text($bits[$i]); - } else { - $token[] = new HTMLPurifier_Token_Start( - 'a', - array('href' => str_replace('%s', $bits[$i], $this->docURL)) - ); - $token[] = new HTMLPurifier_Token_Text('%' . $bits[$i]); - $token[] = new HTMLPurifier_Token_End('a'); - } - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveEmpty.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveEmpty.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveEmpty.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveEmpty.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,112 +0,0 @@ -config = $config; - $this->context = $context; - $this->removeNbsp = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp'); - $this->removeNbspExceptions = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions'); - $this->exclude = $config->get('AutoFormat.RemoveEmpty.Predicate'); - foreach ($this->exclude as $key => $attrs) { - if (!is_array($attrs)) { - // HACK, see HTMLPurifier/Printer/ConfigForm.php - $this->exclude[$key] = explode(';', $attrs); - } - } - $this->attrValidator = new HTMLPurifier_AttrValidator(); - } - - /** - * @param HTMLPurifier_Token $token - */ - public function handleElement(&$token) - { - if (!$token instanceof HTMLPurifier_Token_Start) { - return; - } - $next = false; - $deleted = 1; // the current tag - for ($i = count($this->inputZipper->back) - 1; $i >= 0; $i--, $deleted++) { - $next = $this->inputZipper->back[$i]; - if ($next instanceof HTMLPurifier_Token_Text) { - if ($next->is_whitespace) { - continue; - } - if ($this->removeNbsp && !isset($this->removeNbspExceptions[$token->name])) { - $plain = str_replace("\xC2\xA0", "", $next->data); - $isWsOrNbsp = $plain === '' || ctype_space($plain); - if ($isWsOrNbsp) { - continue; - } - } - } - break; - } - if (!$next || ($next instanceof HTMLPurifier_Token_End && $next->name == $token->name)) { - $this->attrValidator->validateToken($token, $this->config, $this->context); - $token->armor['ValidateAttributes'] = true; - if (isset($this->exclude[$token->name])) { - $r = true; - foreach ($this->exclude[$token->name] as $elem) { - if (!isset($token->attr[$elem])) $r = false; - } - if ($r) return; - } - if (isset($token->attr['id']) || isset($token->attr['name'])) { - return; - } - $token = $deleted + 1; - for ($b = 0, $c = count($this->inputZipper->front); $b < $c; $b++) { - $prev = $this->inputZipper->front[$b]; - if ($prev instanceof HTMLPurifier_Token_Text && $prev->is_whitespace) { - continue; - } - break; - } - // This is safe because we removed the token that triggered this. - $this->rewindOffset($b+$deleted); - return; - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,84 +0,0 @@ -attrValidator = new HTMLPurifier_AttrValidator(); - $this->config = $config; - $this->context = $context; - return parent::prepare($config, $context); - } - - /** - * @param HTMLPurifier_Token $token - */ - public function handleElement(&$token) - { - if ($token->name !== 'span' || !$token instanceof HTMLPurifier_Token_Start) { - return; - } - - // We need to validate the attributes now since this doesn't normally - // happen until after MakeWellFormed. If all the attributes are removed - // the span needs to be removed too. - $this->attrValidator->validateToken($token, $this->config, $this->context); - $token->armor['ValidateAttributes'] = true; - - if (!empty($token->attr)) { - return; - } - - $nesting = 0; - while ($this->forwardUntilEndToken($i, $current, $nesting)) { - } - - if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') { - // Mark closing span tag for deletion - $current->markForDeletion = true; - // Delete open span tag - $token = false; - } - } - - /** - * @param HTMLPurifier_Token $token - */ - public function handleEnd(&$token) - { - if ($token->markForDeletion) { - $token = false; - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/SafeObject.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/SafeObject.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/SafeObject.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector/SafeObject.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,124 +0,0 @@ - 'never', - 'allowNetworking' => 'internal', - ); - - /** - * These are all lower-case keys. - * @type array - */ - protected $allowedParam = array( - 'wmode' => true, - 'movie' => true, - 'flashvars' => true, - 'src' => true, - 'allowfullscreen' => true, // if omitted, assume to be 'false' - ); - - /** - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return void - */ - public function prepare($config, $context) - { - parent::prepare($config, $context); - } - - /** - * @param HTMLPurifier_Token $token - */ - public function handleElement(&$token) - { - if ($token->name == 'object') { - $this->objectStack[] = $token; - $this->paramStack[] = array(); - $new = array($token); - foreach ($this->addParam as $name => $value) { - $new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value)); - } - $token = $new; - } elseif ($token->name == 'param') { - $nest = count($this->currentNesting) - 1; - if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') { - $i = count($this->objectStack) - 1; - if (!isset($token->attr['name'])) { - $token = false; - return; - } - $n = $token->attr['name']; - // We need this fix because YouTube doesn't supply a data - // attribute, which we need if a type is specified. This is - // *very* Flash specific. - if (!isset($this->objectStack[$i]->attr['data']) && - ($token->attr['name'] == 'movie' || $token->attr['name'] == 'src') - ) { - $this->objectStack[$i]->attr['data'] = $token->attr['value']; - } - // Check if the parameter is the correct value but has not - // already been added - if (!isset($this->paramStack[$i][$n]) && - isset($this->addParam[$n]) && - $token->attr['name'] === $this->addParam[$n]) { - // keep token, and add to param stack - $this->paramStack[$i][$n] = true; - } elseif (isset($this->allowedParam[strtolower($n)])) { - // keep token, don't do anything to it - // (could possibly check for duplicates here) - // Note: In principle, parameters should be case sensitive. - // But it seems they are not really; so accept any case. - } else { - $token = false; - } - } else { - // not directly inside an object, DENY! - $token = false; - } - } - } - - public function handleEnd(&$token) - { - // This is the WRONG way of handling the object and param stacks; - // we should be inserting them directly on the relevant object tokens - // so that the global stack handling handles it. - if ($token->name == 'object') { - array_pop($this->objectStack); - array_pop($this->paramStack); - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Injector.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,283 +0,0 @@ -processToken() - * documentation. - * - * @todo Allow injectors to request a re-run on their output. This - * would help if an operation is recursive. - */ -abstract class HTMLPurifier_Injector -{ - - /** - * Advisory name of injector, this is for friendly error messages. - * @type string - */ - public $name; - - /** - * @type HTMLPurifier_HTMLDefinition - */ - protected $htmlDefinition; - - /** - * Reference to CurrentNesting variable in Context. This is an array - * list of tokens that we are currently "inside" - * @type array - */ - protected $currentNesting; - - /** - * Reference to current token. - * @type HTMLPurifier_Token - */ - protected $currentToken; - - /** - * Reference to InputZipper variable in Context. - * @type HTMLPurifier_Zipper - */ - protected $inputZipper; - - /** - * Array of elements and attributes this injector creates and therefore - * need to be allowed by the definition. Takes form of - * array('element' => array('attr', 'attr2'), 'element2') - * @type array - */ - public $needed = array(); - - /** - * Number of elements to rewind backwards (relative). - * @type bool|int - */ - protected $rewindOffset = false; - - /** - * Rewind to a spot to re-perform processing. This is useful if you - * deleted a node, and now need to see if this change affected any - * earlier nodes. Rewinding does not affect other injectors, and can - * result in infinite loops if not used carefully. - * @param bool|int $offset - * @warning HTML Purifier will prevent you from fast-forwarding with this - * function. - */ - public function rewindOffset($offset) - { - $this->rewindOffset = $offset; - } - - /** - * Retrieves rewind offset, and then unsets it. - * @return bool|int - */ - public function getRewindOffset() - { - $r = $this->rewindOffset; - $this->rewindOffset = false; - return $r; - } - - /** - * Prepares the injector by giving it the config and context objects: - * this allows references to important variables to be made within - * the injector. This function also checks if the HTML environment - * will work with the Injector (see checkNeeded()). - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool|string Boolean false if success, string of missing needed element/attribute if failure - */ - public function prepare($config, $context) - { - $this->htmlDefinition = $config->getHTMLDefinition(); - // Even though this might fail, some unit tests ignore this and - // still test checkNeeded, so be careful. Maybe get rid of that - // dependency. - $result = $this->checkNeeded($config); - if ($result !== false) { - return $result; - } - $this->currentNesting =& $context->get('CurrentNesting'); - $this->currentToken =& $context->get('CurrentToken'); - $this->inputZipper =& $context->get('InputZipper'); - return false; - } - - /** - * This function checks if the HTML environment - * will work with the Injector: if p tags are not allowed, the - * Auto-Paragraphing injector should not be enabled. - * @param HTMLPurifier_Config $config - * @return bool|string Boolean false if success, string of missing needed element/attribute if failure - */ - public function checkNeeded($config) - { - $def = $config->getHTMLDefinition(); - foreach ($this->needed as $element => $attributes) { - if (is_int($element)) { - $element = $attributes; - } - if (!isset($def->info[$element])) { - return $element; - } - if (!is_array($attributes)) { - continue; - } - foreach ($attributes as $name) { - if (!isset($def->info[$element]->attr[$name])) { - return "$element.$name"; - } - } - } - return false; - } - - /** - * Tests if the context node allows a certain element - * @param string $name Name of element to test for - * @return bool True if element is allowed, false if it is not - */ - public function allowsElement($name) - { - if (!empty($this->currentNesting)) { - $parent_token = array_pop($this->currentNesting); - $this->currentNesting[] = $parent_token; - $parent = $this->htmlDefinition->info[$parent_token->name]; - } else { - $parent = $this->htmlDefinition->info_parent_def; - } - if (!isset($parent->child->elements[$name]) || isset($parent->excludes[$name])) { - return false; - } - // check for exclusion - if (!empty($this->currentNesting)) { - for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) { - $node = $this->currentNesting[$i]; - $def = $this->htmlDefinition->info[$node->name]; - if (isset($def->excludes[$name])) { - return false; - } - } - } - return true; - } - - /** - * Iterator function, which starts with the next token and continues until - * you reach the end of the input tokens. - * @warning Please prevent previous references from interfering with this - * functions by setting $i = null beforehand! - * @param int $i Current integer index variable for inputTokens - * @param HTMLPurifier_Token $current Current token variable. - * Do NOT use $token, as that variable is also a reference - * @return bool - */ - protected function forward(&$i, &$current) - { - if ($i === null) { - $i = count($this->inputZipper->back) - 1; - } else { - $i--; - } - if ($i < 0) { - return false; - } - $current = $this->inputZipper->back[$i]; - return true; - } - - /** - * Similar to _forward, but accepts a third parameter $nesting (which - * should be initialized at 0) and stops when we hit the end tag - * for the node $this->inputIndex starts in. - * @param int $i Current integer index variable for inputTokens - * @param HTMLPurifier_Token $current Current token variable. - * Do NOT use $token, as that variable is also a reference - * @param int $nesting - * @return bool - */ - protected function forwardUntilEndToken(&$i, &$current, &$nesting) - { - $result = $this->forward($i, $current); - if (!$result) { - return false; - } - if ($nesting === null) { - $nesting = 0; - } - if ($current instanceof HTMLPurifier_Token_Start) { - $nesting++; - } elseif ($current instanceof HTMLPurifier_Token_End) { - if ($nesting <= 0) { - return false; - } - $nesting--; - } - return true; - } - - /** - * Iterator function, starts with the previous token and continues until - * you reach the beginning of input tokens. - * @warning Please prevent previous references from interfering with this - * functions by setting $i = null beforehand! - * @param int $i Current integer index variable for inputTokens - * @param HTMLPurifier_Token $current Current token variable. - * Do NOT use $token, as that variable is also a reference - * @return bool - */ - protected function backward(&$i, &$current) - { - if ($i === null) { - $i = count($this->inputZipper->front) - 1; - } else { - $i--; - } - if ($i < 0) { - return false; - } - $current = $this->inputZipper->front[$i]; - return true; - } - - /** - * Handler that is called when a text token is processed - */ - public function handleText(&$token) - { - } - - /** - * Handler that is called when a start or empty token is processed - */ - public function handleElement(&$token) - { - } - - /** - * Handler that is called when an end token is processed - */ - public function handleEnd(&$token) - { - $this->notifyEnd($token); - } - - /** - * Notifier that is called when an end token is processed - * @param HTMLPurifier_Token $token Current token variable. - * @note This differs from handlers in that the token is read-only - * @deprecated - */ - public function notifyEnd($token) - { - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/classes/en-x-test.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/classes/en-x-test.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/classes/en-x-test.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/classes/en-x-test.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,9 +0,0 @@ - 'HTML Purifier', -// for unit testing purposes - 'LanguageFactoryTest: Pizza' => 'Pizza', - 'LanguageTest: List' => '$1', - 'LanguageTest: Hash' => '$1.Keys; $1.Values', - 'Item separator' => ', ', - 'Item separator last' => ' and ', // non-Harvard style - - 'ErrorCollector: No errors' => 'No errors detected. However, because error reporting is still incomplete, there may have been errors that the error collector was not notified of; please inspect the output HTML carefully.', - 'ErrorCollector: At line' => ' at line $line', - 'ErrorCollector: Incidental errors' => 'Incidental errors', - 'Lexer: Unclosed comment' => 'Unclosed comment', - 'Lexer: Unescaped lt' => 'Unescaped less-than sign (<) should be <', - 'Lexer: Missing gt' => 'Missing greater-than sign (>), previous less-than sign (<) should be escaped', - 'Lexer: Missing attribute key' => 'Attribute declaration has no key', - 'Lexer: Missing end quote' => 'Attribute declaration has no end quote', - 'Lexer: Extracted body' => 'Removed document metadata tags', - 'Strategy_RemoveForeignElements: Tag transform' => '<$1> element transformed into $CurrentToken.Serialized', - 'Strategy_RemoveForeignElements: Missing required attribute' => '$CurrentToken.Compact element missing required attribute $1', - 'Strategy_RemoveForeignElements: Foreign element to text' => 'Unrecognized $CurrentToken.Serialized tag converted to text', - 'Strategy_RemoveForeignElements: Foreign element removed' => 'Unrecognized $CurrentToken.Serialized tag removed', - 'Strategy_RemoveForeignElements: Comment removed' => 'Comment containing "$CurrentToken.Data" removed', - 'Strategy_RemoveForeignElements: Foreign meta element removed' => 'Unrecognized $CurrentToken.Serialized meta tag and all descendants removed', - 'Strategy_RemoveForeignElements: Token removed to end' => 'Tags and text starting from $1 element where removed to end', - 'Strategy_RemoveForeignElements: Trailing hyphen in comment removed' => 'Trailing hyphen(s) in comment removed', - 'Strategy_RemoveForeignElements: Hyphens in comment collapsed' => 'Double hyphens in comments are not allowed, and were collapsed into single hyphens', - 'Strategy_MakeWellFormed: Unnecessary end tag removed' => 'Unnecessary $CurrentToken.Serialized tag removed', - 'Strategy_MakeWellFormed: Unnecessary end tag to text' => 'Unnecessary $CurrentToken.Serialized tag converted to text', - 'Strategy_MakeWellFormed: Tag auto closed' => '$1.Compact started on line $1.Line auto-closed by $CurrentToken.Compact', - 'Strategy_MakeWellFormed: Tag carryover' => '$1.Compact started on line $1.Line auto-continued into $CurrentToken.Compact', - 'Strategy_MakeWellFormed: Stray end tag removed' => 'Stray $CurrentToken.Serialized tag removed', - 'Strategy_MakeWellFormed: Stray end tag to text' => 'Stray $CurrentToken.Serialized tag converted to text', - 'Strategy_MakeWellFormed: Tag closed by element end' => '$1.Compact tag started on line $1.Line closed by end of $CurrentToken.Serialized', - 'Strategy_MakeWellFormed: Tag closed by document end' => '$1.Compact tag started on line $1.Line closed by end of document', - 'Strategy_FixNesting: Node removed' => '$CurrentToken.Compact node removed', - 'Strategy_FixNesting: Node excluded' => '$CurrentToken.Compact node removed due to descendant exclusion by ancestor element', - 'Strategy_FixNesting: Node reorganized' => 'Contents of $CurrentToken.Compact node reorganized to enforce its content model', - 'Strategy_FixNesting: Node contents removed' => 'Contents of $CurrentToken.Compact node removed', - 'AttrValidator: Attributes transformed' => 'Attributes on $CurrentToken.Compact transformed from $1.Keys to $2.Keys', - 'AttrValidator: Attribute removed' => '$CurrentAttr.Name attribute on $CurrentToken.Compact removed', -); - -$errorNames = array( - E_ERROR => 'Error', - E_WARNING => 'Warning', - E_NOTICE => 'Notice' -); - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-testmini.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-testmini.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-testmini.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-testmini.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,12 +0,0 @@ - 'HTML Purifier XNone' -); - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-test.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-test.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-test.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language/messages/en-x-test.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ - 'HTML Purifier X' -); - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/LanguageFactory.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/LanguageFactory.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/LanguageFactory.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/LanguageFactory.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,209 +0,0 @@ -cache[$language_code][$key] = $value - * @type array - */ - public $cache; - - /** - * Valid keys in the HTMLPurifier_Language object. Designates which - * variables to slurp out of a message file. - * @type array - */ - public $keys = array('fallback', 'messages', 'errorNames'); - - /** - * Instance to validate language codes. - * @type HTMLPurifier_AttrDef_Lang - * - */ - protected $validator; - - /** - * Cached copy of dirname(__FILE__), directory of current file without - * trailing slash. - * @type string - */ - protected $dir; - - /** - * Keys whose contents are a hash map and can be merged. - * @type array - */ - protected $mergeable_keys_map = array('messages' => true, 'errorNames' => true); - - /** - * Keys whose contents are a list and can be merged. - * @value array lookup - */ - protected $mergeable_keys_list = array(); - - /** - * Retrieve sole instance of the factory. - * @param HTMLPurifier_LanguageFactory $prototype Optional prototype to overload sole instance with, - * or bool true to reset to default factory. - * @return HTMLPurifier_LanguageFactory - */ - public static function instance($prototype = null) - { - static $instance = null; - if ($prototype !== null) { - $instance = $prototype; - } elseif ($instance === null || $prototype == true) { - $instance = new HTMLPurifier_LanguageFactory(); - $instance->setup(); - } - return $instance; - } - - /** - * Sets up the singleton, much like a constructor - * @note Prevents people from getting this outside of the singleton - */ - public function setup() - { - $this->validator = new HTMLPurifier_AttrDef_Lang(); - $this->dir = HTMLPURIFIER_PREFIX . '/HTMLPurifier'; - } - - /** - * Creates a language object, handles class fallbacks - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @param bool|string $code Code to override configuration with. Private parameter. - * @return HTMLPurifier_Language - */ - public function create($config, $context, $code = false) - { - // validate language code - if ($code === false) { - $code = $this->validator->validate( - $config->get('Core.Language'), - $config, - $context - ); - } else { - $code = $this->validator->validate($code, $config, $context); - } - if ($code === false) { - $code = 'en'; // malformed code becomes English - } - - $pcode = str_replace('-', '_', $code); // make valid PHP classname - static $depth = 0; // recursion protection - - if ($code == 'en') { - $lang = new HTMLPurifier_Language($config, $context); - } else { - $class = 'HTMLPurifier_Language_' . $pcode; - $file = $this->dir . '/Language/classes/' . $code . '.php'; - if (file_exists($file) || class_exists($class, false)) { - $lang = new $class($config, $context); - } else { - // Go fallback - $raw_fallback = $this->getFallbackFor($code); - $fallback = $raw_fallback ? $raw_fallback : 'en'; - $depth++; - $lang = $this->create($config, $context, $fallback); - if (!$raw_fallback) { - $lang->error = true; - } - $depth--; - } - } - $lang->code = $code; - return $lang; - } - - /** - * Returns the fallback language for language - * @note Loads the original language into cache - * @param string $code language code - * @return string|bool - */ - public function getFallbackFor($code) - { - $this->loadLanguage($code); - return $this->cache[$code]['fallback']; - } - - /** - * Loads language into the cache, handles message file and fallbacks - * @param string $code language code - */ - public function loadLanguage($code) - { - static $languages_seen = array(); // recursion guard - - // abort if we've already loaded it - if (isset($this->cache[$code])) { - return; - } - - // generate filename - $filename = $this->dir . '/Language/messages/' . $code . '.php'; - - // default fallback : may be overwritten by the ensuing include - $fallback = ($code != 'en') ? 'en' : false; - - // load primary localisation - if (!file_exists($filename)) { - // skip the include: will rely solely on fallback - $filename = $this->dir . '/Language/messages/en.php'; - $cache = array(); - } else { - include $filename; - $cache = compact($this->keys); - } - - // load fallback localisation - if (!empty($fallback)) { - - // infinite recursion guard - if (isset($languages_seen[$code])) { - trigger_error( - 'Circular fallback reference in language ' . - $code, - E_USER_ERROR - ); - $fallback = 'en'; - } - $language_seen[$code] = true; - - // load the fallback recursively - $this->loadLanguage($fallback); - $fallback_cache = $this->cache[$fallback]; - - // merge fallback with current language - foreach ($this->keys as $key) { - if (isset($cache[$key]) && isset($fallback_cache[$key])) { - if (isset($this->mergeable_keys_map[$key])) { - $cache[$key] = $cache[$key] + $fallback_cache[$key]; - } elseif (isset($this->mergeable_keys_list[$key])) { - $cache[$key] = array_merge($fallback_cache[$key], $cache[$key]); - } - } else { - $cache[$key] = $fallback_cache[$key]; - } - } - } - - // save to cache for later retrieval - $this->cache[$code] = $cache; - return; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Language.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Language.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,204 +0,0 @@ -config = $config; - $this->context = $context; - } - - /** - * Loads language object with necessary info from factory cache - * @note This is a lazy loader - */ - public function load() - { - if ($this->_loaded) { - return; - } - $factory = HTMLPurifier_LanguageFactory::instance(); - $factory->loadLanguage($this->code); - foreach ($factory->keys as $key) { - $this->$key = $factory->cache[$this->code][$key]; - } - $this->_loaded = true; - } - - /** - * Retrieves a localised message. - * @param string $key string identifier of message - * @return string localised message - */ - public function getMessage($key) - { - if (!$this->_loaded) { - $this->load(); - } - if (!isset($this->messages[$key])) { - return "[$key]"; - } - return $this->messages[$key]; - } - - /** - * Retrieves a localised error name. - * @param int $int error number, corresponding to PHP's error reporting - * @return string localised message - */ - public function getErrorName($int) - { - if (!$this->_loaded) { - $this->load(); - } - if (!isset($this->errorNames[$int])) { - return "[Error: $int]"; - } - return $this->errorNames[$int]; - } - - /** - * Converts an array list into a string readable representation - * @param array $array - * @return string - */ - public function listify($array) - { - $sep = $this->getMessage('Item separator'); - $sep_last = $this->getMessage('Item separator last'); - $ret = ''; - for ($i = 0, $c = count($array); $i < $c; $i++) { - if ($i == 0) { - } elseif ($i + 1 < $c) { - $ret .= $sep; - } else { - $ret .= $sep_last; - } - $ret .= $array[$i]; - } - return $ret; - } - - /** - * Formats a localised message with passed parameters - * @param string $key string identifier of message - * @param array $args Parameters to substitute in - * @return string localised message - * @todo Implement conditionals? Right now, some messages make - * reference to line numbers, but those aren't always available - */ - public function formatMessage($key, $args = array()) - { - if (!$this->_loaded) { - $this->load(); - } - if (!isset($this->messages[$key])) { - return "[$key]"; - } - $raw = $this->messages[$key]; - $subst = array(); - $generator = false; - foreach ($args as $i => $value) { - if (is_object($value)) { - if ($value instanceof HTMLPurifier_Token) { - // factor this out some time - if (!$generator) { - $generator = $this->context->get('Generator'); - } - if (isset($value->name)) { - $subst['$'.$i.'.Name'] = $value->name; - } - if (isset($value->data)) { - $subst['$'.$i.'.Data'] = $value->data; - } - $subst['$'.$i.'.Compact'] = - $subst['$'.$i.'.Serialized'] = $generator->generateFromToken($value); - // a more complex algorithm for compact representation - // could be introduced for all types of tokens. This - // may need to be factored out into a dedicated class - if (!empty($value->attr)) { - $stripped_token = clone $value; - $stripped_token->attr = array(); - $subst['$'.$i.'.Compact'] = $generator->generateFromToken($stripped_token); - } - $subst['$'.$i.'.Line'] = $value->line ? $value->line : 'unknown'; - } - continue; - } elseif (is_array($value)) { - $keys = array_keys($value); - if (array_keys($keys) === $keys) { - // list - $subst['$'.$i] = $this->listify($value); - } else { - // associative array - // no $i implementation yet, sorry - $subst['$'.$i.'.Keys'] = $this->listify($keys); - $subst['$'.$i.'.Values'] = $this->listify(array_values($value)); - } - continue; - } - $subst['$' . $i] = $value; - } - return strtr($raw, $subst); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Length.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Length.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Length.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Length.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,162 +0,0 @@ - true, 'ex' => true, 'px' => true, 'in' => true, - 'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true, - 'ch' => true, 'rem' => true, 'vw' => true, 'vh' => true, - 'vmin' => true, 'vmax' => true - ); - - /** - * @param string $n Magnitude - * @param bool|string $u Unit - */ - public function __construct($n = '0', $u = false) - { - $this->n = (string) $n; - $this->unit = $u !== false ? (string) $u : false; - } - - /** - * @param string $s Unit string, like '2em' or '3.4in' - * @return HTMLPurifier_Length - * @warning Does not perform validation. - */ - public static function make($s) - { - if ($s instanceof HTMLPurifier_Length) { - return $s; - } - $n_length = strspn($s, '1234567890.+-'); - $n = substr($s, 0, $n_length); - $unit = substr($s, $n_length); - if ($unit === '') { - $unit = false; - } - return new HTMLPurifier_Length($n, $unit); - } - - /** - * Validates the number and unit. - * @return bool - */ - protected function validate() - { - // Special case: - if ($this->n === '+0' || $this->n === '-0') { - $this->n = '0'; - } - if ($this->n === '0' && $this->unit === false) { - return true; - } - if (!ctype_lower($this->unit)) { - $this->unit = strtolower($this->unit); - } - if (!isset(HTMLPurifier_Length::$allowedUnits[$this->unit])) { - return false; - } - // Hack: - $def = new HTMLPurifier_AttrDef_CSS_Number(); - $result = $def->validate($this->n, false, false); - if ($result === false) { - return false; - } - $this->n = $result; - return true; - } - - /** - * Returns string representation of number. - * @return string - */ - public function toString() - { - if (!$this->isValid()) { - return false; - } - return $this->n . $this->unit; - } - - /** - * Retrieves string numeric magnitude. - * @return string - */ - public function getN() - { - return $this->n; - } - - /** - * Retrieves string unit. - * @return string - */ - public function getUnit() - { - return $this->unit; - } - - /** - * Returns true if this length unit is valid. - * @return bool - */ - public function isValid() - { - if ($this->isValid === null) { - $this->isValid = $this->validate(); - } - return $this->isValid; - } - - /** - * Compares two lengths, and returns 1 if greater, -1 if less and 0 if equal. - * @param HTMLPurifier_Length $l - * @return int - * @warning If both values are too large or small, this calculation will - * not work properly - */ - public function compareTo($l) - { - if ($l === false) { - return false; - } - if ($l->unit !== $this->unit) { - $converter = new HTMLPurifier_UnitConverter(); - $l = $converter->convert($l, $this->unit); - if ($l === false) { - return false; - } - } - return $this->n - $l->n; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DirectLex.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DirectLex.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DirectLex.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DirectLex.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,539 +0,0 @@ -get('HTML.Trusted')) { - $html = preg_replace_callback( - '#(
, so - // any later token processing scripts must convert improperly - // classified EmptyTags from StartTags. - $is_self_closing = (strrpos($segment, '/') === $strlen_segment - 1); - if ($is_self_closing) { - $strlen_segment--; - $segment = substr($segment, 0, $strlen_segment); - } - - // Check if there are any attributes - $position_first_space = strcspn($segment, $this->_whitespace); - - if ($position_first_space >= $strlen_segment) { - if ($is_self_closing) { - $token = new HTMLPurifier_Token_Empty($segment); - } else { - $token = new HTMLPurifier_Token_Start($segment); - } - if ($maintain_line_numbers) { - $token->rawPosition($current_line, $current_col); - $current_line += $this->substrCount($html, $nl, $cursor, $position_next_gt - $cursor); - } - $array[] = $token; - $inside_tag = false; - $cursor = $position_next_gt + 1; - continue; - } - - // Grab out all the data - $type = substr($segment, 0, $position_first_space); - $attribute_string = - trim( - substr( - $segment, - $position_first_space - ) - ); - if ($attribute_string) { - $attr = $this->parseAttributeString( - $attribute_string, - $config, - $context - ); - } else { - $attr = array(); - } - - if ($is_self_closing) { - $token = new HTMLPurifier_Token_Empty($type, $attr); - } else { - $token = new HTMLPurifier_Token_Start($type, $attr); - } - if ($maintain_line_numbers) { - $token->rawPosition($current_line, $current_col); - $current_line += $this->substrCount($html, $nl, $cursor, $position_next_gt - $cursor); - } - $array[] = $token; - $cursor = $position_next_gt + 1; - $inside_tag = false; - continue; - } else { - // inside tag, but there's no ending > sign - if ($e) { - $e->send(E_WARNING, 'Lexer: Missing gt'); - } - $token = new - HTMLPurifier_Token_Text( - '<' . - $this->parseText( - substr($html, $cursor), $config - ) - ); - if ($maintain_line_numbers) { - $token->rawPosition($current_line, $current_col); - } - // no cursor scroll? Hmm... - $array[] = $token; - break; - } - break; - } - - $context->destroy('CurrentLine'); - $context->destroy('CurrentCol'); - return $array; - } - - /** - * PHP 5.0.x compatible substr_count that implements offset and length - * @param string $haystack - * @param string $needle - * @param int $offset - * @param int $length - * @return int - */ - protected function substrCount($haystack, $needle, $offset, $length) - { - static $oldVersion; - if ($oldVersion === null) { - $oldVersion = version_compare(PHP_VERSION, '5.1', '<'); - } - if ($oldVersion) { - $haystack = substr($haystack, $offset, $length); - return substr_count($haystack, $needle); - } else { - return substr_count($haystack, $needle, $offset, $length); - } - } - - /** - * Takes the inside of an HTML tag and makes an assoc array of attributes. - * - * @param string $string Inside of tag excluding name. - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return array Assoc array of attributes. - */ - public function parseAttributeString($string, $config, $context) - { - $string = (string)$string; // quick typecast - - if ($string == '') { - return array(); - } // no attributes - - $e = false; - if ($config->get('Core.CollectErrors')) { - $e =& $context->get('ErrorCollector'); - } - - // let's see if we can abort as quickly as possible - // one equal sign, no spaces => one attribute - $num_equal = substr_count($string, '='); - $has_space = strpos($string, ' '); - if ($num_equal === 0 && !$has_space) { - // bool attribute - return array($string => $string); - } elseif ($num_equal === 1 && !$has_space) { - // only one attribute - list($key, $quoted_value) = explode('=', $string); - $quoted_value = trim($quoted_value); - if (!$key) { - if ($e) { - $e->send(E_ERROR, 'Lexer: Missing attribute key'); - } - return array(); - } - if (!$quoted_value) { - return array($key => ''); - } - $first_char = @$quoted_value[0]; - $last_char = @$quoted_value[strlen($quoted_value) - 1]; - - $same_quote = ($first_char == $last_char); - $open_quote = ($first_char == '"' || $first_char == "'"); - - if ($same_quote && $open_quote) { - // well behaved - $value = substr($quoted_value, 1, strlen($quoted_value) - 2); - } else { - // not well behaved - if ($open_quote) { - if ($e) { - $e->send(E_ERROR, 'Lexer: Missing end quote'); - } - $value = substr($quoted_value, 1); - } else { - $value = $quoted_value; - } - } - if ($value === false) { - $value = ''; - } - return array($key => $this->parseAttr($value, $config)); - } - - // setup loop environment - $array = array(); // return assoc array of attributes - $cursor = 0; // current position in string (moves forward) - $size = strlen($string); // size of the string (stays the same) - - // if we have unquoted attributes, the parser expects a terminating - // space, so let's guarantee that there's always a terminating space. - $string .= ' '; - - $old_cursor = -1; - while ($cursor < $size) { - if ($old_cursor >= $cursor) { - throw new Exception("Infinite loop detected"); - } - $old_cursor = $cursor; - - $cursor += ($value = strspn($string, $this->_whitespace, $cursor)); - // grab the key - - $key_begin = $cursor; //we're currently at the start of the key - - // scroll past all characters that are the key (not whitespace or =) - $cursor += strcspn($string, $this->_whitespace . '=', $cursor); - - $key_end = $cursor; // now at the end of the key - - $key = substr($string, $key_begin, $key_end - $key_begin); - - if (!$key) { - if ($e) { - $e->send(E_ERROR, 'Lexer: Missing attribute key'); - } - $cursor += 1 + strcspn($string, $this->_whitespace, $cursor + 1); // prevent infinite loop - continue; // empty key - } - - // scroll past all whitespace - $cursor += strspn($string, $this->_whitespace, $cursor); - - if ($cursor >= $size) { - $array[$key] = $key; - break; - } - - // if the next character is an equal sign, we've got a regular - // pair, otherwise, it's a bool attribute - $first_char = @$string[$cursor]; - - if ($first_char == '=') { - // key="value" - - $cursor++; - $cursor += strspn($string, $this->_whitespace, $cursor); - - if ($cursor === false) { - $array[$key] = ''; - break; - } - - // we might be in front of a quote right now - - $char = @$string[$cursor]; - - if ($char == '"' || $char == "'") { - // it's quoted, end bound is $char - $cursor++; - $value_begin = $cursor; - $cursor = strpos($string, $char, $cursor); - $value_end = $cursor; - } else { - // it's not quoted, end bound is whitespace - $value_begin = $cursor; - $cursor += strcspn($string, $this->_whitespace, $cursor); - $value_end = $cursor; - } - - // we reached a premature end - if ($cursor === false) { - $cursor = $size; - $value_end = $cursor; - } - - $value = substr($string, $value_begin, $value_end - $value_begin); - if ($value === false) { - $value = ''; - } - $array[$key] = $this->parseAttr($value, $config); - $cursor++; - } else { - // boolattr - if ($key !== '') { - $array[$key] = $key; - } else { - // purely theoretical - if ($e) { - $e->send(E_ERROR, 'Lexer: Missing attribute key'); - } - } - } - } - return $array; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DOMLex.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DOMLex.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DOMLex.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Lexer/DOMLex.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,328 +0,0 @@ -factory = new HTMLPurifier_TokenFactory(); - } - - /** - * @param string $html - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return HTMLPurifier_Token[] - */ - public function tokenizeHTML($html, $config, $context) - { - $html = $this->normalize($html, $config, $context); - - // attempt to armor stray angled brackets that cannot possibly - // form tags and thus are probably being used as emoticons - if ($config->get('Core.AggressivelyFixLt')) { - $char = '[^a-z!\/]'; - $comment = "/|\z)/is"; - $html = preg_replace_callback($comment, array($this, 'callbackArmorCommentEntities'), $html); - do { - $old = $html; - $html = preg_replace("/<($char)/i", '<\\1', $html); - } while ($html !== $old); - $html = preg_replace_callback($comment, array($this, 'callbackUndoCommentSubst'), $html); // fix comments - } - - // preprocess html, essential for UTF-8 - $html = $this->wrapHTML($html, $config, $context); - - $doc = new DOMDocument(); - $doc->encoding = 'UTF-8'; // theoretically, the above has this covered - - set_error_handler(array($this, 'muteErrorHandler')); - $doc->loadHTML($html); - restore_error_handler(); - - $body = $doc->getElementsByTagName('html')->item(0)-> // - getElementsByTagName('body')->item(0); // - - $div = $body->getElementsByTagName('div')->item(0); //- $tokens = array(); - $this->tokenizeDOM($div, $tokens, $config); - // If the div has a sibling, that means we tripped across - // a prematuretag. So remove the div we parsed, - // and then tokenize the rest of body. We can't tokenize - // the sibling directly as we'll lose the tags in that case. - if ($div->nextSibling) { - $body->removeChild($div); - $this->tokenizeDOM($body, $tokens, $config); - } - return $tokens; - } - - /** - * Iterative function that tokenizes a node, putting it into an accumulator. - * To iterate is human, to recurse divine - L. Peter Deutsch - * @param DOMNode $node DOMNode to be tokenized. - * @param HTMLPurifier_Token[] $tokens Array-list of already tokenized tokens. - * @return HTMLPurifier_Token of node appended to previously passed tokens. - */ - protected function tokenizeDOM($node, &$tokens, $config) - { - $level = 0; - $nodes = array($level => new HTMLPurifier_Queue(array($node))); - $closingNodes = array(); - do { - while (!$nodes[$level]->isEmpty()) { - $node = $nodes[$level]->shift(); // FIFO - $collect = $level > 0 ? true : false; - $needEndingTag = $this->createStartNode($node, $tokens, $collect, $config); - if ($needEndingTag) { - $closingNodes[$level][] = $node; - } - if ($node->childNodes && $node->childNodes->length) { - $level++; - $nodes[$level] = new HTMLPurifier_Queue(); - foreach ($node->childNodes as $childNode) { - $nodes[$level]->push($childNode); - } - } - } - $level--; - if ($level && isset($closingNodes[$level])) { - while ($node = array_pop($closingNodes[$level])) { - $this->createEndNode($node, $tokens); - } - } - } while ($level > 0); - } - - /** - * Portably retrieve the tag name of a node; deals with older versions - * of libxml like 2.7.6 - * @param DOMNode $node - */ - protected function getTagName($node) - { - if (property_exists($node, 'tagName')) { - return $node->tagName; - } else if (property_exists($node, 'nodeName')) { - return $node->nodeName; - } else if (property_exists($node, 'localName')) { - return $node->localName; - } - return null; - } - - /** - * Portably retrieve the data of a node; deals with older versions - * of libxml like 2.7.6 - * @param DOMNode $node - */ - protected function getData($node) - { - if (property_exists($node, 'data')) { - return $node->data; - } else if (property_exists($node, 'nodeValue')) { - return $node->nodeValue; - } else if (property_exists($node, 'textContent')) { - return $node->textContent; - } - return null; - } - - - /** - * @param DOMNode $node DOMNode to be tokenized. - * @param HTMLPurifier_Token[] $tokens Array-list of already tokenized tokens. - * @param bool $collect Says whether or start and close are collected, set to - * false at first recursion because it's the implicit DIV - * tag you're dealing with. - * @return bool if the token needs an endtoken - * @todo data and tagName properties don't seem to exist in DOMNode? - */ - protected function createStartNode($node, &$tokens, $collect, $config) - { - // intercept non element nodes. WE MUST catch all of them, - // but we're not getting the character reference nodes because - // those should have been preprocessed - if ($node->nodeType === XML_TEXT_NODE) { - $data = $this->getData($node); // Handle variable data property - if ($data !== null) { - $tokens[] = $this->factory->createText($data); - } - return false; - } elseif ($node->nodeType === XML_CDATA_SECTION_NODE) { - // undo libxml's special treatment of #i', '', $html); - } - - return $html; - } - - /** - * Takes a string of HTML (fragment or document) and returns the content - * @todo Consider making protected - */ - public function extractBody($html) - { - $matches = array(); - $result = preg_match('|(.*?)
'; printZipper($zipper, $token);//printTokens($this->stack); - //flush(); - - // quick-check: if it's not a tag, no need to process - if (empty($token->is_tag)) { - if ($token instanceof HTMLPurifier_Token_Text) { - foreach ($this->injectors as $i => $injector) { - if (isset($token->skip[$i])) { - // See Note [Injector skips] - continue; - } - if ($token->rewind !== null && $token->rewind !== $i) { - continue; - } - // XXX fuckup - $r = $token; - $injector->handleText($r); - $token = $this->processToken($r, $i); - $reprocess = true; - break; - } - } - // another possibility is a comment - continue; - } - - if (isset($definition->info[$token->name])) { - $type = $definition->info[$token->name]->child->type; - } else { - $type = false; // Type is unknown, treat accordingly - } - - // quick tag checks: anything that's *not* an end tag - $ok = false; - if ($type === 'empty' && $token instanceof HTMLPurifier_Token_Start) { - // claims to be a start tag but is empty - $token = new HTMLPurifier_Token_Empty( - $token->name, - $token->attr, - $token->line, - $token->col, - $token->armor - ); - $ok = true; - } elseif ($type && $type !== 'empty' && $token instanceof HTMLPurifier_Token_Empty) { - // claims to be empty but really is a start tag - // NB: this assignment is required - $old_token = $token; - $token = new HTMLPurifier_Token_End($token->name); - $token = $this->insertBefore( - new HTMLPurifier_Token_Start($old_token->name, $old_token->attr, $old_token->line, $old_token->col, $old_token->armor) - ); - // punt (since we had to modify the input stream in a non-trivial way) - $reprocess = true; - continue; - } elseif ($token instanceof HTMLPurifier_Token_Empty) { - // real empty token - $ok = true; - } elseif ($token instanceof HTMLPurifier_Token_Start) { - // start tag - - // ...unless they also have to close their parent - if (!empty($this->stack)) { - - // Performance note: you might think that it's rather - // inefficient, recalculating the autoclose information - // for every tag that a token closes (since when we - // do an autoclose, we push a new token into the - // stream and then /process/ that, before - // re-processing this token.) But this is - // necessary, because an injector can make an - // arbitrary transformations to the autoclosing - // tokens we introduce, so things may have changed - // in the meantime. Also, doing the inefficient thing is - // "easy" to reason about (for certain perverse definitions - // of "easy") - - $parent = array_pop($this->stack); - $this->stack[] = $parent; - - $parent_def = null; - $parent_elements = null; - $autoclose = false; - if (isset($definition->info[$parent->name])) { - $parent_def = $definition->info[$parent->name]; - $parent_elements = $parent_def->child->getAllowedElements($config); - $autoclose = !isset($parent_elements[$token->name]); - } - - if ($autoclose && $definition->info[$token->name]->wrap) { - // Check if an element can be wrapped by another - // element to make it valid in a context (for - // example,- in between) - $wrapname = $definition->info[$token->name]->wrap; - $wrapdef = $definition->info[$wrapname]; - $elements = $wrapdef->child->getAllowedElements($config); - if (isset($elements[$token->name]) && isset($parent_elements[$wrapname])) { - $newtoken = new HTMLPurifier_Token_Start($wrapname); - $token = $this->insertBefore($newtoken); - $reprocess = true; - continue; - } - } - - $carryover = false; - if ($autoclose && $parent_def->formatting) { - $carryover = true; - } - - if ($autoclose) { - // check if this autoclose is doomed to fail - // (this rechecks $parent, which his harmless) - $autoclose_ok = isset($global_parent_allowed_elements[$token->name]); - if (!$autoclose_ok) { - foreach ($this->stack as $ancestor) { - $elements = $definition->info[$ancestor->name]->child->getAllowedElements($config); - if (isset($elements[$token->name])) { - $autoclose_ok = true; - break; - } - if ($definition->info[$token->name]->wrap) { - $wrapname = $definition->info[$token->name]->wrap; - $wrapdef = $definition->info[$wrapname]; - $wrap_elements = $wrapdef->child->getAllowedElements($config); - if (isset($wrap_elements[$token->name]) && isset($elements[$wrapname])) { - $autoclose_ok = true; - break; - } - } - } - } - if ($autoclose_ok) { - // errors need to be updated - $new_token = new HTMLPurifier_Token_End($parent->name); - $new_token->start = $parent; - // [TagClosedSuppress] - if ($e && !isset($parent->armor['MakeWellFormed_TagClosedError'])) { - if (!$carryover) { - $e->send(E_NOTICE, 'Strategy_MakeWellFormed: Tag auto closed', $parent); - } else { - $e->send(E_NOTICE, 'Strategy_MakeWellFormed: Tag carryover', $parent); - } - } - if ($carryover) { - $element = clone $parent; - // [TagClosedAuto] - $element->armor['MakeWellFormed_TagClosedError'] = true; - $element->carryover = true; - $token = $this->processToken(array($new_token, $token, $element)); - } else { - $token = $this->insertBefore($new_token); - } - } else { - $token = $this->remove(); - } - $reprocess = true; - continue; - } - - } - $ok = true; - } - - if ($ok) { - foreach ($this->injectors as $i => $injector) { - if (isset($token->skip[$i])) { - // See Note [Injector skips] - continue; - } - if ($token->rewind !== null && $token->rewind !== $i) { - continue; - } - $r = $token; - $injector->handleElement($r); - $token = $this->processToken($r, $i); - $reprocess = true; - break; - } - if (!$reprocess) { - // ah, nothing interesting happened; do normal processing - if ($token instanceof HTMLPurifier_Token_Start) { - $this->stack[] = $token; - } elseif ($token instanceof HTMLPurifier_Token_End) { - throw new HTMLPurifier_Exception( - 'Improper handling of end tag in start code; possible error in MakeWellFormed' - ); - } - } - continue; - } - - // sanity check: we should be dealing with a closing tag - if (!$token instanceof HTMLPurifier_Token_End) { - throw new HTMLPurifier_Exception('Unaccounted for tag token in input stream, bug in HTML Purifier'); - } - - // make sure that we have something open - if (empty($this->stack)) { - if ($escape_invalid_tags) { - if ($e) { - $e->send(E_WARNING, 'Strategy_MakeWellFormed: Unnecessary end tag to text'); - } - $token = new HTMLPurifier_Token_Text($generator->generateFromToken($token)); - } else { - if ($e) { - $e->send(E_WARNING, 'Strategy_MakeWellFormed: Unnecessary end tag removed'); - } - $token = $this->remove(); - } - $reprocess = true; - continue; - } - - // first, check for the simplest case: everything closes neatly. - // Eventually, everything passes through here; if there are problems - // we modify the input stream accordingly and then punt, so that - // the tokens get processed again. - $current_parent = array_pop($this->stack); - if ($current_parent->name == $token->name) { - $token->start = $current_parent; - foreach ($this->injectors as $i => $injector) { - if (isset($token->skip[$i])) { - // See Note [Injector skips] - continue; - } - if ($token->rewind !== null && $token->rewind !== $i) { - continue; - } - $r = $token; - $injector->handleEnd($r); - $token = $this->processToken($r, $i); - $this->stack[] = $current_parent; - $reprocess = true; - break; - } - continue; - } - - // okay, so we're trying to close the wrong tag - - // undo the pop previous pop - $this->stack[] = $current_parent; - - // scroll back the entire nest, trying to find our tag. - // (feature could be to specify how far you'd like to go) - $size = count($this->stack); - // -2 because -1 is the last element, but we already checked that - $skipped_tags = false; - for ($j = $size - 2; $j >= 0; $j--) { - if ($this->stack[$j]->name == $token->name) { - $skipped_tags = array_slice($this->stack, $j); - break; - } - } - - // we didn't find the tag, so remove - if ($skipped_tags === false) { - if ($escape_invalid_tags) { - if ($e) { - $e->send(E_WARNING, 'Strategy_MakeWellFormed: Stray end tag to text'); - } - $token = new HTMLPurifier_Token_Text($generator->generateFromToken($token)); - } else { - if ($e) { - $e->send(E_WARNING, 'Strategy_MakeWellFormed: Stray end tag removed'); - } - $token = $this->remove(); - } - $reprocess = true; - continue; - } - - // do errors, in REVERSE $j order: a,b,c with
- needs a
n"; - //echo "$n\nsigfigs = $sigfigs\nnew_log = $new_log\nlog = $log\nrp = $rp\n
\n"; - - $n = $this->round($n, $sigfigs); - if (strpos($n, '.') !== false) { - $n = rtrim($n, '0'); - } - $n = rtrim($n, '.'); - - return new HTMLPurifier_Length($n, $unit); - } - - /** - * Returns the number of significant figures in a string number. - * @param string $n Decimal number - * @return int number of sigfigs - */ - public function getSigFigs($n) - { - $n = ltrim($n, '0+-'); - $dp = strpos($n, '.'); // decimal position - if ($dp === false) { - $sigfigs = strlen(rtrim($n, '0')); - } else { - $sigfigs = strlen(ltrim($n, '0.')); // eliminate extra decimal character - if ($dp !== 0) { - $sigfigs--; - } - } - return $sigfigs; - } - - /** - * Adds two numbers, using arbitrary precision when available. - * @param string $s1 - * @param string $s2 - * @param int $scale - * @return string - */ - private function add($s1, $s2, $scale) - { - if ($this->bcmath) { - return bcadd($s1, $s2, $scale); - } else { - return $this->scale((float)$s1 + (float)$s2, $scale); - } - } - - /** - * Multiples two numbers, using arbitrary precision when available. - * @param string $s1 - * @param string $s2 - * @param int $scale - * @return string - */ - private function mul($s1, $s2, $scale) - { - if ($this->bcmath) { - return bcmul($s1, $s2, $scale); - } else { - return $this->scale((float)$s1 * (float)$s2, $scale); - } - } - - /** - * Divides two numbers, using arbitrary precision when available. - * @param string $s1 - * @param string $s2 - * @param int $scale - * @return string - */ - private function div($s1, $s2, $scale) - { - if ($this->bcmath) { - return bcdiv($s1, $s2, $scale); - } else { - return $this->scale((float)$s1 / (float)$s2, $scale); - } - } - - /** - * Rounds a number according to the number of sigfigs it should have, - * using arbitrary precision when available. - * @param float $n - * @param int $sigfigs - * @return string - */ - private function round($n, $sigfigs) - { - $new_log = (int)floor(log(abs($n), 10)); // Number of digits left of decimal - 1 - $rp = $sigfigs - $new_log - 1; // Number of decimal places needed - $neg = $n < 0 ? '-' : ''; // Negative sign - if ($this->bcmath) { - if ($rp >= 0) { - $n = bcadd($n, $neg . '0.' . str_repeat('0', $rp) . '5', $rp + 1); - $n = bcdiv($n, '1', $rp); - } else { - // This algorithm partially depends on the standardized - // form of numbers that comes out of bcmath. - $n = bcadd($n, $neg . '5' . str_repeat('0', $new_log - $sigfigs), 0); - $n = substr($n, 0, $sigfigs + strlen($neg)) . str_repeat('0', $new_log - $sigfigs + 1); - } - return $n; - } else { - return $this->scale(round($n, $sigfigs - $new_log - 1), $rp + 1); - } - } - - /** - * Scales a float to $scale digits right of decimal point, like BCMath. - * @param float $r - * @param int $scale - * @return string - */ - private function scale($r, $scale) - { - if ($scale < 0) { - // The f sprintf type doesn't support negative numbers, so we - // need to cludge things manually. First get the string. - $r = sprintf('%.0f', (float)$r); - // Due to floating point precision loss, $r will more than likely - // look something like 4652999999999.9234. We grab one more digit - // than we need to precise from $r and then use that to round - // appropriately. - $precise = (string)round(substr($r, 0, strlen($r) + $scale), -1); - // Now we return it, truncating the zero that was rounded off. - return substr($precise, 0, -1) . str_repeat('0', -$scale + 1); - } - return sprintf('%.' . $scale . 'f', (float)$r); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIDefinition.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIDefinition.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIDefinition.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIDefinition.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,112 +0,0 @@ -registerFilter(new HTMLPurifier_URIFilter_DisableExternal()); - $this->registerFilter(new HTMLPurifier_URIFilter_DisableExternalResources()); - $this->registerFilter(new HTMLPurifier_URIFilter_DisableResources()); - $this->registerFilter(new HTMLPurifier_URIFilter_HostBlacklist()); - $this->registerFilter(new HTMLPurifier_URIFilter_SafeIframe()); - $this->registerFilter(new HTMLPurifier_URIFilter_MakeAbsolute()); - $this->registerFilter(new HTMLPurifier_URIFilter_Munge()); - } - - public function registerFilter($filter) - { - $this->registeredFilters[$filter->name] = $filter; - } - - public function addFilter($filter, $config) - { - $r = $filter->prepare($config); - if ($r === false) return; // null is ok, for backwards compat - if ($filter->post) { - $this->postFilters[$filter->name] = $filter; - } else { - $this->filters[$filter->name] = $filter; - } - } - - protected function doSetup($config) - { - $this->setupMemberVariables($config); - $this->setupFilters($config); - } - - protected function setupFilters($config) - { - foreach ($this->registeredFilters as $name => $filter) { - if ($filter->always_load) { - $this->addFilter($filter, $config); - } else { - $conf = $config->get('URI.' . $name); - if ($conf !== false && $conf !== null) { - $this->addFilter($filter, $config); - } - } - } - unset($this->registeredFilters); - } - - protected function setupMemberVariables($config) - { - $this->host = $config->get('URI.Host'); - $base_uri = $config->get('URI.Base'); - if (!is_null($base_uri)) { - $parser = new HTMLPurifier_URIParser(); - $this->base = $parser->parse($base_uri); - $this->defaultScheme = $this->base->scheme; - if (is_null($this->host)) $this->host = $this->base->host; - } - if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme'); - } - - public function getDefaultScheme($config, $context) - { - return HTMLPurifier_URISchemeRegistry::instance()->getScheme($this->defaultScheme, $config, $context); - } - - public function filter(&$uri, $config, $context) - { - foreach ($this->filters as $name => $f) { - $result = $f->filter($uri, $config, $context); - if (!$result) return false; - } - return true; - } - - public function postFilter(&$uri, $config, $context) - { - foreach ($this->postFilters as $name => $f) { - $result = $f->filter($uri, $config, $context); - if (!$result) return false; - } - return true; - } - -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternal.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternal.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternal.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternal.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,54 +0,0 @@ -getDefinition('URI')->host; - if ($our_host !== null) { - $this->ourHostParts = array_reverse(explode('.', $our_host)); - } - } - - /** - * @param HTMLPurifier_URI $uri Reference - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function filter(&$uri, $config, $context) - { - if (is_null($uri->host)) { - return true; - } - if ($this->ourHostParts === false) { - return false; - } - $host_parts = array_reverse(explode('.', $uri->host)); - foreach ($this->ourHostParts as $i => $x) { - if (!isset($host_parts[$i])) { - return false; - } - if ($host_parts[$i] != $this->ourHostParts[$i]) { - return false; - } - } - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternalResources.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternalResources.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternalResources.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableExternalResources.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,25 +0,0 @@ -get('EmbeddedURI', true)) { - return true; - } - return parent::filter($uri, $config, $context); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableResources.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableResources.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableResources.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/DisableResources.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,22 +0,0 @@ -get('EmbeddedURI', true); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/HostBlacklist.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/HostBlacklist.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/HostBlacklist.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/HostBlacklist.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,46 +0,0 @@ -blacklist = $config->get('URI.HostBlacklist'); - return true; - } - - /** - * @param HTMLPurifier_URI $uri - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function filter(&$uri, $config, $context) - { - foreach ($this->blacklist as $blacklisted_host_fragment) { - if (strpos($uri->host, $blacklisted_host_fragment) !== false) { - return false; - } - } - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/MakeAbsolute.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/MakeAbsolute.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/MakeAbsolute.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/MakeAbsolute.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,158 +0,0 @@ -getDefinition('URI'); - $this->base = $def->base; - if (is_null($this->base)) { - trigger_error( - 'URI.MakeAbsolute is being ignored due to lack of ' . - 'value for URI.Base configuration', - E_USER_WARNING - ); - return false; - } - $this->base->fragment = null; // fragment is invalid for base URI - $stack = explode('/', $this->base->path); - array_pop($stack); // discard last segment - $stack = $this->_collapseStack($stack); // do pre-parsing - $this->basePathStack = $stack; - return true; - } - - /** - * @param HTMLPurifier_URI $uri - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function filter(&$uri, $config, $context) - { - if (is_null($this->base)) { - return true; - } // abort early - if ($uri->path === '' && is_null($uri->scheme) && - is_null($uri->host) && is_null($uri->query) && is_null($uri->fragment)) { - // reference to current document - $uri = clone $this->base; - return true; - } - if (!is_null($uri->scheme)) { - // absolute URI already: don't change - if (!is_null($uri->host)) { - return true; - } - $scheme_obj = $uri->getSchemeObj($config, $context); - if (!$scheme_obj) { - // scheme not recognized - return false; - } - if (!$scheme_obj->hierarchical) { - // non-hierarchal URI with explicit scheme, don't change - return true; - } - // special case: had a scheme but always is hierarchical and had no authority - } - if (!is_null($uri->host)) { - // network path, don't bother - return true; - } - if ($uri->path === '') { - $uri->path = $this->base->path; - } elseif ($uri->path[0] !== '/') { - // relative path, needs more complicated processing - $stack = explode('/', $uri->path); - $new_stack = array_merge($this->basePathStack, $stack); - if ($new_stack[0] !== '' && !is_null($this->base->host)) { - array_unshift($new_stack, ''); - } - $new_stack = $this->_collapseStack($new_stack); - $uri->path = implode('/', $new_stack); - } else { - // absolute path, but still we should collapse - $uri->path = implode('/', $this->_collapseStack(explode('/', $uri->path))); - } - // re-combine - $uri->scheme = $this->base->scheme; - if (is_null($uri->userinfo)) { - $uri->userinfo = $this->base->userinfo; - } - if (is_null($uri->host)) { - $uri->host = $this->base->host; - } - if (is_null($uri->port)) { - $uri->port = $this->base->port; - } - return true; - } - - /** - * Resolve dots and double-dots in a path stack - * @param array $stack - * @return array - */ - private function _collapseStack($stack) - { - $result = array(); - $is_folder = false; - for ($i = 0; isset($stack[$i]); $i++) { - $is_folder = false; - // absorb an internally duplicated slash - if ($stack[$i] == '' && $i && isset($stack[$i + 1])) { - continue; - } - if ($stack[$i] == '..') { - if (!empty($result)) { - $segment = array_pop($result); - if ($segment === '' && empty($result)) { - // error case: attempted to back out too far: - // restore the leading slash - $result[] = ''; - } elseif ($segment === '..') { - $result[] = '..'; // cannot remove .. with .. - } - } else { - // relative path, preserve the double-dots - $result[] = '..'; - } - $is_folder = true; - continue; - } - if ($stack[$i] == '.') { - // silently absorb - $is_folder = true; - continue; - } - $result[] = $stack[$i]; - } - if ($is_folder) { - $result[] = ''; - } - return $result; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/Munge.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/Munge.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/Munge.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/Munge.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,115 +0,0 @@ -target = $config->get('URI.' . $this->name); - $this->parser = new HTMLPurifier_URIParser(); - $this->doEmbed = $config->get('URI.MungeResources'); - $this->secretKey = $config->get('URI.MungeSecretKey'); - if ($this->secretKey && !function_exists('hash_hmac')) { - throw new Exception("Cannot use %URI.MungeSecretKey without hash_hmac support."); - } - return true; - } - - /** - * @param HTMLPurifier_URI $uri - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function filter(&$uri, $config, $context) - { - if ($context->get('EmbeddedURI', true) && !$this->doEmbed) { - return true; - } - - $scheme_obj = $uri->getSchemeObj($config, $context); - if (!$scheme_obj) { - return true; - } // ignore unknown schemes, maybe another postfilter did it - if (!$scheme_obj->browsable) { - return true; - } // ignore non-browseable schemes, since we can't munge those in a reasonable way - if ($uri->isBenign($config, $context)) { - return true; - } // don't redirect if a benign URL - - $this->makeReplace($uri, $config, $context); - $this->replace = array_map('rawurlencode', $this->replace); - - $new_uri = strtr($this->target, $this->replace); - $new_uri = $this->parser->parse($new_uri); - // don't redirect if the target host is the same as the - // starting host - if ($uri->host === $new_uri->host) { - return true; - } - $uri = $new_uri; // overwrite - return true; - } - - /** - * @param HTMLPurifier_URI $uri - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - */ - protected function makeReplace($uri, $config, $context) - { - $string = $uri->toString(); - // always available - $this->replace['%s'] = $string; - $this->replace['%r'] = $context->get('EmbeddedURI', true); - $token = $context->get('CurrentToken', true); - $this->replace['%n'] = $token ? $token->name : null; - $this->replace['%m'] = $context->get('CurrentAttr', true); - $this->replace['%p'] = $context->get('CurrentCSSProperty', true); - // not always available - if ($this->secretKey) { - $this->replace['%t'] = hash_hmac("sha256", $string, $this->secretKey); - } - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/SafeIframe.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/SafeIframe.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/SafeIframe.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter/SafeIframe.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,68 +0,0 @@ -regexp = $config->get('URI.SafeIframeRegexp'); - return true; - } - - /** - * @param HTMLPurifier_URI $uri - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function filter(&$uri, $config, $context) - { - // check if filter not applicable - if (!$config->get('HTML.SafeIframe')) { - return true; - } - // check if the filter should actually trigger - if (!$context->get('EmbeddedURI', true)) { - return true; - } - $token = $context->get('CurrentToken', true); - if (!($token && $token->name == 'iframe')) { - return true; - } - // check if we actually have some whitelists enabled - if ($this->regexp === null) { - return false; - } - // actually check the whitelists - return preg_match($this->regexp, $uri->toString()); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIFilter.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,74 +0,0 @@ -percentEncoder = new HTMLPurifier_PercentEncoder(); - } - - /** - * Parses a URI. - * @param $uri string URI to parse - * @return HTMLPurifier_URI representation of URI. This representation has - * not been validated yet and may not conform to RFC. - */ - public function parse($uri) - { - $uri = $this->percentEncoder->normalize($uri); - - // Regexp is as per Appendix B. - // Note that ["<>] are an addition to the RFC's recommended - // characters, because they represent external delimeters. - $r_URI = '!'. - '(([a-zA-Z0-9\.\+\-]+):)?'. // 2. Scheme - '(//([^/?#"<>]*))?'. // 4. Authority - '([^?#"<>]*)'. // 5. Path - '(\?([^#"<>]*))?'. // 7. Query - '(#([^"<>]*))?'. // 8. Fragment - '!'; - - $matches = array(); - $result = preg_match($r_URI, $uri, $matches); - - if (!$result) return false; // *really* invalid URI - - // seperate out parts - $scheme = !empty($matches[1]) ? $matches[2] : null; - $authority = !empty($matches[3]) ? $matches[4] : null; - $path = $matches[5]; // always present, can be empty - $query = !empty($matches[6]) ? $matches[7] : null; - $fragment = !empty($matches[8]) ? $matches[9] : null; - - // further parse authority - if ($authority !== null) { - $r_authority = "/^((.+?)@)?(\[[^\]]+\]|[^:]*)(:(\d*))?/"; - $matches = array(); - preg_match($r_authority, $authority, $matches); - $userinfo = !empty($matches[1]) ? $matches[2] : null; - $host = !empty($matches[3]) ? $matches[3] : ''; - $port = !empty($matches[4]) ? (int) $matches[5] : null; - } else { - $port = $host = $userinfo = null; - } - - return new HTMLPurifier_URI( - $scheme, $userinfo, $host, $port, $path, $query, $fragment); - } - -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URI.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URI.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URI.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URI.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,316 +0,0 @@ -scheme = is_null($scheme) || ctype_lower($scheme) ? $scheme : strtolower($scheme); - $this->userinfo = $userinfo; - $this->host = $host; - $this->port = is_null($port) ? $port : (int)$port; - $this->path = $path; - $this->query = $query; - $this->fragment = $fragment; - } - - /** - * Retrieves a scheme object corresponding to the URI's scheme/default - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return HTMLPurifier_URIScheme Scheme object appropriate for validating this URI - */ - public function getSchemeObj($config, $context) - { - $registry = HTMLPurifier_URISchemeRegistry::instance(); - if ($this->scheme !== null) { - $scheme_obj = $registry->getScheme($this->scheme, $config, $context); - if (!$scheme_obj) { - return false; - } // invalid scheme, clean it out - } else { - // no scheme: retrieve the default one - $def = $config->getDefinition('URI'); - $scheme_obj = $def->getDefaultScheme($config, $context); - if (!$scheme_obj) { - if ($def->defaultScheme !== null) { - // something funky happened to the default scheme object - trigger_error( - 'Default scheme object "' . $def->defaultScheme . '" was not readable', - E_USER_WARNING - ); - } // suppress error if it's null - return false; - } - } - return $scheme_obj; - } - - /** - * Generic validation method applicable for all schemes. May modify - * this URI in order to get it into a compliant form. - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool True if validation/filtering succeeds, false if failure - */ - public function validate($config, $context) - { - // ABNF definitions from RFC 3986 - $chars_sub_delims = '!$&\'()*+,;='; - $chars_gen_delims = ':/?#[]@'; - $chars_pchar = $chars_sub_delims . ':@'; - - // validate host - if (!is_null($this->host)) { - $host_def = new HTMLPurifier_AttrDef_URI_Host(); - $this->host = $host_def->validate($this->host, $config, $context); - if ($this->host === false) { - $this->host = null; - } - } - - // validate scheme - // NOTE: It's not appropriate to check whether or not this - // scheme is in our registry, since a URIFilter may convert a - // URI that we don't allow into one we do. So instead, we just - // check if the scheme can be dropped because there is no host - // and it is our default scheme. - if (!is_null($this->scheme) && is_null($this->host) || $this->host === '') { - // support for relative paths is pretty abysmal when the - // scheme is present, so axe it when possible - $def = $config->getDefinition('URI'); - if ($def->defaultScheme === $this->scheme) { - $this->scheme = null; - } - } - - // validate username - if (!is_null($this->userinfo)) { - $encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . ':'); - $this->userinfo = $encoder->encode($this->userinfo); - } - - // validate port - if (!is_null($this->port)) { - if ($this->port < 1 || $this->port > 65535) { - $this->port = null; - } - } - - // validate path - $segments_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/'); - if (!is_null($this->host)) { // this catches $this->host === '' - // path-abempty (hier and relative) - // http://www.example.com/my/path - // //www.example.com/my/path (looks odd, but works, and - // recognized by most browsers) - // (this set is valid or invalid on a scheme by scheme - // basis, so we'll deal with it later) - // file:///my/path - // ///my/path - $this->path = $segments_encoder->encode($this->path); - } elseif ($this->path !== '') { - if ($this->path[0] === '/') { - // path-absolute (hier and relative) - // http:/my/path - // /my/path - if (strlen($this->path) >= 2 && $this->path[1] === '/') { - // This could happen if both the host gets stripped - // out - // http://my/path - // //my/path - $this->path = ''; - } else { - $this->path = $segments_encoder->encode($this->path); - } - } elseif (!is_null($this->scheme)) { - // path-rootless (hier) - // http:my/path - // Short circuit evaluation means we don't need to check nz - $this->path = $segments_encoder->encode($this->path); - } else { - // path-noscheme (relative) - // my/path - // (once again, not checking nz) - $segment_nc_encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . '@'); - $c = strpos($this->path, '/'); - if ($c !== false) { - $this->path = - $segment_nc_encoder->encode(substr($this->path, 0, $c)) . - $segments_encoder->encode(substr($this->path, $c)); - } else { - $this->path = $segment_nc_encoder->encode($this->path); - } - } - } else { - // path-empty (hier and relative) - $this->path = ''; // just to be safe - } - - // qf = query and fragment - $qf_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/?'); - - if (!is_null($this->query)) { - $this->query = $qf_encoder->encode($this->query); - } - - if (!is_null($this->fragment)) { - $this->fragment = $qf_encoder->encode($this->fragment); - } - return true; - } - - /** - * Convert URI back to string - * @return string URI appropriate for output - */ - public function toString() - { - // reconstruct authority - $authority = null; - // there is a rendering difference between a null authority - // (http:foo-bar) and an empty string authority - // (http:///foo-bar). - if (!is_null($this->host)) { - $authority = ''; - if (!is_null($this->userinfo)) { - $authority .= $this->userinfo . '@'; - } - $authority .= $this->host; - if (!is_null($this->port)) { - $authority .= ':' . $this->port; - } - } - - // Reconstruct the result - // One might wonder about parsing quirks from browsers after - // this reconstruction. Unfortunately, parsing behavior depends - // on what *scheme* was employed (file:///foo is handled *very* - // differently than http:///foo), so unfortunately we have to - // defer to the schemes to do the right thing. - $result = ''; - if (!is_null($this->scheme)) { - $result .= $this->scheme . ':'; - } - if (!is_null($authority)) { - $result .= '//' . $authority; - } - $result .= $this->path; - if (!is_null($this->query)) { - $result .= '?' . $this->query; - } - if (!is_null($this->fragment)) { - $result .= '#' . $this->fragment; - } - - return $result; - } - - /** - * Returns true if this URL might be considered a 'local' URL given - * the current context. This is true when the host is null, or - * when it matches the host supplied to the configuration. - * - * Note that this does not do any scheme checking, so it is mostly - * only appropriate for metadata that doesn't care about protocol - * security. isBenign is probably what you actually want. - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function isLocal($config, $context) - { - if ($this->host === null) { - return true; - } - $uri_def = $config->getDefinition('URI'); - if ($uri_def->host === $this->host) { - return true; - } - return false; - } - - /** - * Returns true if this URL should be considered a 'benign' URL, - * that is: - * - * - It is a local URL (isLocal), and - * - It has a equal or better level of security - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function isBenign($config, $context) - { - if (!$this->isLocal($config, $context)) { - return false; - } - - $scheme_obj = $this->getSchemeObj($config, $context); - if (!$scheme_obj) { - return false; - } // conservative approach - - $current_scheme_obj = $config->getDefinition('URI')->getDefaultScheme($config, $context); - if ($current_scheme_obj->secure) { - if (!$scheme_obj->secure) { - return false; - } - } - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/data.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/data.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/data.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/data.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,136 +0,0 @@ - true, - 'image/gif' => true, - 'image/png' => true, - ); - // this is actually irrelevant since we only write out the path - // component - /** - * @type bool - */ - public $may_omit_host = true; - - /** - * @param HTMLPurifier_URI $uri - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool - */ - public function doValidate(&$uri, $config, $context) - { - $result = explode(',', $uri->path, 2); - $is_base64 = false; - $charset = null; - $content_type = null; - if (count($result) == 2) { - list($metadata, $data) = $result; - // do some legwork on the metadata - $metas = explode(';', $metadata); - while (!empty($metas)) { - $cur = array_shift($metas); - if ($cur == 'base64') { - $is_base64 = true; - break; - } - if (substr($cur, 0, 8) == 'charset=') { - // doesn't match if there are arbitrary spaces, but - // whatever dude - if ($charset !== null) { - continue; - } // garbage - $charset = substr($cur, 8); // not used - } else { - if ($content_type !== null) { - continue; - } // garbage - $content_type = $cur; - } - } - } else { - $data = $result[0]; - } - if ($content_type !== null && empty($this->allowed_types[$content_type])) { - return false; - } - if ($charset !== null) { - // error; we don't allow plaintext stuff - $charset = null; - } - $data = rawurldecode($data); - if ($is_base64) { - $raw_data = base64_decode($data); - } else { - $raw_data = $data; - } - if ( strlen($raw_data) < 12 ) { - // error; exif_imagetype throws exception with small files, - // and this likely indicates a corrupt URI/failed parse anyway - return false; - } - // XXX probably want to refactor this into a general mechanism - // for filtering arbitrary content types - if (function_exists('sys_get_temp_dir')) { - $file = tempnam(sys_get_temp_dir(), ""); - } else { - $file = tempnam("/tmp", ""); - } - file_put_contents($file, $raw_data); - if (function_exists('exif_imagetype')) { - $image_code = exif_imagetype($file); - unlink($file); - } elseif (function_exists('getimagesize')) { - set_error_handler(array($this, 'muteErrorHandler')); - $info = getimagesize($file); - restore_error_handler(); - unlink($file); - if ($info == false) { - return false; - } - $image_code = $info[2]; - } else { - trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR); - } - $real_content_type = image_type_to_mime_type($image_code); - if ($real_content_type != $content_type) { - // we're nice guys; if the content type is something else we - // support, change it over - if (empty($this->allowed_types[$real_content_type])) { - return false; - } - $content_type = $real_content_type; - } - // ok, it's kosher, rewrite what we need - $uri->userinfo = null; - $uri->host = null; - $uri->port = null; - $uri->fragment = null; - $uri->query = null; - $uri->path = "$content_type;base64," . base64_encode($raw_data); - return true; - } - - /** - * @param int $errno - * @param string $errstr - */ - public function muteErrorHandler($errno, $errstr) - { - } -} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/file.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/file.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/file.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/file.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,44 +0,0 @@ -userinfo = null; - // file:// makes no provisions for accessing the resource - $uri->port = null; - // While it seems to work on Firefox, the querystring has - // no possible effect and is thus stripped. - $uri->query = null; - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/ftp.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/ftp.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/ftp.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/ftp.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,58 +0,0 @@ -query = null; - - // typecode check - $semicolon_pos = strrpos($uri->path, ';'); // reverse - if ($semicolon_pos !== false) { - $type = substr($uri->path, $semicolon_pos + 1); // no semicolon - $uri->path = substr($uri->path, 0, $semicolon_pos); - $type_ret = ''; - if (strpos($type, '=') !== false) { - // figure out whether or not the declaration is correct - list($key, $typecode) = explode('=', $type, 2); - if ($key !== 'type') { - // invalid key, tack it back on encoded - $uri->path .= '%3B' . $type; - } elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') { - $type_ret = ";type=$typecode"; - } - } else { - $uri->path .= '%3B' . $type; - } - $uri->path = str_replace(';', '%3B', $uri->path); - $uri->path .= $type_ret; - } - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/http.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/http.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/http.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/http.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,36 +0,0 @@ -userinfo = null; - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/https.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/https.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/https.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/https.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,18 +0,0 @@ -userinfo = null; - $uri->host = null; - $uri->port = null; - // we need to validate path against RFC 2368's addr-spec - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/news.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/news.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/news.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/news.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,35 +0,0 @@ -userinfo = null; - $uri->host = null; - $uri->port = null; - $uri->query = null; - // typecode check needed on path - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/nntp.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/nntp.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/nntp.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/nntp.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,32 +0,0 @@ -userinfo = null; - $uri->query = null; - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/tel.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/tel.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/tel.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme/tel.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,46 +0,0 @@ -userinfo = null; - $uri->host = null; - $uri->port = null; - - // Delete all non-numeric characters, non-x characters - // from phone number, EXCEPT for a leading plus sign. - $uri->path = preg_replace('/(?!^\+)[^\dx]/', '', - // Normalize e(x)tension to lower-case - str_replace('X', 'x', $uri->path)); - - return true; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URIScheme.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,102 +0,0 @@ -, resolves edge cases - * with making relative URIs absolute - * @type bool - */ - public $hierarchical = false; - - /** - * Whether or not the URI may omit a hostname when the scheme is - * explicitly specified, ala file:///path/to/file. As of writing, - * 'file' is the only scheme that browsers support his properly. - * @type bool - */ - public $may_omit_host = false; - - /** - * Validates the components of a URI for a specific scheme. - * @param HTMLPurifier_URI $uri Reference to a HTMLPurifier_URI object - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool success or failure - */ - abstract public function doValidate(&$uri, $config, $context); - - /** - * Public interface for validating components of a URI. Performs a - * bunch of default actions. Don't overload this method. - * @param HTMLPurifier_URI $uri Reference to a HTMLPurifier_URI object - * @param HTMLPurifier_Config $config - * @param HTMLPurifier_Context $context - * @return bool success or failure - */ - public function validate(&$uri, $config, $context) - { - if ($this->default_port == $uri->port) { - $uri->port = null; - } - // kludge: browsers do funny things when the scheme but not the - // authority is set - if (!$this->may_omit_host && - // if the scheme is present, a missing host is always in error - (!is_null($uri->scheme) && ($uri->host === '' || is_null($uri->host))) || - // if the scheme is not present, a *blank* host is in error, - // since this translates into '///path' which most browsers - // interpret as being 'http://path'. - (is_null($uri->scheme) && $uri->host === '') - ) { - do { - if (is_null($uri->scheme)) { - if (substr($uri->path, 0, 2) != '//') { - $uri->host = null; - break; - } - // URI is '////path', so we cannot nullify the - // host to preserve semantics. Try expanding the - // hostname instead (fall through) - } - // first see if we can manually insert a hostname - $host = $config->get('URI.Host'); - if (!is_null($host)) { - $uri->host = $host; - } else { - // we can't do anything sensible, reject the URL. - return false; - } - } while (false); - } - return $this->doValidate($uri, $config, $context); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URISchemeRegistry.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URISchemeRegistry.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/URISchemeRegistry.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/URISchemeRegistry.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,81 +0,0 @@ -get('URI.AllowedSchemes'); - if (!$config->get('URI.OverrideAllowedSchemes') && - !isset($allowed_schemes[$scheme]) - ) { - return; - } - - if (isset($this->schemes[$scheme])) { - return $this->schemes[$scheme]; - } - if (!isset($allowed_schemes[$scheme])) { - return; - } - - $class = 'HTMLPurifier_URIScheme_' . $scheme; - if (!class_exists($class)) { - return; - } - $this->schemes[$scheme] = new $class(); - return $this->schemes[$scheme]; - } - - /** - * Registers a custom scheme to the cache, bypassing reflection. - * @param string $scheme Scheme name - * @param HTMLPurifier_URIScheme $scheme_obj - */ - public function register($scheme, $scheme_obj) - { - $this->schemes[$scheme] = $scheme_obj; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Flexible.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Flexible.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Flexible.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Flexible.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,130 +0,0 @@ - $j) { - $var[$i] = trim($j); - } - if ($type === self::HASH) { - // key:value,key2:value2 - $nvar = array(); - foreach ($var as $keypair) { - $c = explode(':', $keypair, 2); - if (!isset($c[1])) { - continue; - } - $nvar[trim($c[0])] = trim($c[1]); - } - $var = $nvar; - } - } - if (!is_array($var)) { - break; - } - $keys = array_keys($var); - if ($keys === array_keys($keys)) { - if ($type == self::ALIST) { - return $var; - } elseif ($type == self::LOOKUP) { - $new = array(); - foreach ($var as $key) { - $new[$key] = true; - } - return $new; - } else { - break; - } - } - if ($type === self::ALIST) { - trigger_error("Array list did not have consecutive integer indexes", E_USER_WARNING); - return array_values($var); - } - if ($type === self::LOOKUP) { - foreach ($var as $key => $value) { - if ($value !== true) { - trigger_error( - "Lookup array has non-true value at key '$key'; " . - "maybe your input array was not indexed numerically", - E_USER_WARNING - ); - } - $var[$key] = true; - } - } - return $var; - default: - $this->errorInconsistent(__CLASS__, $type); - } - $this->errorGeneric($var, $type); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Native.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Native.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Native.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParser/Native.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,38 +0,0 @@ -evalExpression($var); - } - - /** - * @param string $expr - * @return mixed - * @throws HTMLPurifier_VarParserException - */ - protected function evalExpression($expr) - { - $var = null; - $result = eval("\$var = $expr;"); - if ($result === false) { - throw new HTMLPurifier_VarParserException("Fatal error in evaluated code"); - } - return $var; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParserException.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParserException.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParserException.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/VarParserException.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,11 +0,0 @@ - self::STRING, - 'istring' => self::ISTRING, - 'text' => self::TEXT, - 'itext' => self::ITEXT, - 'int' => self::INT, - 'float' => self::FLOAT, - 'bool' => self::BOOL, - 'lookup' => self::LOOKUP, - 'list' => self::ALIST, - 'hash' => self::HASH, - 'mixed' => self::MIXED - ); - - /** - * Lookup table of types that are string, and can have aliases or - * allowed value lists. - */ - public static $stringTypes = array( - self::STRING => true, - self::ISTRING => true, - self::TEXT => true, - self::ITEXT => true, - ); - - /** - * Validate a variable according to type. - * It may return NULL as a valid type if $allow_null is true. - * - * @param mixed $var Variable to validate - * @param int $type Type of variable, see HTMLPurifier_VarParser->types - * @param bool $allow_null Whether or not to permit null as a value - * @return string Validated and type-coerced variable - * @throws HTMLPurifier_VarParserException - */ - final public function parse($var, $type, $allow_null = false) - { - if (is_string($type)) { - if (!isset(HTMLPurifier_VarParser::$types[$type])) { - throw new HTMLPurifier_VarParserException("Invalid type '$type'"); - } else { - $type = HTMLPurifier_VarParser::$types[$type]; - } - } - $var = $this->parseImplementation($var, $type, $allow_null); - if ($allow_null && $var === null) { - return null; - } - // These are basic checks, to make sure nothing horribly wrong - // happened in our implementations. - switch ($type) { - case (self::STRING): - case (self::ISTRING): - case (self::TEXT): - case (self::ITEXT): - if (!is_string($var)) { - break; - } - if ($type == self::ISTRING || $type == self::ITEXT) { - $var = strtolower($var); - } - return $var; - case (self::INT): - if (!is_int($var)) { - break; - } - return $var; - case (self::FLOAT): - if (!is_float($var)) { - break; - } - return $var; - case (self::BOOL): - if (!is_bool($var)) { - break; - } - return $var; - case (self::LOOKUP): - case (self::ALIST): - case (self::HASH): - if (!is_array($var)) { - break; - } - if ($type === self::LOOKUP) { - foreach ($var as $k) { - if ($k !== true) { - $this->error('Lookup table contains value other than true'); - } - } - } elseif ($type === self::ALIST) { - $keys = array_keys($var); - if (array_keys($keys) !== $keys) { - $this->error('Indices for list are not uniform'); - } - } - return $var; - case (self::MIXED): - return $var; - default: - $this->errorInconsistent(get_class($this), $type); - } - $this->errorGeneric($var, $type); - } - - /** - * Actually implements the parsing. Base implementation does not - * do anything to $var. Subclasses should overload this! - * @param mixed $var - * @param int $type - * @param bool $allow_null - * @return string - */ - protected function parseImplementation($var, $type, $allow_null) - { - return $var; - } - - /** - * Throws an exception. - * @throws HTMLPurifier_VarParserException - */ - protected function error($msg) - { - throw new HTMLPurifier_VarParserException($msg); - } - - /** - * Throws an inconsistency exception. - * @note This should not ever be called. It would be called if we - * extend the allowed values of HTMLPurifier_VarParser without - * updating subclasses. - * @param string $class - * @param int $type - * @throws HTMLPurifier_Exception - */ - protected function errorInconsistent($class, $type) - { - throw new HTMLPurifier_Exception( - "Inconsistency in $class: " . HTMLPurifier_VarParser::getTypeName($type) . - " not implemented" - ); - } - - /** - * Generic error for if a type didn't work. - * @param mixed $var - * @param int $type - */ - protected function errorGeneric($var, $type) - { - $vtype = gettype($var); - $this->error("Expected type " . HTMLPurifier_VarParser::getTypeName($type) . ", got $vtype"); - } - - /** - * @param int $type - * @return string - */ - public static function getTypeName($type) - { - static $lookup; - if (!$lookup) { - // Lazy load the alternative lookup table - $lookup = array_flip(HTMLPurifier_VarParser::$types); - } - if (!isset($lookup[$type])) { - return 'unknown'; - } - return $lookup[$type]; - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Zipper.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Zipper.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier/Zipper.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier/Zipper.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,157 +0,0 @@ -front = $front; - $this->back = $back; - } - - /** - * Creates a zipper from an array, with a hole in the - * 0-index position. - * @param Array to zipper-ify. - * @return Tuple of zipper and element of first position. - */ - static public function fromArray($array) { - $z = new self(array(), array_reverse($array)); - $t = $z->delete(); // delete the "dummy hole" - return array($z, $t); - } - - /** - * Convert zipper back into a normal array, optionally filling in - * the hole with a value. (Usually you should supply a $t, unless you - * are at the end of the array.) - */ - public function toArray($t = NULL) { - $a = $this->front; - if ($t !== NULL) $a[] = $t; - for ($i = count($this->back)-1; $i >= 0; $i--) { - $a[] = $this->back[$i]; - } - return $a; - } - - /** - * Move hole to the next element. - * @param $t Element to fill hole with - * @return Original contents of new hole. - */ - public function next($t) { - if ($t !== NULL) array_push($this->front, $t); - return empty($this->back) ? NULL : array_pop($this->back); - } - - /** - * Iterated hole advancement. - * @param $t Element to fill hole with - * @param $i How many forward to advance hole - * @return Original contents of new hole, i away - */ - public function advance($t, $n) { - for ($i = 0; $i < $n; $i++) { - $t = $this->next($t); - } - return $t; - } - - /** - * Move hole to the previous element - * @param $t Element to fill hole with - * @return Original contents of new hole. - */ - public function prev($t) { - if ($t !== NULL) array_push($this->back, $t); - return empty($this->front) ? NULL : array_pop($this->front); - } - - /** - * Delete contents of current hole, shifting hole to - * next element. - * @return Original contents of new hole. - */ - public function delete() { - return empty($this->back) ? NULL : array_pop($this->back); - } - - /** - * Returns true if we are at the end of the list. - * @return bool - */ - public function done() { - return empty($this->back); - } - - /** - * Insert element before hole. - * @param Element to insert - */ - public function insertBefore($t) { - if ($t !== NULL) array_push($this->front, $t); - } - - /** - * Insert element after hole. - * @param Element to insert - */ - public function insertAfter($t) { - if ($t !== NULL) array_push($this->back, $t); - } - - /** - * Splice in multiple elements at hole. Functional specification - * in terms of array_splice: - * - * $arr1 = $arr; - * $old1 = array_splice($arr1, $i, $delete, $replacement); - * - * list($z, $t) = HTMLPurifier_Zipper::fromArray($arr); - * $t = $z->advance($t, $i); - * list($old2, $t) = $z->splice($t, $delete, $replacement); - * $arr2 = $z->toArray($t); - * - * assert($old1 === $old2); - * assert($arr1 === $arr2); - * - * NB: the absolute index location after this operation is - * *unchanged!* - * - * @param Current contents of hole. - */ - public function splice($t, $delete, $replacement) { - // delete - $old = array(); - $r = $t; - for ($i = $delete; $i > 0; $i--) { - $old[] = $r; - $r = $this->delete(); - } - // insert - for ($i = count($replacement)-1; $i >= 0; $i--) { - $this->insertAfter($r); - $r = $replacement[$i]; - } - return array($old, $r); - } -} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.autoload-legacy.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.autoload-legacy.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.autoload-legacy.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.autoload-legacy.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -purify($html, $config); -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.includes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.includes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.includes.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.includes.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,234 +0,0 @@ - $attributes) { - $allowed_elements[$element] = true; - foreach ($attributes as $attribute => $x) { - $allowed_attributes["$element.$attribute"] = true; - } - } - $config->set('HTML.AllowedElements', $allowed_elements); - $config->set('HTML.AllowedAttributes', $allowed_attributes); - if ($allowed_protocols !== null) { - $config->set('URI.AllowedSchemes', $allowed_protocols); - } - $purifier = new HTMLPurifier($config); - return $purifier->purify($string); -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,292 +0,0 @@ -config = HTMLPurifier_Config::create($config); - $this->strategy = new HTMLPurifier_Strategy_Core(); - } - - /** - * Adds a filter to process the output. First come first serve - * - * @param HTMLPurifier_Filter $filter HTMLPurifier_Filter object - */ - public function addFilter($filter) - { - trigger_error( - 'HTMLPurifier->addFilter() is deprecated, use configuration directives' . - ' in the Filter namespace or Filter.Custom', - E_USER_WARNING - ); - $this->filters[] = $filter; - } - - /** - * Filters an HTML snippet/document to be XSS-free and standards-compliant. - * - * @param string $html String of HTML to purify - * @param HTMLPurifier_Config $config Config object for this operation, - * if omitted, defaults to the config object specified during this - * object's construction. The parameter can also be any type - * that HTMLPurifier_Config::create() supports. - * - * @return string Purified HTML - */ - public function purify($html, $config = null) - { - // :TODO: make the config merge in, instead of replace - $config = $config ? HTMLPurifier_Config::create($config) : $this->config; - - // implementation is partially environment dependant, partially - // configuration dependant - $lexer = HTMLPurifier_Lexer::create($config); - - $context = new HTMLPurifier_Context(); - - // setup HTML generator - $this->generator = new HTMLPurifier_Generator($config, $context); - $context->register('Generator', $this->generator); - - // set up global context variables - if ($config->get('Core.CollectErrors')) { - // may get moved out if other facilities use it - $language_factory = HTMLPurifier_LanguageFactory::instance(); - $language = $language_factory->create($config, $context); - $context->register('Locale', $language); - - $error_collector = new HTMLPurifier_ErrorCollector($context); - $context->register('ErrorCollector', $error_collector); - } - - // setup id_accumulator context, necessary due to the fact that - // AttrValidator can be called from many places - $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context); - $context->register('IDAccumulator', $id_accumulator); - - $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context); - - // setup filters - $filter_flags = $config->getBatch('Filter'); - $custom_filters = $filter_flags['Custom']; - unset($filter_flags['Custom']); - $filters = array(); - foreach ($filter_flags as $filter => $flag) { - if (!$flag) { - continue; - } - if (strpos($filter, '.') !== false) { - continue; - } - $class = "HTMLPurifier_Filter_$filter"; - $filters[] = new $class; - } - foreach ($custom_filters as $filter) { - // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat - $filters[] = $filter; - } - $filters = array_merge($filters, $this->filters); - // maybe prepare(), but later - - for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) { - $html = $filters[$i]->preFilter($html, $config, $context); - } - - // purified HTML - $html = - $this->generator->generateFromTokens( - // list of tokens - $this->strategy->execute( - // list of un-purified tokens - $lexer->tokenizeHTML( - // un-purified HTML - $html, - $config, - $context - ), - $config, - $context - ) - ); - - for ($i = $filter_size - 1; $i >= 0; $i--) { - $html = $filters[$i]->postFilter($html, $config, $context); - } - - $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context); - $this->context =& $context; - return $html; - } - - /** - * Filters an array of HTML snippets - * - * @param string[] $array_of_html Array of html snippets - * @param HTMLPurifier_Config $config Optional config object for this operation. - * See HTMLPurifier::purify() for more details. - * - * @return string[] Array of purified HTML - */ - public function purifyArray($array_of_html, $config = null) - { - $context_array = array(); - foreach ($array_of_html as $key => $html) { - $array_of_html[$key] = $this->purify($html, $config); - $context_array[$key] = $this->context; - } - $this->context = $context_array; - return $array_of_html; - } - - /** - * Singleton for enforcing just one HTML Purifier in your system - * - * @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype - * HTMLPurifier instance to overload singleton with, - * or HTMLPurifier_Config instance to configure the - * generated version with. - * - * @return HTMLPurifier - */ - public static function instance($prototype = null) - { - if (!self::$instance || $prototype) { - if ($prototype instanceof HTMLPurifier) { - self::$instance = $prototype; - } elseif ($prototype) { - self::$instance = new HTMLPurifier($prototype); - } else { - self::$instance = new HTMLPurifier(); - } - } - return self::$instance; - } - - /** - * Singleton for enforcing just one HTML Purifier in your system - * - * @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype - * HTMLPurifier instance to overload singleton with, - * or HTMLPurifier_Config instance to configure the - * generated version with. - * - * @return HTMLPurifier - * @note Backwards compatibility, see instance() - */ - public static function getInstance($prototype = null) - { - return HTMLPurifier::instance($prototype); - } -} - -// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.safe-includes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.safe-includes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.10.0/HTMLPurifier.safe-includes.php 2018-02-23 02:08:20.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.10.0/HTMLPurifier.safe-includes.php 1970-01-01 00:00:00.000000000 +0000 @@ -1,228 +0,0 @@ -getHTMLDefinition(); + $parent = new HTMLPurifier_Token_Start($definition->info_parent); + $stack = array($parent->toNode()); + foreach ($tokens as $token) { + $token->skip = null; // [MUT] + $token->carryover = null; // [MUT] + if ($token instanceof HTMLPurifier_Token_End) { + $token->start = null; // [MUT] + $r = array_pop($stack); + //assert($r->name === $token->name); + //assert(empty($token->attr)); + $r->endCol = $token->col; + $r->endLine = $token->line; + $r->endArmor = $token->armor; + continue; + } + $node = $token->toNode(); + $stack[count($stack)-1]->children[] = $node; + if ($token instanceof HTMLPurifier_Token_Start) { + $stack[] = $node; + } + } + //assert(count($stack) == 1); + return $stack[0]; + } + + public static function flatten($node, $config, $context) { + $level = 0; + $nodes = array($level => new HTMLPurifier_Queue(array($node))); + $closingTokens = array(); + $tokens = array(); + do { + while (!$nodes[$level]->isEmpty()) { + $node = $nodes[$level]->shift(); // FIFO + list($start, $end) = $node->toTokenPair(); + if ($level > 0) { + $tokens[] = $start; + } + if ($end !== NULL) { + $closingTokens[$level][] = $end; + } + if ($node instanceof HTMLPurifier_Node_Element) { + $level++; + $nodes[$level] = new HTMLPurifier_Queue(); + foreach ($node->children as $childNode) { + $nodes[$level]->push($childNode); + } + } + } + $level--; + if ($level && isset($closingTokens[$level])) { + while ($token = array_pop($closingTokens[$level])) { + $tokens[] = $token; + } + } + } while ($level > 0); + return $tokens; + } +} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrCollections.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrCollections.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrCollections.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrCollections.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,148 @@ +doConstruct($attr_types, $modules); + } + + public function doConstruct($attr_types, $modules) + { + // load extensions from the modules + foreach ($modules as $module) { + foreach ($module->attr_collections as $coll_i => $coll) { + if (!isset($this->info[$coll_i])) { + $this->info[$coll_i] = array(); + } + foreach ($coll as $attr_i => $attr) { + if ($attr_i === 0 && isset($this->info[$coll_i][$attr_i])) { + // merge in includes + $this->info[$coll_i][$attr_i] = array_merge( + $this->info[$coll_i][$attr_i], + $attr + ); + continue; + } + $this->info[$coll_i][$attr_i] = $attr; + } + } + } + // perform internal expansions and inclusions + foreach ($this->info as $name => $attr) { + // merge attribute collections that include others + $this->performInclusions($this->info[$name]); + // replace string identifiers with actual attribute objects + $this->expandIdentifiers($this->info[$name], $attr_types); + } + } + + /** + * Takes a reference to an attribute associative array and performs + * all inclusions specified by the zero index. + * @param array &$attr Reference to attribute array + */ + public function performInclusions(&$attr) + { + if (!isset($attr[0])) { + return; + } + $merge = $attr[0]; + $seen = array(); // recursion guard + // loop through all the inclusions + for ($i = 0; isset($merge[$i]); $i++) { + if (isset($seen[$merge[$i]])) { + continue; + } + $seen[$merge[$i]] = true; + // foreach attribute of the inclusion, copy it over + if (!isset($this->info[$merge[$i]])) { + continue; + } + foreach ($this->info[$merge[$i]] as $key => $value) { + if (isset($attr[$key])) { + continue; + } // also catches more inclusions + $attr[$key] = $value; + } + if (isset($this->info[$merge[$i]][0])) { + // recursion + $merge = array_merge($merge, $this->info[$merge[$i]][0]); + } + } + unset($attr[0]); + } + + /** + * Expands all string identifiers in an attribute array by replacing + * them with the appropriate values inside HTMLPurifier_AttrTypes + * @param array &$attr Reference to attribute array + * @param HTMLPurifier_AttrTypes $attr_types HTMLPurifier_AttrTypes instance + */ + public function expandIdentifiers(&$attr, $attr_types) + { + // because foreach will process new elements we add, make sure we + // skip duplicates + $processed = array(); + + foreach ($attr as $def_i => $def) { + // skip inclusions + if ($def_i === 0) { + continue; + } + + if (isset($processed[$def_i])) { + continue; + } + + // determine whether or not attribute is required + if ($required = (strpos($def_i, '*') !== false)) { + // rename the definition + unset($attr[$def_i]); + $def_i = trim($def_i, '*'); + $attr[$def_i] = $def; + } + + $processed[$def_i] = true; + + // if we've already got a literal object, move on + if (is_object($def)) { + // preserve previous required + $attr[$def_i]->required = ($required || $attr[$def_i]->required); + continue; + } + + if ($def === false) { + unset($attr[$def_i]); + continue; + } + + if ($t = $attr_types->get($def)) { + $attr[$def_i] = $t; + $attr[$def_i]->required = $required; + } else { + unset($attr[$def_i]); + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/Clone.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/Clone.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/Clone.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/Clone.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,44 @@ +clone = $clone; + } + + /** + * @param string $v + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($v, $config, $context) + { + return $this->clone->validate($v, $config, $context); + } + + /** + * @param string $string + * @return HTMLPurifier_AttrDef + */ + public function make($string) + { + return clone $this->clone; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/AlphaValue.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/AlphaValue.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/AlphaValue.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/AlphaValue.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,34 @@ + 1.0) { + $result = '1'; + } + return $result; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Background.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Background.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Background.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Background.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,111 @@ +getCSSDefinition(); + $this->info['background-color'] = $def->info['background-color']; + $this->info['background-image'] = $def->info['background-image']; + $this->info['background-repeat'] = $def->info['background-repeat']; + $this->info['background-attachment'] = $def->info['background-attachment']; + $this->info['background-position'] = $def->info['background-position']; + } + + /** + * @param string $string + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($string, $config, $context) + { + // regular pre-processing + $string = $this->parseCDATA($string); + if ($string === '') { + return false; + } + + // munge rgb() decl if necessary + $string = $this->mungeRgb($string); + + // assumes URI doesn't have spaces in it + $bits = explode(' ', $string); // bits to process + + $caught = array(); + $caught['color'] = false; + $caught['image'] = false; + $caught['repeat'] = false; + $caught['attachment'] = false; + $caught['position'] = false; + + $i = 0; // number of catches + + foreach ($bits as $bit) { + if ($bit === '') { + continue; + } + foreach ($caught as $key => $status) { + if ($key != 'position') { + if ($status !== false) { + continue; + } + $r = $this->info['background-' . $key]->validate($bit, $config, $context); + } else { + $r = $bit; + } + if ($r === false) { + continue; + } + if ($key == 'position') { + if ($caught[$key] === false) { + $caught[$key] = ''; + } + $caught[$key] .= $r . ' '; + } else { + $caught[$key] = $r; + } + $i++; + break; + } + } + + if (!$i) { + return false; + } + if ($caught['position'] !== false) { + $caught['position'] = $this->info['background-position']-> + validate($caught['position'], $config, $context); + } + + $ret = array(); + foreach ($caught as $value) { + if ($value === false) { + continue; + } + $ret[] = $value; + } + + if (empty($ret)) { + return false; + } + return implode(' ', $ret); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,157 @@ + || left | center | right + ] + [ + | | top | center | bottom + ]? + ] | + [ // this signifies that the vertical and horizontal adjectives + // can be arbitrarily ordered, however, there can only be two, + // one of each, or none at all + [ + left | center | right + ] || + [ + top | center | bottom + ] + ] + top, left = 0% + center, (none) = 50% + bottom, right = 100% +*/ + +/* QuirksMode says: + keyword + length/percentage must be ordered correctly, as per W3C + + Internet Explorer and Opera, however, support arbitrary ordering. We + should fix it up. + + Minor issue though, not strictly necessary. +*/ + +// control freaks may appreciate the ability to convert these to +// percentages or something, but it's not necessary + +/** + * Validates the value of background-position. + */ +class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef +{ + + /** + * @type HTMLPurifier_AttrDef_CSS_Length + */ + protected $length; + + /** + * @type HTMLPurifier_AttrDef_CSS_Percentage + */ + protected $percentage; + + public function __construct() + { + $this->length = new HTMLPurifier_AttrDef_CSS_Length(); + $this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage(); + } + + /** + * @param string $string + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($string, $config, $context) + { + $string = $this->parseCDATA($string); + $bits = explode(' ', $string); + + $keywords = array(); + $keywords['h'] = false; // left, right + $keywords['v'] = false; // top, bottom + $keywords['ch'] = false; // center (first word) + $keywords['cv'] = false; // center (second word) + $measures = array(); + + $i = 0; + + $lookup = array( + 'top' => 'v', + 'bottom' => 'v', + 'left' => 'h', + 'right' => 'h', + 'center' => 'c' + ); + + foreach ($bits as $bit) { + if ($bit === '') { + continue; + } + + // test for keyword + $lbit = ctype_lower($bit) ? $bit : strtolower($bit); + if (isset($lookup[$lbit])) { + $status = $lookup[$lbit]; + if ($status == 'c') { + if ($i == 0) { + $status = 'ch'; + } else { + $status = 'cv'; + } + } + $keywords[$status] = $lbit; + $i++; + } + + // test for length + $r = $this->length->validate($bit, $config, $context); + if ($r !== false) { + $measures[] = $r; + $i++; + } + + // test for percentage + $r = $this->percentage->validate($bit, $config, $context); + if ($r !== false) { + $measures[] = $r; + $i++; + } + } + + if (!$i) { + return false; + } // no valid values were caught + + $ret = array(); + + // first keyword + if ($keywords['h']) { + $ret[] = $keywords['h']; + } elseif ($keywords['ch']) { + $ret[] = $keywords['ch']; + $keywords['cv'] = false; // prevent re-use: center = center center + } elseif (count($measures)) { + $ret[] = array_shift($measures); + } + + if ($keywords['v']) { + $ret[] = $keywords['v']; + } elseif ($keywords['cv']) { + $ret[] = $keywords['cv']; + } elseif (count($measures)) { + $ret[] = array_shift($measures); + } + + if (empty($ret)) { + return false; + } + return implode(' ', $ret); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Border.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Border.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Border.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Border.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,56 @@ +getCSSDefinition(); + $this->info['border-width'] = $def->info['border-width']; + $this->info['border-style'] = $def->info['border-style']; + $this->info['border-top-color'] = $def->info['border-top-color']; + } + + /** + * @param string $string + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($string, $config, $context) + { + $string = $this->parseCDATA($string); + $string = $this->mungeRgb($string); + $bits = explode(' ', $string); + $done = array(); // segments we've finished + $ret = ''; // return value + foreach ($bits as $bit) { + foreach ($this->info as $propname => $validator) { + if (isset($done[$propname])) { + continue; + } + $r = $validator->validate($bit, $config, $context); + if ($r !== false) { + $ret .= $r . ' '; + $done[$propname] = true; + break; + } + } + } + return rtrim($ret); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Color.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Color.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Color.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Color.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,161 @@ +alpha = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + } + + /** + * @param string $color + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($color, $config, $context) + { + static $colors = null; + if ($colors === null) { + $colors = $config->get('Core.ColorKeywords'); + } + + $color = trim($color); + if ($color === '') { + return false; + } + + $lower = strtolower($color); + if (isset($colors[$lower])) { + return $colors[$lower]; + } + + if (preg_match('#(rgb|rgba|hsl|hsla)\(#', $color, $matches) === 1) { + $length = strlen($color); + if (strpos($color, ')') !== $length - 1) { + return false; + } + + // get used function : rgb, rgba, hsl or hsla + $function = $matches[1]; + + $parameters_size = 3; + $alpha_channel = false; + if (substr($function, -1) === 'a') { + $parameters_size = 4; + $alpha_channel = true; + } + + /* + * Allowed types for values : + * parameter_position => [type => max_value] + */ + $allowed_types = array( + 1 => array('percentage' => 100, 'integer' => 255), + 2 => array('percentage' => 100, 'integer' => 255), + 3 => array('percentage' => 100, 'integer' => 255), + ); + $allow_different_types = false; + + if (strpos($function, 'hsl') !== false) { + $allowed_types = array( + 1 => array('integer' => 360), + 2 => array('percentage' => 100), + 3 => array('percentage' => 100), + ); + $allow_different_types = true; + } + + $values = trim(str_replace($function, '', $color), ' ()'); + + $parts = explode(',', $values); + if (count($parts) !== $parameters_size) { + return false; + } + + $type = false; + $new_parts = array(); + $i = 0; + + foreach ($parts as $part) { + $i++; + $part = trim($part); + + if ($part === '') { + return false; + } + + // different check for alpha channel + if ($alpha_channel === true && $i === count($parts)) { + $result = $this->alpha->validate($part, $config, $context); + + if ($result === false) { + return false; + } + + $new_parts[] = (string)$result; + continue; + } + + if (substr($part, -1) === '%') { + $current_type = 'percentage'; + } else { + $current_type = 'integer'; + } + + if (!array_key_exists($current_type, $allowed_types[$i])) { + return false; + } + + if (!$type) { + $type = $current_type; + } + + if ($allow_different_types === false && $type != $current_type) { + return false; + } + + $max_value = $allowed_types[$i][$current_type]; + + if ($current_type == 'integer') { + // Return value between range 0 -> $max_value + $new_parts[] = (int)max(min($part, $max_value), 0); + } elseif ($current_type == 'percentage') { + $new_parts[] = (float)max(min(rtrim($part, '%'), $max_value), 0) . '%'; + } + } + + $new_values = implode(',', $new_parts); + + $color = $function . '(' . $new_values . ')'; + } else { + // hexadecimal handling + if ($color[0] === '#') { + $hex = substr($color, 1); + } else { + $hex = $color; + $color = '#' . $color; + } + $length = strlen($hex); + if ($length !== 3 && $length !== 6) { + return false; + } + if (!ctype_xdigit($hex)) { + return false; + } + } + return $color; + } + +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Composite.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Composite.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Composite.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Composite.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,48 @@ +defs = $defs; + } + + /** + * @param string $string + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($string, $config, $context) + { + foreach ($this->defs as $i => $def) { + $result = $this->defs[$i]->validate($string, $config, $context); + if ($result !== false) { + return $result; + } + } + return false; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,44 @@ +def = $def; + $this->element = $element; + } + + /** + * Checks if CurrentToken is set and equal to $this->element + * @param string $string + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($string, $config, $context) + { + $token = $context->get('CurrentToken', true); + if ($token && $token->name == $this->element) { + return false; + } + return $this->def->validate($string, $config, $context); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Filter.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Filter.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Filter.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/Filter.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,77 @@ +intValidator = new HTMLPurifier_AttrDef_Integer(); + } + + /** + * @param string $value + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($value, $config, $context) + { + $value = $this->parseCDATA($value); + if ($value === 'none') { + return $value; + } + // if we looped this we could support multiple filters + $function_length = strcspn($value, '('); + $function = trim(substr($value, 0, $function_length)); + if ($function !== 'alpha' && + $function !== 'Alpha' && + $function !== 'progid:DXImageTransform.Microsoft.Alpha' + ) { + return false; + } + $cursor = $function_length + 1; + $parameters_length = strcspn($value, ')', $cursor); + $parameters = substr($value, $cursor, $parameters_length); + $params = explode(',', $parameters); + $ret_params = array(); + $lookup = array(); + foreach ($params as $param) { + list($key, $value) = explode('=', $param); + $key = trim($key); + $value = trim($value); + if (isset($lookup[$key])) { + continue; + } + if ($key !== 'opacity') { + continue; + } + $value = $this->intValidator->validate($value, $config, $context); + if ($value === false) { + continue; + } + $int = (int)$value; + if ($int > 100) { + $value = '100'; + } + if ($int < 0) { + $value = '0'; + } + $ret_params[] = "$key=$value"; + $lookup[$key] = true; + } + $ret_parameters = implode(',', $ret_params); + $ret_function = "$function($ret_parameters)"; + return $ret_function; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/FontFamily.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/FontFamily.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/FontFamily.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/AttrDef/CSS/FontFamily.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,219 @@ +mask = '_- '; + for ($c = 'a'; $c <= 'z'; $c++) { + $this->mask .= $c; + } + for ($c = 'A'; $c <= 'Z'; $c++) { + $this->mask .= $c; + } + for ($c = '0'; $c <= '9'; $c++) { + $this->mask .= $c; + } // cast-y, but should be fine + // special bytes used by UTF-8 + for ($i = 0x80; $i <= 0xFF; $i++) { + // We don't bother excluding invalid bytes in this range, + // because the our restriction of well-formed UTF-8 will + // prevent these from ever occurring. + $this->mask .= chr($i); + } + + /* + PHP's internal strcspn implementation is + O(length of string * length of mask), making it inefficient + for large masks. However, it's still faster than + preg_match 8) + for (p = s1;;) { + spanp = s2; + do { + if (*spanp == c || p == s1_end) { + return p - s1; + } + } while (spanp++ < (s2_end - 1)); + c = *++p; + } + */ + // possible optimization: invert the mask. + } + + /** + * @param string $string + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string + */ + public function validate($string, $config, $context) + { + static $generic_names = array( + 'serif' => true, + 'sans-serif' => true, + 'monospace' => true, + 'fantasy' => true, + 'cursive' => true + ); + $allowed_fonts = $config->get('CSS.AllowedFonts'); + + // assume that no font names contain commas in them + $fonts = explode(',', $string); + $final = ''; + foreach ($fonts as $font) { + $font = trim($font); + if ($font === '') { + continue; + } + // match a generic name + if (isset($generic_names[$font])) { + if ($allowed_fonts === null || isset($allowed_fonts[$font])) { + $final .= $font . ', '; + } + continue; + } + // match a quoted name + if ($font[0] === '"' || $font[0] === "'") { + $length = strlen($font); + if ($length <= 2) { + continue; + } + $quote = $font[0]; + if ($font[$length - 1] !== $quote) { + continue; + } + $font = substr($font, 1, $length - 2); + } + + $font = $this->expandCSSEscape($font); + + // $font is a pure representation of the font name + + if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) { + continue; + } + + if (ctype_alnum($font) && $font !== '') { + // very simple font, allow it in unharmed + $final .= $font . ', '; + continue; + } + + // bugger out on whitespace. form feed (0C) really + // shouldn't show up regardless + $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font); + + // Here, there are various classes of characters which need + // to be treated differently: + // - Alphanumeric characters are essentially safe. We + // handled these above. + // - Spaces require quoting, though most parsers will do + // the right thing if there aren't any characters that + // can be misinterpreted + // - Dashes rarely occur, but they fairly unproblematic + // for parsing/rendering purposes. + // The above characters cover the majority of Western font + // names. + // - Arbitrary Unicode characters not in ASCII. Because + // most parsers give little thought to Unicode, treatment + // of these codepoints is basically uniform, even for + // punctuation-like codepoints. These characters can + // show up in non-Western pages and are supported by most + // major browsers, for example: "ＭＳ 明朝" is a + // legitimate font-name + // to
+ foreach ($definition->info[$token->name]->attr_transform_pre as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) { + $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + } + + // create alias to this element's attribute definition array, see + // also $d_defs (global attribute definition array) + // DEFINITION CALL + $defs = $definition->info[$token->name]->attr; + + $attr_key = false; + $context->register('CurrentAttr', $attr_key); + + // iterate through all the attribute keypairs + // Watch out for name collisions: $key has previously been used + foreach ($attr as $attr_key => $value) { + + // call the definition + if (isset($defs[$attr_key])) { + // there is a local definition defined + if ($defs[$attr_key] === false) { + // We've explicitly been told not to allow this element. + // This is usually when there's a global definition + // that must be overridden. + // Theoretically speaking, we could have a + // AttrDef_DenyAll, but this is faster! + $result = false; + } else { + // validate according to the element's definition + $result = $defs[$attr_key]->validate( + $value, + $config, + $context + ); + } + } elseif (isset($d_defs[$attr_key])) { + // there is a global definition defined, validate according + // to the global definition + $result = $d_defs[$attr_key]->validate( + $value, + $config, + $context + ); + } else { + // system never heard of the attribute? DELETE! + $result = false; + } + + // put the results into effect + if ($result === false || $result === null) { + // this is a generic error message that should replaced + // with more specific ones when possible + if ($e) { + $e->send(E_ERROR, 'AttrValidator: Attribute removed'); + } + + // remove the attribute + unset($attr[$attr_key]); + } elseif (is_string($result)) { + // generally, if a substitution is happening, there + // was some sort of implicit correction going on. We'll + // delegate it to the attribute classes to say exactly what. + + // simple substitution + $attr[$attr_key] = $result; + } else { + // nothing happens + } + + // we'd also want slightly more complicated substitution + // involving an array as the return value, + // although we're not sure how colliding attributes would + // resolve (certain ones would be completely overriden, + // others would prepend themselves). + } + + $context->destroy('CurrentAttr'); + + // post transforms + + // global (error reporting untested) + foreach ($definition->info_attr_transform_post as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) { + $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + } + + // local (error reporting untested) + foreach ($definition->info[$token->name]->attr_transform_post as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) { + $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + } + + $token->attr = $attr; + + // destroy CurrentToken if we made it ourselves + if (!$current_token) { + $context->destroy('CurrentToken'); + } + + } + + +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Bootstrap.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Bootstrap.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Bootstrap.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Bootstrap.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,124 @@ + +if (!defined('PHP_EOL')) { + switch (strtoupper(substr(PHP_OS, 0, 3))) { + case 'WIN': + define('PHP_EOL', "\r\n"); + break; + case 'DAR': + define('PHP_EOL', "\r"); + break; + default: + define('PHP_EOL', "\n"); + } +} + +/** + * Bootstrap class that contains meta-functionality for HTML Purifier such as + * the autoload function. + * + * @note + * This class may be used without any other files from HTML Purifier. + */ +class HTMLPurifier_Bootstrap +{ + + /** + * Autoload function for HTML Purifier + * @param string $class Class to load + * @return bool + */ + public static function autoload($class) + { + $file = HTMLPurifier_Bootstrap::getPath($class); + if (!$file) { + return false; + } + // Technically speaking, it should be ok and more efficient to + // just do 'require', but Antonio Parraga reports that with + // Zend extensions such as Zend debugger and APC, this invariant + // may be broken. Since we have efficient alternatives, pay + // the cost here and avoid the bug. + require_once HTMLPURIFIER_PREFIX . '/' . $file; + return true; + } + + /** + * Returns the path for a specific class. + * @param string $class Class path to get + * @return string + */ + public static function getPath($class) + { + if (strncmp('HTMLPurifier', $class, 12) !== 0) { + return false; + } + // Custom implementations + if (strncmp('HTMLPurifier_Language_', $class, 22) === 0) { + $code = str_replace('_', '-', substr($class, 22)); + $file = 'HTMLPurifier/Language/classes/' . $code . '.php'; + } else { + $file = str_replace('_', '/', $class) . '.php'; + } + if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) { + return false; + } + return $file; + } + + /** + * "Pre-registers" our autoloader on the SPL stack. + */ + public static function registerAutoload() + { + $autoload = array('HTMLPurifier_Bootstrap', 'autoload'); + if (($funcs = spl_autoload_functions()) === false) { + spl_autoload_register($autoload); + } elseif (function_exists('spl_autoload_unregister')) { + if (version_compare(PHP_VERSION, '5.3.0', '>=')) { + // prepend flag exists, no need for shenanigans + spl_autoload_register($autoload, true, true); + } else { + $buggy = version_compare(PHP_VERSION, '5.2.11', '<'); + $compat = version_compare(PHP_VERSION, '5.1.2', '<=') && + version_compare(PHP_VERSION, '5.1.0', '>='); + foreach ($funcs as $func) { + if ($buggy && is_array($func)) { + // :TRICKY: There are some compatibility issues and some + // places where we need to error out + $reflector = new ReflectionMethod($func[0], $func[1]); + if (!$reflector->isStatic()) { + throw new Exception( + 'HTML Purifier autoloader registrar is not compatible + with non-static object methods due to PHP Bug #44144; + Please do not use HTMLPurifier.autoload.php (or any + file that includes this file); instead, place the code: + spl_autoload_register(array(\'HTMLPurifier_Bootstrap\', \'autoload\')) + after your own autoloaders.' + ); + } + // Suprisingly, spl_autoload_register supports the + // Class::staticMethod callback format, although call_user_func doesn't + if ($compat) { + $func = implode('::', $func); + } + } + spl_autoload_unregister($func); + } + spl_autoload_register($autoload); + foreach ($funcs as $func) { + spl_autoload_register($func); + } + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Chameleon.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Chameleon.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Chameleon.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Chameleon.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,67 @@ +inline = new HTMLPurifier_ChildDef_Optional($inline); + $this->block = new HTMLPurifier_ChildDef_Optional($block); + $this->elements = $this->block->elements; + } + + /** + * @param HTMLPurifier_Node[] $children + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function validateChildren($children, $config, $context) + { + if ($context->get('IsInline') === false) { + return $this->block->validateChildren( + $children, + $config, + $context + ); + } else { + return $this->inline->validateChildren( + $children, + $config, + $context + ); + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Custom.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Custom.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Custom.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Custom.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,102 @@ +dtd_regex = $dtd_regex; + $this->_compileRegex(); + } + + /** + * Compiles the PCRE regex from a DTD regex ($dtd_regex to $_pcre_regex) + */ + protected function _compileRegex() + { + $raw = str_replace(' ', '', $this->dtd_regex); + if ($raw{0} != '(') { + $raw = "($raw)"; + } + $el = '[#a-zA-Z0-9_.-]+'; + $reg = $raw; + + // COMPLICATED! AND MIGHT BE BUGGY! I HAVE NO CLUE WHAT I'M + // DOING! Seriously: if there's problems, please report them. + + // collect all elements into the $elements array + preg_match_all("/$el/", $reg, $matches); + foreach ($matches[0] as $match) { + $this->elements[$match] = true; + } + + // setup all elements as parentheticals with leading commas + $reg = preg_replace("/$el/", '(,\\0)', $reg); + + // remove commas when they were not solicited + $reg = preg_replace("/([^,(|]\(+),/", '\\1', $reg); + + // remove all non-paranthetical commas: they are handled by first regex + $reg = preg_replace("/,\(/", '(', $reg); + + $this->_pcre_regex = $reg; + } + + /** + * @param HTMLPurifier_Node[] $children + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function validateChildren($children, $config, $context) + { + $list_of_children = ''; + $nesting = 0; // depth into the nest + foreach ($children as $node) { + if (!empty($node->is_whitespace)) { + continue; + } + $list_of_children .= $node->name . ','; + } + // add leading comma to deal with stray comma declarations + $list_of_children = ',' . rtrim($list_of_children, ','); + $okay = + preg_match( + '/^,?' . $this->_pcre_regex . '$/', + $list_of_children + ); + return (bool)$okay; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Empty.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Empty.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Empty.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Empty.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,38 @@ + true, 'ul' => true, 'ol' => true); + + /** + * @param array $children + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return array + */ + public function validateChildren($children, $config, $context) + { + // Flag for subclasses + $this->whitespace = false; + + // if there are no tokens, delete parent node + if (empty($children)) { + return false; + } + + // if li is not allowed, delete parent node + if (!isset($config->getHTMLDefinition()->info['li'])) { + trigger_error("Cannot allow ul/ol without allowing li", E_USER_WARNING); + return false; + } + + // the new set of children + $result = array(); + + // a little sanity check to make sure it's not ALL whitespace + $all_whitespace = true; + + $current_li = null; + + foreach ($children as $node) { + if (!empty($node->is_whitespace)) { + $result[] = $node; + continue; + } + $all_whitespace = false; // phew, we're not talking about whitespace + + if ($node->name === 'li') { + // good + $current_li = $node; + $result[] = $node; + } else { + // we want to tuck this into the previous li + // Invariant: we expect the node to be ol/ul + // ToDo: Make this more robust in the case of not ol/ul + // by distinguishing between existing li and li created + // to handle non-list elements; non-list elements should + // not be appended to an existing li; only li created + // for non-list. This distinction is not currently made. + if ($current_li === null) { + $current_li = new HTMLPurifier_Node_Element('li'); + $result[] = $current_li; + } + $current_li->children[] = $node; + $current_li->empty = false; // XXX fascinating! Check for this error elsewhere ToDo + } + } + if (empty($result)) { + return false; + } + if ($all_whitespace) { + return false; + } + return $result; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Optional.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Optional.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Optional.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Optional.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,45 @@ +whitespace) { + return $children; + } else { + return array(); + } + } + return $result; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Required.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Required.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Required.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Required.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,118 @@ + $x) { + $elements[$i] = true; + if (empty($i)) { + unset($elements[$i]); + } // remove blank + } + } + $this->elements = $elements; + } + + /** + * @type bool + */ + public $allow_empty = false; + + /** + * @type string + */ + public $type = 'required'; + + /** + * @param array $children + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return array + */ + public function validateChildren($children, $config, $context) + { + // Flag for subclasses + $this->whitespace = false; + + // if there are no tokens, delete parent node + if (empty($children)) { + return false; + } + + // the new set of children + $result = array(); + + // whether or not parsed character data is allowed + // this controls whether or not we silently drop a tag + // or generate escaped HTML from it + $pcdata_allowed = isset($this->elements['#PCDATA']); + + // a little sanity check to make sure it's not ALL whitespace + $all_whitespace = true; + + $stack = array_reverse($children); + while (!empty($stack)) { + $node = array_pop($stack); + if (!empty($node->is_whitespace)) { + $result[] = $node; + continue; + } + $all_whitespace = false; // phew, we're not talking about whitespace + + if (!isset($this->elements[$node->name])) { + // special case text + // XXX One of these ought to be redundant or something + if ($pcdata_allowed && $node instanceof HTMLPurifier_Node_Text) { + $result[] = $node; + continue; + } + // spill the child contents in + // ToDo: Make configurable + if ($node instanceof HTMLPurifier_Node_Element) { + for ($i = count($node->children) - 1; $i >= 0; $i--) { + $stack[] = $node->children[$i]; + } + continue; + } + continue; + } + $result[] = $node; + } + if (empty($result)) { + return false; + } + if ($all_whitespace) { + $this->whitespace = true; + return false; + } + return $result; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/StrictBlockquote.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/StrictBlockquote.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/StrictBlockquote.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/StrictBlockquote.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,110 @@ +init($config); + return $this->fake_elements; + } + + /** + * @param array $children + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return array + */ + public function validateChildren($children, $config, $context) + { + $this->init($config); + + // trick the parent class into thinking it allows more + $this->elements = $this->fake_elements; + $result = parent::validateChildren($children, $config, $context); + $this->elements = $this->real_elements; + + if ($result === false) { + return array(); + } + if ($result === true) { + $result = $children; + } + + $def = $config->getHTMLDefinition(); + $block_wrap_name = $def->info_block_wrapper; + $block_wrap = false; + $ret = array(); + + foreach ($result as $node) { + if ($block_wrap === false) { + if (($node instanceof HTMLPurifier_Node_Text && !$node->is_whitespace) || + ($node instanceof HTMLPurifier_Node_Element && !isset($this->elements[$node->name]))) { + $block_wrap = new HTMLPurifier_Node_Element($def->info_block_wrapper); + $ret[] = $block_wrap; + } + } else { + if ($node instanceof HTMLPurifier_Node_Element && isset($this->elements[$node->name])) { + $block_wrap = false; + + } + } + if ($block_wrap) { + $block_wrap->children[] = $node; + } else { + $ret[] = $node; + } + } + return $ret; + } + + /** + * @param HTMLPurifier_Config $config + */ + private function init($config) + { + if (!$this->init) { + $def = $config->getHTMLDefinition(); + // allow all inline elements + $this->real_elements = $this->elements; + $this->fake_elements = $def->info_content_sets['Flow']; + $this->fake_elements['#PCDATA'] = true; + $this->init = true; + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Table.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Table.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Table.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef/Table.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,224 @@ + true, + 'tbody' => true, + 'thead' => true, + 'tfoot' => true, + 'caption' => true, + 'colgroup' => true, + 'col' => true + ); + + public function __construct() + { + } + + /** + * @param array $children + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return array + */ + public function validateChildren($children, $config, $context) + { + if (empty($children)) { + return false; + } + + // only one of these elements is allowed in a table + $caption = false; + $thead = false; + $tfoot = false; + + // whitespace + $initial_ws = array(); + $after_caption_ws = array(); + $after_thead_ws = array(); + $after_tfoot_ws = array(); + + // as many of these as you want + $cols = array(); + $content = array(); + + $tbody_mode = false; // if true, then we need to wrap any stray + //
s with a . + + $ws_accum =& $initial_ws; + + foreach ($children as $node) { + if ($node instanceof HTMLPurifier_Node_Comment) { + $ws_accum[] = $node; + continue; + } + switch ($node->name) { + case 'tbody': + $tbody_mode = true; + // fall through + case 'tr': + $content[] = $node; + $ws_accum =& $content; + break; + case 'caption': + // there can only be one caption! + if ($caption !== false) break; + $caption = $node; + $ws_accum =& $after_caption_ws; + break; + case 'thead': + $tbody_mode = true; + // XXX This breaks rendering properties with + // Firefox, which never floats a to + // the top. Ever. (Our scheme will float the + // first to the top.) So maybe + // s that are not first should be + // turned into ? Very tricky, indeed. + if ($thead === false) { + $thead = $node; + $ws_accum =& $after_thead_ws; + } else { + // Oops, there's a second one! What + // should we do? Current behavior is to + // transmutate the first and last entries into + // tbody tags, and then put into content. + // Maybe a better idea is to *attach + // it* to the existing thead or tfoot? + // We don't do this, because Firefox + // doesn't float an extra tfoot to the + // bottom like it does for the first one. + $node->name = 'tbody'; + $content[] = $node; + $ws_accum =& $content; + } + break; + case 'tfoot': + // see above for some aveats + $tbody_mode = true; + if ($tfoot === false) { + $tfoot = $node; + $ws_accum =& $after_tfoot_ws; + } else { + $node->name = 'tbody'; + $content[] = $node; + $ws_accum =& $content; + } + break; + case 'colgroup': + case 'col': + $cols[] = $node; + $ws_accum =& $cols; + break; + case '#PCDATA': + // How is whitespace handled? We treat is as sticky to + // the *end* of the previous element. So all of the + // nonsense we have worked on is to keep things + // together. + if (!empty($node->is_whitespace)) { + $ws_accum[] = $node; + } + break; + } + } + + if (empty($content)) { + return false; + } + + $ret = $initial_ws; + if ($caption !== false) { + $ret[] = $caption; + $ret = array_merge($ret, $after_caption_ws); + } + if ($cols !== false) { + $ret = array_merge($ret, $cols); + } + if ($thead !== false) { + $ret[] = $thead; + $ret = array_merge($ret, $after_thead_ws); + } + if ($tfoot !== false) { + $ret[] = $tfoot; + $ret = array_merge($ret, $after_tfoot_ws); + } + + if ($tbody_mode) { + // we have to shuffle tr into tbody + $current_tr_tbody = null; + + foreach($content as $node) { + switch ($node->name) { + case 'tbody': + $current_tr_tbody = null; + $ret[] = $node; + break; + case 'tr': + if ($current_tr_tbody === null) { + $current_tr_tbody = new HTMLPurifier_Node_Element('tbody'); + $ret[] = $current_tr_tbody; + } + $current_tr_tbody->children[] = $node; + break; + case '#PCDATA': + //assert($node->is_whitespace); + if ($current_tr_tbody === null) { + $ret[] = $node; + } else { + $current_tr_tbody->children[] = $node; + } + break; + } + } + } else { + $ret = array_merge($ret, $content); + } + + return $ret; + + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ChildDef.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,52 @@ +elements; + } + + /** + * Validates nodes according to definition and returns modification. + * + * @param HTMLPurifier_Node[] $children Array of HTMLPurifier_Node + * @param HTMLPurifier_Config $config HTMLPurifier_Config object + * @param HTMLPurifier_Context $context HTMLPurifier_Context object + * @return bool|array true to leave nodes as is, false to remove parent node, array of replacement children + */ + abstract public function validateChildren($children, $config, $context); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Config.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Config.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Config.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Config.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,920 @@ +defaultPlist; + $this->plist = new HTMLPurifier_PropertyList($parent); + $this->def = $definition; // keep a copy around for checking + $this->parser = new HTMLPurifier_VarParser_Flexible(); + } + + /** + * Convenience constructor that creates a config object based on a mixed var + * @param mixed $config Variable that defines the state of the config + * object. Can be: a HTMLPurifier_Config() object, + * an array of directives based on loadArray(), + * or a string filename of an ini file. + * @param HTMLPurifier_ConfigSchema $schema Schema object + * @return HTMLPurifier_Config Configured object + */ + public static function create($config, $schema = null) + { + if ($config instanceof HTMLPurifier_Config) { + // pass-through + return $config; + } + if (!$schema) { + $ret = HTMLPurifier_Config::createDefault(); + } else { + $ret = new HTMLPurifier_Config($schema); + } + if (is_string($config)) { + $ret->loadIni($config); + } elseif (is_array($config)) $ret->loadArray($config); + return $ret; + } + + /** + * Creates a new config object that inherits from a previous one. + * @param HTMLPurifier_Config $config Configuration object to inherit from. + * @return HTMLPurifier_Config object with $config as its parent. + */ + public static function inherit(HTMLPurifier_Config $config) + { + return new HTMLPurifier_Config($config->def, $config->plist); + } + + /** + * Convenience constructor that creates a default configuration object. + * @return HTMLPurifier_Config default object. + */ + public static function createDefault() + { + $definition = HTMLPurifier_ConfigSchema::instance(); + $config = new HTMLPurifier_Config($definition); + return $config; + } + + /** + * Retrieves a value from the configuration. + * + * @param string $key String key + * @param mixed $a + * + * @return mixed + */ + public function get($key, $a = null) + { + if ($a !== null) { + $this->triggerError( + "Using deprecated API: use \$config->get('$key.$a') instead", + E_USER_WARNING + ); + $key = "$key.$a"; + } + if (!$this->finalized) { + $this->autoFinalize(); + } + if (!isset($this->def->info[$key])) { + // can't add % due to SimpleTest bug + $this->triggerError( + 'Cannot retrieve value of undefined directive ' . htmlspecialchars($key), + E_USER_WARNING + ); + return; + } + if (isset($this->def->info[$key]->isAlias)) { + $d = $this->def->info[$key]; + $this->triggerError( + 'Cannot get value from aliased directive, use real name ' . $d->key, + E_USER_ERROR + ); + return; + } + if ($this->lock) { + list($ns) = explode('.', $key); + if ($ns !== $this->lock) { + $this->triggerError( + 'Cannot get value of namespace ' . $ns . ' when lock for ' . + $this->lock . + ' is active, this probably indicates a Definition setup method ' . + 'is accessing directives that are not within its namespace', + E_USER_ERROR + ); + return; + } + } + return $this->plist->get($key); + } + + /** + * Retrieves an array of directives to values from a given namespace + * + * @param string $namespace String namespace + * + * @return array + */ + public function getBatch($namespace) + { + if (!$this->finalized) { + $this->autoFinalize(); + } + $full = $this->getAll(); + if (!isset($full[$namespace])) { + $this->triggerError( + 'Cannot retrieve undefined namespace ' . + htmlspecialchars($namespace), + E_USER_WARNING + ); + return; + } + return $full[$namespace]; + } + + /** + * Returns a SHA-1 signature of a segment of the configuration object + * that uniquely identifies that particular configuration + * + * @param string $namespace Namespace to get serial for + * + * @return string + * @note Revision is handled specially and is removed from the batch + * before processing! + */ + public function getBatchSerial($namespace) + { + if (empty($this->serials[$namespace])) { + $batch = $this->getBatch($namespace); + unset($batch['DefinitionRev']); + $this->serials[$namespace] = sha1(serialize($batch)); + } + return $this->serials[$namespace]; + } + + /** + * Returns a SHA-1 signature for the entire configuration object + * that uniquely identifies that particular configuration + * + * @return string + */ + public function getSerial() + { + if (empty($this->serial)) { + $this->serial = sha1(serialize($this->getAll())); + } + return $this->serial; + } + + /** + * Retrieves all directives, organized by namespace + * + * @warning This is a pretty inefficient function, avoid if you can + */ + public function getAll() + { + if (!$this->finalized) { + $this->autoFinalize(); + } + $ret = array(); + foreach ($this->plist->squash() as $name => $value) { + list($ns, $key) = explode('.', $name, 2); + $ret[$ns][$key] = $value; + } + return $ret; + } + + /** + * Sets a value to configuration. + * + * @param string $key key + * @param mixed $value value + * @param mixed $a + */ + public function set($key, $value, $a = null) + { + if (strpos($key, '.') === false) { + $namespace = $key; + $directive = $value; + $value = $a; + $key = "$key.$directive"; + $this->triggerError("Using deprecated API: use \$config->set('$key', ...) instead", E_USER_NOTICE); + } else { + list($namespace) = explode('.', $key); + } + if ($this->isFinalized('Cannot set directive after finalization')) { + return; + } + if (!isset($this->def->info[$key])) { + $this->triggerError( + 'Cannot set undefined directive ' . htmlspecialchars($key) . ' to value', + E_USER_WARNING + ); + return; + } + $def = $this->def->info[$key]; + + if (isset($def->isAlias)) { + if ($this->aliasMode) { + $this->triggerError( + 'Double-aliases not allowed, please fix '. + 'ConfigSchema bug with' . $key, + E_USER_ERROR + ); + return; + } + $this->aliasMode = true; + $this->set($def->key, $value); + $this->aliasMode = false; + $this->triggerError("$key is an alias, preferred directive name is {$def->key}", E_USER_NOTICE); + return; + } + + // Raw type might be negative when using the fully optimized form + // of stdClass, which indicates allow_null == true + $rtype = is_int($def) ? $def : $def->type; + if ($rtype < 0) { + $type = -$rtype; + $allow_null = true; + } else { + $type = $rtype; + $allow_null = isset($def->allow_null); + } + + try { + $value = $this->parser->parse($value, $type, $allow_null); + } catch (HTMLPurifier_VarParserException $e) { + $this->triggerError( + 'Value for ' . $key . ' is of invalid type, should be ' . + HTMLPurifier_VarParser::getTypeName($type), + E_USER_WARNING + ); + return; + } + if (is_string($value) && is_object($def)) { + // resolve value alias if defined + if (isset($def->aliases[$value])) { + $value = $def->aliases[$value]; + } + // check to see if the value is allowed + if (isset($def->allowed) && !isset($def->allowed[$value])) { + $this->triggerError( + 'Value not supported, valid values are: ' . + $this->_listify($def->allowed), + E_USER_WARNING + ); + return; + } + } + $this->plist->set($key, $value); + + // reset definitions if the directives they depend on changed + // this is a very costly process, so it's discouraged + // with finalization + if ($namespace == 'HTML' || $namespace == 'CSS' || $namespace == 'URI') { + $this->definitions[$namespace] = null; + } + + $this->serials[$namespace] = false; + } + + /** + * Convenience function for error reporting + * + * @param array $lookup + * + * @return string + */ + private function _listify($lookup) + { + $list = array(); + foreach ($lookup as $name => $b) { + $list[] = $name; + } + return implode(', ', $list); + } + + /** + * Retrieves object reference to the HTML definition. + * + * @param bool $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + * @param bool $optimized If true, this method may return null, to + * indicate that a cached version of the modified + * definition object is available and no further edits + * are necessary. Consider using + * maybeGetRawHTMLDefinition, which is more explicitly + * named, instead. + * + * @return HTMLPurifier_HTMLDefinition + */ + public function getHTMLDefinition($raw = false, $optimized = false) + { + return $this->getDefinition('HTML', $raw, $optimized); + } + + /** + * Retrieves object reference to the CSS definition + * + * @param bool $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + * @param bool $optimized If true, this method may return null, to + * indicate that a cached version of the modified + * definition object is available and no further edits + * are necessary. Consider using + * maybeGetRawCSSDefinition, which is more explicitly + * named, instead. + * + * @return HTMLPurifier_CSSDefinition + */ + public function getCSSDefinition($raw = false, $optimized = false) + { + return $this->getDefinition('CSS', $raw, $optimized); + } + + /** + * Retrieves object reference to the URI definition + * + * @param bool $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + * @param bool $optimized If true, this method may return null, to + * indicate that a cached version of the modified + * definition object is available and no further edits + * are necessary. Consider using + * maybeGetRawURIDefinition, which is more explicitly + * named, instead. + * + * @return HTMLPurifier_URIDefinition + */ + public function getURIDefinition($raw = false, $optimized = false) + { + return $this->getDefinition('URI', $raw, $optimized); + } + + /** + * Retrieves a definition + * + * @param string $type Type of definition: HTML, CSS, etc + * @param bool $raw Whether or not definition should be returned raw + * @param bool $optimized Only has an effect when $raw is true. Whether + * or not to return null if the result is already present in + * the cache. This is off by default for backwards + * compatibility reasons, but you need to do things this + * way in order to ensure that caching is done properly. + * Check out enduser-customize.html for more details. + * We probably won't ever change this default, as much as the + * maybe semantics is the "right thing to do." + * + * @throws HTMLPurifier_Exception + * @return HTMLPurifier_Definition + */ + public function getDefinition($type, $raw = false, $optimized = false) + { + if ($optimized && !$raw) { + throw new HTMLPurifier_Exception("Cannot set optimized = true when raw = false"); + } + if (!$this->finalized) { + $this->autoFinalize(); + } + // temporarily suspend locks, so we can handle recursive definition calls + $lock = $this->lock; + $this->lock = null; + $factory = HTMLPurifier_DefinitionCacheFactory::instance(); + $cache = $factory->create($type, $this); + $this->lock = $lock; + if (!$raw) { + // full definition + // --------------- + // check if definition is in memory + if (!empty($this->definitions[$type])) { + $def = $this->definitions[$type]; + // check if the definition is setup + if ($def->setup) { + return $def; + } else { + $def->setup($this); + if ($def->optimized) { + $cache->add($def, $this); + } + return $def; + } + } + // check if definition is in cache + $def = $cache->get($this); + if ($def) { + // definition in cache, save to memory and return it + $this->definitions[$type] = $def; + return $def; + } + // initialize it + $def = $this->initDefinition($type); + // set it up + $this->lock = $type; + $def->setup($this); + $this->lock = null; + // save in cache + $cache->add($def, $this); + // return it + return $def; + } else { + // raw definition + // -------------- + // check preconditions + $def = null; + if ($optimized) { + if (is_null($this->get($type . '.DefinitionID'))) { + // fatally error out if definition ID not set + throw new HTMLPurifier_Exception( + "Cannot retrieve raw version without specifying %$type.DefinitionID" + ); + } + } + if (!empty($this->definitions[$type])) { + $def = $this->definitions[$type]; + if ($def->setup && !$optimized) { + $extra = $this->chatty ? + " (try moving this code block earlier in your initialization)" : + ""; + throw new HTMLPurifier_Exception( + "Cannot retrieve raw definition after it has already been setup" . + $extra + ); + } + if ($def->optimized === null) { + $extra = $this->chatty ? " (try flushing your cache)" : ""; + throw new HTMLPurifier_Exception( + "Optimization status of definition is unknown" . $extra + ); + } + if ($def->optimized !== $optimized) { + $msg = $optimized ? "optimized" : "unoptimized"; + $extra = $this->chatty ? + " (this backtrace is for the first inconsistent call, which was for a $msg raw definition)" + : ""; + throw new HTMLPurifier_Exception( + "Inconsistent use of optimized and unoptimized raw definition retrievals" . $extra + ); + } + } + // check if definition was in memory + if ($def) { + if ($def->setup) { + // invariant: $optimized === true (checked above) + return null; + } else { + return $def; + } + } + // if optimized, check if definition was in cache + // (because we do the memory check first, this formulation + // is prone to cache slamming, but I think + // guaranteeing that either /all/ of the raw + // setup code or /none/ of it is run is more important.) + if ($optimized) { + // This code path only gets run once; once we put + // something in $definitions (which is guaranteed by the + // trailing code), we always short-circuit above. + $def = $cache->get($this); + if ($def) { + // save the full definition for later, but don't + // return it yet + $this->definitions[$type] = $def; + return null; + } + } + // check invariants for creation + if (!$optimized) { + if (!is_null($this->get($type . '.DefinitionID'))) { + if ($this->chatty) { + $this->triggerError( + 'Due to a documentation error in previous version of HTML Purifier, your ' . + 'definitions are not being cached. If this is OK, you can remove the ' . + '%$type.DefinitionRev and %$type.DefinitionID declaration. Otherwise, ' . + 'modify your code to use maybeGetRawDefinition, and test if the returned ' . + 'value is null before making any edits (if it is null, that means that a ' . + 'cached version is available, and no raw operations are necessary). See ' . + '' . + 'Customize for more details', + E_USER_WARNING + ); + } else { + $this->triggerError( + "Useless DefinitionID declaration", + E_USER_WARNING + ); + } + } + } + // initialize it + $def = $this->initDefinition($type); + $def->optimized = $optimized; + return $def; + } + throw new HTMLPurifier_Exception("The impossible happened!"); + } + + /** + * Initialise definition + * + * @param string $type What type of definition to create + * + * @return HTMLPurifier_CSSDefinition|HTMLPurifier_HTMLDefinition|HTMLPurifier_URIDefinition + * @throws HTMLPurifier_Exception + */ + private function initDefinition($type) + { + // quick checks failed, let's create the object + if ($type == 'HTML') { + $def = new HTMLPurifier_HTMLDefinition(); + } elseif ($type == 'CSS') { + $def = new HTMLPurifier_CSSDefinition(); + } elseif ($type == 'URI') { + $def = new HTMLPurifier_URIDefinition(); + } else { + throw new HTMLPurifier_Exception( + "Definition of $type type not supported" + ); + } + $this->definitions[$type] = $def; + return $def; + } + + public function maybeGetRawDefinition($name) + { + return $this->getDefinition($name, true, true); + } + + /** + * @return HTMLPurifier_HTMLDefinition + */ + public function maybeGetRawHTMLDefinition() + { + return $this->getDefinition('HTML', true, true); + } + + /** + * @return HTMLPurifier_CSSDefinition + */ + public function maybeGetRawCSSDefinition() + { + return $this->getDefinition('CSS', true, true); + } + + /** + * @return HTMLPurifier_URIDefinition + */ + public function maybeGetRawURIDefinition() + { + return $this->getDefinition('URI', true, true); + } + + /** + * Loads configuration values from an array with the following structure: + * Namespace.Directive => Value + * + * @param array $config_array Configuration associative array + */ + public function loadArray($config_array) + { + if ($this->isFinalized('Cannot load directives after finalization')) { + return; + } + foreach ($config_array as $key => $value) { + $key = str_replace('_', '.', $key); + if (strpos($key, '.') !== false) { + $this->set($key, $value); + } else { + $namespace = $key; + $namespace_values = $value; + foreach ($namespace_values as $directive => $value2) { + $this->set($namespace .'.'. $directive, $value2); + } + } + } + } + + /** + * Returns a list of array(namespace, directive) for all directives + * that are allowed in a web-form context as per an allowed + * namespaces/directives list. + * + * @param array $allowed List of allowed namespaces/directives + * @param HTMLPurifier_ConfigSchema $schema Schema to use, if not global copy + * + * @return array + */ + public static function getAllowedDirectivesForForm($allowed, $schema = null) + { + if (!$schema) { + $schema = HTMLPurifier_ConfigSchema::instance(); + } + if ($allowed !== true) { + if (is_string($allowed)) { + $allowed = array($allowed); + } + $allowed_ns = array(); + $allowed_directives = array(); + $blacklisted_directives = array(); + foreach ($allowed as $ns_or_directive) { + if (strpos($ns_or_directive, '.') !== false) { + // directive + if ($ns_or_directive[0] == '-') { + $blacklisted_directives[substr($ns_or_directive, 1)] = true; + } else { + $allowed_directives[$ns_or_directive] = true; + } + } else { + // namespace + $allowed_ns[$ns_or_directive] = true; + } + } + } + $ret = array(); + foreach ($schema->info as $key => $def) { + list($ns, $directive) = explode('.', $key, 2); + if ($allowed !== true) { + if (isset($blacklisted_directives["$ns.$directive"])) { + continue; + } + if (!isset($allowed_directives["$ns.$directive"]) && !isset($allowed_ns[$ns])) { + continue; + } + } + if (isset($def->isAlias)) { + continue; + } + if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') { + continue; + } + $ret[] = array($ns, $directive); + } + return $ret; + } + + /** + * Loads configuration values from $_GET/$_POST that were posted + * via ConfigForm + * + * @param array $array $_GET or $_POST array to import + * @param string|bool $index Index/name that the config variables are in + * @param array|bool $allowed List of allowed namespaces/directives + * @param bool $mq_fix Boolean whether or not to enable magic quotes fix + * @param HTMLPurifier_ConfigSchema $schema Schema to use, if not global copy + * + * @return mixed + */ + public static function loadArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) + { + $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $schema); + $config = HTMLPurifier_Config::create($ret, $schema); + return $config; + } + + /** + * Merges in configuration values from $_GET/$_POST to object. NOT STATIC. + * + * @param array $array $_GET or $_POST array to import + * @param string|bool $index Index/name that the config variables are in + * @param array|bool $allowed List of allowed namespaces/directives + * @param bool $mq_fix Boolean whether or not to enable magic quotes fix + */ + public function mergeArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true) + { + $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $this->def); + $this->loadArray($ret); + } + + /** + * Prepares an array from a form into something usable for the more + * strict parts of HTMLPurifier_Config + * + * @param array $array $_GET or $_POST array to import + * @param string|bool $index Index/name that the config variables are in + * @param array|bool $allowed List of allowed namespaces/directives + * @param bool $mq_fix Boolean whether or not to enable magic quotes fix + * @param HTMLPurifier_ConfigSchema $schema Schema to use, if not global copy + * + * @return array + */ + public static function prepareArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) + { + if ($index !== false) { + $array = (isset($array[$index]) && is_array($array[$index])) ? $array[$index] : array(); + } + $mq = $mq_fix && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc(); + + $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $schema); + $ret = array(); + foreach ($allowed as $key) { + list($ns, $directive) = $key; + $skey = "$ns.$directive"; + if (!empty($array["Null_$skey"])) { + $ret[$ns][$directive] = null; + continue; + } + if (!isset($array[$skey])) { + continue; + } + $value = $mq ? stripslashes($array[$skey]) : $array[$skey]; + $ret[$ns][$directive] = $value; + } + return $ret; + } + + /** + * Loads configuration values from an ini file + * + * @param string $filename Name of ini file + */ + public function loadIni($filename) + { + if ($this->isFinalized('Cannot load directives after finalization')) { + return; + } + $array = parse_ini_file($filename, true); + $this->loadArray($array); + } + + /** + * Checks whether or not the configuration object is finalized. + * + * @param string|bool $error String error message, or false for no error + * + * @return bool + */ + public function isFinalized($error = false) + { + if ($this->finalized && $error) { + $this->triggerError($error, E_USER_ERROR); + } + return $this->finalized; + } + + /** + * Finalizes configuration only if auto finalize is on and not + * already finalized + */ + public function autoFinalize() + { + if ($this->autoFinalize) { + $this->finalize(); + } else { + $this->plist->squash(true); + } + } + + /** + * Finalizes a configuration object, prohibiting further change + */ + public function finalize() + { + $this->finalized = true; + $this->parser = null; + } + + /** + * Produces a nicely formatted error message by supplying the + * stack frame information OUTSIDE of HTMLPurifier_Config. + * + * @param string $msg An error message + * @param int $no An error number + */ + protected function triggerError($msg, $no) + { + // determine previous stack frame + $extra = ''; + if ($this->chatty) { + $trace = debug_backtrace(); + // zip(tail(trace), trace) -- but PHP is not Haskell har har + for ($i = 0, $c = count($trace); $i < $c - 1; $i++) { + // XXX this is not correct on some versions of HTML Purifier + if (isset($trace[$i + 1]['class']) && $trace[$i + 1]['class'] === 'HTMLPurifier_Config') { + continue; + } + $frame = $trace[$i]; + $extra = " invoked on line {$frame['line']} in file {$frame['file']}"; + break; + } + } + trigger_error($msg . $extra, $no); + } + + /** + * Returns a serialized form of the configuration object that can + * be reconstituted. + * + * @return string + */ + public function serialize() + { + $this->getDefinition('HTML'); + $this->getDefinition('CSS'); + $this->getDefinition('URI'); + return serialize($this); + } + +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,48 @@ +directives as $d) { + $schema->add( + $d->id->key, + $d->default, + $d->type, + $d->typeAllowsNull + ); + if ($d->allowed !== null) { + $schema->addAllowedValues( + $d->id->key, + $d->allowed + ); + } + foreach ($d->aliases as $alias) { + $schema->addAlias( + $alias->key, + $d->id->key + ); + } + if ($d->valueAliases !== null) { + $schema->addValueAliases( + $d->id->key, + $d->valueAliases + ); + } + } + $schema->postProcess(); + return $schema; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/Xml.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/Xml.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/Xml.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Builder/Xml.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,144 @@ +startElement('div'); + + $purifier = HTMLPurifier::getInstance(); + $html = $purifier->purify($html); + $this->writeAttribute('xmlns', 'http://www.w3.org/1999/xhtml'); + $this->writeRaw($html); + + $this->endElement(); // div + } + + /** + * @param mixed $var + * @return string + */ + protected function export($var) + { + if ($var === array()) { + return 'array()'; + } + return var_export($var, true); + } + + /** + * @param HTMLPurifier_ConfigSchema_Interchange $interchange + */ + public function build($interchange) + { + // global access, only use as last resort + $this->interchange = $interchange; + + $this->setIndent(true); + $this->startDocument('1.0', 'UTF-8'); + $this->startElement('configdoc'); + $this->writeElement('title', $interchange->name); + + foreach ($interchange->directives as $directive) { + $this->buildDirective($directive); + } + + if ($this->namespace) { + $this->endElement(); + } // namespace + + $this->endElement(); // configdoc + $this->flush(); + } + + /** + * @param HTMLPurifier_ConfigSchema_Interchange_Directive $directive + */ + public function buildDirective($directive) + { + // Kludge, although I suppose having a notion of a "root namespace" + // certainly makes things look nicer when documentation is built. + // Depends on things being sorted. + if (!$this->namespace || $this->namespace !== $directive->id->getRootNamespace()) { + if ($this->namespace) { + $this->endElement(); + } // namespace + $this->namespace = $directive->id->getRootNamespace(); + $this->startElement('namespace'); + $this->writeAttribute('id', $this->namespace); + $this->writeElement('name', $this->namespace); + } + + $this->startElement('directive'); + $this->writeAttribute('id', $directive->id->toString()); + + $this->writeElement('name', $directive->id->getDirective()); + + $this->startElement('aliases'); + foreach ($directive->aliases as $alias) { + $this->writeElement('alias', $alias->toString()); + } + $this->endElement(); // aliases + + $this->startElement('constraints'); + if ($directive->version) { + $this->writeElement('version', $directive->version); + } + $this->startElement('type'); + if ($directive->typeAllowsNull) { + $this->writeAttribute('allow-null', 'yes'); + } + $this->text($directive->type); + $this->endElement(); // type + if ($directive->allowed) { + $this->startElement('allowed'); + foreach ($directive->allowed as $value => $x) { + $this->writeElement('value', $value); + } + $this->endElement(); // allowed + } + $this->writeElement('default', $this->export($directive->default)); + $this->writeAttribute('xml:space', 'preserve'); + if ($directive->external) { + $this->startElement('external'); + foreach ($directive->external as $project) { + $this->writeElement('project', $project); + } + $this->endElement(); + } + $this->endElement(); // constraints + + if ($directive->deprecatedVersion) { + $this->startElement('deprecated'); + $this->writeElement('version', $directive->deprecatedVersion); + $this->writeElement('use', $directive->deprecatedUse->toString()); + $this->endElement(); // deprecated + } + + $this->startElement('description'); + $this->writeHTMLDiv($directive->description); + $this->endElement(); // description + + $this->endElement(); // directive + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Exception.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Exception.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Exception.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Exception.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ + true). + * Null if all values are allowed. + * @type array + */ + public $allowed; + + /** + * List of aliases for the directive. + * e.g. array(new HTMLPurifier_ConfigSchema_Interchange_Id('Ns', 'Dir'))). + * @type HTMLPurifier_ConfigSchema_Interchange_Id[] + */ + public $aliases = array(); + + /** + * Hash of value aliases, e.g. array('alt' => 'real'). Null if value + * aliasing is disabled (necessary for non-scalar types). + * @type array + */ + public $valueAliases; + + /** + * Version of HTML Purifier the directive was introduced, e.g. '1.3.1'. + * Null if the directive has always existed. + * @type string + */ + public $version; + + /** + * ID of directive that supercedes this old directive. + * Null if not deprecated. + * @type HTMLPurifier_ConfigSchema_Interchange_Id + */ + public $deprecatedUse; + + /** + * Version of HTML Purifier this directive was deprecated. Null if not + * deprecated. + * @type string + */ + public $deprecatedVersion; + + /** + * List of external projects this directive depends on, e.g. array('CSSTidy'). + * @type array + */ + public $external = array(); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange/Id.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange/Id.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange/Id.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange/Id.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,58 @@ +key = $key; + } + + /** + * @return string + * @warning This is NOT magic, to ensure that people don't abuse SPL and + * cause problems for PHP 5.0 support. + */ + public function toString() + { + return $this->key; + } + + /** + * @return string + */ + public function getRootNamespace() + { + return substr($this->key, 0, strpos($this->key, ".")); + } + + /** + * @return string + */ + public function getDirective() + { + return substr($this->key, strpos($this->key, ".") + 1); + } + + /** + * @param string $id + * @return HTMLPurifier_ConfigSchema_Interchange_Id + */ + public static function make($id) + { + return new HTMLPurifier_ConfigSchema_Interchange_Id($id); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/InterchangeBuilder.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/InterchangeBuilder.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/InterchangeBuilder.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/InterchangeBuilder.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,226 @@ +varParser = $varParser ? $varParser : new HTMLPurifier_VarParser_Native(); + } + + /** + * @param string $dir + * @return HTMLPurifier_ConfigSchema_Interchange + */ + public static function buildFromDirectory($dir = null) + { + $builder = new HTMLPurifier_ConfigSchema_InterchangeBuilder(); + $interchange = new HTMLPurifier_ConfigSchema_Interchange(); + return $builder->buildDir($interchange, $dir); + } + + /** + * @param HTMLPurifier_ConfigSchema_Interchange $interchange + * @param string $dir + * @return HTMLPurifier_ConfigSchema_Interchange + */ + public function buildDir($interchange, $dir = null) + { + if (!$dir) { + $dir = HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema'; + } + if (file_exists($dir . '/info.ini')) { + $info = parse_ini_file($dir . '/info.ini'); + $interchange->name = $info['name']; + } + + $files = array(); + $dh = opendir($dir); + while (false !== ($file = readdir($dh))) { + if (!$file || $file[0] == '.' || strrchr($file, '.') !== '.txt') { + continue; + } + $files[] = $file; + } + closedir($dh); + + sort($files); + foreach ($files as $file) { + $this->buildFile($interchange, $dir . '/' . $file); + } + return $interchange; + } + + /** + * @param HTMLPurifier_ConfigSchema_Interchange $interchange + * @param string $file + */ + public function buildFile($interchange, $file) + { + $parser = new HTMLPurifier_StringHashParser(); + $this->build( + $interchange, + new HTMLPurifier_StringHash($parser->parseFile($file)) + ); + } + + /** + * Builds an interchange object based on a hash. + * @param HTMLPurifier_ConfigSchema_Interchange $interchange HTMLPurifier_ConfigSchema_Interchange object to build + * @param HTMLPurifier_StringHash $hash source data + * @throws HTMLPurifier_ConfigSchema_Exception + */ + public function build($interchange, $hash) + { + if (!$hash instanceof HTMLPurifier_StringHash) { + $hash = new HTMLPurifier_StringHash($hash); + } + if (!isset($hash['ID'])) { + throw new HTMLPurifier_ConfigSchema_Exception('Hash does not have any ID'); + } + if (strpos($hash['ID'], '.') === false) { + if (count($hash) == 2 && isset($hash['DESCRIPTION'])) { + $hash->offsetGet('DESCRIPTION'); // prevent complaining + } else { + throw new HTMLPurifier_ConfigSchema_Exception('All directives must have a namespace'); + } + } else { + $this->buildDirective($interchange, $hash); + } + $this->_findUnused($hash); + } + + /** + * @param HTMLPurifier_ConfigSchema_Interchange $interchange + * @param HTMLPurifier_StringHash $hash + * @throws HTMLPurifier_ConfigSchema_Exception + */ + public function buildDirective($interchange, $hash) + { + $directive = new HTMLPurifier_ConfigSchema_Interchange_Directive(); + + // These are required elements: + $directive->id = $this->id($hash->offsetGet('ID')); + $id = $directive->id->toString(); // convenience + + if (isset($hash['TYPE'])) { + $type = explode('/', $hash->offsetGet('TYPE')); + if (isset($type[1])) { + $directive->typeAllowsNull = true; + } + $directive->type = $type[0]; + } else { + throw new HTMLPurifier_ConfigSchema_Exception("TYPE in directive hash '$id' not defined"); + } + + if (isset($hash['DEFAULT'])) { + try { + $directive->default = $this->varParser->parse( + $hash->offsetGet('DEFAULT'), + $directive->type, + $directive->typeAllowsNull + ); + } catch (HTMLPurifier_VarParserException $e) { + throw new HTMLPurifier_ConfigSchema_Exception($e->getMessage() . " in DEFAULT in directive hash '$id'"); + } + } + + if (isset($hash['DESCRIPTION'])) { + $directive->description = $hash->offsetGet('DESCRIPTION'); + } + + if (isset($hash['ALLOWED'])) { + $directive->allowed = $this->lookup($this->evalArray($hash->offsetGet('ALLOWED'))); + } + + if (isset($hash['VALUE-ALIASES'])) { + $directive->valueAliases = $this->evalArray($hash->offsetGet('VALUE-ALIASES')); + } + + if (isset($hash['ALIASES'])) { + $raw_aliases = trim($hash->offsetGet('ALIASES')); + $aliases = preg_split('/\s*,\s*/', $raw_aliases); + foreach ($aliases as $alias) { + $directive->aliases[] = $this->id($alias); + } + } + + if (isset($hash['VERSION'])) { + $directive->version = $hash->offsetGet('VERSION'); + } + + if (isset($hash['DEPRECATED-USE'])) { + $directive->deprecatedUse = $this->id($hash->offsetGet('DEPRECATED-USE')); + } + + if (isset($hash['DEPRECATED-VERSION'])) { + $directive->deprecatedVersion = $hash->offsetGet('DEPRECATED-VERSION'); + } + + if (isset($hash['EXTERNAL'])) { + $directive->external = preg_split('/\s*,\s*/', trim($hash->offsetGet('EXTERNAL'))); + } + + $interchange->addDirective($directive); + } + + /** + * Evaluates an array PHP code string without array() wrapper + * @param string $contents + */ + protected function evalArray($contents) + { + return eval('return array(' . $contents . ');'); + } + + /** + * Converts an array list into a lookup array. + * @param array $array + * @return array + */ + protected function lookup($array) + { + $ret = array(); + foreach ($array as $val) { + $ret[$val] = true; + } + return $ret; + } + + /** + * Convenience function that creates an HTMLPurifier_ConfigSchema_Interchange_Id + * object based on a string Id. + * @param string $id + * @return HTMLPurifier_ConfigSchema_Interchange_Id + */ + protected function id($id) + { + return HTMLPurifier_ConfigSchema_Interchange_Id::make($id); + } + + /** + * Triggers errors for any unused keys passed in the hash; such keys + * may indicate typos, missing values, etc. + * @param HTMLPurifier_StringHash $hash Hash to check. + */ + protected function _findUnused($hash) + { + $accessed = $hash->getAccessed(); + foreach ($hash as $k => $v) { + if (!isset($accessed[$k])) { + trigger_error("String hash key '$k' not used by builder", E_USER_NOTICE); + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Interchange.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,47 @@ + array(directive info) + * @type HTMLPurifier_ConfigSchema_Interchange_Directive[] + */ + public $directives = array(); + + /** + * Adds a directive array to $directives + * @param HTMLPurifier_ConfigSchema_Interchange_Directive $directive + * @throws HTMLPurifier_ConfigSchema_Exception + */ + public function addDirective($directive) + { + if (isset($this->directives[$i = $directive->id->toString()])) { + throw new HTMLPurifier_ConfigSchema_Exception("Cannot redefine directive '$i'"); + } + $this->directives[$i] = $directive; + } + + /** + * Convenience function to perform standard validation. Throws exception + * on failed validation. + */ + public function validate() + { + $validator = new HTMLPurifier_ConfigSchema_Validator(); + return $validator->validate($this); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,8 @@ +Attr.AllowedClasses +TYPE: lookup/null +VERSION: 4.0.0 +DEFAULT: null +--DESCRIPTION-- +List of allowed class values in the class attribute. By default, this is null, +which means all classes are allowed. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Attr.AllowedFrameTargets +TYPE: lookup +DEFAULT: array() +--DESCRIPTION-- +Lookup table of all allowed link frame targets. Some commonly used link +targets include _blank, _self, _parent and _top. Values should be +lowercase, as validation will be done in a case-sensitive manner despite +W3C's recommendation. XHTML 1.0 Strict does not permit the target attribute +so this directive will have no effect in that doctype. XHTML 1.1 does not +enable the Target module by default, you will have to manually enable it +(see the module documentation for more details.) +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +Attr.AllowedRel +TYPE: lookup +VERSION: 1.6.0 +DEFAULT: array() +--DESCRIPTION-- +List of allowed forward document relationships in the rel attribute. Common +values may be nofollow or print. By default, this is empty, meaning that no +document relationships are allowed. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +Attr.AllowedRev +TYPE: lookup +VERSION: 1.6.0 +DEFAULT: array() +--DESCRIPTION-- +List of allowed reverse document relationships in the rev attribute. This +attribute is a bit of an edge-case; if you don't know what it is for, stay +away. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,19 @@ +Attr.ClassUseCDATA +TYPE: bool/null +DEFAULT: null +VERSION: 4.0.0 +--DESCRIPTION-- +If null, class will auto-detect the doctype and, if matching XHTML 1.1 or +XHTML 2.0, will use the restrictive NMTOKENS specification of class. Otherwise, +it will use a relaxed CDATA definition. If true, the relaxed CDATA definition +is forced; if false, the NMTOKENS definition is forced. To get behavior +of HTML Purifier prior to 4.0.0, set this directive to false. + +Some rational behind the auto-detection: +in previous versions of HTML Purifier, it was assumed that the form of +class was NMTOKENS, as specified by the XHTML Modularization (representing +XHTML 1.1 and XHTML 2.0). The DTDs for HTML 4.01 and XHTML 1.0, however +specify class as CDATA. HTML 5 effectively defines it as CDATA, but +with the additional constraint that each name should be unique (this is not +explicitly outlined in previous specifications). +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +Attr.DefaultImageAlt +TYPE: string/null +DEFAULT: null +VERSION: 3.2.0 +--DESCRIPTION-- +This is the content of the alt tag of an image if the user had not +previously specified an alt attribute. This applies to all images without +a valid alt attribute, as opposed to %Attr.DefaultInvalidImageAlt, which +only applies to invalid images, and overrides in the case of an invalid image. +Default behavior with null is to use the basename of the src tag for the alt. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,8 @@ +Attr.DefaultInvalidImageAlt +TYPE: string +DEFAULT: 'Invalid image' +--DESCRIPTION-- +This is the content of the alt tag of an invalid image if the user had not +previously specified an alt attribute. It has no effect when the image is +valid but there was no alt attribute present. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +Attr.DefaultInvalidImage +TYPE: string +DEFAULT: '' +--DESCRIPTION-- +This is the default image an img tag will be pointed to if it does not have +a valid src attribute. In future versions, we may allow the image tag to +be removed completely, but due to design issues, this is not possible right +now. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +Attr.DefaultTextDir +TYPE: string +DEFAULT: 'ltr' +--DESCRIPTION-- +Defines the default text direction (ltr or rtl) of the document being +parsed. This generally is the same as the value of the dir attribute in +HTML, or ltr if that is not specified. +--ALLOWED-- +'ltr', 'rtl' +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +Attr.EnableID +TYPE: bool +DEFAULT: false +VERSION: 1.2.0 +--DESCRIPTION-- +Allows the ID attribute in HTML. This is disabled by default due to the +fact that without proper configuration user input can easily break the +validation of a webpage by specifying an ID that is already on the +surrounding HTML. If you don't mind throwing caution to the wind, enable +this directive, but I strongly recommend you also consider blacklisting IDs +you use (%Attr.IDBlacklist) or prefixing all user supplied IDs +(%Attr.IDPrefix). When set to true HTML Purifier reverts to the behavior of +pre-1.2.0 versions. +--ALIASES-- +HTML.EnableAttrID +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,8 @@ +Attr.ForbiddenClasses +TYPE: lookup +VERSION: 4.0.0 +DEFAULT: array() +--DESCRIPTION-- +List of forbidden class values in the class attribute. By default, this is +empty, which means that no classes are forbidden. See also %Attr.AllowedClasses. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +Attr.IDBlacklistRegexp +TYPE: string/null +VERSION: 1.6.0 +DEFAULT: NULL +--DESCRIPTION-- +PCRE regular expression to be matched against all IDs. If the expression is +matches, the ID is rejected. Use this with care: may cause significant +degradation. ID matching is done after all other validation. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,5 @@ +Attr.IDBlacklist +TYPE: list +DEFAULT: array() +DESCRIPTION: Array of IDs not allowed in the document. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ID.HTML5.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ID.HTML5.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ID.HTML5.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.ID.HTML5.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +Attr.ID.HTML5 +TYPE: bool/null +DEFAULT: null +VERSION: 4.8.0 +--DESCRIPTION-- +In HTML5, restrictions on the format of the id attribute have been significantly +relaxed, such that any string is valid so long as it contains no spaces and +is at least one character. In lieu of a general HTML5 compatibility flag, +set this configuration directive to true to use the relaxed rules. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +Attr.IDPrefixLocal +TYPE: string +VERSION: 1.2.0 +DEFAULT: '' +--DESCRIPTION-- +Temporary prefix for IDs used in conjunction with %Attr.IDPrefix. If you +need to allow multiple sets of user content on web page, you may need to +have a seperate prefix that changes with each iteration. This way, +seperately submitted user content displayed on the same page doesn't +clobber each other. Ideal values are unique identifiers for the content it +represents (i.e. the id of the row in the database). Be sure to add a +seperator (like an underscore) at the end. Warning: this directive will +not work unless %Attr.IDPrefix is set to a non-empty value! +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Attr.IDPrefix +TYPE: string +VERSION: 1.2.0 +DEFAULT: '' +--DESCRIPTION-- +String to prefix to IDs. If you have no idea what IDs your pages may use, +you may opt to simply add a prefix to all user-submitted ID attributes so +that they are still usable, but will not conflict with core page IDs. +Example: setting the directive to 'user_' will result in a user submitted +'foo' to become 'user_foo' Be sure to set %HTML.EnableAttrID to true +before using this. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,31 @@ +AutoFormat.AutoParagraph +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + ++ This directive turns on auto-paragraphing, where double newlines are + converted in to paragraphs whenever possible. Auto-paragraphing: +
+-
+
- Always applies to inline elements or text in the root node, +
- Applies to inline elements or text with double newlines in nodes + that allow paragraph tags, +
- Applies to double newlines in paragraph tags +
+
+ptags must be allowed for this directive to take effect. + We do not usebrtags for paragraphing, as that is + semantically incorrect. ++ To prevent auto-paragraphing as a content-producer, refrain from using + double-newlines except to specify a new paragraph or in contexts where + it has special meaning (whitespace usually has no meaning except in + tags like
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +AutoFormat.Custom +TYPE: list +VERSION: 2.0.1 +DEFAULT: array() +--DESCRIPTION-- + +pre, so this should not be difficult.) To prevent + the paragraphing of inline text adjacent to block elements, wrap them + indivtags (the behavior is slightly different outside of + the root node.) ++ This directive can be used to add custom auto-format injectors. + Specify an array of injector names (class name minus the prefix) + or concrete implementations. Injector class must exist. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +AutoFormat.DisplayLinkURI +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- ++ This directive turns on the in-text display of URIs in <a> tags, and disables + those links. For example, example becomes + example (http://example.com). +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +AutoFormat.Linkify +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + ++ This directive turns on linkification, auto-linking http, ftp and + https URLs.
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +AutoFormat.PurifierLinkify.DocURL +TYPE: string +VERSION: 2.0.1 +DEFAULT: '#%s' +ALIASES: AutoFormatParam.PurifierLinkifyDocURL +--DESCRIPTION-- +atags with thehrefattribute + must be allowed. ++ Location of configuration documentation to link to, let %s substitute + into the configuration's namespace and directive names sans the percent + sign. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +AutoFormat.PurifierLinkify +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + ++ Internal auto-formatter that converts configuration directives in + syntax %Namespace.Directive to links.
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.Predicate.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.Predicate.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.Predicate.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.Predicate.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +AutoFormat.RemoveEmpty.Predicate +TYPE: hash +VERSION: 4.7.0 +DEFAULT: array('colgroup' => array(), 'th' => array(), 'td' => array(), 'iframe' => array('src')) +--DESCRIPTION-- +atags + with thehrefattribute must be allowed. ++ Given that an element has no contents, it will be removed by default, unless + this predicate dictates otherwise. The predicate can either be an associative + map from tag name to list of attributes that must be present for the element + to be considered preserved: thus, the default always preserves
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions +TYPE: lookup +VERSION: 4.0.0 +DEFAULT: array('td' => true, 'th' => true) +--DESCRIPTION-- +colgroup, +thandtd, and alsoiframeif it + has asrc. ++ When %AutoFormat.RemoveEmpty and %AutoFormat.RemoveEmpty.RemoveNbsp + are enabled, this directive defines what HTML elements should not be + removede if they have only a non-breaking space in them. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,15 @@ +AutoFormat.RemoveEmpty.RemoveNbsp +TYPE: bool +VERSION: 4.0.0 +DEFAULT: false +--DESCRIPTION-- ++ When enabled, HTML Purifier will treat any elements that contain only + non-breaking spaces as well as regular whitespace as empty, and remove + them when %AutoFormat.RemoveEmpty is enabled. +
++ See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements + that don't have this behavior applied to them. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,46 @@ +AutoFormat.RemoveEmpty +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- ++ When enabled, HTML Purifier will attempt to remove empty elements that + contribute no semantic information to the document. The following types + of nodes will be removed: +
+-
+ Tags with no attributes and no content, and that are not empty
+ elements (remove
<a></a>but not +<br />), and +
+ -
+ Tags with no content, except for:
-
+
- The
colgroupelement, or
+ -
+ Elements with the
idornameattribute, + when those attributes are permitted on those elements. +
+
+ - The
+ Please be very careful when using this functionality; while it may not + seem that empty elements contain useful information, they can alter the + layout of a document given appropriate styling. This directive is most + useful when you are processing machine-generated HTML, please avoid using + it on regular user HTML. +
++ Elements that contain only whitespace will be treated as empty. Non-breaking + spaces, however, do not count as whitespace. See + %AutoFormat.RemoveEmpty.RemoveNbsp for alternate behavior. +
++ This algorithm is not perfect; you may still notice some empty tags, + particularly if a node had elements, but those elements were later removed + because they were not permitted in that context, or tags that, after + being auto-closed by another tag, where empty. This is for safety reasons + to prevent clever code from breaking validation. The general rule of thumb: + if a tag looked empty on the way in, it will get removed; if HTML Purifier + made it empty, it will stay. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +AutoFormat.RemoveSpansWithoutAttributes +TYPE: bool +VERSION: 4.0.1 +DEFAULT: false +--DESCRIPTION-- ++ This directive causes
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +Cache.DefinitionImpl +TYPE: string/null +VERSION: 2.0.0 +DEFAULT: 'Serializer' +--DESCRIPTION-- + +This directive defines which method to use when caching definitions, +the complex data-type that makes HTML Purifier tick. Set to null +to disable caching (not recommended, as you will see a definite +performance degradation). + +--ALIASES-- +Core.DefinitionCache +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +Cache.SerializerPath +TYPE: string/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + +spantags without any attributes + to be removed. It will also remove spans that had all attributes + removed during processing. ++ Absolute path with no trailing slash to store serialized definitions in. + Default is within the + HTML Purifier library inside DefinitionCache/Serializer. This + path must be writable by the webserver. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +Cache.SerializerPermissions +TYPE: int/null +VERSION: 4.3.0 +DEFAULT: 0755 +--DESCRIPTION-- + ++ Directory permissions of the files and directories created inside + the DefinitionCache/Serializer or other custom serializer path. +
++ In HTML Purifier 4.8.0, this also supports
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,18 @@ +Core.AggressivelyFixLt +TYPE: bool +VERSION: 2.1.0 +DEFAULT: true +--DESCRIPTION-- +NULL, + which means that no chmod'ing or directory creation shall + occur. ++ This directive enables aggressive pre-filter fixes HTML Purifier can + perform in order to ensure that open angled-brackets do not get killed + during parsing stage. Enabling this will result in two preg_replace_callback + calls and at least two preg_replace calls for every HTML document parsed; + if your users make very well-formed HTML, you can set this directive false. + This has no effect when DirectLex is used. +
++ Notice: This directive's default turned from false to true + in HTML Purifier 3.2.0. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyRemoveScript.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +Core.AggressivelyRemoveScript +TYPE: bool +VERSION: 4.9.0 +DEFAULT: true +--DESCRIPTION-- ++ This directive enables aggressive pre-filter removal of + script tags. This is not necessary for security, + but it can help work around a bug in libxml where embedded + HTML elements inside script sections cause the parser to + choke. To revert to pre-4.9.0 behavior, set this to false. + This directive has no effect if %Core.Trusted is true, + %Core.RemoveScriptContents is false, or %Core.HiddenElements + does not contain script. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowHostnameUnderscore.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +Core.AllowHostnameUnderscore +TYPE: bool +VERSION: 4.6.0 +DEFAULT: false +--DESCRIPTION-- ++ By RFC 1123, underscores are not permitted in host names. + (This is in contrast to the specification for DNS, RFC + 2181, which allows underscores.) + However, most browsers do the right thing when faced with + an underscore in the host name, and so some poorly written + websites are written with the expectation this should work. + Setting this parameter to true relaxes our allowed character + check so that underscores are permitted. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Core.AllowParseManyTags +TYPE: bool +DEFAULT: false +VERSION: 4.10.1 +--DESCRIPTION-- ++ This directive allows parsing of many nested tags. + If you set true, relaxes any hardcoded limit from the parser. + However, in that case it may cause a Dos attack. + Be careful when enabling it. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Core.CollectErrors +TYPE: bool +VERSION: 2.0.0 +DEFAULT: false +--DESCRIPTION-- + +Whether or not to collect errors found while filtering the document. This +is a useful way to give feedback to your users. Warning: +Currently this feature is very patchy and experimental, with lots of +possible error messages not yet implemented. It will not cause any +problems, but it may not help your users either. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,160 @@ +Core.ColorKeywords +TYPE: hash +VERSION: 2.0.0 +--DEFAULT-- +array ( + 'aliceblue' => '#F0F8FF', + 'antiquewhite' => '#FAEBD7', + 'aqua' => '#00FFFF', + 'aquamarine' => '#7FFFD4', + 'azure' => '#F0FFFF', + 'beige' => '#F5F5DC', + 'bisque' => '#FFE4C4', + 'black' => '#000000', + 'blanchedalmond' => '#FFEBCD', + 'blue' => '#0000FF', + 'blueviolet' => '#8A2BE2', + 'brown' => '#A52A2A', + 'burlywood' => '#DEB887', + 'cadetblue' => '#5F9EA0', + 'chartreuse' => '#7FFF00', + 'chocolate' => '#D2691E', + 'coral' => '#FF7F50', + 'cornflowerblue' => '#6495ED', + 'cornsilk' => '#FFF8DC', + 'crimson' => '#DC143C', + 'cyan' => '#00FFFF', + 'darkblue' => '#00008B', + 'darkcyan' => '#008B8B', + 'darkgoldenrod' => '#B8860B', + 'darkgray' => '#A9A9A9', + 'darkgrey' => '#A9A9A9', + 'darkgreen' => '#006400', + 'darkkhaki' => '#BDB76B', + 'darkmagenta' => '#8B008B', + 'darkolivegreen' => '#556B2F', + 'darkorange' => '#FF8C00', + 'darkorchid' => '#9932CC', + 'darkred' => '#8B0000', + 'darksalmon' => '#E9967A', + 'darkseagreen' => '#8FBC8F', + 'darkslateblue' => '#483D8B', + 'darkslategray' => '#2F4F4F', + 'darkslategrey' => '#2F4F4F', + 'darkturquoise' => '#00CED1', + 'darkviolet' => '#9400D3', + 'deeppink' => '#FF1493', + 'deepskyblue' => '#00BFFF', + 'dimgray' => '#696969', + 'dimgrey' => '#696969', + 'dodgerblue' => '#1E90FF', + 'firebrick' => '#B22222', + 'floralwhite' => '#FFFAF0', + 'forestgreen' => '#228B22', + 'fuchsia' => '#FF00FF', + 'gainsboro' => '#DCDCDC', + 'ghostwhite' => '#F8F8FF', + 'gold' => '#FFD700', + 'goldenrod' => '#DAA520', + 'gray' => '#808080', + 'grey' => '#808080', + 'green' => '#008000', + 'greenyellow' => '#ADFF2F', + 'honeydew' => '#F0FFF0', + 'hotpink' => '#FF69B4', + 'indianred' => '#CD5C5C', + 'indigo' => '#4B0082', + 'ivory' => '#FFFFF0', + 'khaki' => '#F0E68C', + 'lavender' => '#E6E6FA', + 'lavenderblush' => '#FFF0F5', + 'lawngreen' => '#7CFC00', + 'lemonchiffon' => '#FFFACD', + 'lightblue' => '#ADD8E6', + 'lightcoral' => '#F08080', + 'lightcyan' => '#E0FFFF', + 'lightgoldenrodyellow' => '#FAFAD2', + 'lightgray' => '#D3D3D3', + 'lightgrey' => '#D3D3D3', + 'lightgreen' => '#90EE90', + 'lightpink' => '#FFB6C1', + 'lightsalmon' => '#FFA07A', + 'lightseagreen' => '#20B2AA', + 'lightskyblue' => '#87CEFA', + 'lightslategray' => '#778899', + 'lightslategrey' => '#778899', + 'lightsteelblue' => '#B0C4DE', + 'lightyellow' => '#FFFFE0', + 'lime' => '#00FF00', + 'limegreen' => '#32CD32', + 'linen' => '#FAF0E6', + 'magenta' => '#FF00FF', + 'maroon' => '#800000', + 'mediumaquamarine' => '#66CDAA', + 'mediumblue' => '#0000CD', + 'mediumorchid' => '#BA55D3', + 'mediumpurple' => '#9370DB', + 'mediumseagreen' => '#3CB371', + 'mediumslateblue' => '#7B68EE', + 'mediumspringgreen' => '#00FA9A', + 'mediumturquoise' => '#48D1CC', + 'mediumvioletred' => '#C71585', + 'midnightblue' => '#191970', + 'mintcream' => '#F5FFFA', + 'mistyrose' => '#FFE4E1', + 'moccasin' => '#FFE4B5', + 'navajowhite' => '#FFDEAD', + 'navy' => '#000080', + 'oldlace' => '#FDF5E6', + 'olive' => '#808000', + 'olivedrab' => '#6B8E23', + 'orange' => '#FFA500', + 'orangered' => '#FF4500', + 'orchid' => '#DA70D6', + 'palegoldenrod' => '#EEE8AA', + 'palegreen' => '#98FB98', + 'paleturquoise' => '#AFEEEE', + 'palevioletred' => '#DB7093', + 'papayawhip' => '#FFEFD5', + 'peachpuff' => '#FFDAB9', + 'peru' => '#CD853F', + 'pink' => '#FFC0CB', + 'plum' => '#DDA0DD', + 'powderblue' => '#B0E0E6', + 'purple' => '#800080', + 'rebeccapurple' => '#663399', + 'red' => '#FF0000', + 'rosybrown' => '#BC8F8F', + 'royalblue' => '#4169E1', + 'saddlebrown' => '#8B4513', + 'salmon' => '#FA8072', + 'sandybrown' => '#F4A460', + 'seagreen' => '#2E8B57', + 'seashell' => '#FFF5EE', + 'sienna' => '#A0522D', + 'silver' => '#C0C0C0', + 'skyblue' => '#87CEEB', + 'slateblue' => '#6A5ACD', + 'slategray' => '#708090', + 'slategrey' => '#708090', + 'snow' => '#FFFAFA', + 'springgreen' => '#00FF7F', + 'steelblue' => '#4682B4', + 'tan' => '#D2B48C', + 'teal' => '#008080', + 'thistle' => '#D8BFD8', + 'tomato' => '#FF6347', + 'turquoise' => '#40E0D0', + 'violet' => '#EE82EE', + 'wheat' => '#F5DEB3', + 'white' => '#FFFFFF', + 'whitesmoke' => '#F5F5F5', + 'yellow' => '#FFFF00', + 'yellowgreen' => '#9ACD32' +) +--DESCRIPTION-- + +Lookup array of color names to six digit hexadecimal number corresponding +to color, with preceding hash mark. Used when parsing colors. The lookup +is done in a case-insensitive manner. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +Core.ConvertDocumentToFragment +TYPE: bool +DEFAULT: true +--DESCRIPTION-- + +This parameter determines whether or not the filter should convert +input that is a full document with html and body tags to a fragment +of just the contents of a body tag. This parameter is simply something +HTML Purifier can do during an edge-case: for most inputs, this +processing is not necessary. + +--ALIASES-- +Core.AcceptFullDocuments +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,17 @@ +Core.DirectLexLineNumberSyncInterval +TYPE: int +VERSION: 2.0.0 +DEFAULT: 0 +--DESCRIPTION-- + ++ Specifies the number of tokens the DirectLex line number tracking + implementations should process before attempting to resyncronize the + current line count by manually counting all previous new-lines. When + at 0, this functionality is disabled. Lower values will decrease + performance, and this is only strictly necessary if the counting + algorithm is buggy (in which case you should report it as a bug). + This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is + not being used. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +Core.DisableExcludes +TYPE: bool +DEFAULT: false +VERSION: 4.5.0 +--DESCRIPTION-- ++ This directive disables SGML-style exclusions, e.g. the exclusion of +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +Core.EnableIDNA +TYPE: bool +DEFAULT: false +VERSION: 4.4.0 +--DESCRIPTION-- +Allows international domain names in URLs. This configuration option +requires the PEAR Net_IDNA2 module to be installed. It operates by +punycoding any internationalized host names for maximum portability. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,15 @@ +Core.Encoding +TYPE: istring +DEFAULT: 'utf-8' +--DESCRIPTION-- +If for some reason you are unable to convert all webpages to UTF-8, you can +use this directive as a stop-gap compatibility change to let HTML Purifier +deal with non UTF-8 input. This technique has notable deficiencies: +absolutely no characters outside of the selected character encoding will be +preserved, not even the ones that have been ampersand escaped (this is due +to a UTF-8 specific feature that automatically resolves all +entities), making it pretty useless for anything except the most I18N-blind +applications, although %Core.EscapeNonASCIICharacters offers fixes this +trouble with another tradeoff. This directive only accepts ISO-8859-1 if +iconv is not enabled. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Core.EscapeInvalidChildren +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +<object>in any descendant of a +<pre>tag. Disabling excludes will allow some + invalid documents to pass through HTML Purifier, but HTML Purifier + will also be less likely to accidentally remove large documents during + processing. +Warning: this configuration option is no longer does anything as of 4.6.0.
+ +When true, a child is found that is not allowed in the context of the +parent element will be transformed into text as if it were ASCII. When +false, that element and all internal tags will be dropped, though text will +be preserved. There is no option for dropping the element but preserving +child nodes.
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,7 @@ +Core.EscapeInvalidTags +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When true, invalid tags will be written back to the document as plain text. +Otherwise, they are silently dropped. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +Core.EscapeNonASCIICharacters +TYPE: bool +VERSION: 1.4.0 +DEFAULT: false +--DESCRIPTION-- +This directive overcomes a deficiency in %Core.Encoding by blindly +converting all non-ASCII characters into decimal numeric entities before +converting it to its native encoding. This means that even characters that +can be expressed in the non-UTF-8 encoding will be entity-ized, which can +be a real downer for encodings like Big5. It also assumes that the ASCII +repetoire is available, although this is the case for almost all encodings. +Anyway, use UTF-8! +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,19 @@ +Core.HiddenElements +TYPE: lookup +--DEFAULT-- +array ( + 'script' => true, + 'style' => true, +) +--DESCRIPTION-- + ++ This directive is a lookup array of elements which should have their + contents removed when they are not allowed by the HTML definition. + For example, the contents of a
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Language.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Language.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Language.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.Language.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +Core.Language +TYPE: string +VERSION: 2.0.0 +DEFAULT: 'en' +--DESCRIPTION-- + +ISO 639 language code for localizable things in HTML Purifier to use, +which is mainly error reporting. There is currently only an English (en) +translation, so this directive is currently useless. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,36 @@ +Core.LegacyEntityDecoder +TYPE: bool +VERSION: 4.9.0 +DEFAULT: false +--DESCRIPTION-- +scripttag are not + normally shown in a document, so if script tags are to be removed, + their contents should be removed to. This is opposed to ab+ tag, which defines some presentational changes but does not hide its + contents. ++ Prior to HTML Purifier 4.9.0, entities were decoded by performing + a global search replace for all entities whose decoded versions + did not have special meanings under HTML, and replaced them with + their decoded versions. We would match all entities, even if they did + not have a trailing semicolon, but only if there weren't any trailing + alphanumeric characters. +
++
+Original Text Attribute ¥ ¥ ¥ ¥ ¥ ¥ ¥a ¥a ¥a ¥= ¥= ¥= + In HTML Purifier 4.9.0, we changed the behavior of entity parsing + to match entities that had missing trailing semicolons in less + cases, to more closely match HTML5 parsing behavior: +
++
+Original Text Attribute ¥ ¥ ¥ ¥ ¥ ¥ ¥a ¥a ¥a ¥= ¥= ¥= + This flag reverts back to pre-HTML Purifier 4.9.0 behavior. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,34 @@ +Core.LexerImpl +TYPE: mixed/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ This parameter determines what lexer implementation can be used. The + valid values are: +
+-
+
- null +
- + Recommended, the lexer implementation will be auto-detected based on + your PHP-version and configuration. + +
- string lexer identifier +
- + This is a slim way of manually overridding the implementation. + Currently recognized values are: DOMLex (the default PHP5 +implementation) + and DirectLex (the default PHP4 implementation). Only use this if + you know what you are doing: usually, the auto-detection will + manage things for cases you aren't even aware of. + +
- object lexer instance +
-
+ Super-advanced: you can specify your own, custom, implementation that
+ implements the interface defined by
HTMLPurifier_Lexer. + I may remove this option simply because I don't expect anyone + to use it. +
+
+ If true, HTML Purifier will add line number information to all tokens. + This is useful when error reporting is turned on, but can result in + significant performance degradation and should not be used when + unnecessary. This directive must be used with the DirectLex lexer, + as the DOMLex lexer does not (yet) support this functionality. + If the value is null, an appropriate value will be selected based + on other configuration. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +Core.NormalizeNewlines +TYPE: bool +VERSION: 4.2.0 +DEFAULT: true +--DESCRIPTION-- ++ Whether or not to normalize newlines to the operating + system default. When
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Core.RemoveInvalidImg +TYPE: bool +DEFAULT: true +VERSION: 1.3.0 +--DESCRIPTION-- + +false, HTML Purifier + will attempt to preserve mixed newline files. ++ This directive enables pre-emptive URI checking in
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +Core.RemoveProcessingInstructions +TYPE: bool +VERSION: 4.2.0 +DEFAULT: false +--DESCRIPTION-- +Instead of escaping processing instructions in the formimg+ tags, as the attribute validation strategy is not authorized to + remove elements from the document. Revert to pre-1.3.0 behavior by setting to false. +<? ... +?>, remove it out-right. This may be useful if the HTML +you are validating contains XML processing instruction gunk, however, +it can also be user-unfriendly for people attempting to post PHP +snippets. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +Core.RemoveScriptContents +TYPE: bool/null +DEFAULT: NULL +VERSION: 2.0.0 +DEPRECATED-VERSION: 2.1.0 +DEPRECATED-USE: Core.HiddenElements +--DESCRIPTION-- ++ This directive enables HTML Purifier to remove not only script tags + but all of their contents. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowDuplicates.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +CSS.AllowDuplicates +TYPE: bool +DEFAULT: false +VERSION: 4.8.0 +--DESCRIPTION-- ++ By default, HTML Purifier removes duplicate CSS properties, + like
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +CSS.AllowedFonts +TYPE: lookup/null +VERSION: 4.3.0 +DEFAULT: NULL +--DESCRIPTION-- +color:red; color:blue. If this is set to + true, duplicate properties are allowed. ++ Allows you to manually specify a set of allowed fonts. If +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,18 @@ +CSS.AllowedProperties +TYPE: lookup/null +VERSION: 3.1.0 +DEFAULT: NULL +--DESCRIPTION-- + +NULL, all fonts are allowed. This directive + affects generic names (serif, sans-serif, monospace, cursive, + fantasy) as well as specific font families. ++ If HTML Purifier's style attributes set is unsatisfactory for your needs, + you can overload it with your own list of tags to allow. Note that this + method is subtractive: it does its job by taking away from HTML Purifier + usual feature set, so you cannot add an attribute that HTML Purifier never + supported in the first place. +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,8 @@ +CSS.AllowImportant +TYPE: bool +DEFAULT: false +VERSION: 3.1.0 +--DESCRIPTION-- +This parameter determines whether or not !important cascade modifiers should +be allowed in user CSS. If false, !important will stripped. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +CSS.AllowTricky +TYPE: bool +DEFAULT: false +VERSION: 3.1.0 +--DESCRIPTION-- +This parameter determines whether or not to allow "tricky" CSS properties and +values. Tricky CSS properties/values can drastically modify page layout or +be used for deceptive practices but do not directly constitute a security risk. +For example,display:none;is considered a tricky property that +will only be allowed if this directive is set to true. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +CSS.DefinitionRev +TYPE: int +VERSION: 2.0.0 +DEFAULT: 1 +--DESCRIPTION-- + ++ Revision identifier for your custom definition. See + %HTML.DefinitionRev for details. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +CSS.ForbiddenProperties +TYPE: lookup +VERSION: 4.2.0 +DEFAULT: array() +--DESCRIPTION-- ++ This is the logical inverse of %CSS.AllowedProperties, and it will + override that directive or any other directive. If possible, + %CSS.AllowedProperties is recommended over this directive, + because it can sometimes be difficult to tell whether or not you've + forbidden all of the CSS properties you truly would like to disallow. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +CSS.MaxImgLength +TYPE: string/null +DEFAULT: '1200px' +VERSION: 3.1.1 +--DESCRIPTION-- ++ This parameter sets the maximum allowed length on
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +CSS.Proprietary +TYPE: bool +VERSION: 3.0.0 +DEFAULT: false +--DESCRIPTION-- + +imgtags, + effectively thewidthandheightproperties. + Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is + in place to prevent imagecrash attacks, disable with null at your own risk. + This directive is similar to %HTML.MaxImgLength, and both should be + concurrently edited, although there are + subtle differences in the input format (the CSS max is a number with + a unit). ++ Whether or not to allow safe, proprietary CSS values. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +CSS.Trusted +TYPE: bool +VERSION: 4.2.1 +DEFAULT: false +--DESCRIPTION-- +Indicates whether or not the user's CSS input is trusted or not. If the +input is trusted, a more expansive set of allowed properties. See +also %HTML.Trusted. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +Filter.Custom +TYPE: list +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- ++ This directive can be used to add custom filters; it is nearly the + equivalent of the now deprecated
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +Filter.ExtractStyleBlocks.Escaping +TYPE: bool +VERSION: 3.0.0 +DEFAULT: true +ALIASES: Filter.ExtractStyleBlocksEscaping, FilterParam.ExtractStyleBlocksEscaping +--DESCRIPTION-- + +HTMLPurifier->addFilter()+ method. Specify an array of concrete implementations. ++ Whether or not to escape the dangerous characters <, > and & + as \3C, \3E and \26, respectively. This is can be safely set to false + if the contents of StyleBlocks will be placed in an external stylesheet, + where there is no risk of it being interpreted as HTML. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,29 @@ +Filter.ExtractStyleBlocks.Scope +TYPE: string/null +VERSION: 3.0.0 +DEFAULT: NULL +ALIASES: Filter.ExtractStyleBlocksScope, FilterParam.ExtractStyleBlocksScope +--DESCRIPTION-- + ++ If you would like users to be able to define external stylesheets, but + only allow them to specify CSS declarations for a specific node and + prevent them from fiddling with other elements, use this directive. + It accepts any valid CSS selector, and will prepend this to any + CSS declaration extracted from the document. For example, if this + directive is set to
+#user-contentand a user uses the + selectora:hover, the final selector will be +#user-content a:hover. ++ The comma shorthand may be used; consider the above example, with +
+#user-content, #user-content2, the final selector will + be#user-content a:hover, #user-content2 a:hover. ++ Warning: It is possible for users to bypass this measure + using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML + Purifier, and I am working to get it fixed. Until then, HTML Purifier + performs a basic check to prevent this. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +Filter.ExtractStyleBlocks.TidyImpl +TYPE: mixed/null +VERSION: 3.1.0 +DEFAULT: NULL +ALIASES: FilterParam.ExtractStyleBlocksTidyImpl +--DESCRIPTION-- ++ If left NULL, HTML Purifier will attempt to instantiate a
+csstidy+ class to use for internal cleaning. This will usually be good enough. ++ However, for trusted user input, you can set this to
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,74 @@ +Filter.ExtractStyleBlocks +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +EXTERNAL: CSSTidy +--DESCRIPTION-- +falseto + disable cleaning. In addition, you can supply your own concrete implementation + of Tidy's interface to use, although I don't know why you'd want to do that. ++ This directive turns on the style block extraction filter, which removes +
+styleblocks from input HTML, cleans them up with CSSTidy, + and places them in theStyleBlockscontext variable, for further + use by you, usually to be placed in an external stylesheet, or a +styleblock in theheadof your document. ++ Sample usage: +
+'; +?> + + + +
+Filter.ExtractStyleBlocks +body {color:#F00;} Some text'; + + $config = HTMLPurifier_Config::createDefault(); + $config->set('Filter', 'ExtractStyleBlocks', true); + $purifier = new HTMLPurifier($config); + + $html = $purifier->purify($dirty); + + // This implementation writes the stylesheets to the styles/ directory. + // You can also echo the styles inside the document, but it's a bit + // more difficult to make sure they get interpreted properly by + // browsers; try the usual CSS armoring techniques. + $styles = $purifier->context->get('StyleBlocks'); + $dir = 'styles/'; + if (!is_dir($dir)) mkdir($dir); + $hash = sha1($_GET['html']); + foreach ($styles as $i => $style) { + file_put_contents($name = $dir . $hash . "_$i"); + echo ''; + } +?> + + ++ ++ + +]]>+ Warning: It is possible for a user to mount an + imagecrash attack using this CSS. Counter-measures are difficult; + it is not simply enough to limit the range of CSS lengths (using + relative lengths with many nesting levels allows for large values + to be attained without actually specifying them in the stylesheet), + and the flexible nature of selectors makes it difficult to selectively + disable lengths on image tags (HTML Purifier, however, does disable + CSS width and height in inline styling). There are probably two effective + counter measures: an explicit width and height set to auto in all + images in your document (unlikely) or the disabling of width and + height (somewhat reasonable). Whether or not these measures should be + used is left to the reader. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +Filter.YouTube +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +--DESCRIPTION-- ++ Warning: Deprecated in favor of %HTML.SafeObject and + %Output.FlashCompat (turn both on to allow YouTube videos and other + Flash content). +
++ This directive enables YouTube video embedding in HTML Purifier. Check + this document + on embedding videos for more information on what this filter does. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,19 @@ +HTML.AllowedAttributes +TYPE: lookup/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ If HTML Purifier's attribute set is unsatisfactory, overload it! + The syntax is "tag.attr" or "*.attr" for the global attributes + (style, id, class, dir, lang, xml:lang). +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. For + example, %HTML.EnableAttrID will take precedence over *.id in this + directive. You must set that directive to true before you can use + IDs at all. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,15 @@ +HTML.AllowedCommentsRegexp +TYPE: string/null +VERSION: 4.4.0 +DEFAULT: NULL +--DESCRIPTION-- +A regexp, which if it matches the body of a comment, indicates that +it should be allowed. Trailing and leading spaces are removed prior +to running this regular expression. +Warning: Make sure you specify +correct anchor metacharacters^regex$, otherwise you may accept +comments that you did not mean to! In particular, the regex/foo|bar/+is probably not sufficiently strict, since it also allowsfoobar. +See also %HTML.AllowedComments (these directives are union'ed together, +so a comment is considered valid if any directive deems it valid.) +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +HTML.AllowedComments +TYPE: lookup +VERSION: 4.4.0 +DEFAULT: array() +--DESCRIPTION-- +A whitelist which indicates what explicit comment bodies should be +allowed, modulo leading and trailing whitespace. See also %HTML.AllowedCommentsRegexp +(these directives are union'ed together, so a comment is considered +valid if any directive deems it valid.) +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,23 @@ +HTML.AllowedElements +TYPE: lookup/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- ++ If HTML Purifier's tag set is unsatisfactory for your needs, you can + overload it with your own list of tags to allow. If you change + this, you probably also want to change %HTML.AllowedAttributes; see + also %HTML.Allowed which lets you set allowed elements and + attributes at the same time. +
++ If you attempt to allow an element that HTML Purifier does not know + about, HTML Purifier will raise an error. You will need to manually + tell HTML Purifier about this element by using the + advanced customization features. +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,20 @@ +HTML.AllowedModules +TYPE: lookup/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ A doctype comes with a set of usual modules to use. Without having + to mucking about with the doctypes, you can quickly activate or + disable these modules by specifying which modules you wish to allow + with this directive. This is most useful for unit testing specific + modules, although end users may find it useful for their own ends. +
++ If you specify a module that does not exist, the manager will silently + fail to use it, so be careful! User-defined modules are not affected + by this directive. Modules defined in %HTML.CoreModules are not + affected by this directive. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,25 @@ +HTML.Allowed +TYPE: itext/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ This is a preferred convenience directive that combines + %HTML.AllowedElements and %HTML.AllowedAttributes. + Specify elements and attributes that are allowed using: +
+element1[attr1|attr2],element2.... For example, + if you would like to only allow paragraphs and links, specify +a[href],p. You can specify attributes that apply + to all elements using an asterisk, e.g.*[lang]. + You can also use newlines instead of commas to separate elements. ++ Warning: + All of the constraints on the component directives are still enforced. + The syntax is a subset of TinyMCE's
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +HTML.Attr.Name.UseCDATA +TYPE: bool +DEFAULT: false +VERSION: 4.0.0 +--DESCRIPTION-- +The W3C specification DTD defines the name attribute to be CDATA, not ID, due +to limitations of DTD. In certain documents, this relaxed behavior is desired, +whether it is to specify duplicate names, or to specify names that would be +illegal IDs (for example, names that begin with a digit.) Set this configuration +directive to true to use the relaxed parsing rules. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,18 @@ +HTML.BlockWrapper +TYPE: string +VERSION: 1.3.0 +DEFAULT: 'p' +--DESCRIPTION-- + +valid_elements+ whitelist: directly copy-pasting it here will probably result in + broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes + are set, this directive has no effect. ++ String name of element to wrap inline elements that are inside a block + context. This only occurs in the children of blockquote in strict mode. +
++ Example: by default value, +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,23 @@ +HTML.CoreModules +TYPE: lookup +VERSION: 2.0.0 +--DEFAULT-- +array ( + 'Structure' => true, + 'Text' => true, + 'Hypertext' => true, + 'List' => true, + 'NonXMLCommonAttributes' => true, + 'XMLCommonAttributes' => true, + 'CommonAttributes' => true, +) +--DESCRIPTION-- + +<blockquote>Foo</blockquote>would become +<blockquote><p>Foo</p></blockquote>. + The<p>tags can be replaced with whatever you desire, + as long as it is a block level element. ++ Certain modularized doctypes (XHTML, namely), have certain modules + that must be included for the doctype to be an conforming document + type: put those modules here. By default, XHTML's core modules + are used. You can set this to a blank array to disable core module + protection, but this is not recommended. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +HTML.CustomDoctype +TYPE: string/null +VERSION: 2.0.1 +DEFAULT: NULL +--DESCRIPTION-- + +A custom doctype for power-users who defined their own document +type. This directive only applies when %HTML.Doctype is blank. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,33 @@ +HTML.DefinitionID +TYPE: string/null +DEFAULT: NULL +VERSION: 2.0.0 +--DESCRIPTION-- + ++ Unique identifier for a custom-built HTML definition. If you edit + the raw version of the HTMLDefinition, introducing changes that the + configuration object does not reflect, you must specify this variable. + If you change your custom edits, you should change this directive, or + clear your cache. Example: +
++$config = HTMLPurifier_Config::createDefault(); +$config->set('HTML', 'DefinitionID', '1'); +$def = $config->getHTMLDefinition(); +$def->addAttribute('a', 'tabindex', 'Number'); +++ In the above example, the configuration is still at the defaults, but + using the advanced API, an extra attribute has been added. The + configuration object normally has no way of knowing that this change + has taken place, so it needs an extra directive: %HTML.DefinitionID. + If someone else attempts to use the default configuration, these two + pieces of code will not clobber each other in the cache, since one has + an extra directive attached to it. +
++ You must specify a value to this directive to use the + advanced API features. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ +HTML.DefinitionRev +TYPE: int +VERSION: 2.0.0 +DEFAULT: 1 +--DESCRIPTION-- + ++ Revision identifier for your custom definition specified in + %HTML.DefinitionID. This serves the same purpose: uniquely identifying + your custom definition, but this one does so in a chronological + context: revision 3 is more up-to-date then revision 2. Thus, when + this gets incremented, the cache handling is smart enough to clean + up any older revisions of your definition as well as flush the + cache. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +HTML.Doctype +TYPE: string/null +DEFAULT: NULL +--DESCRIPTION-- +Doctype to use during filtering. Technically speaking this is not actually +a doctype (as it does not identify a corresponding DTD), but we are using +this name for sake of simplicity. When non-blank, this will override any +older directives like %HTML.XHTML or %HTML.Strict. +--ALLOWED-- +'HTML 4.01 Transitional', 'HTML 4.01 Strict', 'XHTML 1.0 Transitional', 'XHTML 1.0 Strict', 'XHTML 1.1' +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +HTML.FlashAllowFullScreen +TYPE: bool +VERSION: 4.2.0 +DEFAULT: false +--DESCRIPTION-- ++ Whether or not to permit embedded Flash content from + %HTML.SafeObject to expand to the full screen. Corresponds to + the
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,21 @@ +HTML.ForbiddenAttributes +TYPE: lookup +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- +allowFullScreenparameter. ++ While this directive is similar to %HTML.AllowedAttributes, for + forwards-compatibility with XML, this attribute has a different syntax. Instead of +
+tag.attr, usetag@attr. To disallowhref+ attributes inatags, set this directive to +a@href. You can also disallow an attribute globally with +attror*@attr(either syntax is fine; the latter + is provided for consistency with %HTML.AllowedAttributes). ++ Warning: This directive complements %HTML.ForbiddenElements, + accordingly, check + out that directive for a discussion of why you + should think twice before using this directive. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,20 @@ +HTML.ForbiddenElements +TYPE: lookup +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- ++ This was, perhaps, the most requested feature ever in HTML + Purifier. Please don't abuse it! This is the logical inverse of + %HTML.AllowedElements, and it will override that directive, or any + other directive. +
++ If possible, %HTML.Allowed is recommended over this directive, because it + can sometimes be difficult to tell whether or not you've forbidden all of + the behavior you would like to disallow. If you forbid
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +HTML.MaxImgLength +TYPE: int/null +DEFAULT: 1200 +VERSION: 3.1.1 +--DESCRIPTION-- +img+ with the expectation of preventing images on your site, you'll be in for + a nasty surprise when people start using thebackground-image+ CSS property. ++ This directive controls the maximum number of pixels in the width and + height attributes in
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,7 @@ +HTML.Nofollow +TYPE: bool +VERSION: 4.3.0 +DEFAULT: FALSE +--DESCRIPTION-- +If enabled, nofollow rel attributes are added to all outgoing links. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +HTML.Parent +TYPE: string +VERSION: 1.3.0 +DEFAULT: 'div' +--DESCRIPTION-- + +imgtags. This is + in place to prevent imagecrash attacks, disable with null at your own risk. + This directive is similar to %CSS.MaxImgLength, and both should be + concurrently edited, although there are + subtle differences in the input format (the HTML max is an integer). ++ String name of element that HTML fragment passed to library will be + inserted in. An interesting variation would be using span as the + parent element, meaning that only inline tags would be allowed. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ +HTML.Proprietary +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +--DESCRIPTION-- ++ Whether or not to allow proprietary elements and attributes in your + documents, as per
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +HTML.SafeEmbed +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- +HTMLPurifier_HTMLModule_Proprietary. + Warning: This can cause your documents to stop + validating! ++ Whether or not to permit embed tags in documents, with a number of extra + security features added to prevent script execution. This is similar to + what websites like MySpace do to embed tags. Embed is a proprietary + element and will cause your website to stop validating; you should + see if you can use %Output.FlashCompat with %HTML.SafeObject instead + first.
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +HTML.SafeIframe +TYPE: bool +VERSION: 4.4.0 +DEFAULT: false +--DESCRIPTION-- ++ Whether or not to permit iframe tags in untrusted documents. This + directive must be accompanied by a whitelist of permitted iframes, + such as %URI.SafeIframeRegexp, otherwise it will fatally error. + This directive has no effect on strict doctypes, as iframes are not + valid. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +HTML.SafeObject +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- ++ Whether or not to permit object tags in documents, with a number of extra + security features added to prevent script execution. This is similar to + what websites like MySpace do to object tags. You should also enable + %Output.FlashCompat in order to generate Internet Explorer + compatibility code for your object tags. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +HTML.SafeScripting +TYPE: lookup +VERSION: 4.5.0 +DEFAULT: array() +--DESCRIPTION-- ++ Whether or not to permit script tags to external scripts in documents. + Inline scripting is not allowed, and the script must match an explicit whitelist. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +HTML.Strict +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +DEPRECATED-VERSION: 1.7.0 +DEPRECATED-USE: HTML.Doctype +--DESCRIPTION-- +Determines whether or not to use Transitional (loose) or Strict rulesets. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,8 @@ +HTML.TargetBlank +TYPE: bool +VERSION: 4.4.0 +DEFAULT: FALSE +--DESCRIPTION-- +If enabled,target=blankattributes are added to all outgoing links. +(This includes links from an HTTPS version of a page to an HTTP version.) +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,10 @@ +--# vim: et sw=4 sts=4 +HTML.TargetNoopener +TYPE: bool +VERSION: 4.8.0 +DEFAULT: TRUE +--DESCRIPTION-- +If enabled, noopener rel attributes are added to links which have +a target attribute associated with them. This prevents malicious +destinations from overwriting the original window. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +HTML.TargetNoreferrer +TYPE: bool +VERSION: 4.8.0 +DEFAULT: TRUE +--DESCRIPTION-- +If enabled, noreferrer rel attributes are added to links which have +a target attribute associated with them. This prevents malicious +destinations from overwriting the original window. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,8 @@ +HTML.TidyAdd +TYPE: lookup +VERSION: 2.0.0 +DEFAULT: array() +--DESCRIPTION-- + +Fixes to add to the default set of Tidy fixes as per your level. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,24 @@ +HTML.TidyLevel +TYPE: string +VERSION: 2.0.0 +DEFAULT: 'medium' +--DESCRIPTION-- + +General level of cleanliness the Tidy module should enforce. +There are four allowed values:
+-
+
- none +
- No extra tidying should be done +
- light +
- Only fix elements that would be discarded otherwise due to + lack of support in doctype +
- medium +
- Enforce best practices +
- heavy +
- Transform all deprecated elements and attributes to standards + compliant equivalents +
+ If true, HTML Purifier will protect against Internet Explorer's + mishandling of the
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +Output.FlashCompat +TYPE: bool +VERSION: 4.1.0 +DEFAULT: false +--DESCRIPTION-- +innerHTMLattribute by appending + a space to any attribute that does not contain angled brackets, spaces + or quotes, but contains a backtick. This slightly changes the + semantics of any given attribute, so if this is unacceptable and + you do not useinnerHTMLon any of your pages, you can + turn this directive off. ++ If true, HTML Purifier will generate Internet Explorer compatibility + code for all object code. This is highly recommended if you enable + %HTML.SafeObject. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +Output.Newline +TYPE: string/null +VERSION: 2.0.1 +DEFAULT: NULL +--DESCRIPTION-- + ++ Newline string to format final output with. If left null, HTML Purifier + will auto-detect the default newline type of the system and use that; + you can manually override it here. Remember, \r\n is Windows, \r + is Mac, and \n is Unix. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +Output.SortAttr +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- ++ If true, HTML Purifier will sort attributes by name before writing them back + to the document, converting a tag like:
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,25 @@ +Output.TidyFormat +TYPE: bool +VERSION: 1.1.1 +DEFAULT: false +--DESCRIPTION-- +<el b="" a="" c="" />+ to<el a="" b="" c="" />. This is a workaround for + a bug in FCKeditor which causes it to swap attributes order, adding noise + to text diffs. If you're not seeing this bug, chances are, you don't need + this directive. ++ Determines whether or not to run Tidy on the final output for pretty + formatting reasons, such as indentation and wrap. +
++ This can greatly improve readability for editors who are hand-editing + the HTML, but is by no means necessary as HTML Purifier has already + fixed all major errors the HTML may have had. Tidy is a non-default + extension, and this directive will silently fail if Tidy is not + available. +
++ If you are looking to make the overall look of your page's source + better, I recommend running Tidy on the entire page rather than just + user-content (after all, the indentation relative to the containing + blocks will be incorrect). +
+--ALIASES-- +Core.TidyFormat +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,7 @@ +Test.ForceNoIconv +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When set to true, HTMLPurifier_Encoder will act as if iconv does not exist +and use only pure PHP implementations. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,18 @@ +URI.AllowedSchemes +TYPE: lookup +--DEFAULT-- +array ( + 'http' => true, + 'https' => true, + 'mailto' => true, + 'ftp' => true, + 'nntp' => true, + 'news' => true, + 'tel' => true, +) +--DESCRIPTION-- +Whitelist that defines the schemes that a URI is allowed to have. This +prevents XSS attacks from using pseudo-schemes like javascript or mocha. +There is also support for thedataandfile+URI schemes, but they are not enabled by default. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Base.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,17 @@ +URI.Base +TYPE: string/null +VERSION: 2.1.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ The base URI is the URI of the document this purified HTML will be + inserted into. This information is important if HTML Purifier needs + to calculate absolute URIs from relative URIs, such as when %URI.MakeAbsolute + is on. You may use a non-absolute URI for this value, but behavior + may vary (%URI.MakeAbsolute deals nicely with both absolute and + relative paths, but forwards-compatibility is not guaranteed). + Warning: If set, the scheme on this URI + overrides the one specified by %URI.DefaultScheme. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,15 @@ +URI.DefaultScheme +TYPE: string/null +DEFAULT: 'http' +--DESCRIPTION-- + ++ Defines through what scheme the output will be served, in order to + select the proper object validator when no scheme information is present. +
+ ++ Starting with HTML Purifier 4.9.0, the default scheme can be null, in + which case we reject all URIs which do not have explicit schemes. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +URI.DefinitionID +TYPE: string/null +VERSION: 2.1.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ Unique identifier for a custom-built URI definition. If you want + to add custom URIFilters, you must specify this value. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +URI.DefinitionRev +TYPE: int +VERSION: 2.1.0 +DEFAULT: 1 +--DESCRIPTION-- + ++ Revision identifier for your custom definition. See + %HTML.DefinitionRev for details. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +URI.DisableExternalResources +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- +Disables the embedding of external resources, preventing users from +embedding things like images from other hosts. This prevents access +tracking (good for email viewers), bandwidth leeching, cross-site request +forging, goatse.cx posting, and other nasties, but also results in a loss +of end-user functionality (they can't directly post a pic they posted from +Flickr anymore). Use it if you don't have a robust user-content moderation +team. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ +URI.DisableExternal +TYPE: bool +VERSION: 1.2.0 +DEFAULT: false +--DESCRIPTION-- +Disables links to external websites. This is a highly effective anti-spam +and anti-pagerank-leech measure, but comes at a hefty price: nolinks or +images outside of your domain will be allowed. Non-linkified URIs will +still be preserved. If you want to be able to link to subdomains or use +absolute URIs, specify %URI.Host for your website. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,15 @@ +URI.DisableResources +TYPE: bool +VERSION: 4.2.0 +DEFAULT: false +--DESCRIPTION-- ++ Disables embedding resources, essentially meaning no pictures. You can + still link to them though. See %URI.DisableExternalResources for why + this might be a good idea. +
++ Note: While this directive has been available since 1.3.0, + it didn't actually start doing anything until 4.2.0. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ +URI.Disable +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- + ++ Disables all URIs in all forms. Not sure why you'd want to do that + (after all, the Internet's founded on the notion of a hyperlink). +
+ +--ALIASES-- +Attr.DisableURI +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +URI.HostBlacklist +TYPE: list +VERSION: 1.3.0 +DEFAULT: array() +--DESCRIPTION-- +List of strings that are forbidden in the host of any URI. Use it to kill +domain names of spam, etc. Note that it will catch anything in the domain, +so moo.com will catch moo.com.example.com. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Host.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,19 @@ +URI.Host +TYPE: string/null +VERSION: 1.2.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ Defines the domain name of the server, so we can determine whether or + an absolute URI is from your website or not. Not strictly necessary, + as users should be using relative URIs to reference resources on your + website. It will, however, let you use absolute URIs to link to + subdomains of the domain you post here: i.e. example.com will allow + sub.example.com. However, higher up domains will still be excluded: + if you set %URI.Host to sub.example.com, example.com will be blocked. + Note: This directive overrides %URI.Base because + a given page may be on a sub-domain, but you wish HTML Purifier to be + more relaxed and allow some of the parent domains too. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ +URI.MakeAbsolute +TYPE: bool +VERSION: 2.1.0 +DEFAULT: false +--DESCRIPTION-- + ++ Converts all URIs into absolute forms. This is useful when the HTML + being filtered assumes a specific base path, but will actually be + viewed in a different context (and setting an alternate base URI is + not possible). %URI.Base must be set for this directive to work. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,17 @@ +URI.MungeResources +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- ++ If true, any URI munging directives like %URI.Munge + will also apply to embedded resources, such as
+<img src="">. + Be careful enabling this directive if you have a redirector script + that does not use theLocationHTTP header; all of your images + and other embedded resources will break. ++ Warning: It is strongly advised you use this in conjunction + %URI.MungeSecretKey to mitigate the security risk of an open redirector. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,30 @@ +URI.MungeSecretKey +TYPE: string/null +VERSION: 3.1.1 +DEFAULT: NULL +--DESCRIPTION-- ++ This directive enables secure checksum generation along with %URI.Munge. + It should be set to a secure key that is not shared with anyone else. + The checksum can be placed in the URI using %t. Use of this checksum + affords an additional level of protection by allowing a redirector + to check if a URI has passed through HTML Purifier with this line: +
+ +$checksum === hash_hmac("sha256", $url, $secret_key)+ ++ If the output is TRUE, the redirector script should accept the URI. +
+ ++ Please note that it would still be possible for an attacker to procure + secure hashes en-mass by abusing your website's Preview feature or the + like, but this service affords an additional level of protection + that should be combined with website blacklisting. +
+ ++ Remember this has no effect if %URI.Munge is not on. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,83 @@ +URI.Munge +TYPE: string/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- + ++ Munges all browsable (usually http, https and ftp) + absolute URIs into another URI, usually a URI redirection service. + This directive accepts a URI, formatted with a
+%swhere + the url-encoded original URI should be inserted (sample: +http://www.google.com/url?q=%s). ++ Uses for this directive: +
+-
+
- + Prevent PageRank leaks, while being fairly transparent + to users (you may also want to add some client side JavaScript to + override the text in the statusbar). Notice: + Many security experts believe that this form of protection does not deter spam-bots. + +
- + Redirect users to a splash page telling them they are leaving your + website. While this is poor usability practice, it is often mandated + in corporate environments. + +
+ Prior to HTML Purifier 3.1.1, this directive also enabled the munging + of browsable external resources, which could break things if your redirection + script was a splash page or used
+metatags. To revert to + previous behavior, please use %URI.MungeResources. ++ You may want to also use %URI.MungeSecretKey along with this directive + in order to enforce what URIs your redirector script allows. Open + redirector scripts can be a security risk and negatively affect the + reputation of your domain name. +
++ Starting with HTML Purifier 3.1.1, there is also these substitutions: +
++ +
++ + + +Key +Description +Example +<a href="">+ +%r +1 - The URI embeds a resource +
(blank) - The URI is merely a link+ + +%n +The name of the tag this URI came from +a ++ +%m +The name of the attribute this URI came from +href ++ + +%p +The name of the CSS property this URI came from, or blank if irrelevant ++ + Admittedly, these letters are somewhat arbitrary; the only stipulation + was that they couldn't be a through f. r is for resource (I would have preferred + e, but you take what you can get), n is for name, m + was picked because it came after n (and I couldn't use a), p is for + property. +
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ +URI.OverrideAllowedSchemes +TYPE: bool +DEFAULT: true +--DESCRIPTION-- +If this is set to true (which it is by default), you can override +%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme to the +registry. If false, you will also have to update that directive in order +to add more schemes. +--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,22 @@ +URI.SafeIframeRegexp +TYPE: string/null +VERSION: 4.4.0 +DEFAULT: NULL +--DESCRIPTION-- ++ A PCRE regular expression that will be matched against an iframe URI. This is + a relatively inflexible scheme, but works well enough for the most common + use-case of iframes: embedded video. This directive only has an effect if + %HTML.SafeIframe is enabled. Here are some example values: +
+-
+
%^http://www.youtube.com/embed/%- Allow YouTube videos
+ %^http://player.vimeo.com/video/%- Allow Vimeo videos
+ %^http://(www.youtube.com/embed/|player.vimeo.com/video/)%- Allow both
+
+ Note that this directive does not give you enough granularity to, say, disable + all
+--# vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema.ser php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema.ser --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema.ser 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/schema.ser 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1 @@ +O:25:"HTMLPurifier_ConfigSchema":3:{s:8:"defaults";a:126:{s:19:"Attr.AllowedClasses";N;s:24:"Attr.AllowedFrameTargets";a:0:{}s:15:"Attr.AllowedRel";a:0:{}s:15:"Attr.AllowedRev";a:0:{}s:18:"Attr.ClassUseCDATA";N;s:20:"Attr.DefaultImageAlt";N;s:24:"Attr.DefaultInvalidImage";s:0:"";s:27:"Attr.DefaultInvalidImageAlt";s:13:"Invalid image";s:19:"Attr.DefaultTextDir";s:3:"ltr";s:13:"Attr.EnableID";b:0;s:21:"Attr.ForbiddenClasses";a:0:{}s:13:"Attr.ID.HTML5";N;s:16:"Attr.IDBlacklist";a:0:{}s:22:"Attr.IDBlacklistRegexp";N;s:13:"Attr.IDPrefix";s:0:"";s:18:"Attr.IDPrefixLocal";s:0:"";s:24:"AutoFormat.AutoParagraph";b:0;s:17:"AutoFormat.Custom";a:0:{}s:25:"AutoFormat.DisplayLinkURI";b:0;s:18:"AutoFormat.Linkify";b:0;s:33:"AutoFormat.PurifierLinkify.DocURL";s:3:"#%s";s:26:"AutoFormat.PurifierLinkify";b:0;s:32:"AutoFormat.RemoveEmpty.Predicate";a:4:{s:8:"colgroup";a:0:{}s:2:"th";a:0:{}s:2:"td";a:0:{}s:6:"iframe";a:1:{i:0;s:3:"src";}}s:44:"AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions";a:2:{s:2:"td";b:1;s:2:"th";b:1;}s:33:"AutoFormat.RemoveEmpty.RemoveNbsp";b:0;s:22:"AutoFormat.RemoveEmpty";b:0;s:39:"AutoFormat.RemoveSpansWithoutAttributes";b:0;s:19:"CSS.AllowDuplicates";b:0;s:18:"CSS.AllowImportant";b:0;s:15:"CSS.AllowTricky";b:0;s:16:"CSS.AllowedFonts";N;s:21:"CSS.AllowedProperties";N;s:17:"CSS.DefinitionRev";i:1;s:23:"CSS.ForbiddenProperties";a:0:{}s:16:"CSS.MaxImgLength";s:6:"1200px";s:15:"CSS.Proprietary";b:0;s:11:"CSS.Trusted";b:0;s:20:"Cache.DefinitionImpl";s:10:"Serializer";s:20:"Cache.SerializerPath";N;s:27:"Cache.SerializerPermissions";i:493;s:22:"Core.AggressivelyFixLt";b:1;s:29:"Core.AggressivelyRemoveScript";b:1;s:28:"Core.AllowHostnameUnderscore";b:0;s:23:"Core.AllowParseManyTags";b:0;s:18:"Core.CollectErrors";b:0;s:18:"Core.ColorKeywords";a:148:{s:9:"aliceblue";s:7:"#F0F8FF";s:12:"antiquewhite";s:7:"#FAEBD7";s:4:"aqua";s:7:"#00FFFF";s:10:"aquamarine";s:7:"#7FFFD4";s:5:"azure";s:7:"#F0FFFF";s:5:"beige";s:7:"#F5F5DC";s:6:"bisque";s:7:"#FFE4C4";s:5:"black";s:7:"#000000";s:14:"blanchedalmond";s:7:"#FFEBCD";s:4:"blue";s:7:"#0000FF";s:10:"blueviolet";s:7:"#8A2BE2";s:5:"brown";s:7:"#A52A2A";s:9:"burlywood";s:7:"#DEB887";s:9:"cadetblue";s:7:"#5F9EA0";s:10:"chartreuse";s:7:"#7FFF00";s:9:"chocolate";s:7:"#D2691E";s:5:"coral";s:7:"#FF7F50";s:14:"cornflowerblue";s:7:"#6495ED";s:8:"cornsilk";s:7:"#FFF8DC";s:7:"crimson";s:7:"#DC143C";s:4:"cyan";s:7:"#00FFFF";s:8:"darkblue";s:7:"#00008B";s:8:"darkcyan";s:7:"#008B8B";s:13:"darkgoldenrod";s:7:"#B8860B";s:8:"darkgray";s:7:"#A9A9A9";s:8:"darkgrey";s:7:"#A9A9A9";s:9:"darkgreen";s:7:"#006400";s:9:"darkkhaki";s:7:"#BDB76B";s:11:"darkmagenta";s:7:"#8B008B";s:14:"darkolivegreen";s:7:"#556B2F";s:10:"darkorange";s:7:"#FF8C00";s:10:"darkorchid";s:7:"#9932CC";s:7:"darkred";s:7:"#8B0000";s:10:"darksalmon";s:7:"#E9967A";s:12:"darkseagreen";s:7:"#8FBC8F";s:13:"darkslateblue";s:7:"#483D8B";s:13:"darkslategray";s:7:"#2F4F4F";s:13:"darkslategrey";s:7:"#2F4F4F";s:13:"darkturquoise";s:7:"#00CED1";s:10:"darkviolet";s:7:"#9400D3";s:8:"deeppink";s:7:"#FF1493";s:11:"deepskyblue";s:7:"#00BFFF";s:7:"dimgray";s:7:"#696969";s:7:"dimgrey";s:7:"#696969";s:10:"dodgerblue";s:7:"#1E90FF";s:9:"firebrick";s:7:"#B22222";s:11:"floralwhite";s:7:"#FFFAF0";s:11:"forestgreen";s:7:"#228B22";s:7:"fuchsia";s:7:"#FF00FF";s:9:"gainsboro";s:7:"#DCDCDC";s:10:"ghostwhite";s:7:"#F8F8FF";s:4:"gold";s:7:"#FFD700";s:9:"goldenrod";s:7:"#DAA520";s:4:"gray";s:7:"#808080";s:4:"grey";s:7:"#808080";s:5:"green";s:7:"#008000";s:11:"greenyellow";s:7:"#ADFF2F";s:8:"honeydew";s:7:"#F0FFF0";s:7:"hotpink";s:7:"#FF69B4";s:9:"indianred";s:7:"#CD5C5C";s:6:"indigo";s:7:"#4B0082";s:5:"ivory";s:7:"#FFFFF0";s:5:"khaki";s:7:"#F0E68C";s:8:"lavender";s:7:"#E6E6FA";s:13:"lavenderblush";s:7:"#FFF0F5";s:9:"lawngreen";s:7:"#7CFC00";s:12:"lemonchiffon";s:7:"#FFFACD";s:9:"lightblue";s:7:"#ADD8E6";s:10:"lightcoral";s:7:"#F08080";s:9:"lightcyan";s:7:"#E0FFFF";s:20:"lightgoldenrodyellow";s:7:"#FAFAD2";s:9:"lightgray";s:7:"#D3D3D3";s:9:"lightgrey";s:7:"#D3D3D3";s:10:"lightgreen";s:7:"#90EE90";s:9:"lightpink";s:7:"#FFB6C1";s:11:"lightsalmon";s:7:"#FFA07A";s:13:"lightseagreen";s:7:"#20B2AA";s:12:"lightskyblue";s:7:"#87CEFA";s:14:"lightslategray";s:7:"#778899";s:14:"lightslategrey";s:7:"#778899";s:14:"lightsteelblue";s:7:"#B0C4DE";s:11:"lightyellow";s:7:"#FFFFE0";s:4:"lime";s:7:"#00FF00";s:9:"limegreen";s:7:"#32CD32";s:5:"linen";s:7:"#FAF0E6";s:7:"magenta";s:7:"#FF00FF";s:6:"maroon";s:7:"#800000";s:16:"mediumaquamarine";s:7:"#66CDAA";s:10:"mediumblue";s:7:"#0000CD";s:12:"mediumorchid";s:7:"#BA55D3";s:12:"mediumpurple";s:7:"#9370DB";s:14:"mediumseagreen";s:7:"#3CB371";s:15:"mediumslateblue";s:7:"#7B68EE";s:17:"mediumspringgreen";s:7:"#00FA9A";s:15:"mediumturquoise";s:7:"#48D1CC";s:15:"mediumvioletred";s:7:"#C71585";s:12:"midnightblue";s:7:"#191970";s:9:"mintcream";s:7:"#F5FFFA";s:9:"mistyrose";s:7:"#FFE4E1";s:8:"moccasin";s:7:"#FFE4B5";s:11:"navajowhite";s:7:"#FFDEAD";s:4:"navy";s:7:"#000080";s:7:"oldlace";s:7:"#FDF5E6";s:5:"olive";s:7:"#808000";s:9:"olivedrab";s:7:"#6B8E23";s:6:"orange";s:7:"#FFA500";s:9:"orangered";s:7:"#FF4500";s:6:"orchid";s:7:"#DA70D6";s:13:"palegoldenrod";s:7:"#EEE8AA";s:9:"palegreen";s:7:"#98FB98";s:13:"paleturquoise";s:7:"#AFEEEE";s:13:"palevioletred";s:7:"#DB7093";s:10:"papayawhip";s:7:"#FFEFD5";s:9:"peachpuff";s:7:"#FFDAB9";s:4:"peru";s:7:"#CD853F";s:4:"pink";s:7:"#FFC0CB";s:4:"plum";s:7:"#DDA0DD";s:10:"powderblue";s:7:"#B0E0E6";s:6:"purple";s:7:"#800080";s:13:"rebeccapurple";s:7:"#663399";s:3:"red";s:7:"#FF0000";s:9:"rosybrown";s:7:"#BC8F8F";s:9:"royalblue";s:7:"#4169E1";s:11:"saddlebrown";s:7:"#8B4513";s:6:"salmon";s:7:"#FA8072";s:10:"sandybrown";s:7:"#F4A460";s:8:"seagreen";s:7:"#2E8B57";s:8:"seashell";s:7:"#FFF5EE";s:6:"sienna";s:7:"#A0522D";s:6:"silver";s:7:"#C0C0C0";s:7:"skyblue";s:7:"#87CEEB";s:9:"slateblue";s:7:"#6A5ACD";s:9:"slategray";s:7:"#708090";s:9:"slategrey";s:7:"#708090";s:4:"snow";s:7:"#FFFAFA";s:11:"springgreen";s:7:"#00FF7F";s:9:"steelblue";s:7:"#4682B4";s:3:"tan";s:7:"#D2B48C";s:4:"teal";s:7:"#008080";s:7:"thistle";s:7:"#D8BFD8";s:6:"tomato";s:7:"#FF6347";s:9:"turquoise";s:7:"#40E0D0";s:6:"violet";s:7:"#EE82EE";s:5:"wheat";s:7:"#F5DEB3";s:5:"white";s:7:"#FFFFFF";s:10:"whitesmoke";s:7:"#F5F5F5";s:6:"yellow";s:7:"#FFFF00";s:11:"yellowgreen";s:7:"#9ACD32";}s:30:"Core.ConvertDocumentToFragment";b:1;s:36:"Core.DirectLexLineNumberSyncInterval";i:0;s:20:"Core.DisableExcludes";b:0;s:15:"Core.EnableIDNA";b:0;s:13:"Core.Encoding";s:5:"utf-8";s:26:"Core.EscapeInvalidChildren";b:0;s:22:"Core.EscapeInvalidTags";b:0;s:29:"Core.EscapeNonASCIICharacters";b:0;s:19:"Core.HiddenElements";a:2:{s:6:"script";b:1;s:5:"style";b:1;}s:13:"Core.Language";s:2:"en";s:24:"Core.LegacyEntityDecoder";b:0;s:14:"Core.LexerImpl";N;s:24:"Core.MaintainLineNumbers";N;s:22:"Core.NormalizeNewlines";b:1;s:21:"Core.RemoveInvalidImg";b:1;s:33:"Core.RemoveProcessingInstructions";b:0;s:25:"Core.RemoveScriptContents";N;s:13:"Filter.Custom";a:0:{}s:34:"Filter.ExtractStyleBlocks.Escaping";b:1;s:31:"Filter.ExtractStyleBlocks.Scope";N;s:34:"Filter.ExtractStyleBlocks.TidyImpl";N;s:25:"Filter.ExtractStyleBlocks";b:0;s:14:"Filter.YouTube";b:0;s:12:"HTML.Allowed";N;s:22:"HTML.AllowedAttributes";N;s:20:"HTML.AllowedComments";a:0:{}s:26:"HTML.AllowedCommentsRegexp";N;s:20:"HTML.AllowedElements";N;s:19:"HTML.AllowedModules";N;s:23:"HTML.Attr.Name.UseCDATA";b:0;s:17:"HTML.BlockWrapper";s:1:"p";s:16:"HTML.CoreModules";a:7:{s:9:"Structure";b:1;s:4:"Text";b:1;s:9:"Hypertext";b:1;s:4:"List";b:1;s:22:"NonXMLCommonAttributes";b:1;s:19:"XMLCommonAttributes";b:1;s:16:"CommonAttributes";b:1;}s:18:"HTML.CustomDoctype";N;s:17:"HTML.DefinitionID";N;s:18:"HTML.DefinitionRev";i:1;s:12:"HTML.Doctype";N;s:25:"HTML.FlashAllowFullScreen";b:0;s:24:"HTML.ForbiddenAttributes";a:0:{}s:22:"HTML.ForbiddenElements";a:0:{}s:17:"HTML.MaxImgLength";i:1200;s:13:"HTML.Nofollow";b:0;s:11:"HTML.Parent";s:3:"div";s:16:"HTML.Proprietary";b:0;s:14:"HTML.SafeEmbed";b:0;s:15:"HTML.SafeIframe";b:0;s:15:"HTML.SafeObject";b:0;s:18:"HTML.SafeScripting";a:0:{}s:11:"HTML.Strict";b:0;s:16:"HTML.TargetBlank";b:0;s:19:"HTML.TargetNoopener";b:1;s:21:"HTML.TargetNoreferrer";b:1;s:12:"HTML.TidyAdd";a:0:{}s:14:"HTML.TidyLevel";s:6:"medium";s:15:"HTML.TidyRemove";a:0:{}s:12:"HTML.Trusted";b:0;s:10:"HTML.XHTML";b:1;s:28:"Output.CommentScriptContents";b:1;s:19:"Output.FixInnerHTML";b:1;s:18:"Output.FlashCompat";b:0;s:14:"Output.Newline";N;s:15:"Output.SortAttr";b:0;s:17:"Output.TidyFormat";b:0;s:17:"Test.ForceNoIconv";b:0;s:18:"URI.AllowedSchemes";a:7:{s:4:"http";b:1;s:5:"https";b:1;s:6:"mailto";b:1;s:3:"ftp";b:1;s:4:"nntp";b:1;s:4:"news";b:1;s:3:"tel";b:1;}s:8:"URI.Base";N;s:17:"URI.DefaultScheme";s:4:"http";s:16:"URI.DefinitionID";N;s:17:"URI.DefinitionRev";i:1;s:11:"URI.Disable";b:0;s:19:"URI.DisableExternal";b:0;s:28:"URI.DisableExternalResources";b:0;s:20:"URI.DisableResources";b:0;s:8:"URI.Host";N;s:17:"URI.HostBlacklist";a:0:{}s:16:"URI.MakeAbsolute";b:0;s:9:"URI.Munge";N;s:18:"URI.MungeResources";b:0;s:18:"URI.MungeSecretKey";N;s:26:"URI.OverrideAllowedSchemes";b:1;s:20:"URI.SafeIframeRegexp";N;}s:12:"defaultPlist";O:25:"HTMLPurifier_PropertyList":3:{s:7:" * data";a:126:{s:19:"Attr.AllowedClasses";N;s:24:"Attr.AllowedFrameTargets";a:0:{}s:15:"Attr.AllowedRel";a:0:{}s:15:"Attr.AllowedRev";a:0:{}s:18:"Attr.ClassUseCDATA";N;s:20:"Attr.DefaultImageAlt";N;s:24:"Attr.DefaultInvalidImage";s:0:"";s:27:"Attr.DefaultInvalidImageAlt";s:13:"Invalid image";s:19:"Attr.DefaultTextDir";s:3:"ltr";s:13:"Attr.EnableID";b:0;s:21:"Attr.ForbiddenClasses";a:0:{}s:13:"Attr.ID.HTML5";N;s:16:"Attr.IDBlacklist";a:0:{}s:22:"Attr.IDBlacklistRegexp";N;s:13:"Attr.IDPrefix";s:0:"";s:18:"Attr.IDPrefixLocal";s:0:"";s:24:"AutoFormat.AutoParagraph";b:0;s:17:"AutoFormat.Custom";a:0:{}s:25:"AutoFormat.DisplayLinkURI";b:0;s:18:"AutoFormat.Linkify";b:0;s:33:"AutoFormat.PurifierLinkify.DocURL";s:3:"#%s";s:26:"AutoFormat.PurifierLinkify";b:0;s:32:"AutoFormat.RemoveEmpty.Predicate";a:4:{s:8:"colgroup";a:0:{}s:2:"th";a:0:{}s:2:"td";a:0:{}s:6:"iframe";a:1:{i:0;s:3:"src";}}s:44:"AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions";a:2:{s:2:"td";b:1;s:2:"th";b:1;}s:33:"AutoFormat.RemoveEmpty.RemoveNbsp";b:0;s:22:"AutoFormat.RemoveEmpty";b:0;s:39:"AutoFormat.RemoveSpansWithoutAttributes";b:0;s:19:"CSS.AllowDuplicates";b:0;s:18:"CSS.AllowImportant";b:0;s:15:"CSS.AllowTricky";b:0;s:16:"CSS.AllowedFonts";N;s:21:"CSS.AllowedProperties";N;s:17:"CSS.DefinitionRev";i:1;s:23:"CSS.ForbiddenProperties";a:0:{}s:16:"CSS.MaxImgLength";s:6:"1200px";s:15:"CSS.Proprietary";b:0;s:11:"CSS.Trusted";b:0;s:20:"Cache.DefinitionImpl";s:10:"Serializer";s:20:"Cache.SerializerPath";N;s:27:"Cache.SerializerPermissions";i:493;s:22:"Core.AggressivelyFixLt";b:1;s:29:"Core.AggressivelyRemoveScript";b:1;s:28:"Core.AllowHostnameUnderscore";b:0;s:23:"Core.AllowParseManyTags";b:0;s:18:"Core.CollectErrors";b:0;s:18:"Core.ColorKeywords";a:148:{s:9:"aliceblue";s:7:"#F0F8FF";s:12:"antiquewhite";s:7:"#FAEBD7";s:4:"aqua";s:7:"#00FFFF";s:10:"aquamarine";s:7:"#7FFFD4";s:5:"azure";s:7:"#F0FFFF";s:5:"beige";s:7:"#F5F5DC";s:6:"bisque";s:7:"#FFE4C4";s:5:"black";s:7:"#000000";s:14:"blanchedalmond";s:7:"#FFEBCD";s:4:"blue";s:7:"#0000FF";s:10:"blueviolet";s:7:"#8A2BE2";s:5:"brown";s:7:"#A52A2A";s:9:"burlywood";s:7:"#DEB887";s:9:"cadetblue";s:7:"#5F9EA0";s:10:"chartreuse";s:7:"#7FFF00";s:9:"chocolate";s:7:"#D2691E";s:5:"coral";s:7:"#FF7F50";s:14:"cornflowerblue";s:7:"#6495ED";s:8:"cornsilk";s:7:"#FFF8DC";s:7:"crimson";s:7:"#DC143C";s:4:"cyan";s:7:"#00FFFF";s:8:"darkblue";s:7:"#00008B";s:8:"darkcyan";s:7:"#008B8B";s:13:"darkgoldenrod";s:7:"#B8860B";s:8:"darkgray";s:7:"#A9A9A9";s:8:"darkgrey";s:7:"#A9A9A9";s:9:"darkgreen";s:7:"#006400";s:9:"darkkhaki";s:7:"#BDB76B";s:11:"darkmagenta";s:7:"#8B008B";s:14:"darkolivegreen";s:7:"#556B2F";s:10:"darkorange";s:7:"#FF8C00";s:10:"darkorchid";s:7:"#9932CC";s:7:"darkred";s:7:"#8B0000";s:10:"darksalmon";s:7:"#E9967A";s:12:"darkseagreen";s:7:"#8FBC8F";s:13:"darkslateblue";s:7:"#483D8B";s:13:"darkslategray";s:7:"#2F4F4F";s:13:"darkslategrey";s:7:"#2F4F4F";s:13:"darkturquoise";s:7:"#00CED1";s:10:"darkviolet";s:7:"#9400D3";s:8:"deeppink";s:7:"#FF1493";s:11:"deepskyblue";s:7:"#00BFFF";s:7:"dimgray";s:7:"#696969";s:7:"dimgrey";s:7:"#696969";s:10:"dodgerblue";s:7:"#1E90FF";s:9:"firebrick";s:7:"#B22222";s:11:"floralwhite";s:7:"#FFFAF0";s:11:"forestgreen";s:7:"#228B22";s:7:"fuchsia";s:7:"#FF00FF";s:9:"gainsboro";s:7:"#DCDCDC";s:10:"ghostwhite";s:7:"#F8F8FF";s:4:"gold";s:7:"#FFD700";s:9:"goldenrod";s:7:"#DAA520";s:4:"gray";s:7:"#808080";s:4:"grey";s:7:"#808080";s:5:"green";s:7:"#008000";s:11:"greenyellow";s:7:"#ADFF2F";s:8:"honeydew";s:7:"#F0FFF0";s:7:"hotpink";s:7:"#FF69B4";s:9:"indianred";s:7:"#CD5C5C";s:6:"indigo";s:7:"#4B0082";s:5:"ivory";s:7:"#FFFFF0";s:5:"khaki";s:7:"#F0E68C";s:8:"lavender";s:7:"#E6E6FA";s:13:"lavenderblush";s:7:"#FFF0F5";s:9:"lawngreen";s:7:"#7CFC00";s:12:"lemonchiffon";s:7:"#FFFACD";s:9:"lightblue";s:7:"#ADD8E6";s:10:"lightcoral";s:7:"#F08080";s:9:"lightcyan";s:7:"#E0FFFF";s:20:"lightgoldenrodyellow";s:7:"#FAFAD2";s:9:"lightgray";s:7:"#D3D3D3";s:9:"lightgrey";s:7:"#D3D3D3";s:10:"lightgreen";s:7:"#90EE90";s:9:"lightpink";s:7:"#FFB6C1";s:11:"lightsalmon";s:7:"#FFA07A";s:13:"lightseagreen";s:7:"#20B2AA";s:12:"lightskyblue";s:7:"#87CEFA";s:14:"lightslategray";s:7:"#778899";s:14:"lightslategrey";s:7:"#778899";s:14:"lightsteelblue";s:7:"#B0C4DE";s:11:"lightyellow";s:7:"#FFFFE0";s:4:"lime";s:7:"#00FF00";s:9:"limegreen";s:7:"#32CD32";s:5:"linen";s:7:"#FAF0E6";s:7:"magenta";s:7:"#FF00FF";s:6:"maroon";s:7:"#800000";s:16:"mediumaquamarine";s:7:"#66CDAA";s:10:"mediumblue";s:7:"#0000CD";s:12:"mediumorchid";s:7:"#BA55D3";s:12:"mediumpurple";s:7:"#9370DB";s:14:"mediumseagreen";s:7:"#3CB371";s:15:"mediumslateblue";s:7:"#7B68EE";s:17:"mediumspringgreen";s:7:"#00FA9A";s:15:"mediumturquoise";s:7:"#48D1CC";s:15:"mediumvioletred";s:7:"#C71585";s:12:"midnightblue";s:7:"#191970";s:9:"mintcream";s:7:"#F5FFFA";s:9:"mistyrose";s:7:"#FFE4E1";s:8:"moccasin";s:7:"#FFE4B5";s:11:"navajowhite";s:7:"#FFDEAD";s:4:"navy";s:7:"#000080";s:7:"oldlace";s:7:"#FDF5E6";s:5:"olive";s:7:"#808000";s:9:"olivedrab";s:7:"#6B8E23";s:6:"orange";s:7:"#FFA500";s:9:"orangered";s:7:"#FF4500";s:6:"orchid";s:7:"#DA70D6";s:13:"palegoldenrod";s:7:"#EEE8AA";s:9:"palegreen";s:7:"#98FB98";s:13:"paleturquoise";s:7:"#AFEEEE";s:13:"palevioletred";s:7:"#DB7093";s:10:"papayawhip";s:7:"#FFEFD5";s:9:"peachpuff";s:7:"#FFDAB9";s:4:"peru";s:7:"#CD853F";s:4:"pink";s:7:"#FFC0CB";s:4:"plum";s:7:"#DDA0DD";s:10:"powderblue";s:7:"#B0E0E6";s:6:"purple";s:7:"#800080";s:13:"rebeccapurple";s:7:"#663399";s:3:"red";s:7:"#FF0000";s:9:"rosybrown";s:7:"#BC8F8F";s:9:"royalblue";s:7:"#4169E1";s:11:"saddlebrown";s:7:"#8B4513";s:6:"salmon";s:7:"#FA8072";s:10:"sandybrown";s:7:"#F4A460";s:8:"seagreen";s:7:"#2E8B57";s:8:"seashell";s:7:"#FFF5EE";s:6:"sienna";s:7:"#A0522D";s:6:"silver";s:7:"#C0C0C0";s:7:"skyblue";s:7:"#87CEEB";s:9:"slateblue";s:7:"#6A5ACD";s:9:"slategray";s:7:"#708090";s:9:"slategrey";s:7:"#708090";s:4:"snow";s:7:"#FFFAFA";s:11:"springgreen";s:7:"#00FF7F";s:9:"steelblue";s:7:"#4682B4";s:3:"tan";s:7:"#D2B48C";s:4:"teal";s:7:"#008080";s:7:"thistle";s:7:"#D8BFD8";s:6:"tomato";s:7:"#FF6347";s:9:"turquoise";s:7:"#40E0D0";s:6:"violet";s:7:"#EE82EE";s:5:"wheat";s:7:"#F5DEB3";s:5:"white";s:7:"#FFFFFF";s:10:"whitesmoke";s:7:"#F5F5F5";s:6:"yellow";s:7:"#FFFF00";s:11:"yellowgreen";s:7:"#9ACD32";}s:30:"Core.ConvertDocumentToFragment";b:1;s:36:"Core.DirectLexLineNumberSyncInterval";i:0;s:20:"Core.DisableExcludes";b:0;s:15:"Core.EnableIDNA";b:0;s:13:"Core.Encoding";s:5:"utf-8";s:26:"Core.EscapeInvalidChildren";b:0;s:22:"Core.EscapeInvalidTags";b:0;s:29:"Core.EscapeNonASCIICharacters";b:0;s:19:"Core.HiddenElements";a:2:{s:6:"script";b:1;s:5:"style";b:1;}s:13:"Core.Language";s:2:"en";s:24:"Core.LegacyEntityDecoder";b:0;s:14:"Core.LexerImpl";N;s:24:"Core.MaintainLineNumbers";N;s:22:"Core.NormalizeNewlines";b:1;s:21:"Core.RemoveInvalidImg";b:1;s:33:"Core.RemoveProcessingInstructions";b:0;s:25:"Core.RemoveScriptContents";N;s:13:"Filter.Custom";a:0:{}s:34:"Filter.ExtractStyleBlocks.Escaping";b:1;s:31:"Filter.ExtractStyleBlocks.Scope";N;s:34:"Filter.ExtractStyleBlocks.TidyImpl";N;s:25:"Filter.ExtractStyleBlocks";b:0;s:14:"Filter.YouTube";b:0;s:12:"HTML.Allowed";N;s:22:"HTML.AllowedAttributes";N;s:20:"HTML.AllowedComments";a:0:{}s:26:"HTML.AllowedCommentsRegexp";N;s:20:"HTML.AllowedElements";N;s:19:"HTML.AllowedModules";N;s:23:"HTML.Attr.Name.UseCDATA";b:0;s:17:"HTML.BlockWrapper";s:1:"p";s:16:"HTML.CoreModules";a:7:{s:9:"Structure";b:1;s:4:"Text";b:1;s:9:"Hypertext";b:1;s:4:"List";b:1;s:22:"NonXMLCommonAttributes";b:1;s:19:"XMLCommonAttributes";b:1;s:16:"CommonAttributes";b:1;}s:18:"HTML.CustomDoctype";N;s:17:"HTML.DefinitionID";N;s:18:"HTML.DefinitionRev";i:1;s:12:"HTML.Doctype";N;s:25:"HTML.FlashAllowFullScreen";b:0;s:24:"HTML.ForbiddenAttributes";a:0:{}s:22:"HTML.ForbiddenElements";a:0:{}s:17:"HTML.MaxImgLength";i:1200;s:13:"HTML.Nofollow";b:0;s:11:"HTML.Parent";s:3:"div";s:16:"HTML.Proprietary";b:0;s:14:"HTML.SafeEmbed";b:0;s:15:"HTML.SafeIframe";b:0;s:15:"HTML.SafeObject";b:0;s:18:"HTML.SafeScripting";a:0:{}s:11:"HTML.Strict";b:0;s:16:"HTML.TargetBlank";b:0;s:19:"HTML.TargetNoopener";b:1;s:21:"HTML.TargetNoreferrer";b:1;s:12:"HTML.TidyAdd";a:0:{}s:14:"HTML.TidyLevel";s:6:"medium";s:15:"HTML.TidyRemove";a:0:{}s:12:"HTML.Trusted";b:0;s:10:"HTML.XHTML";b:1;s:28:"Output.CommentScriptContents";b:1;s:19:"Output.FixInnerHTML";b:1;s:18:"Output.FlashCompat";b:0;s:14:"Output.Newline";N;s:15:"Output.SortAttr";b:0;s:17:"Output.TidyFormat";b:0;s:17:"Test.ForceNoIconv";b:0;s:18:"URI.AllowedSchemes";a:7:{s:4:"http";b:1;s:5:"https";b:1;s:6:"mailto";b:1;s:3:"ftp";b:1;s:4:"nntp";b:1;s:4:"news";b:1;s:3:"tel";b:1;}s:8:"URI.Base";N;s:17:"URI.DefaultScheme";s:4:"http";s:16:"URI.DefinitionID";N;s:17:"URI.DefinitionRev";i:1;s:11:"URI.Disable";b:0;s:19:"URI.DisableExternal";b:0;s:28:"URI.DisableExternalResources";b:0;s:20:"URI.DisableResources";b:0;s:8:"URI.Host";N;s:17:"URI.HostBlacklist";a:0:{}s:16:"URI.MakeAbsolute";b:0;s:9:"URI.Munge";N;s:18:"URI.MungeResources";b:0;s:18:"URI.MungeSecretKey";N;s:26:"URI.OverrideAllowedSchemes";b:1;s:20:"URI.SafeIframeRegexp";N;}s:9:" * parent";N;s:8:" * cache";N;}s:4:"info";a:139:{s:19:"Attr.AllowedClasses";i:-8;s:24:"Attr.AllowedFrameTargets";i:8;s:15:"Attr.AllowedRel";i:8;s:15:"Attr.AllowedRev";i:8;s:18:"Attr.ClassUseCDATA";i:-7;s:20:"Attr.DefaultImageAlt";i:-1;s:24:"Attr.DefaultInvalidImage";i:1;s:27:"Attr.DefaultInvalidImageAlt";i:1;s:19:"Attr.DefaultTextDir";O:8:"stdClass":2:{s:4:"type";i:1;s:7:"allowed";a:2:{s:3:"ltr";b:1;s:3:"rtl";b:1;}}s:13:"Attr.EnableID";i:7;s:17:"HTML.EnableAttrID";O:8:"stdClass":2:{s:3:"key";s:13:"Attr.EnableID";s:7:"isAlias";b:1;}s:21:"Attr.ForbiddenClasses";i:8;s:13:"Attr.ID.HTML5";i:-7;s:16:"Attr.IDBlacklist";i:9;s:22:"Attr.IDBlacklistRegexp";i:-1;s:13:"Attr.IDPrefix";i:1;s:18:"Attr.IDPrefixLocal";i:1;s:24:"AutoFormat.AutoParagraph";i:7;s:17:"AutoFormat.Custom";i:9;s:25:"AutoFormat.DisplayLinkURI";i:7;s:18:"AutoFormat.Linkify";i:7;s:33:"AutoFormat.PurifierLinkify.DocURL";i:1;s:37:"AutoFormatParam.PurifierLinkifyDocURL";O:8:"stdClass":2:{s:3:"key";s:33:"AutoFormat.PurifierLinkify.DocURL";s:7:"isAlias";b:1;}s:26:"AutoFormat.PurifierLinkify";i:7;s:32:"AutoFormat.RemoveEmpty.Predicate";i:10;s:44:"AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions";i:8;s:33:"AutoFormat.RemoveEmpty.RemoveNbsp";i:7;s:22:"AutoFormat.RemoveEmpty";i:7;s:39:"AutoFormat.RemoveSpansWithoutAttributes";i:7;s:19:"CSS.AllowDuplicates";i:7;s:18:"CSS.AllowImportant";i:7;s:15:"CSS.AllowTricky";i:7;s:16:"CSS.AllowedFonts";i:-8;s:21:"CSS.AllowedProperties";i:-8;s:17:"CSS.DefinitionRev";i:5;s:23:"CSS.ForbiddenProperties";i:8;s:16:"CSS.MaxImgLength";i:-1;s:15:"CSS.Proprietary";i:7;s:11:"CSS.Trusted";i:7;s:20:"Cache.DefinitionImpl";i:-1;s:20:"Core.DefinitionCache";O:8:"stdClass":2:{s:3:"key";s:20:"Cache.DefinitionImpl";s:7:"isAlias";b:1;}s:20:"Cache.SerializerPath";i:-1;s:27:"Cache.SerializerPermissions";i:-5;s:22:"Core.AggressivelyFixLt";i:7;s:29:"Core.AggressivelyRemoveScript";i:7;s:28:"Core.AllowHostnameUnderscore";i:7;s:23:"Core.AllowParseManyTags";i:7;s:18:"Core.CollectErrors";i:7;s:18:"Core.ColorKeywords";i:10;s:30:"Core.ConvertDocumentToFragment";i:7;s:24:"Core.AcceptFullDocuments";O:8:"stdClass":2:{s:3:"key";s:30:"Core.ConvertDocumentToFragment";s:7:"isAlias";b:1;}s:36:"Core.DirectLexLineNumberSyncInterval";i:5;s:20:"Core.DisableExcludes";i:7;s:15:"Core.EnableIDNA";i:7;s:13:"Core.Encoding";i:2;s:26:"Core.EscapeInvalidChildren";i:7;s:22:"Core.EscapeInvalidTags";i:7;s:29:"Core.EscapeNonASCIICharacters";i:7;s:19:"Core.HiddenElements";i:8;s:13:"Core.Language";i:1;s:24:"Core.LegacyEntityDecoder";i:7;s:14:"Core.LexerImpl";i:-11;s:24:"Core.MaintainLineNumbers";i:-7;s:22:"Core.NormalizeNewlines";i:7;s:21:"Core.RemoveInvalidImg";i:7;s:33:"Core.RemoveProcessingInstructions";i:7;s:25:"Core.RemoveScriptContents";i:-7;s:13:"Filter.Custom";i:9;s:34:"Filter.ExtractStyleBlocks.Escaping";i:7;s:33:"Filter.ExtractStyleBlocksEscaping";O:8:"stdClass":2:{s:3:"key";s:34:"Filter.ExtractStyleBlocks.Escaping";s:7:"isAlias";b:1;}s:38:"FilterParam.ExtractStyleBlocksEscaping";O:8:"stdClass":2:{s:3:"key";s:34:"Filter.ExtractStyleBlocks.Escaping";s:7:"isAlias";b:1;}s:31:"Filter.ExtractStyleBlocks.Scope";i:-1;s:30:"Filter.ExtractStyleBlocksScope";O:8:"stdClass":2:{s:3:"key";s:31:"Filter.ExtractStyleBlocks.Scope";s:7:"isAlias";b:1;}s:35:"FilterParam.ExtractStyleBlocksScope";O:8:"stdClass":2:{s:3:"key";s:31:"Filter.ExtractStyleBlocks.Scope";s:7:"isAlias";b:1;}s:34:"Filter.ExtractStyleBlocks.TidyImpl";i:-11;s:38:"FilterParam.ExtractStyleBlocksTidyImpl";O:8:"stdClass":2:{s:3:"key";s:34:"Filter.ExtractStyleBlocks.TidyImpl";s:7:"isAlias";b:1;}s:25:"Filter.ExtractStyleBlocks";i:7;s:14:"Filter.YouTube";i:7;s:12:"HTML.Allowed";i:-4;s:22:"HTML.AllowedAttributes";i:-8;s:20:"HTML.AllowedComments";i:8;s:26:"HTML.AllowedCommentsRegexp";i:-1;s:20:"HTML.AllowedElements";i:-8;s:19:"HTML.AllowedModules";i:-8;s:23:"HTML.Attr.Name.UseCDATA";i:7;s:17:"HTML.BlockWrapper";i:1;s:16:"HTML.CoreModules";i:8;s:18:"HTML.CustomDoctype";i:-1;s:17:"HTML.DefinitionID";i:-1;s:18:"HTML.DefinitionRev";i:5;s:12:"HTML.Doctype";O:8:"stdClass":3:{s:4:"type";i:1;s:10:"allow_null";b:1;s:7:"allowed";a:5:{s:22:"HTML 4.01 Transitional";b:1;s:16:"HTML 4.01 Strict";b:1;s:22:"XHTML 1.0 Transitional";b:1;s:16:"XHTML 1.0 Strict";b:1;s:9:"XHTML 1.1";b:1;}}s:25:"HTML.FlashAllowFullScreen";i:7;s:24:"HTML.ForbiddenAttributes";i:8;s:22:"HTML.ForbiddenElements";i:8;s:17:"HTML.MaxImgLength";i:-5;s:13:"HTML.Nofollow";i:7;s:11:"HTML.Parent";i:1;s:16:"HTML.Proprietary";i:7;s:14:"HTML.SafeEmbed";i:7;s:15:"HTML.SafeIframe";i:7;s:15:"HTML.SafeObject";i:7;s:18:"HTML.SafeScripting";i:8;s:11:"HTML.Strict";i:7;s:16:"HTML.TargetBlank";i:7;s:19:"HTML.TargetNoopener";i:7;s:21:"HTML.TargetNoreferrer";i:7;s:12:"HTML.TidyAdd";i:8;s:14:"HTML.TidyLevel";O:8:"stdClass":2:{s:4:"type";i:1;s:7:"allowed";a:4:{s:4:"none";b:1;s:5:"light";b:1;s:6:"medium";b:1;s:5:"heavy";b:1;}}s:15:"HTML.TidyRemove";i:8;s:12:"HTML.Trusted";i:7;s:10:"HTML.XHTML";i:7;s:10:"Core.XHTML";O:8:"stdClass":2:{s:3:"key";s:10:"HTML.XHTML";s:7:"isAlias";b:1;}s:28:"Output.CommentScriptContents";i:7;s:26:"Core.CommentScriptContents";O:8:"stdClass":2:{s:3:"key";s:28:"Output.CommentScriptContents";s:7:"isAlias";b:1;}s:19:"Output.FixInnerHTML";i:7;s:18:"Output.FlashCompat";i:7;s:14:"Output.Newline";i:-1;s:15:"Output.SortAttr";i:7;s:17:"Output.TidyFormat";i:7;s:15:"Core.TidyFormat";O:8:"stdClass":2:{s:3:"key";s:17:"Output.TidyFormat";s:7:"isAlias";b:1;}s:17:"Test.ForceNoIconv";i:7;s:18:"URI.AllowedSchemes";i:8;s:8:"URI.Base";i:-1;s:17:"URI.DefaultScheme";i:-1;s:16:"URI.DefinitionID";i:-1;s:17:"URI.DefinitionRev";i:5;s:11:"URI.Disable";i:7;s:15:"Attr.DisableURI";O:8:"stdClass":2:{s:3:"key";s:11:"URI.Disable";s:7:"isAlias";b:1;}s:19:"URI.DisableExternal";i:7;s:28:"URI.DisableExternalResources";i:7;s:20:"URI.DisableResources";i:7;s:8:"URI.Host";i:-1;s:17:"URI.HostBlacklist";i:9;s:16:"URI.MakeAbsolute";i:7;s:9:"URI.Munge";i:-1;s:18:"URI.MungeResources";i:7;s:18:"URI.MungeSecretKey";i:-1;s:26:"URI.OverrideAllowedSchemes";i:7;s:20:"URI.SafeIframeRegexp";i:-1;}} \ No newline at end of file diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/ValidatorAtom.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/ValidatorAtom.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/ValidatorAtom.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/ValidatorAtom.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,130 @@ +context = $context; + $this->obj = $obj; + $this->member = $member; + $this->contents =& $obj->$member; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertIsString() + { + if (!is_string($this->contents)) { + $this->error('must be a string'); + } + return $this; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertIsBool() + { + if (!is_bool($this->contents)) { + $this->error('must be a boolean'); + } + return $this; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertIsArray() + { + if (!is_array($this->contents)) { + $this->error('must be an array'); + } + return $this; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertNotNull() + { + if ($this->contents === null) { + $this->error('must not be null'); + } + return $this; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertAlnum() + { + $this->assertIsString(); + if (!ctype_alnum($this->contents)) { + $this->error('must be alphanumeric'); + } + return $this; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertNotEmpty() + { + if (empty($this->contents)) { + $this->error('must not be empty'); + } + return $this; + } + + /** + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + public function assertIsLookup() + { + $this->assertIsArray(); + foreach ($this->contents as $v) { + if ($v !== true) { + $this->error('must be a lookup array'); + } + } + return $this; + } + + /** + * @param string $msg + * @throws HTMLPurifier_ConfigSchema_Exception + */ + protected function error($msg) + { + throw new HTMLPurifier_ConfigSchema_Exception(ucfirst($this->member) . ' in ' . $this->context . ' ' . $msg); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Validator.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Validator.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Validator.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema/Validator.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,248 @@ +parser = new HTMLPurifier_VarParser(); + } + + /** + * Validates a fully-formed interchange object. + * @param HTMLPurifier_ConfigSchema_Interchange $interchange + * @return bool + */ + public function validate($interchange) + { + $this->interchange = $interchange; + $this->aliases = array(); + // PHP is a bit lax with integer <=> string conversions in + // arrays, so we don't use the identical !== comparison + foreach ($interchange->directives as $i => $directive) { + $id = $directive->id->toString(); + if ($i != $id) { + $this->error(false, "Integrity violation: key '$i' does not match internal id '$id'"); + } + $this->validateDirective($directive); + } + return true; + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Id object. + * @param HTMLPurifier_ConfigSchema_Interchange_Id $id + */ + public function validateId($id) + { + $id_string = $id->toString(); + $this->context[] = "id '$id_string'"; + if (!$id instanceof HTMLPurifier_ConfigSchema_Interchange_Id) { + // handled by InterchangeBuilder + $this->error(false, 'is not an instance of HTMLPurifier_ConfigSchema_Interchange_Id'); + } + // keys are now unconstrained (we might want to narrow down to A-Za-z0-9.) + // we probably should check that it has at least one namespace + $this->with($id, 'key') + ->assertNotEmpty() + ->assertIsString(); // implicit assertIsString handled by InterchangeBuilder + array_pop($this->context); + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Directive object. + * @param HTMLPurifier_ConfigSchema_Interchange_Directive $d + */ + public function validateDirective($d) + { + $id = $d->id->toString(); + $this->context[] = "directive '$id'"; + $this->validateId($d->id); + + $this->with($d, 'description') + ->assertNotEmpty(); + + // BEGIN - handled by InterchangeBuilder + $this->with($d, 'type') + ->assertNotEmpty(); + $this->with($d, 'typeAllowsNull') + ->assertIsBool(); + try { + // This also tests validity of $d->type + $this->parser->parse($d->default, $d->type, $d->typeAllowsNull); + } catch (HTMLPurifier_VarParserException $e) { + $this->error('default', 'had error: ' . $e->getMessage()); + } + // END - handled by InterchangeBuilder + + if (!is_null($d->allowed) || !empty($d->valueAliases)) { + // allowed and valueAliases require that we be dealing with + // strings, so check for that early. + $d_int = HTMLPurifier_VarParser::$types[$d->type]; + if (!isset(HTMLPurifier_VarParser::$stringTypes[$d_int])) { + $this->error('type', 'must be a string type when used with allowed or value aliases'); + } + } + + $this->validateDirectiveAllowed($d); + $this->validateDirectiveValueAliases($d); + $this->validateDirectiveAliases($d); + + array_pop($this->context); + } + + /** + * Extra validation if $allowed member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + * @param HTMLPurifier_ConfigSchema_Interchange_Directive $d + */ + public function validateDirectiveAllowed($d) + { + if (is_null($d->allowed)) { + return; + } + $this->with($d, 'allowed') + ->assertNotEmpty() + ->assertIsLookup(); // handled by InterchangeBuilder + if (is_string($d->default) && !isset($d->allowed[$d->default])) { + $this->error('default', 'must be an allowed value'); + } + $this->context[] = 'allowed'; + foreach ($d->allowed as $val => $x) { + if (!is_string($val)) { + $this->error("value $val", 'must be a string'); + } + } + array_pop($this->context); + } + + /** + * Extra validation if $valueAliases member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + * @param HTMLPurifier_ConfigSchema_Interchange_Directive $d + */ + public function validateDirectiveValueAliases($d) + { + if (is_null($d->valueAliases)) { + return; + } + $this->with($d, 'valueAliases') + ->assertIsArray(); // handled by InterchangeBuilder + $this->context[] = 'valueAliases'; + foreach ($d->valueAliases as $alias => $real) { + if (!is_string($alias)) { + $this->error("alias $alias", 'must be a string'); + } + if (!is_string($real)) { + $this->error("alias target $real from alias '$alias'", 'must be a string'); + } + if ($alias === $real) { + $this->error("alias '$alias'", "must not be an alias to itself"); + } + } + if (!is_null($d->allowed)) { + foreach ($d->valueAliases as $alias => $real) { + if (isset($d->allowed[$alias])) { + $this->error("alias '$alias'", 'must not be an allowed value'); + } elseif (!isset($d->allowed[$real])) { + $this->error("alias '$alias'", 'must be an alias to an allowed value'); + } + } + } + array_pop($this->context); + } + + /** + * Extra validation if $aliases member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + * @param HTMLPurifier_ConfigSchema_Interchange_Directive $d + */ + public function validateDirectiveAliases($d) + { + $this->with($d, 'aliases') + ->assertIsArray(); // handled by InterchangeBuilder + $this->context[] = 'aliases'; + foreach ($d->aliases as $alias) { + $this->validateId($alias); + $s = $alias->toString(); + if (isset($this->interchange->directives[$s])) { + $this->error("alias '$s'", 'collides with another directive'); + } + if (isset($this->aliases[$s])) { + $other_directive = $this->aliases[$s]; + $this->error("alias '$s'", "collides with alias for directive '$other_directive'"); + } + $this->aliases[$s] = $d->id->toString(); + } + array_pop($this->context); + } + + // protected helper functions + + /** + * Convenience function for generating HTMLPurifier_ConfigSchema_ValidatorAtom + * for validating simple member variables of objects. + * @param $obj + * @param $member + * @return HTMLPurifier_ConfigSchema_ValidatorAtom + */ + protected function with($obj, $member) + { + return new HTMLPurifier_ConfigSchema_ValidatorAtom($this->getFormattedContext(), $obj, $member); + } + + /** + * Emits an error, providing helpful context. + * @throws HTMLPurifier_ConfigSchema_Exception + */ + protected function error($target, $msg) + { + if ($target !== false) { + $prefix = ucfirst($target) . ' in ' . $this->getFormattedContext(); + } else { + $prefix = ucfirst($this->getFormattedContext()); + } + throw new HTMLPurifier_ConfigSchema_Exception(trim($prefix . ' ' . $msg)); + } + + /** + * Returns a formatted context string. + * @return string + */ + protected function getFormattedContext() + { + return implode(' in ', array_reverse($this->context)); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ConfigSchema.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,176 @@ + array( + * 'Directive' => new stdClass(), + * ) + * ) + * + * The stdClass may have the following properties: + * + * - If isAlias isn't set: + * - type: Integer type of directive, see HTMLPurifier_VarParser for definitions + * - allow_null: If set, this directive allows null values + * - aliases: If set, an associative array of value aliases to real values + * - allowed: If set, a lookup array of allowed (string) values + * - If isAlias is set: + * - namespace: Namespace this directive aliases to + * - name: Directive name this directive aliases to + * + * In certain degenerate cases, stdClass will actually be an integer. In + * that case, the value is equivalent to an stdClass with the type + * property set to the integer. If the integer is negative, type is + * equal to the absolute value of integer, and allow_null is true. + * + * This class is friendly with HTMLPurifier_Config. If you need introspection + * about the schema, you're better of using the ConfigSchema_Interchange, + * which uses more memory but has much richer information. + * @type array + */ + public $info = array(); + + /** + * Application-wide singleton + * @type HTMLPurifier_ConfigSchema + */ + protected static $singleton; + + public function __construct() + { + $this->defaultPlist = new HTMLPurifier_PropertyList(); + } + + /** + * Unserializes the default ConfigSchema. + * @return HTMLPurifier_ConfigSchema + */ + public static function makeFromSerial() + { + $contents = file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema.ser'); + $r = unserialize($contents); + if (!$r) { + $hash = sha1($contents); + trigger_error("Unserialization of configuration schema failed, sha1 of file was $hash", E_USER_ERROR); + } + return $r; + } + + /** + * Retrieves an instance of the application-wide configuration definition. + * @param HTMLPurifier_ConfigSchema $prototype + * @return HTMLPurifier_ConfigSchema + */ + public static function instance($prototype = null) + { + if ($prototype !== null) { + HTMLPurifier_ConfigSchema::$singleton = $prototype; + } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) { + HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial(); + } + return HTMLPurifier_ConfigSchema::$singleton; + } + + /** + * Defines a directive for configuration + * @warning Will fail of directive's namespace is defined. + * @warning This method's signature is slightly different from the legacy + * define() static method! Beware! + * @param string $key Name of directive + * @param mixed $default Default value of directive + * @param string $type Allowed type of the directive. See + * HTMLPurifier_VarParser::$types for allowed values + * @param bool $allow_null Whether or not to allow null values + */ + public function add($key, $default, $type, $allow_null) + { + $obj = new stdClass(); + $obj->type = is_int($type) ? $type : HTMLPurifier_VarParser::$types[$type]; + if ($allow_null) { + $obj->allow_null = true; + } + $this->info[$key] = $obj; + $this->defaults[$key] = $default; + $this->defaultPlist->set($key, $default); + } + + /** + * Defines a directive value alias. + * + * Directive value aliases are convenient for developers because it lets + * them set a directive to several values and get the same result. + * @param string $key Name of Directive + * @param array $aliases Hash of aliased values to the real alias + */ + public function addValueAliases($key, $aliases) + { + if (!isset($this->info[$key]->aliases)) { + $this->info[$key]->aliases = array(); + } + foreach ($aliases as $alias => $real) { + $this->info[$key]->aliases[$alias] = $real; + } + } + + /** + * Defines a set of allowed values for a directive. + * @warning This is slightly different from the corresponding static + * method definition. + * @param string $key Name of directive + * @param array $allowed Lookup array of allowed values + */ + public function addAllowedValues($key, $allowed) + { + $this->info[$key]->allowed = $allowed; + } + + /** + * Defines a directive alias for backwards compatibility + * @param string $key Directive that will be aliased + * @param string $new_key Directive that the alias will be to + */ + public function addAlias($key, $new_key) + { + $obj = new stdClass; + $obj->key = $new_key; + $obj->isAlias = true; + $this->info[$key] = $obj; + } + + /** + * Replaces any stdClass that only has the type property with type integer. + */ + public function postProcess() + { + foreach ($this->info as $key => $v) { + if (count((array) $v) == 1) { + $this->info[$key] = $v->type; + } elseif (count((array) $v) == 2 && isset($v->allow_null)) { + $this->info[$key] = -$v->type; + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ContentSets.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ContentSets.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ContentSets.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ContentSets.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,170 @@ + true) indexed by name. + * @type array + * @note This is in HTMLPurifier_HTMLDefinition->info_content_sets + */ + public $lookup = array(); + + /** + * Synchronized list of defined content sets (keys of info). + * @type array + */ + protected $keys = array(); + /** + * Synchronized list of defined content values (values of info). + * @type array + */ + protected $values = array(); + + /** + * Merges in module's content sets, expands identifiers in the content + * sets and populates the keys, values and lookup member variables. + * @param HTMLPurifier_HTMLModule[] $modules List of HTMLPurifier_HTMLModule + */ + public function __construct($modules) + { + if (!is_array($modules)) { + $modules = array($modules); + } + // populate content_sets based on module hints + // sorry, no way of overloading + foreach ($modules as $module) { + foreach ($module->content_sets as $key => $value) { + $temp = $this->convertToLookup($value); + if (isset($this->lookup[$key])) { + // add it into the existing content set + $this->lookup[$key] = array_merge($this->lookup[$key], $temp); + } else { + $this->lookup[$key] = $temp; + } + } + } + $old_lookup = false; + while ($old_lookup !== $this->lookup) { + $old_lookup = $this->lookup; + foreach ($this->lookup as $i => $set) { + $add = array(); + foreach ($set as $element => $x) { + if (isset($this->lookup[$element])) { + $add += $this->lookup[$element]; + unset($this->lookup[$i][$element]); + } + } + $this->lookup[$i] += $add; + } + } + + foreach ($this->lookup as $key => $lookup) { + $this->info[$key] = implode(' | ', array_keys($lookup)); + } + $this->keys = array_keys($this->info); + $this->values = array_values($this->info); + } + + /** + * Accepts a definition; generates and assigns a ChildDef for it + * @param HTMLPurifier_ElementDef $def HTMLPurifier_ElementDef reference + * @param HTMLPurifier_HTMLModule $module Module that defined the ElementDef + */ + public function generateChildDef(&$def, $module) + { + if (!empty($def->child)) { // already done! + return; + } + $content_model = $def->content_model; + if (is_string($content_model)) { + // Assume that $this->keys is alphanumeric + $def->content_model = preg_replace_callback( + '/\b(' . implode('|', $this->keys) . ')\b/', + array($this, 'generateChildDefCallback'), + $content_model + ); + //$def->content_model = str_replace( + // $this->keys, $this->values, $content_model); + } + $def->child = $this->getChildDef($def, $module); + } + + public function generateChildDefCallback($matches) + { + return $this->info[$matches[0]]; + } + + /** + * Instantiates a ChildDef based on content_model and content_model_type + * member variables in HTMLPurifier_ElementDef + * @note This will also defer to modules for custom HTMLPurifier_ChildDef + * subclasses that need content set expansion + * @param HTMLPurifier_ElementDef $def HTMLPurifier_ElementDef to have ChildDef extracted + * @param HTMLPurifier_HTMLModule $module Module that defined the ElementDef + * @return HTMLPurifier_ChildDef corresponding to ElementDef + */ + public function getChildDef($def, $module) + { + $value = $def->content_model; + if (is_object($value)) { + trigger_error( + 'Literal object child definitions should be stored in '. + 'ElementDef->child not ElementDef->content_model', + E_USER_NOTICE + ); + return $value; + } + switch ($def->content_model_type) { + case 'required': + return new HTMLPurifier_ChildDef_Required($value); + case 'optional': + return new HTMLPurifier_ChildDef_Optional($value); + case 'empty': + return new HTMLPurifier_ChildDef_Empty(); + case 'custom': + return new HTMLPurifier_ChildDef_Custom($value); + } + // defer to its module + $return = false; + if ($module->defines_child_def) { // save a func call + $return = $module->getChildDef($def); + } + if ($return !== false) { + return $return; + } + // error-out + trigger_error( + 'Could not determine which ChildDef class to instantiate', + E_USER_ERROR + ); + return false; + } + + /** + * Converts a string list of elements separated by pipes into + * a lookup array. + * @param string $string List of elements + * @return array Lookup array of elements + */ + protected function convertToLookup($string) + { + $array = explode('|', str_replace(' ', '', $string)); + $ret = array(); + foreach ($array as $k) { + $ret[$k] = true; + } + return $ret; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Context.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Context.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Context.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Context.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,95 @@ +_storage)) { + trigger_error( + "Name $name produces collision, cannot re-register", + E_USER_ERROR + ); + return; + } + $this->_storage[$name] =& $ref; + } + + /** + * Retrieves a variable reference from the context. + * @param string $name String name + * @param bool $ignore_error Boolean whether or not to ignore error + * @return mixed + */ + public function &get($name, $ignore_error = false) + { + if (!array_key_exists($name, $this->_storage)) { + if (!$ignore_error) { + trigger_error( + "Attempted to retrieve non-existent variable $name", + E_USER_ERROR + ); + } + $var = null; // so we can return by reference + return $var; + } + return $this->_storage[$name]; + } + + /** + * Destroys a variable in the context. + * @param string $name String name + */ + public function destroy($name) + { + if (!array_key_exists($name, $this->_storage)) { + trigger_error( + "Attempted to destroy non-existent variable $name", + E_USER_ERROR + ); + return; + } + unset($this->_storage[$name]); + } + + /** + * Checks whether or not the variable exists. + * @param string $name String name + * @return bool + */ + public function exists($name) + { + return array_key_exists($name, $this->_storage); + } + + /** + * Loads a series of variables from an associative array + * @param array $context_array Assoc array of variables to load + */ + public function loadArray($context_array) + { + foreach ($context_array as $key => $discard) { + $this->register($key, $context_array[$key]); + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/CSSDefinition.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/CSSDefinition.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/CSSDefinition.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/CSSDefinition.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,533 @@ +info['text-align'] = new HTMLPurifier_AttrDef_Enum( + array('left', 'right', 'center', 'justify'), + false + ); + + $border_style = + $this->info['border-bottom-style'] = + $this->info['border-right-style'] = + $this->info['border-left-style'] = + $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum( + array( + 'none', + 'hidden', + 'dotted', + 'dashed', + 'solid', + 'double', + 'groove', + 'ridge', + 'inset', + 'outset' + ), + false + ); + + $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style); + + $this->info['clear'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'left', 'right', 'both'), + false + ); + $this->info['float'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'left', 'right'), + false + ); + $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'italic', 'oblique'), + false + ); + $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'small-caps'), + false + ); + + $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('none')), + new HTMLPurifier_AttrDef_CSS_URI() + ) + ); + + $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum( + array('inside', 'outside'), + false + ); + $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum( + array( + 'disc', + 'circle', + 'square', + 'decimal', + 'lower-roman', + 'upper-roman', + 'lower-alpha', + 'upper-alpha', + 'none' + ), + false + ); + $this->info['list-style-image'] = $uri_or_none; + + $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config); + + $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum( + array('capitalize', 'uppercase', 'lowercase', 'none'), + false + ); + $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color(); + + $this->info['background-image'] = $uri_or_none; + $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum( + array('repeat', 'repeat-x', 'repeat-y', 'no-repeat') + ); + $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum( + array('scroll', 'fixed') + ); + $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition(); + + $border_color = + $this->info['border-top-color'] = + $this->info['border-bottom-color'] = + $this->info['border-left-color'] = + $this->info['border-right-color'] = + $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('transparent')), + new HTMLPurifier_AttrDef_CSS_Color() + ) + ); + + $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config); + + $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color); + + $border_width = + $this->info['border-top-width'] = + $this->info['border-bottom-width'] = + $this->info['border-left-width'] = + $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')), + new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative + ) + ); + + $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width); + + $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Length() + ) + ); + + $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Length() + ) + ); + + $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum( + array( + 'xx-small', + 'x-small', + 'small', + 'medium', + 'large', + 'x-large', + 'xx-large', + 'larger', + 'smaller' + ) + ), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_CSS_Length() + ) + ); + + $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true) + ) + ); + + $margin = + $this->info['margin-top'] = + $this->info['margin-bottom'] = + $this->info['margin-left'] = + $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_Enum(array('auto')) + ) + ); + + $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin); + + // non-negative + $padding = + $this->info['padding-top'] = + $this->info['padding-bottom'] = + $this->info['padding-left'] = + $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true) + ) + ); + + $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding); + + $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage() + ) + ); + + $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('auto', 'initial', 'inherit')) + ) + ); + $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit')) + ) + ); + $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit')) + ) + ); + $max = $config->get('CSS.MaxImgLength'); + + $this->info['width'] = + $this->info['height'] = + $max === null ? + $trusted_wh : + new HTMLPurifier_AttrDef_Switch( + 'img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('auto')) + ) + ), + // For everyone else: + $trusted_wh + ); + $this->info['min-width'] = + $this->info['min-height'] = + $max === null ? + $trusted_min_wh : + new HTMLPurifier_AttrDef_Switch( + 'img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit')) + ) + ), + // For everyone else: + $trusted_min_wh + ); + $this->info['max-width'] = + $this->info['max-height'] = + $max === null ? + $trusted_max_wh : + new HTMLPurifier_AttrDef_Switch( + 'img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit')) + ) + ), + // For everyone else: + $trusted_max_wh + ); + + $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration(); + + $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily(); + + // this could use specialized code + $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum( + array( + 'normal', + 'bold', + 'bolder', + 'lighter', + '100', + '200', + '300', + '400', + '500', + '600', + '700', + '800', + '900' + ), + false + ); + + // MUST be called after other font properties, as it references + // a CSSDefinition object + $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config); + + // same here + $this->info['border'] = + $this->info['border-bottom'] = + $this->info['border-top'] = + $this->info['border-left'] = + $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config); + + $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum( + array('collapse', 'separate') + ); + + $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum( + array('top', 'bottom') + ); + + $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum( + array('auto', 'fixed') + ); + + $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum( + array( + 'baseline', + 'sub', + 'super', + 'top', + 'text-top', + 'middle', + 'bottom', + 'text-bottom' + ) + ), + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage() + ) + ); + + $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2); + + // These CSS properties don't work on many browsers, but we live + // in THE FUTURE! + $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum( + array('nowrap', 'normal', 'pre', 'pre-wrap', 'pre-line') + ); + + if ($config->get('CSS.Proprietary')) { + $this->doSetupProprietary($config); + } + + if ($config->get('CSS.AllowTricky')) { + $this->doSetupTricky($config); + } + + if ($config->get('CSS.Trusted')) { + $this->doSetupTrusted($config); + } + + $allow_important = $config->get('CSS.AllowImportant'); + // wrap all attr-defs with decorator that handles !important + foreach ($this->info as $k => $v) { + $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important); + } + + $this->setupConfigStuff($config); + } + + /** + * @param HTMLPurifier_Config $config + */ + protected function doSetupProprietary($config) + { + // Internet Explorer only scrollbar colors + $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + + // vendor specific prefixes of opacity + $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + + // only opacity, for now + $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter(); + + // more CSS3 + $this->info['page-break-after'] = + $this->info['page-break-before'] = new HTMLPurifier_AttrDef_Enum( + array( + 'auto', + 'always', + 'avoid', + 'left', + 'right' + ) + ); + $this->info['page-break-inside'] = new HTMLPurifier_AttrDef_Enum(array('auto', 'avoid')); + + $border_radius = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Percentage(true), // disallow negative + new HTMLPurifier_AttrDef_CSS_Length('0') // disallow negative + )); + + $this->info['border-top-left-radius'] = + $this->info['border-top-right-radius'] = + $this->info['border-bottom-right-radius'] = + $this->info['border-bottom-left-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 2); + // TODO: support SLASH syntax + $this->info['border-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 4); + + } + + /** + * @param HTMLPurifier_Config $config + */ + protected function doSetupTricky($config) + { + $this->info['display'] = new HTMLPurifier_AttrDef_Enum( + array( + 'inline', + 'block', + 'list-item', + 'run-in', + 'compact', + 'marker', + 'table', + 'inline-block', + 'inline-table', + 'table-row-group', + 'table-header-group', + 'table-footer-group', + 'table-row', + 'table-column-group', + 'table-column', + 'table-cell', + 'table-caption', + 'none' + ) + ); + $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum( + array('visible', 'hidden', 'collapse') + ); + $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(array('visible', 'hidden', 'auto', 'scroll')); + $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + } + + /** + * @param HTMLPurifier_Config $config + */ + protected function doSetupTrusted($config) + { + $this->info['position'] = new HTMLPurifier_AttrDef_Enum( + array('static', 'relative', 'absolute', 'fixed') + ); + $this->info['top'] = + $this->info['left'] = + $this->info['right'] = + $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_Enum(array('auto')), + ) + ); + $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Integer(), + new HTMLPurifier_AttrDef_Enum(array('auto')), + ) + ); + } + + /** + * Performs extra config-based processing. Based off of + * HTMLPurifier_HTMLDefinition. + * @param HTMLPurifier_Config $config + * @todo Refactor duplicate elements into common class (probably using + * composition, not inheritance). + */ + protected function setupConfigStuff($config) + { + // setup allowed elements + $support = "(for information on implementing this, see the " . + "support forums) "; + $allowed_properties = $config->get('CSS.AllowedProperties'); + if ($allowed_properties !== null) { + foreach ($this->info as $name => $d) { + if (!isset($allowed_properties[$name])) { + unset($this->info[$name]); + } + unset($allowed_properties[$name]); + } + // emit errors + foreach ($allowed_properties as $name => $d) { + // :TODO: Is this htmlspecialchars() call really necessary? + $name = htmlspecialchars($name); + trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING); + } + } + + $forbidden_properties = $config->get('CSS.ForbiddenProperties'); + if ($forbidden_properties !== null) { + foreach ($this->info as $name => $d) { + if (isset($forbidden_properties[$name])) { + unset($this->info[$name]); + } + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,78 @@ +definitions[$this->generateKey($config)] = $def; + } + return $status; + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function set($def, $config) + { + $status = parent::set($def, $config); + if ($status) { + $this->definitions[$this->generateKey($config)] = $def; + } + return $status; + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function replace($def, $config) + { + $status = parent::replace($def, $config); + if ($status) { + $this->definitions[$this->generateKey($config)] = $def; + } + return $status; + } + + /** + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function get($config) + { + $key = $this->generateKey($config); + if (isset($this->definitions[$key])) { + return $this->definitions[$key]; + } + $this->definitions[$key] = parent::get($config); + return $this->definitions[$key]; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Template.php.in php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Template.php.in --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Template.php.in 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Decorator/Template.php.in 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,82 @@ +copy(); + // reference is necessary for mocks in PHP 4 + $decorator->cache =& $cache; + $decorator->type = $cache->type; + return $decorator; + } + + /** + * Cross-compatible clone substitute + * @return HTMLPurifier_DefinitionCache_Decorator + */ + public function copy() + { + return new HTMLPurifier_DefinitionCache_Decorator(); + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function add($def, $config) + { + return $this->cache->add($def, $config); + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function set($def, $config) + { + return $this->cache->set($def, $config); + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function replace($def, $config) + { + return $this->cache->replace($def, $config); + } + + /** + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function get($config) + { + return $this->cache->get($config); + } + + /** + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function remove($config) + { + return $this->cache->remove($config); + } + + /** + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function flush($config) + { + return $this->cache->flush($config); + } + + /** + * @param HTMLPurifier_Config $config + * @return mixed + */ + public function cleanup($config) + { + return $this->cache->cleanup($config); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Null.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Null.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Null.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache/Null.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,76 @@ +checkDefType($def)) { + return; + } + $file = $this->generateFilePath($config); + if (file_exists($file)) { + return false; + } + if (!$this->_prepareDir($config)) { + return false; + } + return $this->_write($file, serialize($def), $config); + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return int|bool + */ + public function set($def, $config) + { + if (!$this->checkDefType($def)) { + return; + } + $file = $this->generateFilePath($config); + if (!$this->_prepareDir($config)) { + return false; + } + return $this->_write($file, serialize($def), $config); + } + + /** + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + * @return int|bool + */ + public function replace($def, $config) + { + if (!$this->checkDefType($def)) { + return; + } + $file = $this->generateFilePath($config); + if (!file_exists($file)) { + return false; + } + if (!$this->_prepareDir($config)) { + return false; + } + return $this->_write($file, serialize($def), $config); + } + + /** + * @param HTMLPurifier_Config $config + * @return bool|HTMLPurifier_Config + */ + public function get($config) + { + $file = $this->generateFilePath($config); + if (!file_exists($file)) { + return false; + } + return unserialize(file_get_contents($file)); + } + + /** + * @param HTMLPurifier_Config $config + * @return bool + */ + public function remove($config) + { + $file = $this->generateFilePath($config); + if (!file_exists($file)) { + return false; + } + return unlink($file); + } + + /** + * @param HTMLPurifier_Config $config + * @return bool + */ + public function flush($config) + { + if (!$this->_prepareDir($config)) { + return false; + } + $dir = $this->generateDirectoryPath($config); + $dh = opendir($dir); + // Apparently, on some versions of PHP, readdir will return + // an empty string if you pass an invalid argument to readdir. + // So you need this test. See #49. + if (false === $dh) { + return false; + } + while (false !== ($filename = readdir($dh))) { + if (empty($filename)) { + continue; + } + if ($filename[0] === '.') { + continue; + } + unlink($dir . '/' . $filename); + } + closedir($dh); + return true; + } + + /** + * @param HTMLPurifier_Config $config + * @return bool + */ + public function cleanup($config) + { + if (!$this->_prepareDir($config)) { + return false; + } + $dir = $this->generateDirectoryPath($config); + $dh = opendir($dir); + // See #49 (and above). + if (false === $dh) { + return false; + } + while (false !== ($filename = readdir($dh))) { + if (empty($filename)) { + continue; + } + if ($filename[0] === '.') { + continue; + } + $key = substr($filename, 0, strlen($filename) - 4); + if ($this->isOld($key, $config)) { + unlink($dir . '/' . $filename); + } + } + closedir($dh); + return true; + } + + /** + * Generates the file path to the serial file corresponding to + * the configuration and definition name + * @param HTMLPurifier_Config $config + * @return string + * @todo Make protected + */ + public function generateFilePath($config) + { + $key = $this->generateKey($config); + return $this->generateDirectoryPath($config) . '/' . $key . '.ser'; + } + + /** + * Generates the path to the directory contain this cache's serial files + * @param HTMLPurifier_Config $config + * @return string + * @note No trailing slash + * @todo Make protected + */ + public function generateDirectoryPath($config) + { + $base = $this->generateBaseDirectoryPath($config); + return $base . '/' . $this->type; + } + + /** + * Generates path to base directory that contains all definition type + * serials + * @param HTMLPurifier_Config $config + * @return mixed|string + * @todo Make protected + */ + public function generateBaseDirectoryPath($config) + { + $base = $config->get('Cache.SerializerPath'); + $base = is_null($base) ? HTMLPURIFIER_PREFIX . '/HTMLPurifier/DefinitionCache/Serializer' : $base; + return $base; + } + + /** + * Convenience wrapper function for file_put_contents + * @param string $file File name to write to + * @param string $data Data to write into file + * @param HTMLPurifier_Config $config + * @return int|bool Number of bytes written if success, or false if failure. + */ + private function _write($file, $data, $config) + { + $result = file_put_contents($file, $data); + if ($result !== false) { + // set permissions of the new file (no execute) + $chmod = $config->get('Cache.SerializerPermissions'); + if ($chmod !== null) { + chmod($file, $chmod & 0666); + } + } + return $result; + } + + /** + * Prepares the directory that this type stores the serials in + * @param HTMLPurifier_Config $config + * @return bool True if successful + */ + private function _prepareDir($config) + { + $directory = $this->generateDirectoryPath($config); + $chmod = $config->get('Cache.SerializerPermissions'); + if ($chmod === null) { + if (!@mkdir($directory) && !is_dir($directory)) { + trigger_error( + 'Could not create directory ' . $directory . '', + E_USER_WARNING + ); + return false; + } + return true; + } + if (!is_dir($directory)) { + $base = $this->generateBaseDirectoryPath($config); + if (!is_dir($base)) { + trigger_error( + 'Base directory ' . $base . ' does not exist, + please create or change using %Cache.SerializerPath', + E_USER_WARNING + ); + return false; + } elseif (!$this->_testPermissions($base, $chmod)) { + return false; + } + if (!@mkdir($directory, $chmod) && !is_dir($directory)) { + trigger_error( + 'Could not create directory ' . $directory . '', + E_USER_WARNING + ); + return false; + } + if (!$this->_testPermissions($directory, $chmod)) { + return false; + } + } elseif (!$this->_testPermissions($directory, $chmod)) { + return false; + } + return true; + } + + /** + * Tests permissions on a directory and throws out friendly + * error messages and attempts to chmod it itself if possible + * @param string $dir Directory path + * @param int $chmod Permissions + * @return bool True if directory is writable + */ + private function _testPermissions($dir, $chmod) + { + // early abort, if it is writable, everything is hunky-dory + if (is_writable($dir)) { + return true; + } + if (!is_dir($dir)) { + // generally, you'll want to handle this beforehand + // so a more specific error message can be given + trigger_error( + 'Directory ' . $dir . ' does not exist', + E_USER_WARNING + ); + return false; + } + if (function_exists('posix_getuid') && $chmod !== null) { + // POSIX system, we can give more specific advice + if (fileowner($dir) === posix_getuid()) { + // we can chmod it ourselves + $chmod = $chmod | 0700; + if (chmod($dir, $chmod)) { + return true; + } + } elseif (filegroup($dir) === posix_getgid()) { + $chmod = $chmod | 0070; + } else { + // PHP's probably running as nobody, so we'll + // need to give global permissions + $chmod = $chmod | 0777; + } + trigger_error( + 'Directory ' . $dir . ' not writable, ' . + 'please chmod to ' . decoct($chmod), + E_USER_WARNING + ); + } else { + // generic error message + trigger_error( + 'Directory ' . $dir . ' not writable, ' . + 'please alter file permissions', + E_USER_WARNING + ); + } + return false; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCacheFactory.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCacheFactory.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCacheFactory.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCacheFactory.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,106 @@ + array()); + + /** + * @type array + */ + protected $implementations = array(); + + /** + * @type HTMLPurifier_DefinitionCache_Decorator[] + */ + protected $decorators = array(); + + /** + * Initialize default decorators + */ + public function setup() + { + $this->addDecorator('Cleanup'); + } + + /** + * Retrieves an instance of global definition cache factory. + * @param HTMLPurifier_DefinitionCacheFactory $prototype + * @return HTMLPurifier_DefinitionCacheFactory + */ + public static function instance($prototype = null) + { + static $instance; + if ($prototype !== null) { + $instance = $prototype; + } elseif ($instance === null || $prototype === true) { + $instance = new HTMLPurifier_DefinitionCacheFactory(); + $instance->setup(); + } + return $instance; + } + + /** + * Registers a new definition cache object + * @param string $short Short name of cache object, for reference + * @param string $long Full class name of cache object, for construction + */ + public function register($short, $long) + { + $this->implementations[$short] = $long; + } + + /** + * Factory method that creates a cache object based on configuration + * @param string $type Name of definitions handled by cache + * @param HTMLPurifier_Config $config Config instance + * @return mixed + */ + public function create($type, $config) + { + $method = $config->get('Cache.DefinitionImpl'); + if ($method === null) { + return new HTMLPurifier_DefinitionCache_Null($type); + } + if (!empty($this->caches[$method][$type])) { + return $this->caches[$method][$type]; + } + if (isset($this->implementations[$method]) && + class_exists($class = $this->implementations[$method], false)) { + $cache = new $class($type); + } else { + if ($method != 'Serializer') { + trigger_error("Unrecognized DefinitionCache $method, using Serializer instead", E_USER_WARNING); + } + $cache = new HTMLPurifier_DefinitionCache_Serializer($type); + } + foreach ($this->decorators as $decorator) { + $new_cache = $decorator->decorate($cache); + // prevent infinite recursion in PHP 4 + unset($cache); + $cache = $new_cache; + } + $this->caches[$method][$type] = $cache; + return $this->caches[$method][$type]; + } + + /** + * Registers a decorator to add to all new cache objects + * @param HTMLPurifier_DefinitionCache_Decorator|string $decorator An instance or the name of a decorator + */ + public function addDecorator($decorator) + { + if (is_string($decorator)) { + $class = "HTMLPurifier_DefinitionCache_Decorator_$decorator"; + $decorator = new $class; + } + $this->decorators[$decorator->name] = $decorator; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DefinitionCache.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,129 @@ +type = $type; + } + + /** + * Generates a unique identifier for a particular configuration + * @param HTMLPurifier_Config $config Instance of HTMLPurifier_Config + * @return string + */ + public function generateKey($config) + { + return $config->version . ',' . // possibly replace with function calls + $config->getBatchSerial($this->type) . ',' . + $config->get($this->type . '.DefinitionRev'); + } + + /** + * Tests whether or not a key is old with respect to the configuration's + * version and revision number. + * @param string $key Key to test + * @param HTMLPurifier_Config $config Instance of HTMLPurifier_Config to test against + * @return bool + */ + public function isOld($key, $config) + { + if (substr_count($key, ',') < 2) { + return true; + } + list($version, $hash, $revision) = explode(',', $key, 3); + $compare = version_compare($version, $config->version); + // version mismatch, is always old + if ($compare != 0) { + return true; + } + // versions match, ids match, check revision number + if ($hash == $config->getBatchSerial($this->type) && + $revision < $config->get($this->type . '.DefinitionRev')) { + return true; + } + return false; + } + + /** + * Checks if a definition's type jives with the cache's type + * @note Throws an error on failure + * @param HTMLPurifier_Definition $def Definition object to check + * @return bool true if good, false if not + */ + public function checkDefType($def) + { + if ($def->type !== $this->type) { + trigger_error("Cannot use definition of type {$def->type} in cache for {$this->type}"); + return false; + } + return true; + } + + /** + * Adds a definition object to the cache + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + */ + abstract public function add($def, $config); + + /** + * Unconditionally saves a definition object to the cache + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + */ + abstract public function set($def, $config); + + /** + * Replace an object in the cache + * @param HTMLPurifier_Definition $def + * @param HTMLPurifier_Config $config + */ + abstract public function replace($def, $config); + + /** + * Retrieves a definition object from the cache + * @param HTMLPurifier_Config $config + */ + abstract public function get($config); + + /** + * Removes a definition object to the cache + * @param HTMLPurifier_Config $config + */ + abstract public function remove($config); + + /** + * Clears all objects from cache + * @param HTMLPurifier_Config $config + */ + abstract public function flush($config); + + /** + * Clears all expired (older version or revision) objects from cache + * @note Be careful implementing this method as flush. Flush must + * not interfere with other Definition types, and cleanup() + * should not be repeatedly called by userland code. + * @param HTMLPurifier_Config $config + */ + abstract public function cleanup($config); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Definition.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Definition.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Definition.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Definition.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,55 @@ +setup) { + return; + } + $this->setup = true; + $this->doSetup($config); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Doctype.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Doctype.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Doctype.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Doctype.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,73 @@ +renderDoctype. + * If structure changes, please update that function. + */ +class HTMLPurifier_Doctype +{ + /** + * Full name of doctype + * @type string + */ + public $name; + + /** + * List of standard modules (string identifiers or literal objects) + * that this doctype uses + * @type array + */ + public $modules = array(); + + /** + * List of modules to use for tidying up code + * @type array + */ + public $tidyModules = array(); + + /** + * Is the language derived from XML (i.e. XHTML)? + * @type bool + */ + public $xml = true; + + /** + * List of aliases for this doctype + * @type array + */ + public $aliases = array(); + + /** + * Public DTD identifier + * @type string + */ + public $dtdPublic; + + /** + * System DTD identifier + * @type string + */ + public $dtdSystem; + + public function __construct( + $name = null, + $xml = true, + $modules = array(), + $tidyModules = array(), + $aliases = array(), + $dtd_public = null, + $dtd_system = null + ) { + $this->name = $name; + $this->xml = $xml; + $this->modules = $modules; + $this->tidyModules = $tidyModules; + $this->aliases = $aliases; + $this->dtdPublic = $dtd_public; + $this->dtdSystem = $dtd_system; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DoctypeRegistry.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DoctypeRegistry.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/DoctypeRegistry.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/DoctypeRegistry.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,142 @@ +doctypes[$doctype->name] = $doctype; + $name = $doctype->name; + // hookup aliases + foreach ($doctype->aliases as $alias) { + if (isset($this->doctypes[$alias])) { + continue; + } + $this->aliases[$alias] = $name; + } + // remove old aliases + if (isset($this->aliases[$name])) { + unset($this->aliases[$name]); + } + return $doctype; + } + + /** + * Retrieves reference to a doctype of a certain name + * @note This function resolves aliases + * @note When possible, use the more fully-featured make() + * @param string $doctype Name of doctype + * @return HTMLPurifier_Doctype Editable doctype object + */ + public function get($doctype) + { + if (isset($this->aliases[$doctype])) { + $doctype = $this->aliases[$doctype]; + } + if (!isset($this->doctypes[$doctype])) { + trigger_error('Doctype ' . htmlspecialchars($doctype) . ' does not exist', E_USER_ERROR); + $anon = new HTMLPurifier_Doctype($doctype); + return $anon; + } + return $this->doctypes[$doctype]; + } + + /** + * Creates a doctype based on a configuration object, + * will perform initialization on the doctype + * @note Use this function to get a copy of doctype that config + * can hold on to (this is necessary in order to tell + * Generator whether or not the current document is XML + * based or not). + * @param HTMLPurifier_Config $config + * @return HTMLPurifier_Doctype + */ + public function make($config) + { + return clone $this->get($this->getDoctypeFromConfig($config)); + } + + /** + * Retrieves the doctype from the configuration object + * @param HTMLPurifier_Config $config + * @return string + */ + public function getDoctypeFromConfig($config) + { + // recommended test + $doctype = $config->get('HTML.Doctype'); + if (!empty($doctype)) { + return $doctype; + } + $doctype = $config->get('HTML.CustomDoctype'); + if (!empty($doctype)) { + return $doctype; + } + // backwards-compatibility + if ($config->get('HTML.XHTML')) { + $doctype = 'XHTML 1.0'; + } else { + $doctype = 'HTML 4.01'; + } + if ($config->get('HTML.Strict')) { + $doctype .= ' Strict'; + } else { + $doctype .= ' Transitional'; + } + return $doctype; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ElementDef.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ElementDef.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ElementDef.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ElementDef.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,216 @@ +setup(), this array may also + * contain an array at index 0 that indicates which attribute + * collections to load into the full array. It may also + * contain string indentifiers in lieu of HTMLPurifier_AttrDef, + * see HTMLPurifier_AttrTypes on how they are expanded during + * HTMLPurifier_HTMLDefinition->setup() processing. + */ + public $attr = array(); + + // XXX: Design note: currently, it's not possible to override + // previously defined AttrTransforms without messing around with + // the final generated config. This is by design; a previous version + // used an associated list of attr_transform, but it was extremely + // easy to accidentally override other attribute transforms by + // forgetting to specify an index (and just using 0.) While we + // could check this by checking the index number and complaining, + // there is a second problem which is that it is not at all easy to + // tell when something is getting overridden. Combine this with a + // codebase where this isn't really being used, and it's perfect for + // nuking. + + /** + * List of tags HTMLPurifier_AttrTransform to be done before validation. + * @type array + */ + public $attr_transform_pre = array(); + + /** + * List of tags HTMLPurifier_AttrTransform to be done after validation. + * @type array + */ + public $attr_transform_post = array(); + + /** + * HTMLPurifier_ChildDef of this tag. + * @type HTMLPurifier_ChildDef + */ + public $child; + + /** + * Abstract string representation of internal ChildDef rules. + * @see HTMLPurifier_ContentSets for how this is parsed and then transformed + * into an HTMLPurifier_ChildDef. + * @warning This is a temporary variable that is not available after + * being processed by HTMLDefinition + * @type string + */ + public $content_model; + + /** + * Value of $child->type, used to determine which ChildDef to use, + * used in combination with $content_model. + * @warning This must be lowercase + * @warning This is a temporary variable that is not available after + * being processed by HTMLDefinition + * @type string + */ + public $content_model_type; + + /** + * Does the element have a content model (#PCDATA | Inline)*? This + * is important for chameleon ins and del processing in + * HTMLPurifier_ChildDef_Chameleon. Dynamically set: modules don't + * have to worry about this one. + * @type bool + */ + public $descendants_are_inline = false; + + /** + * List of the names of required attributes this element has. + * Dynamically populated by HTMLPurifier_HTMLDefinition::getElement() + * @type array + */ + public $required_attr = array(); + + /** + * Lookup table of tags excluded from all descendants of this tag. + * @type array + * @note SGML permits exclusions for all descendants, but this is + * not possible with DTDs or XML Schemas. W3C has elected to + * use complicated compositions of content_models to simulate + * exclusion for children, but we go the simpler, SGML-style + * route of flat-out exclusions, which correctly apply to + * all descendants and not just children. Note that the XHTML + * Modularization Abstract Modules are blithely unaware of such + * distinctions. + */ + public $excludes = array(); + + /** + * This tag is explicitly auto-closed by the following tags. + * @type array + */ + public $autoclose = array(); + + /** + * If a foreign element is found in this element, test if it is + * allowed by this sub-element; if it is, instead of closing the + * current element, place it inside this element. + * @type string + */ + public $wrap; + + /** + * Whether or not this is a formatting element affected by the + * "Active Formatting Elements" algorithm. + * @type bool + */ + public $formatting; + + /** + * Low-level factory constructor for creating new standalone element defs + */ + public static function create($content_model, $content_model_type, $attr) + { + $def = new HTMLPurifier_ElementDef(); + $def->content_model = $content_model; + $def->content_model_type = $content_model_type; + $def->attr = $attr; + return $def; + } + + /** + * Merges the values of another element definition into this one. + * Values from the new element def take precedence if a value is + * not mergeable. + * @param HTMLPurifier_ElementDef $def + */ + public function mergeIn($def) + { + // later keys takes precedence + foreach ($def->attr as $k => $v) { + if ($k === 0) { + // merge in the includes + // sorry, no way to override an include + foreach ($v as $v2) { + $this->attr[0][] = $v2; + } + continue; + } + if ($v === false) { + if (isset($this->attr[$k])) { + unset($this->attr[$k]); + } + continue; + } + $this->attr[$k] = $v; + } + $this->_mergeAssocArray($this->excludes, $def->excludes); + $this->attr_transform_pre = array_merge($this->attr_transform_pre, $def->attr_transform_pre); + $this->attr_transform_post = array_merge($this->attr_transform_post, $def->attr_transform_post); + + if (!empty($def->content_model)) { + $this->content_model = + str_replace("#SUPER", $this->content_model, $def->content_model); + $this->child = false; + } + if (!empty($def->content_model_type)) { + $this->content_model_type = $def->content_model_type; + $this->child = false; + } + if (!is_null($def->child)) { + $this->child = $def->child; + } + if (!is_null($def->formatting)) { + $this->formatting = $def->formatting; + } + if ($def->descendants_are_inline) { + $this->descendants_are_inline = $def->descendants_are_inline; + } + } + + /** + * Merges one array into another, removes values which equal false + * @param $a1 Array by reference that is merged into + * @param $a2 Array that merges into $a1 + */ + private function _mergeAssocArray(&$a1, $a2) + { + foreach ($a2 as $k => $v) { + if ($v === false) { + if (isset($a1[$k])) { + unset($a1[$k]); + } + continue; + } + $a1[$k] = $v; + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Encoder.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Encoder.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Encoder.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Encoder.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,617 @@ += $c) { + $r .= self::unsafeIconv($in, $out, substr($text, $i)); + break; + } + // wibble the boundary + if (0x80 != (0xC0 & ord($text[$i + $max_chunk_size]))) { + $chunk_size = $max_chunk_size; + } elseif (0x80 != (0xC0 & ord($text[$i + $max_chunk_size - 1]))) { + $chunk_size = $max_chunk_size - 1; + } elseif (0x80 != (0xC0 & ord($text[$i + $max_chunk_size - 2]))) { + $chunk_size = $max_chunk_size - 2; + } elseif (0x80 != (0xC0 & ord($text[$i + $max_chunk_size - 3]))) { + $chunk_size = $max_chunk_size - 3; + } else { + return false; // rather confusing UTF-8... + } + $chunk = substr($text, $i, $chunk_size); // substr doesn't mind overlong lengths + $r .= self::unsafeIconv($in, $out, $chunk); + $i += $chunk_size; + } + return $r; + } else { + return false; + } + } else { + return false; + } + } + + /** + * Cleans a UTF-8 string for well-formedness and SGML validity + * + * It will parse according to UTF-8 and return a valid UTF8 string, with + * non-SGML codepoints excluded. + * + * Specifically, it will permit: + * \x{9}\x{A}\x{D}\x{20}-\x{7E}\x{A0}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF} + * Source: https://www.w3.org/TR/REC-xml/#NT-Char + * Arguably this function should be modernized to the HTML5 set + * of allowed characters: + * https://www.w3.org/TR/html5/syntax.html#preprocessing-the-input-stream + * which simultaneously expand and restrict the set of allowed characters. + * + * @param string $str The string to clean + * @param bool $force_php + * @return string + * + * @note Just for reference, the non-SGML code points are 0 to 31 and + * 127 to 159, inclusive. However, we allow code points 9, 10 + * and 13, which are the tab, line feed and carriage return + * respectively. 128 and above the code points map to multibyte + * UTF-8 representations. + * + * @note Fallback code adapted from utf8ToUnicode by Henri Sivonen and + * hsivonen@iki.fi atautoplayvideos. Pipe up on the HTML Purifier forums if this + is a capability you want. +' . $this->locale->getMessage('ErrorCollector: No errors') . '
'; + } else { + return '- ' . implode('
- ', $ret) . '
'; + // W3C uses an icon to indicate the severity of the error. + $error = $this->locale->getErrorName($severity); + $string .= "$error "; + if (!is_null($line) && !is_null($col)) { + $string .= "Line $line, Column $col: "; + } else { + $string .= 'End of Document: '; + } + $string .= '' . $this->generator->escape($msg) . ' '; + $string .= ''; + // Here, have a marker for the character on the column appropriate. + // Be sure to clip extremely long lines. + //$string .= ''; + //$string .= ''; + //$string .= '
'; + $ret[] = $string; + } + foreach ($current->children as $array) { + $context[] = $current; + $stack = array_merge($stack, array_reverse($array, true)); + for ($i = count($array); $i > 0; $i--) { + $context_stack[] = $context; + } + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ErrorStruct.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ErrorStruct.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/ErrorStruct.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/ErrorStruct.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,74 @@ +children[$type][$id])) { + $this->children[$type][$id] = new HTMLPurifier_ErrorStruct(); + $this->children[$type][$id]->type = $type; + } + return $this->children[$type][$id]; + } + + /** + * @param int $severity + * @param string $message + */ + public function addError($severity, $message) + { + $this->errors[] = array($severity, $message); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Exception.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Exception.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Exception.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Exception.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,12 @@ + blocks from input HTML, cleans them up + * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks') + * so they can be used elsewhere in the document. + * + * @note + * See tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php for + * sample usage. + * + * @note + * This filter can also be used on stylesheets not included in the + * document--something purists would probably prefer. Just directly + * call HTMLPurifier_Filter_ExtractStyleBlocks->cleanCSS() + */ +class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter +{ + /** + * @type string + */ + public $name = 'ExtractStyleBlocks'; + + /** + * @type array + */ + private $_styleMatches = array(); + + /** + * @type csstidy + */ + private $_tidy; + + /** + * @type HTMLPurifier_AttrDef_HTML_ID + */ + private $_id_attrdef; + + /** + * @type HTMLPurifier_AttrDef_CSS_Ident + */ + private $_class_attrdef; + + /** + * @type HTMLPurifier_AttrDef_Enum + */ + private $_enum_attrdef; + + public function __construct() + { + $this->_tidy = new csstidy(); + $this->_tidy->set_cfg('lowercase_s', false); + $this->_id_attrdef = new HTMLPurifier_AttrDef_HTML_ID(true); + $this->_class_attrdef = new HTMLPurifier_AttrDef_CSS_Ident(); + $this->_enum_attrdef = new HTMLPurifier_AttrDef_Enum( + array( + 'first-child', + 'link', + 'visited', + 'active', + 'hover', + 'focus' + ) + ); + } + + /** + * Save the contents of CSS blocks to style matches + * @param array $matches preg_replace style $matches array + */ + protected function styleCallback($matches) + { + $this->_styleMatches[] = $matches[1]; + } + + /** + * Removes inline + // we must not grab foo in a font-family prop). + if ($config->get('Filter.ExtractStyleBlocks.Escaping')) { + $css = str_replace( + array('<', '>', '&'), + array('\3C ', '\3E ', '\26 '), + $css + ); + } + return $css; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter/YouTube.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter/YouTube.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter/YouTube.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter/YouTube.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,65 @@ +]+>.+?' . + '(?:http:)?//www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?#s'; + $pre_replace = ''; + return preg_replace($pre_regex, $pre_replace, $html); + } + + /** + * @param string $html + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return string + */ + public function postFilter($html, $config, $context) + { + $post_regex = '##'; + return preg_replace_callback($post_regex, array($this, 'postFilterCallback'), $html); + } + + /** + * @param $url + * @return string + */ + protected function armorUrl($url) + { + return str_replace('--', '--', $url); + } + + /** + * @param array $matches + * @return string + */ + protected function postFilterCallback($matches) + { + $url = $this->armorUrl($matches[1]); + return ''; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Filter.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,56 @@ +preFilter, + * 2->preFilter, 3->preFilter, purify, 3->postFilter, 2->postFilter, + * 1->postFilter. + * + * @note Methods are not declared abstract as it is perfectly legitimate + * for an implementation not to want anything to happen on a step + */ + +class HTMLPurifier_Filter +{ + + /** + * Name of the filter for identification purposes. + * @type string + */ + public $name; + + /** + * Pre-processor function, handles HTML before HTML Purifier + * @param string $html + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return string + */ + public function preFilter($html, $config, $context) + { + return $html; + } + + /** + * Post-processor function, handles HTML after HTML Purifier + * @param string $html + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return string + */ + public function postFilter($html, $config, $context) + { + return $html; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Generator.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Generator.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Generator.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Generator.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,286 @@ + tags. + * @type bool + */ + private $_scriptFix = false; + + /** + * Cache of HTMLDefinition during HTML output to determine whether or + * not attributes should be minimized. + * @type HTMLPurifier_HTMLDefinition + */ + private $_def; + + /** + * Cache of %Output.SortAttr. + * @type bool + */ + private $_sortAttr; + + /** + * Cache of %Output.FlashCompat. + * @type bool + */ + private $_flashCompat; + + /** + * Cache of %Output.FixInnerHTML. + * @type bool + */ + private $_innerHTMLFix; + + /** + * Stack for keeping track of object information when outputting IE + * compatibility code. + * @type array + */ + private $_flashStack = array(); + + /** + * Configuration for the generator + * @type HTMLPurifier_Config + */ + protected $config; + + /** + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + */ + public function __construct($config, $context) + { + $this->config = $config; + $this->_scriptFix = $config->get('Output.CommentScriptContents'); + $this->_innerHTMLFix = $config->get('Output.FixInnerHTML'); + $this->_sortAttr = $config->get('Output.SortAttr'); + $this->_flashCompat = $config->get('Output.FlashCompat'); + $this->_def = $config->getHTMLDefinition(); + $this->_xhtml = $this->_def->doctype->xml; + } + + /** + * Generates HTML from an array of tokens. + * @param HTMLPurifier_Token[] $tokens Array of HTMLPurifier_Token + * @return string Generated HTML + */ + public function generateFromTokens($tokens) + { + if (!$tokens) { + return ''; + } + + // Basic algorithm + $html = ''; + for ($i = 0, $size = count($tokens); $i < $size; $i++) { + if ($this->_scriptFix && $tokens[$i]->name === 'script' + && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) { + // script special case + // the contents of the script block must be ONE token + // for this to work. + $html .= $this->generateFromToken($tokens[$i++]); + $html .= $this->generateScriptFromToken($tokens[$i++]); + } + $html .= $this->generateFromToken($tokens[$i]); + } + + // Tidy cleanup + if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) { + $tidy = new Tidy; + $tidy->parseString( + $html, + array( + 'indent'=> true, + 'output-xhtml' => $this->_xhtml, + 'show-body-only' => true, + 'indent-spaces' => 2, + 'wrap' => 68, + ), + 'utf8' + ); + $tidy->cleanRepair(); + $html = (string) $tidy; // explicit cast necessary + } + + // Normalize newlines to system defined value + if ($this->config->get('Core.NormalizeNewlines')) { + $nl = $this->config->get('Output.Newline'); + if ($nl === null) { + $nl = PHP_EOL; + } + if ($nl !== "\n") { + $html = str_replace("\n", $nl, $html); + } + } + return $html; + } + + /** + * Generates HTML from a single token. + * @param HTMLPurifier_Token $token HTMLPurifier_Token object. + * @return string Generated HTML + */ + public function generateFromToken($token) + { + if (!$token instanceof HTMLPurifier_Token) { + trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); + return ''; + + } elseif ($token instanceof HTMLPurifier_Token_Start) { + $attr = $this->generateAttributes($token->attr, $token->name); + if ($this->_flashCompat) { + if ($token->name == "object") { + $flash = new stdClass(); + $flash->attr = $token->attr; + $flash->param = array(); + $this->_flashStack[] = $flash; + } + } + return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_End) { + $_extra = ''; + if ($this->_flashCompat) { + if ($token->name == "object" && !empty($this->_flashStack)) { + // doesn't do anything for now + } + } + return $_extra . 'name . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_Empty) { + if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) { + $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value']; + } + $attr = $this->generateAttributes($token->attr, $token->name); + return '<' . $token->name . ($attr ? ' ' : '') . $attr . + ( $this->_xhtml ? ' /': '' ) //
v.
+ . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_Text) { + return $this->escape($token->data, ENT_NOQUOTES); + + } elseif ($token instanceof HTMLPurifier_Token_Comment) { + return ''; + } else { + return ''; + + } + } + + /** + * Special case processor for the contents of script tags + * @param HTMLPurifier_Token $token HTMLPurifier_Token object. + * @return string + * @warning This runs into problems if there's already a literal + * --> somewhere inside the script contents. + */ + public function generateScriptFromToken($token) + { + if (!$token instanceof HTMLPurifier_Token_Text) { + return $this->generateFromToken($token); + } + // Thanks+ // becomes + //
+ // becomes + //
+ // Fortunately, all we need to do is trigger an appropriate + // quoting style, which we do by adding an extra space. + // This also is consistent with the W3C spec, which states + // that user agents may ignore leading or trailing + // whitespace (in fact, most don't, at least for attributes + // like alt, but an extra space at the end is barely + // noticeable). Still, we have a configuration knob for + // this, since this transformation is not necesary if you + // don't process user input with innerHTML or you don't plan + // on supporting Internet Explorer. + if ($this->_innerHTMLFix) { + if (strpos($value, '`') !== false) { + // check if correct quoting style would not already be + // triggered + if (strcspn($value, '"\' <>') === strlen($value)) { + // protect! + $value .= ' '; + } + } + } + $html .= $key.'="'.$this->escape($value).'" '; + } + return rtrim($html); + } + + /** + * Escapes raw text data. + * @todo This really ought to be protected, but until we have a facility + * for properly generating HTML here w/o using tokens, it stays + * public. + * @param string $string String data to escape for HTML. + * @param int $quote Quoting style, like htmlspecialchars. ENT_NOQUOTES is + * permissible for non-attribute output. + * @return string escaped data. + */ + public function escape($string, $quote = null) + { + // Workaround for APC bug on Mac Leopard reported by sidepodcast + // http://htmlpurifier.org/phorum/read.php?3,4823,4846 + if ($quote === null) { + $quote = ENT_COMPAT; + } + return htmlspecialchars($string, $quote, 'UTF-8'); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLDefinition.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLDefinition.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLDefinition.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLDefinition.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,493 @@ +getAnonymousModule(); + if (!isset($module->info[$element_name])) { + $element = $module->addBlankElement($element_name); + } else { + $element = $module->info[$element_name]; + } + $element->attr[$attr_name] = $def; + } + + /** + * Adds a custom element to your HTML definition + * @see HTMLPurifier_HTMLModule::addElement() for detailed + * parameter and return value descriptions. + */ + public function addElement($element_name, $type, $contents, $attr_collections, $attributes = array()) + { + $module = $this->getAnonymousModule(); + // assume that if the user is calling this, the element + // is safe. This may not be a good idea + $element = $module->addElement($element_name, $type, $contents, $attr_collections, $attributes); + return $element; + } + + /** + * Adds a blank element to your HTML definition, for overriding + * existing behavior + * @param string $element_name + * @return HTMLPurifier_ElementDef + * @see HTMLPurifier_HTMLModule::addBlankElement() for detailed + * parameter and return value descriptions. + */ + public function addBlankElement($element_name) + { + $module = $this->getAnonymousModule(); + $element = $module->addBlankElement($element_name); + return $element; + } + + /** + * Retrieves a reference to the anonymous module, so you can + * bust out advanced features without having to make your own + * module. + * @return HTMLPurifier_HTMLModule + */ + public function getAnonymousModule() + { + if (!$this->_anonModule) { + $this->_anonModule = new HTMLPurifier_HTMLModule(); + $this->_anonModule->name = 'Anonymous'; + } + return $this->_anonModule; + } + + private $_anonModule = null; + + // PUBLIC BUT INTERNAL VARIABLES -------------------------------------- + + /** + * @type string + */ + public $type = 'HTML'; + + /** + * @type HTMLPurifier_HTMLModuleManager + */ + public $manager; + + /** + * Performs low-cost, preliminary initialization. + */ + public function __construct() + { + $this->manager = new HTMLPurifier_HTMLModuleManager(); + } + + /** + * @param HTMLPurifier_Config $config + */ + protected function doSetup($config) + { + $this->processModules($config); + $this->setupConfigStuff($config); + unset($this->manager); + + // cleanup some of the element definitions + foreach ($this->info as $k => $v) { + unset($this->info[$k]->content_model); + unset($this->info[$k]->content_model_type); + } + } + + /** + * Extract out the information from the manager + * @param HTMLPurifier_Config $config + */ + protected function processModules($config) + { + if ($this->_anonModule) { + // for user specific changes + // this is late-loaded so we don't have to deal with PHP4 + // reference wonky-ness + $this->manager->addModule($this->_anonModule); + unset($this->_anonModule); + } + + $this->manager->setup($config); + $this->doctype = $this->manager->doctype; + + foreach ($this->manager->modules as $module) { + foreach ($module->info_tag_transform as $k => $v) { + if ($v === false) { + unset($this->info_tag_transform[$k]); + } else { + $this->info_tag_transform[$k] = $v; + } + } + foreach ($module->info_attr_transform_pre as $k => $v) { + if ($v === false) { + unset($this->info_attr_transform_pre[$k]); + } else { + $this->info_attr_transform_pre[$k] = $v; + } + } + foreach ($module->info_attr_transform_post as $k => $v) { + if ($v === false) { + unset($this->info_attr_transform_post[$k]); + } else { + $this->info_attr_transform_post[$k] = $v; + } + } + foreach ($module->info_injector as $k => $v) { + if ($v === false) { + unset($this->info_injector[$k]); + } else { + $this->info_injector[$k] = $v; + } + } + } + $this->info = $this->manager->getElements(); + $this->info_content_sets = $this->manager->contentSets->lookup; + } + + /** + * Sets up stuff based on config. We need a better way of doing this. + * @param HTMLPurifier_Config $config + */ + protected function setupConfigStuff($config) + { + $block_wrapper = $config->get('HTML.BlockWrapper'); + if (isset($this->info_content_sets['Block'][$block_wrapper])) { + $this->info_block_wrapper = $block_wrapper; + } else { + trigger_error( + 'Cannot use non-block element as block wrapper', + E_USER_ERROR + ); + } + + $parent = $config->get('HTML.Parent'); + $def = $this->manager->getElement($parent, true); + if ($def) { + $this->info_parent = $parent; + $this->info_parent_def = $def; + } else { + trigger_error( + 'Cannot use unrecognized element as parent', + E_USER_ERROR + ); + $this->info_parent_def = $this->manager->getElement($this->info_parent, true); + } + + // support template text + $support = "(for information on implementing this, see the support forums) "; + + // setup allowed elements ----------------------------------------- + + $allowed_elements = $config->get('HTML.AllowedElements'); + $allowed_attributes = $config->get('HTML.AllowedAttributes'); // retrieve early + + if (!is_array($allowed_elements) && !is_array($allowed_attributes)) { + $allowed = $config->get('HTML.Allowed'); + if (is_string($allowed)) { + list($allowed_elements, $allowed_attributes) = $this->parseTinyMCEAllowedList($allowed); + } + } + + if (is_array($allowed_elements)) { + foreach ($this->info as $name => $d) { + if (!isset($allowed_elements[$name])) { + unset($this->info[$name]); + } + unset($allowed_elements[$name]); + } + // emit errors + foreach ($allowed_elements as $element => $d) { + $element = htmlspecialchars($element); // PHP doesn't escape errors, be careful! + trigger_error("Element '$element' is not supported $support", E_USER_WARNING); + } + } + + // setup allowed attributes --------------------------------------- + + $allowed_attributes_mutable = $allowed_attributes; // by copy! + if (is_array($allowed_attributes)) { + // This actually doesn't do anything, since we went away from + // global attributes. It's possible that userland code uses + // it, but HTMLModuleManager doesn't! + foreach ($this->info_global_attr as $attr => $x) { + $keys = array($attr, "*@$attr", "*.$attr"); + $delete = true; + foreach ($keys as $key) { + if ($delete && isset($allowed_attributes[$key])) { + $delete = false; + } + if (isset($allowed_attributes_mutable[$key])) { + unset($allowed_attributes_mutable[$key]); + } + } + if ($delete) { + unset($this->info_global_attr[$attr]); + } + } + + foreach ($this->info as $tag => $info) { + foreach ($info->attr as $attr => $x) { + $keys = array("$tag@$attr", $attr, "*@$attr", "$tag.$attr", "*.$attr"); + $delete = true; + foreach ($keys as $key) { + if ($delete && isset($allowed_attributes[$key])) { + $delete = false; + } + if (isset($allowed_attributes_mutable[$key])) { + unset($allowed_attributes_mutable[$key]); + } + } + if ($delete) { + if ($this->info[$tag]->attr[$attr]->required) { + trigger_error( + "Required attribute '$attr' in element '$tag' " . + "was not allowed, which means '$tag' will not be allowed either", + E_USER_WARNING + ); + } + unset($this->info[$tag]->attr[$attr]); + } + } + } + // emit errors + foreach ($allowed_attributes_mutable as $elattr => $d) { + $bits = preg_split('/[.@]/', $elattr, 2); + $c = count($bits); + switch ($c) { + case 2: + if ($bits[0] !== '*') { + $element = htmlspecialchars($bits[0]); + $attribute = htmlspecialchars($bits[1]); + if (!isset($this->info[$element])) { + trigger_error( + "Cannot allow attribute '$attribute' if element " . + "'$element' is not allowed/supported $support" + ); + } else { + trigger_error( + "Attribute '$attribute' in element '$element' not supported $support", + E_USER_WARNING + ); + } + break; + } + // otherwise fall through + case 1: + $attribute = htmlspecialchars($bits[0]); + trigger_error( + "Global attribute '$attribute' is not ". + "supported in any elements $support", + E_USER_WARNING + ); + break; + } + } + } + + // setup forbidden elements --------------------------------------- + + $forbidden_elements = $config->get('HTML.ForbiddenElements'); + $forbidden_attributes = $config->get('HTML.ForbiddenAttributes'); + + foreach ($this->info as $tag => $info) { + if (isset($forbidden_elements[$tag])) { + unset($this->info[$tag]); + continue; + } + foreach ($info->attr as $attr => $x) { + if (isset($forbidden_attributes["$tag@$attr"]) || + isset($forbidden_attributes["*@$attr"]) || + isset($forbidden_attributes[$attr]) + ) { + unset($this->info[$tag]->attr[$attr]); + continue; + } elseif (isset($forbidden_attributes["$tag.$attr"])) { // this segment might get removed eventually + // $tag.$attr are not user supplied, so no worries! + trigger_error( + "Error with $tag.$attr: tag.attr syntax not supported for " . + "HTML.ForbiddenAttributes; use tag@attr instead", + E_USER_WARNING + ); + } + } + } + foreach ($forbidden_attributes as $key => $v) { + if (strlen($key) < 2) { + continue; + } + if ($key[0] != '*') { + continue; + } + if ($key[1] == '.') { + trigger_error( + "Error with $key: *.attr syntax not supported for HTML.ForbiddenAttributes; use attr instead", + E_USER_WARNING + ); + } + } + + // setup injectors ----------------------------------------------------- + foreach ($this->info_injector as $i => $injector) { + if ($injector->checkNeeded($config) !== false) { + // remove injector that does not have it's required + // elements/attributes present, and is thus not needed. + unset($this->info_injector[$i]); + } + } + } + + /** + * Parses a TinyMCE-flavored Allowed Elements and Attributes list into + * separate lists for processing. Format is element[attr1|attr2],element2... + * @warning Although it's largely drawn from TinyMCE's implementation, + * it is different, and you'll probably have to modify your lists + * @param array $list String list to parse + * @return array + * @todo Give this its own class, probably static interface + */ + public function parseTinyMCEAllowedList($list) + { + $list = str_replace(array(' ', "\t"), '', $list); + + $elements = array(); + $attributes = array(); + + $chunks = preg_split('/(,|[\n\r]+)/', $list); + foreach ($chunks as $chunk) { + if (empty($chunk)) { + continue; + } + // remove TinyMCE element control characters + if (!strpos($chunk, '[')) { + $element = $chunk; + $attr = false; + } else { + list($element, $attr) = explode('[', $chunk); + } + if ($element !== '*') { + $elements[$element] = true; + } + if (!$attr) { + continue; + } + $attr = substr($attr, 0, strlen($attr) - 1); // remove trailing ] + $attr = explode('|', $attr); + foreach ($attr as $key) { + $attributes["$element.$key"] = true; + } + } + return array($elements, $attributes); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Bdo.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Bdo.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Bdo.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Bdo.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,44 @@ + array('dir' => false) + ); + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + $bdo = $this->addElement( + 'bdo', + 'Inline', + 'Inline', + array('Core', 'Lang'), + array( + 'dir' => 'Enum#ltr,rtl', // required + // The Abstract Module specification has the attribute + // inclusions wrong for bdo: bdo allows Lang + ) + ); + $bdo->attr_transform_post[] = new HTMLPurifier_AttrTransform_BdoDir(); + + $this->attr_collections['I18N']['dir'] = 'Enum#ltr,rtl'; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/CommonAttributes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/CommonAttributes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/CommonAttributes.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/CommonAttributes.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,31 @@ + array( + 0 => array('Style'), + // 'xml:space' => false, + 'class' => 'Class', + 'id' => 'ID', + 'title' => 'CDATA', + ), + 'Lang' => array(), + 'I18N' => array( + 0 => array('Lang'), // proprietary, for xml:lang/lang + ), + 'Common' => array( + 0 => array('Core', 'I18N') + ) + ); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Edit.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Edit.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Edit.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Edit.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,55 @@ + 'URI', + // 'datetime' => 'Datetime', // not implemented + ); + $this->addElement('del', 'Inline', $contents, 'Common', $attr); + $this->addElement('ins', 'Inline', $contents, 'Common', $attr); + } + + // HTML 4.01 specifies that ins/del must not contain block + // elements when used in an inline context, chameleon is + // a complicated workaround to acheive this effect + + // Inline context ! Block context (exclamation mark is + // separator, see getChildDef for parsing) + + /** + * @type bool + */ + public $defines_child_def = true; + + /** + * @param HTMLPurifier_ElementDef $def + * @return HTMLPurifier_ChildDef_Chameleon + */ + public function getChildDef($def) + { + if ($def->content_model_type != 'chameleon') { + return false; + } + $value = explode('!', $def->content_model); + return new HTMLPurifier_ChildDef_Chameleon($value[0], $value[1]); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Forms.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Forms.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Forms.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Forms.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,190 @@ + 'Form', + 'Inline' => 'Formctrl', + ); + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + $form = $this->addElement( + 'form', + 'Form', + 'Required: Heading | List | Block | fieldset', + 'Common', + array( + 'accept' => 'ContentTypes', + 'accept-charset' => 'Charsets', + 'action*' => 'URI', + 'method' => 'Enum#get,post', + // really ContentType, but these two are the only ones used today + 'enctype' => 'Enum#application/x-www-form-urlencoded,multipart/form-data', + ) + ); + $form->excludes = array('form' => true); + + $input = $this->addElement( + 'input', + 'Formctrl', + 'Empty', + 'Common', + array( + 'accept' => 'ContentTypes', + 'accesskey' => 'Character', + 'alt' => 'Text', + 'checked' => 'Bool#checked', + 'disabled' => 'Bool#disabled', + 'maxlength' => 'Number', + 'name' => 'CDATA', + 'readonly' => 'Bool#readonly', + 'size' => 'Number', + 'src' => 'URI#embedded', + 'tabindex' => 'Number', + 'type' => 'Enum#text,password,checkbox,button,radio,submit,reset,file,hidden,image', + 'value' => 'CDATA', + ) + ); + $input->attr_transform_post[] = new HTMLPurifier_AttrTransform_Input(); + + $this->addElement( + 'select', + 'Formctrl', + 'Required: optgroup | option', + 'Common', + array( + 'disabled' => 'Bool#disabled', + 'multiple' => 'Bool#multiple', + 'name' => 'CDATA', + 'size' => 'Number', + 'tabindex' => 'Number', + ) + ); + + $this->addElement( + 'option', + false, + 'Optional: #PCDATA', + 'Common', + array( + 'disabled' => 'Bool#disabled', + 'label' => 'Text', + 'selected' => 'Bool#selected', + 'value' => 'CDATA', + ) + ); + // It's illegal for there to be more than one selected, but not + // be multiple. Also, no selected means undefined behavior. This might + // be difficult to implement; perhaps an injector, or a context variable. + + $textarea = $this->addElement( + 'textarea', + 'Formctrl', + 'Optional: #PCDATA', + 'Common', + array( + 'accesskey' => 'Character', + 'cols*' => 'Number', + 'disabled' => 'Bool#disabled', + 'name' => 'CDATA', + 'readonly' => 'Bool#readonly', + 'rows*' => 'Number', + 'tabindex' => 'Number', + ) + ); + $textarea->attr_transform_pre[] = new HTMLPurifier_AttrTransform_Textarea(); + + $button = $this->addElement( + 'button', + 'Formctrl', + 'Optional: #PCDATA | Heading | List | Block | Inline', + 'Common', + array( + 'accesskey' => 'Character', + 'disabled' => 'Bool#disabled', + 'name' => 'CDATA', + 'tabindex' => 'Number', + 'type' => 'Enum#button,submit,reset', + 'value' => 'CDATA', + ) + ); + + // For exclusions, ideally we'd specify content sets, not literal elements + $button->excludes = $this->makeLookup( + 'form', + 'fieldset', // Form + 'input', + 'select', + 'textarea', + 'label', + 'button', // Formctrl + 'a', // as per HTML 4.01 spec, this is omitted by modularization + 'isindex', + 'iframe' // legacy items + ); + + // Extra exclusion: img usemap="" is not permitted within this element. + // We'll omit this for now, since we don't have any good way of + // indicating it yet. + + // This is HIGHLY user-unfriendly; we need a custom child-def for this + $this->addElement('fieldset', 'Form', 'Custom: (#WS?,legend,(Flow|#PCDATA)*)', 'Common'); + + $label = $this->addElement( + 'label', + 'Formctrl', + 'Optional: #PCDATA | Inline', + 'Common', + array( + 'accesskey' => 'Character', + // 'for' => 'IDREF', // IDREF not implemented, cannot allow + ) + ); + $label->excludes = array('label' => true); + + $this->addElement( + 'legend', + false, + 'Optional: #PCDATA | Inline', + 'Common', + array( + 'accesskey' => 'Character', + ) + ); + + $this->addElement( + 'optgroup', + false, + 'Required: option', + 'Common', + array( + 'disabled' => 'Bool#disabled', + 'label*' => 'Text', + ) + ); + // Don't forget an injector for
. This one's a little complex + // because it maps to multiple elements. + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Hypertext.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Hypertext.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Hypertext.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Hypertext.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,40 @@ +addElement( + 'a', + 'Inline', + 'Inline', + 'Common', + array( + // 'accesskey' => 'Character', + // 'charset' => 'Charset', + 'href' => 'URI', + // 'hreflang' => 'LanguageCode', + 'rel' => new HTMLPurifier_AttrDef_HTML_LinkTypes('rel'), + 'rev' => new HTMLPurifier_AttrDef_HTML_LinkTypes('rev'), + // 'tabindex' => 'Number', + // 'type' => 'ContentType', + ) + ); + $a->formatting = true; + $a->excludes = array('a' => true); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Iframe.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Iframe.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Iframe.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Iframe.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,51 @@ +get('HTML.SafeIframe')) { + $this->safe = true; + } + $this->addElement( + 'iframe', + 'Inline', + 'Flow', + 'Common', + array( + 'src' => 'URI#embedded', + 'width' => 'Length', + 'height' => 'Length', + 'name' => 'ID', + 'scrolling' => 'Enum#yes,no,auto', + 'frameborder' => 'Enum#0,1', + 'longdesc' => 'URI', + 'marginheight' => 'Pixels', + 'marginwidth' => 'Pixels', + ) + ); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Image.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Image.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Image.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Image.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,49 @@ +get('HTML.MaxImgLength'); + $img = $this->addElement( + 'img', + 'Inline', + 'Empty', + 'Common', + array( + 'alt*' => 'Text', + // According to the spec, it's Length, but percents can + // be abused, so we allow only Pixels. + 'height' => 'Pixels#' . $max, + 'width' => 'Pixels#' . $max, + 'longdesc' => 'URI', + 'src*' => new HTMLPurifier_AttrDef_URI(true), // embedded + ) + ); + if ($max === null || $config->get('HTML.Trusted')) { + $img->attr['height'] = + $img->attr['width'] = 'Length'; + } + + // kind of strange, but splitting things up would be inefficient + $img->attr_transform_pre[] = + $img->attr_transform_post[] = + new HTMLPurifier_AttrTransform_ImgRequired(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Legacy.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Legacy.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Legacy.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Legacy.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,186 @@ +addElement( + 'basefont', + 'Inline', + 'Empty', + null, + array( + 'color' => 'Color', + 'face' => 'Text', // extremely broad, we should + 'size' => 'Text', // tighten it + 'id' => 'ID' + ) + ); + $this->addElement('center', 'Block', 'Flow', 'Common'); + $this->addElement( + 'dir', + 'Block', + 'Required: li', + 'Common', + array( + 'compact' => 'Bool#compact' + ) + ); + $this->addElement( + 'font', + 'Inline', + 'Inline', + array('Core', 'I18N'), + array( + 'color' => 'Color', + 'face' => 'Text', // extremely broad, we should + 'size' => 'Text', // tighten it + ) + ); + $this->addElement( + 'menu', + 'Block', + 'Required: li', + 'Common', + array( + 'compact' => 'Bool#compact' + ) + ); + + $s = $this->addElement('s', 'Inline', 'Inline', 'Common'); + $s->formatting = true; + + $strike = $this->addElement('strike', 'Inline', 'Inline', 'Common'); + $strike->formatting = true; + + $u = $this->addElement('u', 'Inline', 'Inline', 'Common'); + $u->formatting = true; + + // setup modifications to old elements + + $align = 'Enum#left,right,center,justify'; + + $address = $this->addBlankElement('address'); + $address->content_model = 'Inline | #PCDATA | p'; + $address->content_model_type = 'optional'; + $address->child = false; + + $blockquote = $this->addBlankElement('blockquote'); + $blockquote->content_model = 'Flow | #PCDATA'; + $blockquote->content_model_type = 'optional'; + $blockquote->child = false; + + $br = $this->addBlankElement('br'); + $br->attr['clear'] = 'Enum#left,all,right,none'; + + $caption = $this->addBlankElement('caption'); + $caption->attr['align'] = 'Enum#top,bottom,left,right'; + + $div = $this->addBlankElement('div'); + $div->attr['align'] = $align; + + $dl = $this->addBlankElement('dl'); + $dl->attr['compact'] = 'Bool#compact'; + + for ($i = 1; $i <= 6; $i++) { + $h = $this->addBlankElement("h$i"); + $h->attr['align'] = $align; + } + + $hr = $this->addBlankElement('hr'); + $hr->attr['align'] = $align; + $hr->attr['noshade'] = 'Bool#noshade'; + $hr->attr['size'] = 'Pixels'; + $hr->attr['width'] = 'Length'; + + $img = $this->addBlankElement('img'); + $img->attr['align'] = 'IAlign'; + $img->attr['border'] = 'Pixels'; + $img->attr['hspace'] = 'Pixels'; + $img->attr['vspace'] = 'Pixels'; + + // figure out this integer business + + $li = $this->addBlankElement('li'); + $li->attr['value'] = new HTMLPurifier_AttrDef_Integer(); + $li->attr['type'] = 'Enum#s:1,i,I,a,A,disc,square,circle'; + + $ol = $this->addBlankElement('ol'); + $ol->attr['compact'] = 'Bool#compact'; + $ol->attr['start'] = new HTMLPurifier_AttrDef_Integer(); + $ol->attr['type'] = 'Enum#s:1,i,I,a,A'; + + $p = $this->addBlankElement('p'); + $p->attr['align'] = $align; + + $pre = $this->addBlankElement('pre'); + $pre->attr['width'] = 'Number'; + + // script omitted + + $table = $this->addBlankElement('table'); + $table->attr['align'] = 'Enum#left,center,right'; + $table->attr['bgcolor'] = 'Color'; + + $tr = $this->addBlankElement('tr'); + $tr->attr['bgcolor'] = 'Color'; + + $th = $this->addBlankElement('th'); + $th->attr['bgcolor'] = 'Color'; + $th->attr['height'] = 'Length'; + $th->attr['nowrap'] = 'Bool#nowrap'; + $th->attr['width'] = 'Length'; + + $td = $this->addBlankElement('td'); + $td->attr['bgcolor'] = 'Color'; + $td->attr['height'] = 'Length'; + $td->attr['nowrap'] = 'Bool#nowrap'; + $td->attr['width'] = 'Length'; + + $ul = $this->addBlankElement('ul'); + $ul->attr['compact'] = 'Bool#compact'; + $ul->attr['type'] = 'Enum#square,disc,circle'; + + // "safe" modifications to "unsafe" elements + // WARNING: If you want to add support for an unsafe, legacy + // attribute, make a new TrustedLegacy module with the trusted + // bit set appropriately + + $form = $this->addBlankElement('form'); + $form->content_model = 'Flow | #PCDATA'; + $form->content_model_type = 'optional'; + $form->attr['target'] = 'FrameTarget'; + + $input = $this->addBlankElement('input'); + $input->attr['align'] = 'IAlign'; + + $legend = $this->addBlankElement('legend'); + $legend->attr['align'] = 'LAlign'; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/List.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/List.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/List.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/List.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,51 @@ + 'List'); + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + $ol = $this->addElement('ol', 'List', new HTMLPurifier_ChildDef_List(), 'Common'); + $ul = $this->addElement('ul', 'List', new HTMLPurifier_ChildDef_List(), 'Common'); + // XXX The wrap attribute is handled by MakeWellFormed. This is all + // quite unsatisfactory, because we generated this + // *specifically* for lists, and now a big chunk of the handling + // is done properly by the List ChildDef. So actually, we just + // want enough information to make autoclosing work properly, + // and then hand off the tricky stuff to the ChildDef. + $ol->wrap = 'li'; + $ul->wrap = 'li'; + $this->addElement('dl', 'List', 'Required: dt | dd', 'Common'); + + $this->addElement('li', false, 'Flow', 'Common'); + + $this->addElement('dd', false, 'Flow', 'Common'); + $this->addElement('dt', false, 'Inline', 'Common'); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Name.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Name.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Name.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Name.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,26 @@ +addBlankElement($name); + $element->attr['name'] = 'CDATA'; + if (!$config->get('HTML.Attr.Name.UseCDATA')) { + $element->attr_transform_post[] = new HTMLPurifier_AttrTransform_NameSync(); + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Nofollow.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Nofollow.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Nofollow.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Nofollow.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,25 @@ +addBlankElement('a'); + $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_Nofollow(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,20 @@ + array( + 'lang' => 'LanguageCode', + ) + ); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Object.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Object.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Object.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Object.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,62 @@ + to cater to legacy browsers: this + * module does not allow this sort of behavior + */ +class HTMLPurifier_HTMLModule_Object extends HTMLPurifier_HTMLModule +{ + /** + * @type string + */ + public $name = 'Object'; + + /** + * @type bool + */ + public $safe = false; + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + $this->addElement( + 'object', + 'Inline', + 'Optional: #PCDATA | Flow | param', + 'Common', + array( + 'archive' => 'URI', + 'classid' => 'URI', + 'codebase' => 'URI', + 'codetype' => 'Text', + 'data' => 'URI', + 'declare' => 'Bool#declare', + 'height' => 'Length', + 'name' => 'CDATA', + 'standby' => 'Text', + 'tabindex' => 'Number', + 'type' => 'ContentType', + 'width' => 'Length' + ) + ); + + $this->addElement( + 'param', + false, + 'Empty', + null, + array( + 'id' => 'ID', + 'name*' => 'Text', + 'type' => 'Text', + 'value' => 'Text', + 'valuetype' => 'Enum#data,ref,object' + ) + ); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Presentation.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Presentation.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Presentation.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Presentation.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,42 @@ +addElement('hr', 'Block', 'Empty', 'Common'); + $this->addElement('sub', 'Inline', 'Inline', 'Common'); + $this->addElement('sup', 'Inline', 'Inline', 'Common'); + $b = $this->addElement('b', 'Inline', 'Inline', 'Common'); + $b->formatting = true; + $big = $this->addElement('big', 'Inline', 'Inline', 'Common'); + $big->formatting = true; + $i = $this->addElement('i', 'Inline', 'Inline', 'Common'); + $i->formatting = true; + $small = $this->addElement('small', 'Inline', 'Inline', 'Common'); + $small->formatting = true; + $tt = $this->addElement('tt', 'Inline', 'Inline', 'Common'); + $tt->formatting = true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Proprietary.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Proprietary.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Proprietary.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Proprietary.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,40 @@ +addElement( + 'marquee', + 'Inline', + 'Flow', + 'Common', + array( + 'direction' => 'Enum#left,right,up,down', + 'behavior' => 'Enum#alternate', + 'width' => 'Length', + 'height' => 'Length', + 'scrolldelay' => 'Number', + 'scrollamount' => 'Number', + 'loop' => 'Number', + 'bgcolor' => 'Color', + 'hspace' => 'Pixels', + 'vspace' => 'Pixels', + ) + ); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Ruby.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Ruby.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Ruby.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Ruby.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,36 @@ +addElement( + 'ruby', + 'Inline', + 'Custom: ((rb, (rt | (rp, rt, rp))) | (rbc, rtc, rtc?))', + 'Common' + ); + $this->addElement('rbc', false, 'Required: rb', 'Common'); + $this->addElement('rtc', false, 'Required: rt', 'Common'); + $rb = $this->addElement('rb', false, 'Inline', 'Common'); + $rb->excludes = array('ruby' => true); + $rt = $this->addElement('rt', false, 'Inline', 'Common', array('rbspan' => 'Number')); + $rt->excludes = array('ruby' => true); + $this->addElement('rp', false, 'Optional: #PCDATA', 'Common'); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeEmbed.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeEmbed.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeEmbed.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeEmbed.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,40 @@ +get('HTML.MaxImgLength'); + $embed = $this->addElement( + 'embed', + 'Inline', + 'Empty', + 'Common', + array( + 'src*' => 'URI#embedded', + 'type' => 'Enum#application/x-shockwave-flash', + 'width' => 'Pixels#' . $max, + 'height' => 'Pixels#' . $max, + 'allowscriptaccess' => 'Enum#never', + 'allownetworking' => 'Enum#internal', + 'flashvars' => 'Text', + 'wmode' => 'Enum#window,transparent,opaque', + 'name' => 'ID', + ) + ); + $embed->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeEmbed(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeObject.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeObject.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeObject.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeObject.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,62 @@ +get('HTML.MaxImgLength'); + $object = $this->addElement( + 'object', + 'Inline', + 'Optional: param | Flow | #PCDATA', + 'Common', + array( + // While technically not required by the spec, we're forcing + // it to this value. + 'type' => 'Enum#application/x-shockwave-flash', + 'width' => 'Pixels#' . $max, + 'height' => 'Pixels#' . $max, + 'data' => 'URI#embedded', + 'codebase' => new HTMLPurifier_AttrDef_Enum( + array( + 'http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0' + ) + ), + ) + ); + $object->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeObject(); + + $param = $this->addElement( + 'param', + false, + 'Empty', + false, + array( + 'id' => 'ID', + 'name*' => 'Text', + 'value' => 'Text' + ) + ); + $param->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeParam(); + $this->info_injector[] = 'SafeObject'; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeScripting.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeScripting.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeScripting.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/SafeScripting.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,40 @@ +get('HTML.SafeScripting'); + $script = $this->addElement( + 'script', + 'Inline', + 'Optional:', // Not `Empty` to not allow to autoclose the tag @see https://www.w3.org/TR/html4/interact/scripts.html + null, + array( + // While technically not required by the spec, we're forcing + // it to this value. + 'type' => 'Enum#text/javascript', + 'src*' => new HTMLPurifier_AttrDef_Enum(array_keys($allowed), /*case sensitive*/ true) + ) + ); + $script->attr_transform_pre[] = + $script->attr_transform_post[] = new HTMLPurifier_AttrTransform_ScriptRequired(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Scripting.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Scripting.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Scripting.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Scripting.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,73 @@ + 'script | noscript', 'Inline' => 'script | noscript'); + + /** + * @type bool + */ + public $safe = false; + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + // TODO: create custom child-definition for noscript that + // auto-wraps stray #PCDATA in a similar manner to + // blockquote's custom definition (we would use it but + // blockquote's contents are optional while noscript's contents + // are required) + + // TODO: convert this to new syntax, main problem is getting + // both content sets working + + // In theory, this could be safe, but I don't see any reason to + // allow it. + $this->info['noscript'] = new HTMLPurifier_ElementDef(); + $this->info['noscript']->attr = array(0 => array('Common')); + $this->info['noscript']->content_model = 'Heading | List | Block'; + $this->info['noscript']->content_model_type = 'required'; + + $this->info['script'] = new HTMLPurifier_ElementDef(); + $this->info['script']->attr = array( + 'defer' => new HTMLPurifier_AttrDef_Enum(array('defer')), + 'src' => new HTMLPurifier_AttrDef_URI(true), + 'type' => new HTMLPurifier_AttrDef_Enum(array('text/javascript')) + ); + $this->info['script']->content_model = '#PCDATA'; + $this->info['script']->content_model_type = 'optional'; + $this->info['script']->attr_transform_pre[] = + $this->info['script']->attr_transform_post[] = + new HTMLPurifier_AttrTransform_ScriptRequired(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/StyleAttribute.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/StyleAttribute.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/StyleAttribute.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/StyleAttribute.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,33 @@ + array('style' => false), // see constructor + 'Core' => array(0 => array('Style')) + ); + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + $this->attr_collections['Style']['style'] = new HTMLPurifier_AttrDef_CSS(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tables.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tables.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tables.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tables.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,75 @@ +addElement('caption', false, 'Inline', 'Common'); + + $this->addElement( + 'table', + 'Block', + new HTMLPurifier_ChildDef_Table(), + 'Common', + array( + 'border' => 'Pixels', + 'cellpadding' => 'Length', + 'cellspacing' => 'Length', + 'frame' => 'Enum#void,above,below,hsides,lhs,rhs,vsides,box,border', + 'rules' => 'Enum#none,groups,rows,cols,all', + 'summary' => 'Text', + 'width' => 'Length' + ) + ); + + // common attributes + $cell_align = array( + 'align' => 'Enum#left,center,right,justify,char', + 'charoff' => 'Length', + 'valign' => 'Enum#top,middle,bottom,baseline', + ); + + $cell_t = array_merge( + array( + 'abbr' => 'Text', + 'colspan' => 'Number', + 'rowspan' => 'Number', + // Apparently, as of HTML5 this attribute only applies + // to 'th' elements. + 'scope' => 'Enum#row,col,rowgroup,colgroup', + ), + $cell_align + ); + $this->addElement('td', false, 'Flow', 'Common', $cell_t); + $this->addElement('th', false, 'Flow', 'Common', $cell_t); + + $this->addElement('tr', false, 'Required: td | th', 'Common', $cell_align); + + $cell_col = array_merge( + array( + 'span' => 'Number', + 'width' => 'MultiLength', + ), + $cell_align + ); + $this->addElement('col', false, 'Empty', 'Common', $cell_col); + $this->addElement('colgroup', false, 'Optional: col', 'Common', $cell_col); + + $this->addElement('tbody', false, 'Required: tr', 'Common', $cell_align); + $this->addElement('thead', false, 'Required: tr', 'Common', $cell_align); + $this->addElement('tfoot', false, 'Required: tr', 'Common', $cell_align); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetBlank.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetBlank.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetBlank.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetBlank.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,24 @@ +addBlankElement('a'); + $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_TargetBlank(); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoopener.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoopener.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoopener.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoopener.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,21 @@ +addBlankElement('a'); + $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_TargetNoopener(); + } +} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoreferrer.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoreferrer.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoreferrer.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/TargetNoreferrer.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,21 @@ +addBlankElement('a'); + $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_TargetNoreferrer(); + } +} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Target.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Target.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Target.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Target.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,28 @@ +addBlankElement($name); + $e->attr = array( + 'target' => new HTMLPurifier_AttrDef_HTML_FrameTarget() + ); + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Text.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Text.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Text.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Text.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,87 @@ + 'Heading | Block | Inline' + ); + + /** + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + // Inline Phrasal ------------------------------------------------- + $this->addElement('abbr', 'Inline', 'Inline', 'Common'); + $this->addElement('acronym', 'Inline', 'Inline', 'Common'); + $this->addElement('cite', 'Inline', 'Inline', 'Common'); + $this->addElement('dfn', 'Inline', 'Inline', 'Common'); + $this->addElement('kbd', 'Inline', 'Inline', 'Common'); + $this->addElement('q', 'Inline', 'Inline', 'Common', array('cite' => 'URI')); + $this->addElement('samp', 'Inline', 'Inline', 'Common'); + $this->addElement('var', 'Inline', 'Inline', 'Common'); + + $em = $this->addElement('em', 'Inline', 'Inline', 'Common'); + $em->formatting = true; + + $strong = $this->addElement('strong', 'Inline', 'Inline', 'Common'); + $strong->formatting = true; + + $code = $this->addElement('code', 'Inline', 'Inline', 'Common'); + $code->formatting = true; + + // Inline Structural ---------------------------------------------- + $this->addElement('span', 'Inline', 'Inline', 'Common'); + $this->addElement('br', 'Inline', 'Empty', 'Core'); + + // Block Phrasal -------------------------------------------------- + $this->addElement('address', 'Block', 'Inline', 'Common'); + $this->addElement('blockquote', 'Block', 'Optional: Heading | Block | List', 'Common', array('cite' => 'URI')); + $pre = $this->addElement('pre', 'Block', 'Inline', 'Common'); + $pre->excludes = $this->makeLookup( + 'img', + 'big', + 'small', + 'object', + 'applet', + 'font', + 'basefont' + ); + $this->addElement('h1', 'Heading', 'Inline', 'Common'); + $this->addElement('h2', 'Heading', 'Inline', 'Common'); + $this->addElement('h3', 'Heading', 'Inline', 'Common'); + $this->addElement('h4', 'Heading', 'Inline', 'Common'); + $this->addElement('h5', 'Heading', 'Inline', 'Common'); + $this->addElement('h6', 'Heading', 'Inline', 'Common'); + + // Block Structural ----------------------------------------------- + $p = $this->addElement('p', 'Block', 'Inline', 'Common'); + $p->autoclose = array_flip( + array("address", "blockquote", "center", "dir", "div", "dl", "fieldset", "ol", "p", "ul") + ); + + $this->addElement('div', 'Block', 'Flow', 'Common'); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Name.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Name.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Name.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Name.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,33 @@ +content_model_type != 'strictblockquote') { + return parent::getChildDef($def); + } + return new HTMLPurifier_ChildDef_StrictBlockquote($def->content_model); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Transitional.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Transitional.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Transitional.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/Transitional.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,16 @@ + 'text-align:left;', + 'right' => 'text-align:right;', + 'top' => 'caption-side:top;', + 'bottom' => 'caption-side:bottom;' // not supported by IE + ) + ); + + // @align for img ------------------------------------------------- + $r['img@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS( + 'align', + array( + 'left' => 'float:left;', + 'right' => 'float:right;', + 'top' => 'vertical-align:top;', + 'middle' => 'vertical-align:middle;', + 'bottom' => 'vertical-align:baseline;', + ) + ); + + // @align for table ----------------------------------------------- + $r['table@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS( + 'align', + array( + 'left' => 'float:left;', + 'center' => 'margin-left:auto;margin-right:auto;', + 'right' => 'float:right;' + ) + ); + + // @align for hr ----------------------------------------------- + $r['hr@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS( + 'align', + array( + // we use both text-align and margin because these work + // for different browsers (IE and Firefox, respectively) + // and the melange makes for a pretty cross-compatible + // solution + 'left' => 'margin-left:0;margin-right:auto;text-align:left;', + 'center' => 'margin-left:auto;margin-right:auto;text-align:center;', + 'right' => 'margin-left:auto;margin-right:0;text-align:right;' + ) + ); + + // @align for h1, h2, h3, h4, h5, h6, p, div ---------------------- + // {{{ + $align_lookup = array(); + $align_values = array('left', 'right', 'center', 'justify'); + foreach ($align_values as $v) { + $align_lookup[$v] = "text-align:$v;"; + } + // }}} + $r['h1@align'] = + $r['h2@align'] = + $r['h3@align'] = + $r['h4@align'] = + $r['h5@align'] = + $r['h6@align'] = + $r['p@align'] = + $r['div@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS('align', $align_lookup); + + // @bgcolor for table, tr, td, th --------------------------------- + $r['table@bgcolor'] = + $r['td@bgcolor'] = + $r['th@bgcolor'] = + new HTMLPurifier_AttrTransform_BgColor(); + + // @border for img ------------------------------------------------ + $r['img@border'] = new HTMLPurifier_AttrTransform_Border(); + + // @clear for br -------------------------------------------------- + $r['br@clear'] = + new HTMLPurifier_AttrTransform_EnumToCSS( + 'clear', + array( + 'left' => 'clear:left;', + 'right' => 'clear:right;', + 'all' => 'clear:both;', + 'none' => 'clear:none;', + ) + ); + + // @height for td, th --------------------------------------------- + $r['td@height'] = + $r['th@height'] = + new HTMLPurifier_AttrTransform_Length('height'); + + // @hspace for img ------------------------------------------------ + $r['img@hspace'] = new HTMLPurifier_AttrTransform_ImgSpace('hspace'); + + // @noshade for hr ------------------------------------------------ + // this transformation is not precise but often good enough. + // different browsers use different styles to designate noshade + $r['hr@noshade'] = + new HTMLPurifier_AttrTransform_BoolToCSS( + 'noshade', + 'color:#808080;background-color:#808080;border:0;' + ); + + // @nowrap for td, th --------------------------------------------- + $r['td@nowrap'] = + $r['th@nowrap'] = + new HTMLPurifier_AttrTransform_BoolToCSS( + 'nowrap', + 'white-space:nowrap;' + ); + + // @size for hr -------------------------------------------------- + $r['hr@size'] = new HTMLPurifier_AttrTransform_Length('size', 'height'); + + // @type for li, ol, ul ------------------------------------------- + // {{{ + $ul_types = array( + 'disc' => 'list-style-type:disc;', + 'square' => 'list-style-type:square;', + 'circle' => 'list-style-type:circle;' + ); + $ol_types = array( + '1' => 'list-style-type:decimal;', + 'i' => 'list-style-type:lower-roman;', + 'I' => 'list-style-type:upper-roman;', + 'a' => 'list-style-type:lower-alpha;', + 'A' => 'list-style-type:upper-alpha;' + ); + $li_types = $ul_types + $ol_types; + // }}} + + $r['ul@type'] = new HTMLPurifier_AttrTransform_EnumToCSS('type', $ul_types); + $r['ol@type'] = new HTMLPurifier_AttrTransform_EnumToCSS('type', $ol_types, true); + $r['li@type'] = new HTMLPurifier_AttrTransform_EnumToCSS('type', $li_types, true); + + // @vspace for img ------------------------------------------------ + $r['img@vspace'] = new HTMLPurifier_AttrTransform_ImgSpace('vspace'); + + // @width for hr, td, th ------------------------------------------ + $r['td@width'] = + $r['th@width'] = + $r['hr@width'] = new HTMLPurifier_AttrTransform_Length('width'); + + return $r; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/XHTML.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/XHTML.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/XHTML.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/Tidy/XHTML.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,26 @@ + 'none', 'light', 'medium', 'heavy'); + + /** + * Default level to place all fixes in. + * Disabled by default. + * @type string + */ + public $defaultLevel = null; + + /** + * Lists of fixes used by getFixesForLevel(). + * Format is: + * HTMLModule_Tidy->fixesForLevel[$level] = array('fix-1', 'fix-2'); + * @type array + */ + public $fixesForLevel = array( + 'light' => array(), + 'medium' => array(), + 'heavy' => array() + ); + + /** + * Lazy load constructs the module by determining the necessary + * fixes to create and then delegating to the populate() function. + * @param HTMLPurifier_Config $config + * @todo Wildcard matching and error reporting when an added or + * subtracted fix has no effect. + */ + public function setup($config) + { + // create fixes, initialize fixesForLevel + $fixes = $this->makeFixes(); + $this->makeFixesForLevel($fixes); + + // figure out which fixes to use + $level = $config->get('HTML.TidyLevel'); + $fixes_lookup = $this->getFixesForLevel($level); + + // get custom fix declarations: these need namespace processing + $add_fixes = $config->get('HTML.TidyAdd'); + $remove_fixes = $config->get('HTML.TidyRemove'); + + foreach ($fixes as $name => $fix) { + // needs to be refactored a little to implement globbing + if (isset($remove_fixes[$name]) || + (!isset($add_fixes[$name]) && !isset($fixes_lookup[$name]))) { + unset($fixes[$name]); + } + } + + // populate this module with necessary fixes + $this->populate($fixes); + } + + /** + * Retrieves all fixes per a level, returning fixes for that specific + * level as well as all levels below it. + * @param string $level level identifier, see $levels for valid values + * @return array Lookup up table of fixes + */ + public function getFixesForLevel($level) + { + if ($level == $this->levels[0]) { + return array(); + } + $activated_levels = array(); + for ($i = 1, $c = count($this->levels); $i < $c; $i++) { + $activated_levels[] = $this->levels[$i]; + if ($this->levels[$i] == $level) { + break; + } + } + if ($i == $c) { + trigger_error( + 'Tidy level ' . htmlspecialchars($level) . ' not recognized', + E_USER_WARNING + ); + return array(); + } + $ret = array(); + foreach ($activated_levels as $level) { + foreach ($this->fixesForLevel[$level] as $fix) { + $ret[$fix] = true; + } + } + return $ret; + } + + /** + * Dynamically populates the $fixesForLevel member variable using + * the fixes array. It may be custom overloaded, used in conjunction + * with $defaultLevel, or not used at all. + * @param array $fixes + */ + public function makeFixesForLevel($fixes) + { + if (!isset($this->defaultLevel)) { + return; + } + if (!isset($this->fixesForLevel[$this->defaultLevel])) { + trigger_error( + 'Default level ' . $this->defaultLevel . ' does not exist', + E_USER_ERROR + ); + return; + } + $this->fixesForLevel[$this->defaultLevel] = array_keys($fixes); + } + + /** + * Populates the module with transforms and other special-case code + * based on a list of fixes passed to it + * @param array $fixes Lookup table of fixes to activate + */ + public function populate($fixes) + { + foreach ($fixes as $name => $fix) { + // determine what the fix is for + list($type, $params) = $this->getFixType($name); + switch ($type) { + case 'attr_transform_pre': + case 'attr_transform_post': + $attr = $params['attr']; + if (isset($params['element'])) { + $element = $params['element']; + if (empty($this->info[$element])) { + $e = $this->addBlankElement($element); + } else { + $e = $this->info[$element]; + } + } else { + $type = "info_$type"; + $e = $this; + } + // PHP does some weird parsing when I do + // $e->$type[$attr], so I have to assign a ref. + $f =& $e->$type; + $f[$attr] = $fix; + break; + case 'tag_transform': + $this->info_tag_transform[$params['element']] = $fix; + break; + case 'child': + case 'content_model_type': + $element = $params['element']; + if (empty($this->info[$element])) { + $e = $this->addBlankElement($element); + } else { + $e = $this->info[$element]; + } + $e->$type = $fix; + break; + default: + trigger_error("Fix type $type not supported", E_USER_ERROR); + break; + } + } + } + + /** + * Parses a fix name and determines what kind of fix it is, as well + * as other information defined by the fix + * @param $name String name of fix + * @return array(string $fix_type, array $fix_parameters) + * @note $fix_parameters is type dependant, see populate() for usage + * of these parameters + */ + public function getFixType($name) + { + // parse it + $property = $attr = null; + if (strpos($name, '#') !== false) { + list($name, $property) = explode('#', $name); + } + if (strpos($name, '@') !== false) { + list($name, $attr) = explode('@', $name); + } + + // figure out the parameters + $params = array(); + if ($name !== '') { + $params['element'] = $name; + } + if (!is_null($attr)) { + $params['attr'] = $attr; + } + + // special case: attribute transform + if (!is_null($attr)) { + if (is_null($property)) { + $property = 'pre'; + } + $type = 'attr_transform_' . $property; + return array($type, $params); + } + + // special case: tag transform + if (is_null($property)) { + return array('tag_transform', $params); + } + + return array($property, $params); + + } + + /** + * Defines all fixes the module will perform in a compact + * associative array of fix name to fix implementation. + * @return array + */ + public function makeFixes() + { + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/XMLCommonAttributes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/XMLCommonAttributes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/XMLCommonAttributes.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule/XMLCommonAttributes.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,20 @@ + array( + 'xml:lang' => 'LanguageCode', + ) + ); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModuleManager.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModuleManager.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModuleManager.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModuleManager.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,467 @@ +attrTypes = new HTMLPurifier_AttrTypes(); + $this->doctypes = new HTMLPurifier_DoctypeRegistry(); + + // setup basic modules + $common = array( + 'CommonAttributes', 'Text', 'Hypertext', 'List', + 'Presentation', 'Edit', 'Bdo', 'Tables', 'Image', + 'StyleAttribute', + // Unsafe: + 'Scripting', 'Object', 'Forms', + // Sorta legacy, but present in strict: + 'Name', + ); + $transitional = array('Legacy', 'Target', 'Iframe'); + $xml = array('XMLCommonAttributes'); + $non_xml = array('NonXMLCommonAttributes'); + + // setup basic doctypes + $this->doctypes->register( + 'HTML 4.01 Transitional', + false, + array_merge($common, $transitional, $non_xml), + array('Tidy_Transitional', 'Tidy_Proprietary'), + array(), + '-//W3C//DTD HTML 4.01 Transitional//EN', + 'http://www.w3.org/TR/html4/loose.dtd' + ); + + $this->doctypes->register( + 'HTML 4.01 Strict', + false, + array_merge($common, $non_xml), + array('Tidy_Strict', 'Tidy_Proprietary', 'Tidy_Name'), + array(), + '-//W3C//DTD HTML 4.01//EN', + 'http://www.w3.org/TR/html4/strict.dtd' + ); + + $this->doctypes->register( + 'XHTML 1.0 Transitional', + true, + array_merge($common, $transitional, $xml, $non_xml), + array('Tidy_Transitional', 'Tidy_XHTML', 'Tidy_Proprietary', 'Tidy_Name'), + array(), + '-//W3C//DTD XHTML 1.0 Transitional//EN', + 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd' + ); + + $this->doctypes->register( + 'XHTML 1.0 Strict', + true, + array_merge($common, $xml, $non_xml), + array('Tidy_Strict', 'Tidy_XHTML', 'Tidy_Strict', 'Tidy_Proprietary', 'Tidy_Name'), + array(), + '-//W3C//DTD XHTML 1.0 Strict//EN', + 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd' + ); + + $this->doctypes->register( + 'XHTML 1.1', + true, + // Iframe is a real XHTML 1.1 module, despite being + // "transitional"! + array_merge($common, $xml, array('Ruby', 'Iframe')), + array('Tidy_Strict', 'Tidy_XHTML', 'Tidy_Proprietary', 'Tidy_Strict', 'Tidy_Name'), // Tidy_XHTML1_1 + array(), + '-//W3C//DTD XHTML 1.1//EN', + 'http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd' + ); + + } + + /** + * Registers a module to the recognized module list, useful for + * overloading pre-existing modules. + * @param $module Mixed: string module name, with or without + * HTMLPurifier_HTMLModule prefix, or instance of + * subclass of HTMLPurifier_HTMLModule. + * @param $overload Boolean whether or not to overload previous modules. + * If this is not set, and you do overload a module, + * HTML Purifier will complain with a warning. + * @note This function will not call autoload, you must instantiate + * (and thus invoke) autoload outside the method. + * @note If a string is passed as a module name, different variants + * will be tested in this order: + * - Check for HTMLPurifier_HTMLModule_$name + * - Check all prefixes with $name in order they were added + * - Check for literal object name + * - Throw fatal error + * If your object name collides with an internal class, specify + * your module manually. All modules must have been included + * externally: registerModule will not perform inclusions for you! + */ + public function registerModule($module, $overload = false) + { + if (is_string($module)) { + // attempt to load the module + $original_module = $module; + $ok = false; + foreach ($this->prefixes as $prefix) { + $module = $prefix . $original_module; + if (class_exists($module)) { + $ok = true; + break; + } + } + if (!$ok) { + $module = $original_module; + if (!class_exists($module)) { + trigger_error( + $original_module . ' module does not exist', + E_USER_ERROR + ); + return; + } + } + $module = new $module(); + } + if (empty($module->name)) { + trigger_error('Module instance of ' . get_class($module) . ' must have name'); + return; + } + if (!$overload && isset($this->registeredModules[$module->name])) { + trigger_error('Overloading ' . $module->name . ' without explicit overload parameter', E_USER_WARNING); + } + $this->registeredModules[$module->name] = $module; + } + + /** + * Adds a module to the current doctype by first registering it, + * and then tacking it on to the active doctype + */ + public function addModule($module) + { + $this->registerModule($module); + if (is_object($module)) { + $module = $module->name; + } + $this->userModules[] = $module; + } + + /** + * Adds a class prefix that registerModule() will use to resolve a + * string name to a concrete class + */ + public function addPrefix($prefix) + { + $this->prefixes[] = $prefix; + } + + /** + * Performs processing on modules, after being called you may + * use getElement() and getElements() + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + $this->trusted = $config->get('HTML.Trusted'); + + // generate + $this->doctype = $this->doctypes->make($config); + $modules = $this->doctype->modules; + + // take out the default modules that aren't allowed + $lookup = $config->get('HTML.AllowedModules'); + $special_cases = $config->get('HTML.CoreModules'); + + if (is_array($lookup)) { + foreach ($modules as $k => $m) { + if (isset($special_cases[$m])) { + continue; + } + if (!isset($lookup[$m])) { + unset($modules[$k]); + } + } + } + + // custom modules + if ($config->get('HTML.Proprietary')) { + $modules[] = 'Proprietary'; + } + if ($config->get('HTML.SafeObject')) { + $modules[] = 'SafeObject'; + } + if ($config->get('HTML.SafeEmbed')) { + $modules[] = 'SafeEmbed'; + } + if ($config->get('HTML.SafeScripting') !== array()) { + $modules[] = 'SafeScripting'; + } + if ($config->get('HTML.Nofollow')) { + $modules[] = 'Nofollow'; + } + if ($config->get('HTML.TargetBlank')) { + $modules[] = 'TargetBlank'; + } + // NB: HTML.TargetNoreferrer and HTML.TargetNoopener must be AFTER HTML.TargetBlank + // so that its post-attr-transform gets run afterwards. + if ($config->get('HTML.TargetNoreferrer')) { + $modules[] = 'TargetNoreferrer'; + } + if ($config->get('HTML.TargetNoopener')) { + $modules[] = 'TargetNoopener'; + } + + // merge in custom modules + $modules = array_merge($modules, $this->userModules); + + foreach ($modules as $module) { + $this->processModule($module); + $this->modules[$module]->setup($config); + } + + foreach ($this->doctype->tidyModules as $module) { + $this->processModule($module); + $this->modules[$module]->setup($config); + } + + // prepare any injectors + foreach ($this->modules as $module) { + $n = array(); + foreach ($module->info_injector as $injector) { + if (!is_object($injector)) { + $class = "HTMLPurifier_Injector_$injector"; + $injector = new $class; + } + $n[$injector->name] = $injector; + } + $module->info_injector = $n; + } + + // setup lookup table based on all valid modules + foreach ($this->modules as $module) { + foreach ($module->info as $name => $def) { + if (!isset($this->elementLookup[$name])) { + $this->elementLookup[$name] = array(); + } + $this->elementLookup[$name][] = $module->name; + } + } + + // note the different choice + $this->contentSets = new HTMLPurifier_ContentSets( + // content set assembly deals with all possible modules, + // not just ones deemed to be "safe" + $this->modules + ); + $this->attrCollections = new HTMLPurifier_AttrCollections( + $this->attrTypes, + // there is no way to directly disable a global attribute, + // but using AllowedAttributes or simply not including + // the module in your custom doctype should be sufficient + $this->modules + ); + } + + /** + * Takes a module and adds it to the active module collection, + * registering it if necessary. + */ + public function processModule($module) + { + if (!isset($this->registeredModules[$module]) || is_object($module)) { + $this->registerModule($module); + } + $this->modules[$module] = $this->registeredModules[$module]; + } + + /** + * Retrieves merged element definitions. + * @return Array of HTMLPurifier_ElementDef + */ + public function getElements() + { + $elements = array(); + foreach ($this->modules as $module) { + if (!$this->trusted && !$module->safe) { + continue; + } + foreach ($module->info as $name => $v) { + if (isset($elements[$name])) { + continue; + } + $elements[$name] = $this->getElement($name); + } + } + + // remove dud elements, this happens when an element that + // appeared to be safe actually wasn't + foreach ($elements as $n => $v) { + if ($v === false) { + unset($elements[$n]); + } + } + + return $elements; + + } + + /** + * Retrieves a single merged element definition + * @param string $name Name of element + * @param bool $trusted Boolean trusted overriding parameter: set to true + * if you want the full version of an element + * @return HTMLPurifier_ElementDef Merged HTMLPurifier_ElementDef + * @note You may notice that modules are getting iterated over twice (once + * in getElements() and once here). This + * is because + */ + public function getElement($name, $trusted = null) + { + if (!isset($this->elementLookup[$name])) { + return false; + } + + // setup global state variables + $def = false; + if ($trusted === null) { + $trusted = $this->trusted; + } + + // iterate through each module that has registered itself to this + // element + foreach ($this->elementLookup[$name] as $module_name) { + $module = $this->modules[$module_name]; + + // refuse to create/merge from a module that is deemed unsafe-- + // pretend the module doesn't exist--when trusted mode is not on. + if (!$trusted && !$module->safe) { + continue; + } + + // clone is used because, ideally speaking, the original + // definition should not be modified. Usually, this will + // make no difference, but for consistency's sake + $new_def = clone $module->info[$name]; + + if (!$def && $new_def->standalone) { + $def = $new_def; + } elseif ($def) { + // This will occur even if $new_def is standalone. In practice, + // this will usually result in a full replacement. + $def->mergeIn($new_def); + } else { + // :TODO: + // non-standalone definitions that don't have a standalone + // to merge into could be deferred to the end + // HOWEVER, it is perfectly valid for a non-standalone + // definition to lack a standalone definition, even + // after all processing: this allows us to safely + // specify extra attributes for elements that may not be + // enabled all in one place. In particular, this might + // be the case for trusted elements. WARNING: care must + // be taken that the /extra/ definitions are all safe. + continue; + } + + // attribute value expansions + $this->attrCollections->performInclusions($def->attr); + $this->attrCollections->expandIdentifiers($def->attr, $this->attrTypes); + + // descendants_are_inline, for ChildDef_Chameleon + if (is_string($def->content_model) && + strpos($def->content_model, 'Inline') !== false) { + if ($name != 'del' && $name != 'ins') { + // this is for you, ins/del + $def->descendants_are_inline = true; + } + } + + $this->contentSets->generateChildDef($def, $module); + } + + // This can occur if there is a blank definition, but no base to + // mix it in with + if (!$def) { + return false; + } + + // add information on required attributes + foreach ($def->attr as $attr_name => $attr_def) { + if ($attr_def->required) { + $def->required_attr[] = $attr_name; + } + } + return $def; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/HTMLModule.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,284 @@ +info, since the object's data is only info, + * with extra behavior associated with it. + * @type array + */ + public $attr_collections = array(); + + /** + * Associative array of deprecated tag name to HTMLPurifier_TagTransform. + * @type array + */ + public $info_tag_transform = array(); + + /** + * List of HTMLPurifier_AttrTransform to be performed before validation. + * @type array + */ + public $info_attr_transform_pre = array(); + + /** + * List of HTMLPurifier_AttrTransform to be performed after validation. + * @type array + */ + public $info_attr_transform_post = array(); + + /** + * List of HTMLPurifier_Injector to be performed during well-formedness fixing. + * An injector will only be invoked if all of it's pre-requisites are met; + * if an injector fails setup, there will be no error; it will simply be + * silently disabled. + * @type array + */ + public $info_injector = array(); + + /** + * Boolean flag that indicates whether or not getChildDef is implemented. + * For optimization reasons: may save a call to a function. Be sure + * to set it if you do implement getChildDef(), otherwise it will have + * no effect! + * @type bool + */ + public $defines_child_def = false; + + /** + * Boolean flag whether or not this module is safe. If it is not safe, all + * of its members are unsafe. Modules are safe by default (this might be + * slightly dangerous, but it doesn't make much sense to force HTML Purifier, + * which is based off of safe HTML, to explicitly say, "This is safe," even + * though there are modules which are "unsafe") + * + * @type bool + * @note Previously, safety could be applied at an element level granularity. + * We've removed this ability, so in order to add "unsafe" elements + * or attributes, a dedicated module with this property set to false + * must be used. + */ + public $safe = true; + + /** + * Retrieves a proper HTMLPurifier_ChildDef subclass based on + * content_model and content_model_type member variables of + * the HTMLPurifier_ElementDef class. There is a similar function + * in HTMLPurifier_HTMLDefinition. + * @param HTMLPurifier_ElementDef $def + * @return HTMLPurifier_ChildDef subclass + */ + public function getChildDef($def) + { + return false; + } + + // -- Convenience ----------------------------------------------------- + + /** + * Convenience function that sets up a new element + * @param string $element Name of element to add + * @param string|bool $type What content set should element be registered to? + * Set as false to skip this step. + * @param string $contents Allowed children in form of: + * "$content_model_type: $content_model" + * @param array $attr_includes What attribute collections to register to + * element? + * @param array $attr What unique attributes does the element define? + * @see HTMLPurifier_ElementDef:: for in-depth descriptions of these parameters. + * @return HTMLPurifier_ElementDef Created element definition object, so you + * can set advanced parameters + */ + public function addElement($element, $type, $contents, $attr_includes = array(), $attr = array()) + { + $this->elements[] = $element; + // parse content_model + list($content_model_type, $content_model) = $this->parseContents($contents); + // merge in attribute inclusions + $this->mergeInAttrIncludes($attr, $attr_includes); + // add element to content sets + if ($type) { + $this->addElementToContentSet($element, $type); + } + // create element + $this->info[$element] = HTMLPurifier_ElementDef::create( + $content_model, + $content_model_type, + $attr + ); + // literal object $contents means direct child manipulation + if (!is_string($contents)) { + $this->info[$element]->child = $contents; + } + return $this->info[$element]; + } + + /** + * Convenience function that creates a totally blank, non-standalone + * element. + * @param string $element Name of element to create + * @return HTMLPurifier_ElementDef Created element + */ + public function addBlankElement($element) + { + if (!isset($this->info[$element])) { + $this->elements[] = $element; + $this->info[$element] = new HTMLPurifier_ElementDef(); + $this->info[$element]->standalone = false; + } else { + trigger_error("Definition for $element already exists in module, cannot redefine"); + } + return $this->info[$element]; + } + + /** + * Convenience function that registers an element to a content set + * @param string $element Element to register + * @param string $type Name content set (warning: case sensitive, usually upper-case + * first letter) + */ + public function addElementToContentSet($element, $type) + { + if (!isset($this->content_sets[$type])) { + $this->content_sets[$type] = ''; + } else { + $this->content_sets[$type] .= ' | '; + } + $this->content_sets[$type] .= $element; + } + + /** + * Convenience function that transforms single-string contents + * into separate content model and content model type + * @param string $contents Allowed children in form of: + * "$content_model_type: $content_model" + * @return array + * @note If contents is an object, an array of two nulls will be + * returned, and the callee needs to take the original $contents + * and use it directly. + */ + public function parseContents($contents) + { + if (!is_string($contents)) { + return array(null, null); + } // defer + switch ($contents) { + // check for shorthand content model forms + case 'Empty': + return array('empty', ''); + case 'Inline': + return array('optional', 'Inline | #PCDATA'); + case 'Flow': + return array('optional', 'Flow | #PCDATA'); + } + list($content_model_type, $content_model) = explode(':', $contents); + $content_model_type = strtolower(trim($content_model_type)); + $content_model = trim($content_model); + return array($content_model_type, $content_model); + } + + /** + * Convenience function that merges a list of attribute includes into + * an attribute array. + * @param array $attr Reference to attr array to modify + * @param array $attr_includes Array of includes / string include to merge in + */ + public function mergeInAttrIncludes(&$attr, $attr_includes) + { + if (!is_array($attr_includes)) { + if (empty($attr_includes)) { + $attr_includes = array(); + } else { + $attr_includes = array($attr_includes); + } + } + $attr[0] = $attr_includes; + } + + /** + * Convenience function that generates a lookup table with boolean + * true as value. + * @param string $list List of values to turn into a lookup + * @note You can also pass an arbitrary number of arguments in + * place of the regular argument + * @return array array equivalent of list + */ + public function makeLookup($list) + { + if (is_string($list)) { + $list = func_get_args(); + } + $ret = array(); + foreach ($list as $value) { + if (is_null($value)) { + continue; + } + $ret[$value] = true; + } + return $ret; + } + + /** + * Lazy load construction of the module after determining whether + * or not it's needed, and also when a finalized configuration object + * is available. + * @param HTMLPurifier_Config $config + */ + public function setup($config) + { + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/IDAccumulator.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/IDAccumulator.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/IDAccumulator.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/IDAccumulator.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,57 @@ +load($config->get('Attr.IDBlacklist')); + return $id_accumulator; + } + + /** + * Add an ID to the lookup table. + * @param string $id ID to be added. + * @return bool status, true if success, false if there's a dupe + */ + public function add($id) + { + if (isset($this->ids[$id])) { + return false; + } + return $this->ids[$id] = true; + } + + /** + * Load a list of IDs into the lookup table + * @param $array_of_ids Array of IDs to load + * @note This function doesn't care about duplicates + */ + public function load($array_of_ids) + { + foreach ($array_of_ids as $id) { + $this->ids[$id] = true; + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/AutoParagraph.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/AutoParagraph.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/AutoParagraph.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/AutoParagraph.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,356 @@ +armor['MakeWellFormed_TagClosedError'] = true; + return $par; + } + + /** + * @param HTMLPurifier_Token_Text $token + */ + public function handleText(&$token) + { + $text = $token->data; + // Does the current parent allow tags? + if ($this->allowsElement('p')) { + if (empty($this->currentNesting) || strpos($text, "\n\n") !== false) { + // Note that we have differing behavior when dealing with text + // in the anonymous root node, or a node inside the document. + // If the text as a double-newline, the treatment is the same; + // if it doesn't, see the next if-block if you're in the document. + + $i = $nesting = null; + if (!$this->forwardUntilEndToken($i, $current, $nesting) && $token->is_whitespace) { + // State 1.1: ... ^ (whitespace, then document end) + // ---- + // This is a degenerate case + } else { + if (!$token->is_whitespace || $this->_isInline($current)) { + // State 1.2: PAR1 + // ---- + + // State 1.3: PAR1\n\nPAR2 + // ------------ + + // State 1.4:
PAR1\n\nPAR2 (see State 2) + // ------------ + $token = array($this->_pStart()); + $this->_splitText($text, $token); + } else { + // State 1.5: \n
+ // -- + } + } + } else { + // State 2:PAR1... (similar to 1.4) + // ---- + + // We're in an element that allows paragraph tags, but we're not + // sure if we're going to need them. + if ($this->_pLookAhead()) { + // State 2.1:PAR1PAR1\n\nPAR2 + // ---- + // Note: This will always be the first child, since any + // previous inline element would have triggered this very + // same routine, and found the double newline. One possible + // exception would be a comment. + $token = array($this->_pStart(), $token); + } else { + // State 2.2.1:PAR1+ // ---- + + // State 2.2.2:PAR1PAR1+ // ---- + } + } + // Is the current parent atag? + } elseif (!empty($this->currentNesting) && + $this->currentNesting[count($this->currentNesting) - 1]->name == 'p') { + // State 3.1: ...
PAR1 + // ---- + + // State 3.2: ...
PAR1\n\nPAR2 + // ------------ + $token = array(); + $this->_splitText($text, $token); + // Abort! + } else { + // State 4.1: ...PAR1 + // ---- + + // State 4.2: ...PAR1\n\nPAR2 + // ------------ + } + } + + /** + * @param HTMLPurifier_Token $token + */ + public function handleElement(&$token) + { + // We don't have to check if we're already in a
tag for block + // tokens, because the tag would have been autoclosed by MakeWellFormed. + if ($this->allowsElement('p')) { + if (!empty($this->currentNesting)) { + if ($this->_isInline($token)) { + // State 1:
... + // --- + // Check if this token is adjacent to the parent token + // (seek backwards until token isn't whitespace) + $i = null; + $this->backward($i, $prev); + + if (!$prev instanceof HTMLPurifier_Token_Start) { + // Token wasn't adjacent + if ($prev instanceof HTMLPurifier_Token_Text && + substr($prev->data, -2) === "\n\n" + ) { + // State 1.1.4:PAR1
\n\n + // --- + // Quite frankly, this should be handled by splitText + $token = array($this->_pStart(), $token); + } else { + // State 1.1.1:PAR1
+ // --- + // State 1.1.2:
+ // --- + // State 1.1.3:PAR + // --- + } + } else { + // State 1.2.1:+ // --- + // Lookahead to see ifis needed. + if ($this->_pLookAhead()) { + // State 1.3.1:
PAR1\n\nPAR2 + // --- + $token = array($this->_pStart(), $token); + } else { + // State 1.3.2:PAR1+ // --- + + // State 1.3.3:PAR1\n\n+ // --- + } + } + } else { + // State 2.3: ...+ // ----- + } + } else { + if ($this->_isInline($token)) { + // State 3.1: + // --- + // This is where the {p} tag is inserted, not reflected in + // inputTokens yet, however. + $token = array($this->_pStart(), $token); + } else { + // State 3.2:+ // ----- + } + + $i = null; + if ($this->backward($i, $prev)) { + if (!$prev instanceof HTMLPurifier_Token_Text) { + // State 3.1.1: ...{p} + // --- + // State 3.2.1: ...+ // ----- + if (!is_array($token)) { + $token = array($token); + } + array_unshift($token, new HTMLPurifier_Token_Text("\n\n")); + } else { + // State 3.1.2: ...\n\n{p} + // --- + // State 3.2.2: ...\n\n+ // ----- + // Note: PARcannot occur because PAR would have been + // wrapped in tags. + } + } + } + } else { + // State 2.2:
-
+ // ----
+ // State 2.4:
+ // --- + } + } + + /** + * Splits up a text in paragraph tokens and appends them + * to the result stream that will replace the original + * @param string $data String text data that will be processed + * into paragraphs + * @param HTMLPurifier_Token[] $result Reference to array of tokens that the + * tags will be appended onto + */ + private function _splitText($data, &$result) + { + $raw_paragraphs = explode("\n\n", $data); + $paragraphs = array(); // without empty paragraphs + $needs_start = false; + $needs_end = false; + + $c = count($raw_paragraphs); + if ($c == 1) { + // There were no double-newlines, abort quickly. In theory this + // should never happen. + $result[] = new HTMLPurifier_Token_Text($data); + return; + } + for ($i = 0; $i < $c; $i++) { + $par = $raw_paragraphs[$i]; + if (trim($par) !== '') { + $paragraphs[] = $par; + } else { + if ($i == 0) { + // Double newline at the front + if (empty($result)) { + // The empty result indicates that the AutoParagraph + // injector did not add any start paragraph tokens. + // This means that we have been in a paragraph for + // a while, and the newline means we should start a new one. + $result[] = new HTMLPurifier_Token_End('p'); + $result[] = new HTMLPurifier_Token_Text("\n\n"); + // However, the start token should only be added if + // there is more processing to be done (i.e. there are + // real paragraphs in here). If there are none, the + // next start paragraph tag will be handled by the + // next call to the injector + $needs_start = true; + } else { + // We just started a new paragraph! + // Reinstate a double-newline for presentation's sake, since + // it was in the source code. + array_unshift($result, new HTMLPurifier_Token_Text("\n\n")); + } + } elseif ($i + 1 == $c) { + // Double newline at the end + // There should be a trailing
when we're finally done. + $needs_end = true; + } + } + } + + // Check if this was just a giant blob of whitespace. Move this earlier, + // perhaps? + if (empty($paragraphs)) { + return; + } + + // Add the start tag indicated by \n\n at the beginning of $data + if ($needs_start) { + $result[] = $this->_pStart(); + } + + // Append the paragraphs onto the result + foreach ($paragraphs as $par) { + $result[] = new HTMLPurifier_Token_Text($par); + $result[] = new HTMLPurifier_Token_End('p'); + $result[] = new HTMLPurifier_Token_Text("\n\n"); + $result[] = $this->_pStart(); + } + + // Remove trailing start token; Injector will handle this later if + // it was indeed needed. This prevents from needing to do a lookahead, + // at the cost of a lookbehind later. + array_pop($result); + + // If there is no need for an end tag, remove all of it and let + // MakeWellFormed close it later. + if (!$needs_end) { + array_pop($result); // removes \n\n + array_pop($result); // removes + } + } + + /** + * Returns true if passed token is inline (and, ergo, allowed in + * paragraph tags) + * @param HTMLPurifier_Token $token + * @return bool + */ + private function _isInline($token) + { + return isset($this->htmlDefinition->info['p']->child->elements[$token->name]); + } + + /** + * Looks ahead in the token list and determines whether or not we need + * to insert atag. + * @return bool + */ + private function _pLookAhead() + { + if ($this->currentToken instanceof HTMLPurifier_Token_Start) { + $nesting = 1; + } else { + $nesting = 0; + } + $ok = false; + $i = null; + while ($this->forwardUntilEndToken($i, $current, $nesting)) { + $result = $this->_checkNeedsP($current); + if ($result !== null) { + $ok = $result; + break; + } + } + return $ok; + } + + /** + * Determines if a particular token requires an earlier inline token + * to get a paragraph. This should be used with _forwardUntilEndToken + * @param HTMLPurifier_Token $current + * @return bool + */ + private function _checkNeedsP($current) + { + if ($current instanceof HTMLPurifier_Token_Start) { + if (!$this->_isInline($current)) { + //
PAR1+ // ---- + // Terminate early, since we hit a block element + return false; + } + } elseif ($current instanceof HTMLPurifier_Token_Text) { + if (strpos($current->data, "\n\n") !== false) { + //PAR1PAR1\n\nPAR2 + // ---- + return true; + } else { + //PAR1PAR1... + // ---- + } + } + return null; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/DisplayLinkURI.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/DisplayLinkURI.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/DisplayLinkURI.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/DisplayLinkURI.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,40 @@ +start->attr['href'])) { + $url = $token->start->attr['href']; + unset($token->start->attr['href']); + $token = array($token, new HTMLPurifier_Token_Text(" ($url)")); + } else { + // nothing to display + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/Linkify.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/Linkify.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/Linkify.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/Linkify.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,64 @@ + array('href')); + + /** + * @param HTMLPurifier_Token $token + */ + public function handleText(&$token) + { + if (!$this->allowsElement('a')) { + return; + } + + if (strpos($token->data, '://') === false) { + // our really quick heuristic failed, abort + // this may not work so well if we want to match things like + // "google.com", but then again, most people don't + return; + } + + // there is/are URL(s). Let's split the string. + // We use this regex: + // https://gist.github.com/gruber/249502 + // but with @cscott's backtracking fix and also + // the Unicode characters un-Unicodified. + $bits = preg_split( + '/\\b((?:[a-z][\\w\\-]+:(?:\\/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}\\/)(?:[^\\s()<>]|\\((?:[^\\s()<>]|(?:\\([^\\s()<>]+\\)))*\\))+(?:\\((?:[^\\s()<>]|(?:\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:\'".,<>?\x{00ab}\x{00bb}\x{201c}\x{201d}\x{2018}\x{2019}]))/iu', + $token->data, -1, PREG_SPLIT_DELIM_CAPTURE); + + + $token = array(); + + // $i = index + // $c = count + // $l = is link + for ($i = 0, $c = count($bits), $l = false; $i < $c; $i++, $l = !$l) { + if (!$l) { + if ($bits[$i] === '') { + continue; + } + $token[] = new HTMLPurifier_Token_Text($bits[$i]); + } else { + $token[] = new HTMLPurifier_Token_Start('a', array('href' => $bits[$i])); + $token[] = new HTMLPurifier_Token_Text($bits[$i]); + $token[] = new HTMLPurifier_Token_End('a'); + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/PurifierLinkify.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/PurifierLinkify.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/PurifierLinkify.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/PurifierLinkify.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,71 @@ + array('href')); + + /** + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return string + */ + public function prepare($config, $context) + { + $this->docURL = $config->get('AutoFormat.PurifierLinkify.DocURL'); + return parent::prepare($config, $context); + } + + /** + * @param HTMLPurifier_Token $token + */ + public function handleText(&$token) + { + if (!$this->allowsElement('a')) { + return; + } + if (strpos($token->data, '%') === false) { + return; + } + + $bits = preg_split('#%([a-z0-9]+\.[a-z0-9]+)#Si', $token->data, -1, PREG_SPLIT_DELIM_CAPTURE); + $token = array(); + + // $i = index + // $c = count + // $l = is link + for ($i = 0, $c = count($bits), $l = false; $i < $c; $i++, $l = !$l) { + if (!$l) { + if ($bits[$i] === '') { + continue; + } + $token[] = new HTMLPurifier_Token_Text($bits[$i]); + } else { + $token[] = new HTMLPurifier_Token_Start( + 'a', + array('href' => str_replace('%s', $bits[$i], $this->docURL)) + ); + $token[] = new HTMLPurifier_Token_Text('%' . $bits[$i]); + $token[] = new HTMLPurifier_Token_End('a'); + } + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveEmpty.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveEmpty.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveEmpty.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveEmpty.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,112 @@ +config = $config; + $this->context = $context; + $this->removeNbsp = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp'); + $this->removeNbspExceptions = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions'); + $this->exclude = $config->get('AutoFormat.RemoveEmpty.Predicate'); + foreach ($this->exclude as $key => $attrs) { + if (!is_array($attrs)) { + // HACK, see HTMLPurifier/Printer/ConfigForm.php + $this->exclude[$key] = explode(';', $attrs); + } + } + $this->attrValidator = new HTMLPurifier_AttrValidator(); + } + + /** + * @param HTMLPurifier_Token $token + */ + public function handleElement(&$token) + { + if (!$token instanceof HTMLPurifier_Token_Start) { + return; + } + $next = false; + $deleted = 1; // the current tag + for ($i = count($this->inputZipper->back) - 1; $i >= 0; $i--, $deleted++) { + $next = $this->inputZipper->back[$i]; + if ($next instanceof HTMLPurifier_Token_Text) { + if ($next->is_whitespace) { + continue; + } + if ($this->removeNbsp && !isset($this->removeNbspExceptions[$token->name])) { + $plain = str_replace("\xC2\xA0", "", $next->data); + $isWsOrNbsp = $plain === '' || ctype_space($plain); + if ($isWsOrNbsp) { + continue; + } + } + } + break; + } + if (!$next || ($next instanceof HTMLPurifier_Token_End && $next->name == $token->name)) { + $this->attrValidator->validateToken($token, $this->config, $this->context); + $token->armor['ValidateAttributes'] = true; + if (isset($this->exclude[$token->name])) { + $r = true; + foreach ($this->exclude[$token->name] as $elem) { + if (!isset($token->attr[$elem])) $r = false; + } + if ($r) return; + } + if (isset($token->attr['id']) || isset($token->attr['name'])) { + return; + } + $token = $deleted + 1; + for ($b = 0, $c = count($this->inputZipper->front); $b < $c; $b++) { + $prev = $this->inputZipper->front[$b]; + if ($prev instanceof HTMLPurifier_Token_Text && $prev->is_whitespace) { + continue; + } + break; + } + // This is safe because we removed the token that triggered this. + $this->rewindOffset($b+$deleted); + return; + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,84 @@ +attrValidator = new HTMLPurifier_AttrValidator(); + $this->config = $config; + $this->context = $context; + return parent::prepare($config, $context); + } + + /** + * @param HTMLPurifier_Token $token + */ + public function handleElement(&$token) + { + if ($token->name !== 'span' || !$token instanceof HTMLPurifier_Token_Start) { + return; + } + + // We need to validate the attributes now since this doesn't normally + // happen until after MakeWellFormed. If all the attributes are removed + // the span needs to be removed too. + $this->attrValidator->validateToken($token, $this->config, $this->context); + $token->armor['ValidateAttributes'] = true; + + if (!empty($token->attr)) { + return; + } + + $nesting = 0; + while ($this->forwardUntilEndToken($i, $current, $nesting)) { + } + + if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') { + // Mark closing span tag for deletion + $current->markForDeletion = true; + // Delete open span tag + $token = false; + } + } + + /** + * @param HTMLPurifier_Token $token + */ + public function handleEnd(&$token) + { + if ($token->markForDeletion) { + $token = false; + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/SafeObject.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/SafeObject.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/SafeObject.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector/SafeObject.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,124 @@ + 'never', + 'allowNetworking' => 'internal', + ); + + /** + * These are all lower-case keys. + * @type array + */ + protected $allowedParam = array( + 'wmode' => true, + 'movie' => true, + 'flashvars' => true, + 'src' => true, + 'allowfullscreen' => true, // if omitted, assume to be 'false' + ); + + /** + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return void + */ + public function prepare($config, $context) + { + parent::prepare($config, $context); + } + + /** + * @param HTMLPurifier_Token $token + */ + public function handleElement(&$token) + { + if ($token->name == 'object') { + $this->objectStack[] = $token; + $this->paramStack[] = array(); + $new = array($token); + foreach ($this->addParam as $name => $value) { + $new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value)); + } + $token = $new; + } elseif ($token->name == 'param') { + $nest = count($this->currentNesting) - 1; + if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') { + $i = count($this->objectStack) - 1; + if (!isset($token->attr['name'])) { + $token = false; + return; + } + $n = $token->attr['name']; + // We need this fix because YouTube doesn't supply a data + // attribute, which we need if a type is specified. This is + // *very* Flash specific. + if (!isset($this->objectStack[$i]->attr['data']) && + ($token->attr['name'] == 'movie' || $token->attr['name'] == 'src') + ) { + $this->objectStack[$i]->attr['data'] = $token->attr['value']; + } + // Check if the parameter is the correct value but has not + // already been added + if (!isset($this->paramStack[$i][$n]) && + isset($this->addParam[$n]) && + $token->attr['name'] === $this->addParam[$n]) { + // keep token, and add to param stack + $this->paramStack[$i][$n] = true; + } elseif (isset($this->allowedParam[strtolower($n)])) { + // keep token, don't do anything to it + // (could possibly check for duplicates here) + // Note: In principle, parameters should be case sensitive. + // But it seems they are not really; so accept any case. + } else { + $token = false; + } + } else { + // not directly inside an object, DENY! + $token = false; + } + } + } + + public function handleEnd(&$token) + { + // This is the WRONG way of handling the object and param stacks; + // we should be inserting them directly on the relevant object tokens + // so that the global stack handling handles it. + if ($token->name == 'object') { + array_pop($this->objectStack); + array_pop($this->paramStack); + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Injector.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,283 @@ +processToken() + * documentation. + * + * @todo Allow injectors to request a re-run on their output. This + * would help if an operation is recursive. + */ +abstract class HTMLPurifier_Injector +{ + + /** + * Advisory name of injector, this is for friendly error messages. + * @type string + */ + public $name; + + /** + * @type HTMLPurifier_HTMLDefinition + */ + protected $htmlDefinition; + + /** + * Reference to CurrentNesting variable in Context. This is an array + * list of tokens that we are currently "inside" + * @type array + */ + protected $currentNesting; + + /** + * Reference to current token. + * @type HTMLPurifier_Token + */ + protected $currentToken; + + /** + * Reference to InputZipper variable in Context. + * @type HTMLPurifier_Zipper + */ + protected $inputZipper; + + /** + * Array of elements and attributes this injector creates and therefore + * need to be allowed by the definition. Takes form of + * array('element' => array('attr', 'attr2'), 'element2') + * @type array + */ + public $needed = array(); + + /** + * Number of elements to rewind backwards (relative). + * @type bool|int + */ + protected $rewindOffset = false; + + /** + * Rewind to a spot to re-perform processing. This is useful if you + * deleted a node, and now need to see if this change affected any + * earlier nodes. Rewinding does not affect other injectors, and can + * result in infinite loops if not used carefully. + * @param bool|int $offset + * @warning HTML Purifier will prevent you from fast-forwarding with this + * function. + */ + public function rewindOffset($offset) + { + $this->rewindOffset = $offset; + } + + /** + * Retrieves rewind offset, and then unsets it. + * @return bool|int + */ + public function getRewindOffset() + { + $r = $this->rewindOffset; + $this->rewindOffset = false; + return $r; + } + + /** + * Prepares the injector by giving it the config and context objects: + * this allows references to important variables to be made within + * the injector. This function also checks if the HTML environment + * will work with the Injector (see checkNeeded()). + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool|string Boolean false if success, string of missing needed element/attribute if failure + */ + public function prepare($config, $context) + { + $this->htmlDefinition = $config->getHTMLDefinition(); + // Even though this might fail, some unit tests ignore this and + // still test checkNeeded, so be careful. Maybe get rid of that + // dependency. + $result = $this->checkNeeded($config); + if ($result !== false) { + return $result; + } + $this->currentNesting =& $context->get('CurrentNesting'); + $this->currentToken =& $context->get('CurrentToken'); + $this->inputZipper =& $context->get('InputZipper'); + return false; + } + + /** + * This function checks if the HTML environment + * will work with the Injector: if p tags are not allowed, the + * Auto-Paragraphing injector should not be enabled. + * @param HTMLPurifier_Config $config + * @return bool|string Boolean false if success, string of missing needed element/attribute if failure + */ + public function checkNeeded($config) + { + $def = $config->getHTMLDefinition(); + foreach ($this->needed as $element => $attributes) { + if (is_int($element)) { + $element = $attributes; + } + if (!isset($def->info[$element])) { + return $element; + } + if (!is_array($attributes)) { + continue; + } + foreach ($attributes as $name) { + if (!isset($def->info[$element]->attr[$name])) { + return "$element.$name"; + } + } + } + return false; + } + + /** + * Tests if the context node allows a certain element + * @param string $name Name of element to test for + * @return bool True if element is allowed, false if it is not + */ + public function allowsElement($name) + { + if (!empty($this->currentNesting)) { + $parent_token = array_pop($this->currentNesting); + $this->currentNesting[] = $parent_token; + $parent = $this->htmlDefinition->info[$parent_token->name]; + } else { + $parent = $this->htmlDefinition->info_parent_def; + } + if (!isset($parent->child->elements[$name]) || isset($parent->excludes[$name])) { + return false; + } + // check for exclusion + if (!empty($this->currentNesting)) { + for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) { + $node = $this->currentNesting[$i]; + $def = $this->htmlDefinition->info[$node->name]; + if (isset($def->excludes[$name])) { + return false; + } + } + } + return true; + } + + /** + * Iterator function, which starts with the next token and continues until + * you reach the end of the input tokens. + * @warning Please prevent previous references from interfering with this + * functions by setting $i = null beforehand! + * @param int $i Current integer index variable for inputTokens + * @param HTMLPurifier_Token $current Current token variable. + * Do NOT use $token, as that variable is also a reference + * @return bool + */ + protected function forward(&$i, &$current) + { + if ($i === null) { + $i = count($this->inputZipper->back) - 1; + } else { + $i--; + } + if ($i < 0) { + return false; + } + $current = $this->inputZipper->back[$i]; + return true; + } + + /** + * Similar to _forward, but accepts a third parameter $nesting (which + * should be initialized at 0) and stops when we hit the end tag + * for the node $this->inputIndex starts in. + * @param int $i Current integer index variable for inputTokens + * @param HTMLPurifier_Token $current Current token variable. + * Do NOT use $token, as that variable is also a reference + * @param int $nesting + * @return bool + */ + protected function forwardUntilEndToken(&$i, &$current, &$nesting) + { + $result = $this->forward($i, $current); + if (!$result) { + return false; + } + if ($nesting === null) { + $nesting = 0; + } + if ($current instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($current instanceof HTMLPurifier_Token_End) { + if ($nesting <= 0) { + return false; + } + $nesting--; + } + return true; + } + + /** + * Iterator function, starts with the previous token and continues until + * you reach the beginning of input tokens. + * @warning Please prevent previous references from interfering with this + * functions by setting $i = null beforehand! + * @param int $i Current integer index variable for inputTokens + * @param HTMLPurifier_Token $current Current token variable. + * Do NOT use $token, as that variable is also a reference + * @return bool + */ + protected function backward(&$i, &$current) + { + if ($i === null) { + $i = count($this->inputZipper->front) - 1; + } else { + $i--; + } + if ($i < 0) { + return false; + } + $current = $this->inputZipper->front[$i]; + return true; + } + + /** + * Handler that is called when a text token is processed + */ + public function handleText(&$token) + { + } + + /** + * Handler that is called when a start or empty token is processed + */ + public function handleElement(&$token) + { + } + + /** + * Handler that is called when an end token is processed + */ + public function handleEnd(&$token) + { + $this->notifyEnd($token); + } + + /** + * Notifier that is called when an end token is processed + * @param HTMLPurifier_Token $token Current token variable. + * @note This differs from handlers in that the token is read-only + * @deprecated + */ + public function notifyEnd($token) + { + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/classes/en-x-test.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/classes/en-x-test.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/classes/en-x-test.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/classes/en-x-test.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,9 @@ + 'HTML Purifier', +// for unit testing purposes + 'LanguageFactoryTest: Pizza' => 'Pizza', + 'LanguageTest: List' => '$1', + 'LanguageTest: Hash' => '$1.Keys; $1.Values', + 'Item separator' => ', ', + 'Item separator last' => ' and ', // non-Harvard style + + 'ErrorCollector: No errors' => 'No errors detected. However, because error reporting is still incomplete, there may have been errors that the error collector was not notified of; please inspect the output HTML carefully.', + 'ErrorCollector: At line' => ' at line $line', + 'ErrorCollector: Incidental errors' => 'Incidental errors', + 'Lexer: Unclosed comment' => 'Unclosed comment', + 'Lexer: Unescaped lt' => 'Unescaped less-than sign (<) should be <', + 'Lexer: Missing gt' => 'Missing greater-than sign (>), previous less-than sign (<) should be escaped', + 'Lexer: Missing attribute key' => 'Attribute declaration has no key', + 'Lexer: Missing end quote' => 'Attribute declaration has no end quote', + 'Lexer: Extracted body' => 'Removed document metadata tags', + 'Strategy_RemoveForeignElements: Tag transform' => '<$1> element transformed into $CurrentToken.Serialized', + 'Strategy_RemoveForeignElements: Missing required attribute' => '$CurrentToken.Compact element missing required attribute $1', + 'Strategy_RemoveForeignElements: Foreign element to text' => 'Unrecognized $CurrentToken.Serialized tag converted to text', + 'Strategy_RemoveForeignElements: Foreign element removed' => 'Unrecognized $CurrentToken.Serialized tag removed', + 'Strategy_RemoveForeignElements: Comment removed' => 'Comment containing "$CurrentToken.Data" removed', + 'Strategy_RemoveForeignElements: Foreign meta element removed' => 'Unrecognized $CurrentToken.Serialized meta tag and all descendants removed', + 'Strategy_RemoveForeignElements: Token removed to end' => 'Tags and text starting from $1 element where removed to end', + 'Strategy_RemoveForeignElements: Trailing hyphen in comment removed' => 'Trailing hyphen(s) in comment removed', + 'Strategy_RemoveForeignElements: Hyphens in comment collapsed' => 'Double hyphens in comments are not allowed, and were collapsed into single hyphens', + 'Strategy_MakeWellFormed: Unnecessary end tag removed' => 'Unnecessary $CurrentToken.Serialized tag removed', + 'Strategy_MakeWellFormed: Unnecessary end tag to text' => 'Unnecessary $CurrentToken.Serialized tag converted to text', + 'Strategy_MakeWellFormed: Tag auto closed' => '$1.Compact started on line $1.Line auto-closed by $CurrentToken.Compact', + 'Strategy_MakeWellFormed: Tag carryover' => '$1.Compact started on line $1.Line auto-continued into $CurrentToken.Compact', + 'Strategy_MakeWellFormed: Stray end tag removed' => 'Stray $CurrentToken.Serialized tag removed', + 'Strategy_MakeWellFormed: Stray end tag to text' => 'Stray $CurrentToken.Serialized tag converted to text', + 'Strategy_MakeWellFormed: Tag closed by element end' => '$1.Compact tag started on line $1.Line closed by end of $CurrentToken.Serialized', + 'Strategy_MakeWellFormed: Tag closed by document end' => '$1.Compact tag started on line $1.Line closed by end of document', + 'Strategy_FixNesting: Node removed' => '$CurrentToken.Compact node removed', + 'Strategy_FixNesting: Node excluded' => '$CurrentToken.Compact node removed due to descendant exclusion by ancestor element', + 'Strategy_FixNesting: Node reorganized' => 'Contents of $CurrentToken.Compact node reorganized to enforce its content model', + 'Strategy_FixNesting: Node contents removed' => 'Contents of $CurrentToken.Compact node removed', + 'AttrValidator: Attributes transformed' => 'Attributes on $CurrentToken.Compact transformed from $1.Keys to $2.Keys', + 'AttrValidator: Attribute removed' => '$CurrentAttr.Name attribute on $CurrentToken.Compact removed', +); + +$errorNames = array( + E_ERROR => 'Error', + E_WARNING => 'Warning', + E_NOTICE => 'Notice' +); + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-testmini.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-testmini.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-testmini.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-testmini.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,14 @@ + 'HTML Purifier XNone' +); + +$errorNames = array(); + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-test.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-test.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-test.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language/messages/en-x-test.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,13 @@ + 'HTML Purifier X' +); + +$errorNames = array(); + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/LanguageFactory.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/LanguageFactory.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/LanguageFactory.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/LanguageFactory.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,209 @@ +cache[$language_code][$key] = $value + * @type array + */ + public $cache; + + /** + * Valid keys in the HTMLPurifier_Language object. Designates which + * variables to slurp out of a message file. + * @type array + */ + public $keys = array('fallback', 'messages', 'errorNames'); + + /** + * Instance to validate language codes. + * @type HTMLPurifier_AttrDef_Lang + * + */ + protected $validator; + + /** + * Cached copy of dirname(__FILE__), directory of current file without + * trailing slash. + * @type string + */ + protected $dir; + + /** + * Keys whose contents are a hash map and can be merged. + * @type array + */ + protected $mergeable_keys_map = array('messages' => true, 'errorNames' => true); + + /** + * Keys whose contents are a list and can be merged. + * @value array lookup + */ + protected $mergeable_keys_list = array(); + + /** + * Retrieve sole instance of the factory. + * @param HTMLPurifier_LanguageFactory $prototype Optional prototype to overload sole instance with, + * or bool true to reset to default factory. + * @return HTMLPurifier_LanguageFactory + */ + public static function instance($prototype = null) + { + static $instance = null; + if ($prototype !== null) { + $instance = $prototype; + } elseif ($instance === null || $prototype == true) { + $instance = new HTMLPurifier_LanguageFactory(); + $instance->setup(); + } + return $instance; + } + + /** + * Sets up the singleton, much like a constructor + * @note Prevents people from getting this outside of the singleton + */ + public function setup() + { + $this->validator = new HTMLPurifier_AttrDef_Lang(); + $this->dir = HTMLPURIFIER_PREFIX . '/HTMLPurifier'; + } + + /** + * Creates a language object, handles class fallbacks + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @param bool|string $code Code to override configuration with. Private parameter. + * @return HTMLPurifier_Language + */ + public function create($config, $context, $code = false) + { + // validate language code + if ($code === false) { + $code = $this->validator->validate( + $config->get('Core.Language'), + $config, + $context + ); + } else { + $code = $this->validator->validate($code, $config, $context); + } + if ($code === false) { + $code = 'en'; // malformed code becomes English + } + + $pcode = str_replace('-', '_', $code); // make valid PHP classname + static $depth = 0; // recursion protection + + if ($code == 'en') { + $lang = new HTMLPurifier_Language($config, $context); + } else { + $class = 'HTMLPurifier_Language_' . $pcode; + $file = $this->dir . '/Language/classes/' . $code . '.php'; + if (file_exists($file) || class_exists($class, false)) { + $lang = new $class($config, $context); + } else { + // Go fallback + $raw_fallback = $this->getFallbackFor($code); + $fallback = $raw_fallback ? $raw_fallback : 'en'; + $depth++; + $lang = $this->create($config, $context, $fallback); + if (!$raw_fallback) { + $lang->error = true; + } + $depth--; + } + } + $lang->code = $code; + return $lang; + } + + /** + * Returns the fallback language for language + * @note Loads the original language into cache + * @param string $code language code + * @return string|bool + */ + public function getFallbackFor($code) + { + $this->loadLanguage($code); + return $this->cache[$code]['fallback']; + } + + /** + * Loads language into the cache, handles message file and fallbacks + * @param string $code language code + */ + public function loadLanguage($code) + { + static $languages_seen = array(); // recursion guard + + // abort if we've already loaded it + if (isset($this->cache[$code])) { + return; + } + + // generate filename + $filename = $this->dir . '/Language/messages/' . $code . '.php'; + + // default fallback : may be overwritten by the ensuing include + $fallback = ($code != 'en') ? 'en' : false; + + // load primary localisation + if (!file_exists($filename)) { + // skip the include: will rely solely on fallback + $filename = $this->dir . '/Language/messages/en.php'; + $cache = array(); + } else { + include $filename; + $cache = compact($this->keys); + } + + // load fallback localisation + if (!empty($fallback)) { + + // infinite recursion guard + if (isset($languages_seen[$code])) { + trigger_error( + 'Circular fallback reference in language ' . + $code, + E_USER_ERROR + ); + $fallback = 'en'; + } + $language_seen[$code] = true; + + // load the fallback recursively + $this->loadLanguage($fallback); + $fallback_cache = $this->cache[$fallback]; + + // merge fallback with current language + foreach ($this->keys as $key) { + if (isset($cache[$key]) && isset($fallback_cache[$key])) { + if (isset($this->mergeable_keys_map[$key])) { + $cache[$key] = $cache[$key] + $fallback_cache[$key]; + } elseif (isset($this->mergeable_keys_list[$key])) { + $cache[$key] = array_merge($fallback_cache[$key], $cache[$key]); + } + } else { + $cache[$key] = $fallback_cache[$key]; + } + } + } + + // save to cache for later retrieval + $this->cache[$code] = $cache; + return; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Language.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Language.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,204 @@ +config = $config; + $this->context = $context; + } + + /** + * Loads language object with necessary info from factory cache + * @note This is a lazy loader + */ + public function load() + { + if ($this->_loaded) { + return; + } + $factory = HTMLPurifier_LanguageFactory::instance(); + $factory->loadLanguage($this->code); + foreach ($factory->keys as $key) { + $this->$key = $factory->cache[$this->code][$key]; + } + $this->_loaded = true; + } + + /** + * Retrieves a localised message. + * @param string $key string identifier of message + * @return string localised message + */ + public function getMessage($key) + { + if (!$this->_loaded) { + $this->load(); + } + if (!isset($this->messages[$key])) { + return "[$key]"; + } + return $this->messages[$key]; + } + + /** + * Retrieves a localised error name. + * @param int $int error number, corresponding to PHP's error reporting + * @return string localised message + */ + public function getErrorName($int) + { + if (!$this->_loaded) { + $this->load(); + } + if (!isset($this->errorNames[$int])) { + return "[Error: $int]"; + } + return $this->errorNames[$int]; + } + + /** + * Converts an array list into a string readable representation + * @param array $array + * @return string + */ + public function listify($array) + { + $sep = $this->getMessage('Item separator'); + $sep_last = $this->getMessage('Item separator last'); + $ret = ''; + for ($i = 0, $c = count($array); $i < $c; $i++) { + if ($i == 0) { + } elseif ($i + 1 < $c) { + $ret .= $sep; + } else { + $ret .= $sep_last; + } + $ret .= $array[$i]; + } + return $ret; + } + + /** + * Formats a localised message with passed parameters + * @param string $key string identifier of message + * @param array $args Parameters to substitute in + * @return string localised message + * @todo Implement conditionals? Right now, some messages make + * reference to line numbers, but those aren't always available + */ + public function formatMessage($key, $args = array()) + { + if (!$this->_loaded) { + $this->load(); + } + if (!isset($this->messages[$key])) { + return "[$key]"; + } + $raw = $this->messages[$key]; + $subst = array(); + $generator = false; + foreach ($args as $i => $value) { + if (is_object($value)) { + if ($value instanceof HTMLPurifier_Token) { + // factor this out some time + if (!$generator) { + $generator = $this->context->get('Generator'); + } + if (isset($value->name)) { + $subst['$'.$i.'.Name'] = $value->name; + } + if (isset($value->data)) { + $subst['$'.$i.'.Data'] = $value->data; + } + $subst['$'.$i.'.Compact'] = + $subst['$'.$i.'.Serialized'] = $generator->generateFromToken($value); + // a more complex algorithm for compact representation + // could be introduced for all types of tokens. This + // may need to be factored out into a dedicated class + if (!empty($value->attr)) { + $stripped_token = clone $value; + $stripped_token->attr = array(); + $subst['$'.$i.'.Compact'] = $generator->generateFromToken($stripped_token); + } + $subst['$'.$i.'.Line'] = $value->line ? $value->line : 'unknown'; + } + continue; + } elseif (is_array($value)) { + $keys = array_keys($value); + if (array_keys($keys) === $keys) { + // list + $subst['$'.$i] = $this->listify($value); + } else { + // associative array + // no $i implementation yet, sorry + $subst['$'.$i.'.Keys'] = $this->listify($keys); + $subst['$'.$i.'.Values'] = $this->listify(array_values($value)); + } + continue; + } + $subst['$' . $i] = $value; + } + return strtr($raw, $subst); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Length.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Length.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Length.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Length.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,162 @@ + true, 'ex' => true, 'px' => true, 'in' => true, + 'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true, + 'ch' => true, 'rem' => true, 'vw' => true, 'vh' => true, + 'vmin' => true, 'vmax' => true + ); + + /** + * @param string $n Magnitude + * @param bool|string $u Unit + */ + public function __construct($n = '0', $u = false) + { + $this->n = (string) $n; + $this->unit = $u !== false ? (string) $u : false; + } + + /** + * @param string $s Unit string, like '2em' or '3.4in' + * @return HTMLPurifier_Length + * @warning Does not perform validation. + */ + public static function make($s) + { + if ($s instanceof HTMLPurifier_Length) { + return $s; + } + $n_length = strspn($s, '1234567890.+-'); + $n = substr($s, 0, $n_length); + $unit = substr($s, $n_length); + if ($unit === '') { + $unit = false; + } + return new HTMLPurifier_Length($n, $unit); + } + + /** + * Validates the number and unit. + * @return bool + */ + protected function validate() + { + // Special case: + if ($this->n === '+0' || $this->n === '-0') { + $this->n = '0'; + } + if ($this->n === '0' && $this->unit === false) { + return true; + } + if (!ctype_lower($this->unit)) { + $this->unit = strtolower($this->unit); + } + if (!isset(HTMLPurifier_Length::$allowedUnits[$this->unit])) { + return false; + } + // Hack: + $def = new HTMLPurifier_AttrDef_CSS_Number(); + $result = $def->validate($this->n, false, false); + if ($result === false) { + return false; + } + $this->n = $result; + return true; + } + + /** + * Returns string representation of number. + * @return string + */ + public function toString() + { + if (!$this->isValid()) { + return false; + } + return $this->n . $this->unit; + } + + /** + * Retrieves string numeric magnitude. + * @return string + */ + public function getN() + { + return $this->n; + } + + /** + * Retrieves string unit. + * @return string + */ + public function getUnit() + { + return $this->unit; + } + + /** + * Returns true if this length unit is valid. + * @return bool + */ + public function isValid() + { + if ($this->isValid === null) { + $this->isValid = $this->validate(); + } + return $this->isValid; + } + + /** + * Compares two lengths, and returns 1 if greater, -1 if less and 0 if equal. + * @param HTMLPurifier_Length $l + * @return int + * @warning If both values are too large or small, this calculation will + * not work properly + */ + public function compareTo($l) + { + if ($l === false) { + return false; + } + if ($l->unit !== $this->unit) { + $converter = new HTMLPurifier_UnitConverter(); + $l = $converter->convert($l, $this->unit); + if ($l === false) { + return false; + } + } + return $this->n - $l->n; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DirectLex.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DirectLex.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DirectLex.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DirectLex.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,539 @@ +get('HTML.Trusted')) { + $html = preg_replace_callback( + '#(
, so + // any later token processing scripts must convert improperly + // classified EmptyTags from StartTags. + $is_self_closing = (strrpos($segment, '/') === $strlen_segment - 1); + if ($is_self_closing) { + $strlen_segment--; + $segment = substr($segment, 0, $strlen_segment); + } + + // Check if there are any attributes + $position_first_space = strcspn($segment, $this->_whitespace); + + if ($position_first_space >= $strlen_segment) { + if ($is_self_closing) { + $token = new HTMLPurifier_Token_Empty($segment); + } else { + $token = new HTMLPurifier_Token_Start($segment); + } + if ($maintain_line_numbers) { + $token->rawPosition($current_line, $current_col); + $current_line += $this->substrCount($html, $nl, $cursor, $position_next_gt - $cursor); + } + $array[] = $token; + $inside_tag = false; + $cursor = $position_next_gt + 1; + continue; + } + + // Grab out all the data + $type = substr($segment, 0, $position_first_space); + $attribute_string = + trim( + substr( + $segment, + $position_first_space + ) + ); + if ($attribute_string) { + $attr = $this->parseAttributeString( + $attribute_string, + $config, + $context + ); + } else { + $attr = array(); + } + + if ($is_self_closing) { + $token = new HTMLPurifier_Token_Empty($type, $attr); + } else { + $token = new HTMLPurifier_Token_Start($type, $attr); + } + if ($maintain_line_numbers) { + $token->rawPosition($current_line, $current_col); + $current_line += $this->substrCount($html, $nl, $cursor, $position_next_gt - $cursor); + } + $array[] = $token; + $cursor = $position_next_gt + 1; + $inside_tag = false; + continue; + } else { + // inside tag, but there's no ending > sign + if ($e) { + $e->send(E_WARNING, 'Lexer: Missing gt'); + } + $token = new + HTMLPurifier_Token_Text( + '<' . + $this->parseText( + substr($html, $cursor), $config + ) + ); + if ($maintain_line_numbers) { + $token->rawPosition($current_line, $current_col); + } + // no cursor scroll? Hmm... + $array[] = $token; + break; + } + break; + } + + $context->destroy('CurrentLine'); + $context->destroy('CurrentCol'); + return $array; + } + + /** + * PHP 5.0.x compatible substr_count that implements offset and length + * @param string $haystack + * @param string $needle + * @param int $offset + * @param int $length + * @return int + */ + protected function substrCount($haystack, $needle, $offset, $length) + { + static $oldVersion; + if ($oldVersion === null) { + $oldVersion = version_compare(PHP_VERSION, '5.1', '<'); + } + if ($oldVersion) { + $haystack = substr($haystack, $offset, $length); + return substr_count($haystack, $needle); + } else { + return substr_count($haystack, $needle, $offset, $length); + } + } + + /** + * Takes the inside of an HTML tag and makes an assoc array of attributes. + * + * @param string $string Inside of tag excluding name. + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return array Assoc array of attributes. + */ + public function parseAttributeString($string, $config, $context) + { + $string = (string)$string; // quick typecast + + if ($string == '') { + return array(); + } // no attributes + + $e = false; + if ($config->get('Core.CollectErrors')) { + $e =& $context->get('ErrorCollector'); + } + + // let's see if we can abort as quickly as possible + // one equal sign, no spaces => one attribute + $num_equal = substr_count($string, '='); + $has_space = strpos($string, ' '); + if ($num_equal === 0 && !$has_space) { + // bool attribute + return array($string => $string); + } elseif ($num_equal === 1 && !$has_space) { + // only one attribute + list($key, $quoted_value) = explode('=', $string); + $quoted_value = trim($quoted_value); + if (!$key) { + if ($e) { + $e->send(E_ERROR, 'Lexer: Missing attribute key'); + } + return array(); + } + if (!$quoted_value) { + return array($key => ''); + } + $first_char = @$quoted_value[0]; + $last_char = @$quoted_value[strlen($quoted_value) - 1]; + + $same_quote = ($first_char == $last_char); + $open_quote = ($first_char == '"' || $first_char == "'"); + + if ($same_quote && $open_quote) { + // well behaved + $value = substr($quoted_value, 1, strlen($quoted_value) - 2); + } else { + // not well behaved + if ($open_quote) { + if ($e) { + $e->send(E_ERROR, 'Lexer: Missing end quote'); + } + $value = substr($quoted_value, 1); + } else { + $value = $quoted_value; + } + } + if ($value === false) { + $value = ''; + } + return array($key => $this->parseAttr($value, $config)); + } + + // setup loop environment + $array = array(); // return assoc array of attributes + $cursor = 0; // current position in string (moves forward) + $size = strlen($string); // size of the string (stays the same) + + // if we have unquoted attributes, the parser expects a terminating + // space, so let's guarantee that there's always a terminating space. + $string .= ' '; + + $old_cursor = -1; + while ($cursor < $size) { + if ($old_cursor >= $cursor) { + throw new Exception("Infinite loop detected"); + } + $old_cursor = $cursor; + + $cursor += ($value = strspn($string, $this->_whitespace, $cursor)); + // grab the key + + $key_begin = $cursor; //we're currently at the start of the key + + // scroll past all characters that are the key (not whitespace or =) + $cursor += strcspn($string, $this->_whitespace . '=', $cursor); + + $key_end = $cursor; // now at the end of the key + + $key = substr($string, $key_begin, $key_end - $key_begin); + + if (!$key) { + if ($e) { + $e->send(E_ERROR, 'Lexer: Missing attribute key'); + } + $cursor += 1 + strcspn($string, $this->_whitespace, $cursor + 1); // prevent infinite loop + continue; // empty key + } + + // scroll past all whitespace + $cursor += strspn($string, $this->_whitespace, $cursor); + + if ($cursor >= $size) { + $array[$key] = $key; + break; + } + + // if the next character is an equal sign, we've got a regular + // pair, otherwise, it's a bool attribute + $first_char = @$string[$cursor]; + + if ($first_char == '=') { + // key="value" + + $cursor++; + $cursor += strspn($string, $this->_whitespace, $cursor); + + if ($cursor === false) { + $array[$key] = ''; + break; + } + + // we might be in front of a quote right now + + $char = @$string[$cursor]; + + if ($char == '"' || $char == "'") { + // it's quoted, end bound is $char + $cursor++; + $value_begin = $cursor; + $cursor = strpos($string, $char, $cursor); + $value_end = $cursor; + } else { + // it's not quoted, end bound is whitespace + $value_begin = $cursor; + $cursor += strcspn($string, $this->_whitespace, $cursor); + $value_end = $cursor; + } + + // we reached a premature end + if ($cursor === false) { + $cursor = $size; + $value_end = $cursor; + } + + $value = substr($string, $value_begin, $value_end - $value_begin); + if ($value === false) { + $value = ''; + } + $array[$key] = $this->parseAttr($value, $config); + $cursor++; + } else { + // boolattr + if ($key !== '') { + $array[$key] = $key; + } else { + // purely theoretical + if ($e) { + $e->send(E_ERROR, 'Lexer: Missing attribute key'); + } + } + } + } + return $array; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DOMLex.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DOMLex.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DOMLex.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Lexer/DOMLex.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,333 @@ +factory = new HTMLPurifier_TokenFactory(); + } + + /** + * @param string $html + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return HTMLPurifier_Token[] + */ + public function tokenizeHTML($html, $config, $context) + { + $html = $this->normalize($html, $config, $context); + + // attempt to armor stray angled brackets that cannot possibly + // form tags and thus are probably being used as emoticons + if ($config->get('Core.AggressivelyFixLt')) { + $char = '[^a-z!\/]'; + $comment = "/|\z)/is"; + $html = preg_replace_callback($comment, array($this, 'callbackArmorCommentEntities'), $html); + do { + $old = $html; + $html = preg_replace("/<($char)/i", '<\\1', $html); + } while ($html !== $old); + $html = preg_replace_callback($comment, array($this, 'callbackUndoCommentSubst'), $html); // fix comments + } + + // preprocess html, essential for UTF-8 + $html = $this->wrapHTML($html, $config, $context); + + $doc = new DOMDocument(); + $doc->encoding = 'UTF-8'; // theoretically, the above has this covered + + $options = 0; + if ($config->get('Core.AllowParseManyTags') && defined('LIBXML_PARSEHUGE')) { + $options |= LIBXML_PARSEHUGE; + } + + set_error_handler(array($this, 'muteErrorHandler')); + $doc->loadHTML($html, $options); + restore_error_handler(); + + $body = $doc->getElementsByTagName('html')->item(0)-> // + getElementsByTagName('body')->item(0); // + + $div = $body->getElementsByTagName('div')->item(0); //+ $tokens = array(); + $this->tokenizeDOM($div, $tokens, $config); + // If the div has a sibling, that means we tripped across + // a prematuretag. So remove the div we parsed, + // and then tokenize the rest of body. We can't tokenize + // the sibling directly as we'll lose the tags in that case. + if ($div->nextSibling) { + $body->removeChild($div); + $this->tokenizeDOM($body, $tokens, $config); + } + return $tokens; + } + + /** + * Iterative function that tokenizes a node, putting it into an accumulator. + * To iterate is human, to recurse divine - L. Peter Deutsch + * @param DOMNode $node DOMNode to be tokenized. + * @param HTMLPurifier_Token[] $tokens Array-list of already tokenized tokens. + * @return HTMLPurifier_Token of node appended to previously passed tokens. + */ + protected function tokenizeDOM($node, &$tokens, $config) + { + $level = 0; + $nodes = array($level => new HTMLPurifier_Queue(array($node))); + $closingNodes = array(); + do { + while (!$nodes[$level]->isEmpty()) { + $node = $nodes[$level]->shift(); // FIFO + $collect = $level > 0 ? true : false; + $needEndingTag = $this->createStartNode($node, $tokens, $collect, $config); + if ($needEndingTag) { + $closingNodes[$level][] = $node; + } + if ($node->childNodes && $node->childNodes->length) { + $level++; + $nodes[$level] = new HTMLPurifier_Queue(); + foreach ($node->childNodes as $childNode) { + $nodes[$level]->push($childNode); + } + } + } + $level--; + if ($level && isset($closingNodes[$level])) { + while ($node = array_pop($closingNodes[$level])) { + $this->createEndNode($node, $tokens); + } + } + } while ($level > 0); + } + + /** + * Portably retrieve the tag name of a node; deals with older versions + * of libxml like 2.7.6 + * @param DOMNode $node + */ + protected function getTagName($node) + { + if (isset($node->tagName)) { + return $node->tagName; + } else if (isset($node->nodeName)) { + return $node->nodeName; + } else if (isset($node->localName)) { + return $node->localName; + } + return null; + } + + /** + * Portably retrieve the data of a node; deals with older versions + * of libxml like 2.7.6 + * @param DOMNode $node + */ + protected function getData($node) + { + if (isset($node->data)) { + return $node->data; + } else if (isset($node->nodeValue)) { + return $node->nodeValue; + } else if (isset($node->textContent)) { + return $node->textContent; + } + return null; + } + + + /** + * @param DOMNode $node DOMNode to be tokenized. + * @param HTMLPurifier_Token[] $tokens Array-list of already tokenized tokens. + * @param bool $collect Says whether or start and close are collected, set to + * false at first recursion because it's the implicit DIV + * tag you're dealing with. + * @return bool if the token needs an endtoken + * @todo data and tagName properties don't seem to exist in DOMNode? + */ + protected function createStartNode($node, &$tokens, $collect, $config) + { + // intercept non element nodes. WE MUST catch all of them, + // but we're not getting the character reference nodes because + // those should have been preprocessed + if ($node->nodeType === XML_TEXT_NODE) { + $data = $this->getData($node); // Handle variable data property + if ($data !== null) { + $tokens[] = $this->factory->createText($data); + } + return false; + } elseif ($node->nodeType === XML_CDATA_SECTION_NODE) { + // undo libxml's special treatment of #i', '', $html); + } + + return $html; + } + + /** + * Takes a string of HTML (fragment or document) and returns the content + * @todo Consider making protected + */ + public function extractBody($html) + { + $matches = array(); + $result = preg_match('|(.*?)
'; printZipper($zipper, $token);//printTokens($this->stack); + //flush(); + + // quick-check: if it's not a tag, no need to process + if (empty($token->is_tag)) { + if ($token instanceof HTMLPurifier_Token_Text) { + foreach ($this->injectors as $i => $injector) { + if (isset($token->skip[$i])) { + // See Note [Injector skips] + continue; + } + if ($token->rewind !== null && $token->rewind !== $i) { + continue; + } + // XXX fuckup + $r = $token; + $injector->handleText($r); + $token = $this->processToken($r, $i); + $reprocess = true; + break; + } + } + // another possibility is a comment + continue; + } + + if (isset($definition->info[$token->name])) { + $type = $definition->info[$token->name]->child->type; + } else { + $type = false; // Type is unknown, treat accordingly + } + + // quick tag checks: anything that's *not* an end tag + $ok = false; + if ($type === 'empty' && $token instanceof HTMLPurifier_Token_Start) { + // claims to be a start tag but is empty + $token = new HTMLPurifier_Token_Empty( + $token->name, + $token->attr, + $token->line, + $token->col, + $token->armor + ); + $ok = true; + } elseif ($type && $type !== 'empty' && $token instanceof HTMLPurifier_Token_Empty) { + // claims to be empty but really is a start tag + // NB: this assignment is required + $old_token = $token; + $token = new HTMLPurifier_Token_End($token->name); + $token = $this->insertBefore( + new HTMLPurifier_Token_Start($old_token->name, $old_token->attr, $old_token->line, $old_token->col, $old_token->armor) + ); + // punt (since we had to modify the input stream in a non-trivial way) + $reprocess = true; + continue; + } elseif ($token instanceof HTMLPurifier_Token_Empty) { + // real empty token + $ok = true; + } elseif ($token instanceof HTMLPurifier_Token_Start) { + // start tag + + // ...unless they also have to close their parent + if (!empty($this->stack)) { + + // Performance note: you might think that it's rather + // inefficient, recalculating the autoclose information + // for every tag that a token closes (since when we + // do an autoclose, we push a new token into the + // stream and then /process/ that, before + // re-processing this token.) But this is + // necessary, because an injector can make an + // arbitrary transformations to the autoclosing + // tokens we introduce, so things may have changed + // in the meantime. Also, doing the inefficient thing is + // "easy" to reason about (for certain perverse definitions + // of "easy") + + $parent = array_pop($this->stack); + $this->stack[] = $parent; + + $parent_def = null; + $parent_elements = null; + $autoclose = false; + if (isset($definition->info[$parent->name])) { + $parent_def = $definition->info[$parent->name]; + $parent_elements = $parent_def->child->getAllowedElements($config); + $autoclose = !isset($parent_elements[$token->name]); + } + + if ($autoclose && $definition->info[$token->name]->wrap) { + // Check if an element can be wrapped by another + // element to make it valid in a context (for + // example,- in between) + $wrapname = $definition->info[$token->name]->wrap; + $wrapdef = $definition->info[$wrapname]; + $elements = $wrapdef->child->getAllowedElements($config); + if (isset($elements[$token->name]) && isset($parent_elements[$wrapname])) { + $newtoken = new HTMLPurifier_Token_Start($wrapname); + $token = $this->insertBefore($newtoken); + $reprocess = true; + continue; + } + } + + $carryover = false; + if ($autoclose && $parent_def->formatting) { + $carryover = true; + } + + if ($autoclose) { + // check if this autoclose is doomed to fail + // (this rechecks $parent, which his harmless) + $autoclose_ok = isset($global_parent_allowed_elements[$token->name]); + if (!$autoclose_ok) { + foreach ($this->stack as $ancestor) { + $elements = $definition->info[$ancestor->name]->child->getAllowedElements($config); + if (isset($elements[$token->name])) { + $autoclose_ok = true; + break; + } + if ($definition->info[$token->name]->wrap) { + $wrapname = $definition->info[$token->name]->wrap; + $wrapdef = $definition->info[$wrapname]; + $wrap_elements = $wrapdef->child->getAllowedElements($config); + if (isset($wrap_elements[$token->name]) && isset($elements[$wrapname])) { + $autoclose_ok = true; + break; + } + } + } + } + if ($autoclose_ok) { + // errors need to be updated + $new_token = new HTMLPurifier_Token_End($parent->name); + $new_token->start = $parent; + // [TagClosedSuppress] + if ($e && !isset($parent->armor['MakeWellFormed_TagClosedError'])) { + if (!$carryover) { + $e->send(E_NOTICE, 'Strategy_MakeWellFormed: Tag auto closed', $parent); + } else { + $e->send(E_NOTICE, 'Strategy_MakeWellFormed: Tag carryover', $parent); + } + } + if ($carryover) { + $element = clone $parent; + // [TagClosedAuto] + $element->armor['MakeWellFormed_TagClosedError'] = true; + $element->carryover = true; + $token = $this->processToken(array($new_token, $token, $element)); + } else { + $token = $this->insertBefore($new_token); + } + } else { + $token = $this->remove(); + } + $reprocess = true; + continue; + } + + } + $ok = true; + } + + if ($ok) { + foreach ($this->injectors as $i => $injector) { + if (isset($token->skip[$i])) { + // See Note [Injector skips] + continue; + } + if ($token->rewind !== null && $token->rewind !== $i) { + continue; + } + $r = $token; + $injector->handleElement($r); + $token = $this->processToken($r, $i); + $reprocess = true; + break; + } + if (!$reprocess) { + // ah, nothing interesting happened; do normal processing + if ($token instanceof HTMLPurifier_Token_Start) { + $this->stack[] = $token; + } elseif ($token instanceof HTMLPurifier_Token_End) { + throw new HTMLPurifier_Exception( + 'Improper handling of end tag in start code; possible error in MakeWellFormed' + ); + } + } + continue; + } + + // sanity check: we should be dealing with a closing tag + if (!$token instanceof HTMLPurifier_Token_End) { + throw new HTMLPurifier_Exception('Unaccounted for tag token in input stream, bug in HTML Purifier'); + } + + // make sure that we have something open + if (empty($this->stack)) { + if ($escape_invalid_tags) { + if ($e) { + $e->send(E_WARNING, 'Strategy_MakeWellFormed: Unnecessary end tag to text'); + } + $token = new HTMLPurifier_Token_Text($generator->generateFromToken($token)); + } else { + if ($e) { + $e->send(E_WARNING, 'Strategy_MakeWellFormed: Unnecessary end tag removed'); + } + $token = $this->remove(); + } + $reprocess = true; + continue; + } + + // first, check for the simplest case: everything closes neatly. + // Eventually, everything passes through here; if there are problems + // we modify the input stream accordingly and then punt, so that + // the tokens get processed again. + $current_parent = array_pop($this->stack); + if ($current_parent->name == $token->name) { + $token->start = $current_parent; + foreach ($this->injectors as $i => $injector) { + if (isset($token->skip[$i])) { + // See Note [Injector skips] + continue; + } + if ($token->rewind !== null && $token->rewind !== $i) { + continue; + } + $r = $token; + $injector->handleEnd($r); + $token = $this->processToken($r, $i); + $this->stack[] = $current_parent; + $reprocess = true; + break; + } + continue; + } + + // okay, so we're trying to close the wrong tag + + // undo the pop previous pop + $this->stack[] = $current_parent; + + // scroll back the entire nest, trying to find our tag. + // (feature could be to specify how far you'd like to go) + $size = count($this->stack); + // -2 because -1 is the last element, but we already checked that + $skipped_tags = false; + for ($j = $size - 2; $j >= 0; $j--) { + if ($this->stack[$j]->name == $token->name) { + $skipped_tags = array_slice($this->stack, $j); + break; + } + } + + // we didn't find the tag, so remove + if ($skipped_tags === false) { + if ($escape_invalid_tags) { + if ($e) { + $e->send(E_WARNING, 'Strategy_MakeWellFormed: Stray end tag to text'); + } + $token = new HTMLPurifier_Token_Text($generator->generateFromToken($token)); + } else { + if ($e) { + $e->send(E_WARNING, 'Strategy_MakeWellFormed: Stray end tag removed'); + } + $token = $this->remove(); + } + $reprocess = true; + continue; + } + + // do errors, in REVERSE $j order: a,b,c with
- needs a
n"; + //echo "$n\nsigfigs = $sigfigs\nnew_log = $new_log\nlog = $log\nrp = $rp\n
\n"; + + $n = $this->round($n, $sigfigs); + if (strpos($n, '.') !== false) { + $n = rtrim($n, '0'); + } + $n = rtrim($n, '.'); + + return new HTMLPurifier_Length($n, $unit); + } + + /** + * Returns the number of significant figures in a string number. + * @param string $n Decimal number + * @return int number of sigfigs + */ + public function getSigFigs($n) + { + $n = ltrim($n, '0+-'); + $dp = strpos($n, '.'); // decimal position + if ($dp === false) { + $sigfigs = strlen(rtrim($n, '0')); + } else { + $sigfigs = strlen(ltrim($n, '0.')); // eliminate extra decimal character + if ($dp !== 0) { + $sigfigs--; + } + } + return $sigfigs; + } + + /** + * Adds two numbers, using arbitrary precision when available. + * @param string $s1 + * @param string $s2 + * @param int $scale + * @return string + */ + private function add($s1, $s2, $scale) + { + if ($this->bcmath) { + return bcadd($s1, $s2, $scale); + } else { + return $this->scale((float)$s1 + (float)$s2, $scale); + } + } + + /** + * Multiples two numbers, using arbitrary precision when available. + * @param string $s1 + * @param string $s2 + * @param int $scale + * @return string + */ + private function mul($s1, $s2, $scale) + { + if ($this->bcmath) { + return bcmul($s1, $s2, $scale); + } else { + return $this->scale((float)$s1 * (float)$s2, $scale); + } + } + + /** + * Divides two numbers, using arbitrary precision when available. + * @param string $s1 + * @param string $s2 + * @param int $scale + * @return string + */ + private function div($s1, $s2, $scale) + { + if ($this->bcmath) { + return bcdiv($s1, $s2, $scale); + } else { + return $this->scale((float)$s1 / (float)$s2, $scale); + } + } + + /** + * Rounds a number according to the number of sigfigs it should have, + * using arbitrary precision when available. + * @param float $n + * @param int $sigfigs + * @return string + */ + private function round($n, $sigfigs) + { + $new_log = (int)floor(log(abs($n), 10)); // Number of digits left of decimal - 1 + $rp = $sigfigs - $new_log - 1; // Number of decimal places needed + $neg = $n < 0 ? '-' : ''; // Negative sign + if ($this->bcmath) { + if ($rp >= 0) { + $n = bcadd($n, $neg . '0.' . str_repeat('0', $rp) . '5', $rp + 1); + $n = bcdiv($n, '1', $rp); + } else { + // This algorithm partially depends on the standardized + // form of numbers that comes out of bcmath. + $n = bcadd($n, $neg . '5' . str_repeat('0', $new_log - $sigfigs), 0); + $n = substr($n, 0, $sigfigs + strlen($neg)) . str_repeat('0', $new_log - $sigfigs + 1); + } + return $n; + } else { + return $this->scale(round($n, $sigfigs - $new_log - 1), $rp + 1); + } + } + + /** + * Scales a float to $scale digits right of decimal point, like BCMath. + * @param float $r + * @param int $scale + * @return string + */ + private function scale($r, $scale) + { + if ($scale < 0) { + // The f sprintf type doesn't support negative numbers, so we + // need to cludge things manually. First get the string. + $r = sprintf('%.0f', (float)$r); + // Due to floating point precision loss, $r will more than likely + // look something like 4652999999999.9234. We grab one more digit + // than we need to precise from $r and then use that to round + // appropriately. + $precise = (string)round(substr($r, 0, strlen($r) + $scale), -1); + // Now we return it, truncating the zero that was rounded off. + return substr($precise, 0, -1) . str_repeat('0', -$scale + 1); + } + return sprintf('%.' . $scale . 'f', (float)$r); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIDefinition.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIDefinition.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIDefinition.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIDefinition.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,112 @@ +registerFilter(new HTMLPurifier_URIFilter_DisableExternal()); + $this->registerFilter(new HTMLPurifier_URIFilter_DisableExternalResources()); + $this->registerFilter(new HTMLPurifier_URIFilter_DisableResources()); + $this->registerFilter(new HTMLPurifier_URIFilter_HostBlacklist()); + $this->registerFilter(new HTMLPurifier_URIFilter_SafeIframe()); + $this->registerFilter(new HTMLPurifier_URIFilter_MakeAbsolute()); + $this->registerFilter(new HTMLPurifier_URIFilter_Munge()); + } + + public function registerFilter($filter) + { + $this->registeredFilters[$filter->name] = $filter; + } + + public function addFilter($filter, $config) + { + $r = $filter->prepare($config); + if ($r === false) return; // null is ok, for backwards compat + if ($filter->post) { + $this->postFilters[$filter->name] = $filter; + } else { + $this->filters[$filter->name] = $filter; + } + } + + protected function doSetup($config) + { + $this->setupMemberVariables($config); + $this->setupFilters($config); + } + + protected function setupFilters($config) + { + foreach ($this->registeredFilters as $name => $filter) { + if ($filter->always_load) { + $this->addFilter($filter, $config); + } else { + $conf = $config->get('URI.' . $name); + if ($conf !== false && $conf !== null) { + $this->addFilter($filter, $config); + } + } + } + unset($this->registeredFilters); + } + + protected function setupMemberVariables($config) + { + $this->host = $config->get('URI.Host'); + $base_uri = $config->get('URI.Base'); + if (!is_null($base_uri)) { + $parser = new HTMLPurifier_URIParser(); + $this->base = $parser->parse($base_uri); + $this->defaultScheme = $this->base->scheme; + if (is_null($this->host)) $this->host = $this->base->host; + } + if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme'); + } + + public function getDefaultScheme($config, $context) + { + return HTMLPurifier_URISchemeRegistry::instance()->getScheme($this->defaultScheme, $config, $context); + } + + public function filter(&$uri, $config, $context) + { + foreach ($this->filters as $name => $f) { + $result = $f->filter($uri, $config, $context); + if (!$result) return false; + } + return true; + } + + public function postFilter(&$uri, $config, $context) + { + foreach ($this->postFilters as $name => $f) { + $result = $f->filter($uri, $config, $context); + if (!$result) return false; + } + return true; + } + +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternal.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternal.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternal.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternal.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,54 @@ +getDefinition('URI')->host; + if ($our_host !== null) { + $this->ourHostParts = array_reverse(explode('.', $our_host)); + } + } + + /** + * @param HTMLPurifier_URI $uri Reference + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function filter(&$uri, $config, $context) + { + if (is_null($uri->host)) { + return true; + } + if ($this->ourHostParts === false) { + return false; + } + $host_parts = array_reverse(explode('.', $uri->host)); + foreach ($this->ourHostParts as $i => $x) { + if (!isset($host_parts[$i])) { + return false; + } + if ($host_parts[$i] != $this->ourHostParts[$i]) { + return false; + } + } + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternalResources.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternalResources.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternalResources.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableExternalResources.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,25 @@ +get('EmbeddedURI', true)) { + return true; + } + return parent::filter($uri, $config, $context); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableResources.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableResources.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableResources.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/DisableResources.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,22 @@ +get('EmbeddedURI', true); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/HostBlacklist.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/HostBlacklist.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/HostBlacklist.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/HostBlacklist.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,46 @@ +blacklist = $config->get('URI.HostBlacklist'); + return true; + } + + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function filter(&$uri, $config, $context) + { + foreach ($this->blacklist as $blacklisted_host_fragment) { + if (strpos($uri->host, $blacklisted_host_fragment) !== false) { + return false; + } + } + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/MakeAbsolute.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/MakeAbsolute.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/MakeAbsolute.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/MakeAbsolute.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,158 @@ +getDefinition('URI'); + $this->base = $def->base; + if (is_null($this->base)) { + trigger_error( + 'URI.MakeAbsolute is being ignored due to lack of ' . + 'value for URI.Base configuration', + E_USER_WARNING + ); + return false; + } + $this->base->fragment = null; // fragment is invalid for base URI + $stack = explode('/', $this->base->path); + array_pop($stack); // discard last segment + $stack = $this->_collapseStack($stack); // do pre-parsing + $this->basePathStack = $stack; + return true; + } + + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function filter(&$uri, $config, $context) + { + if (is_null($this->base)) { + return true; + } // abort early + if ($uri->path === '' && is_null($uri->scheme) && + is_null($uri->host) && is_null($uri->query) && is_null($uri->fragment)) { + // reference to current document + $uri = clone $this->base; + return true; + } + if (!is_null($uri->scheme)) { + // absolute URI already: don't change + if (!is_null($uri->host)) { + return true; + } + $scheme_obj = $uri->getSchemeObj($config, $context); + if (!$scheme_obj) { + // scheme not recognized + return false; + } + if (!$scheme_obj->hierarchical) { + // non-hierarchal URI with explicit scheme, don't change + return true; + } + // special case: had a scheme but always is hierarchical and had no authority + } + if (!is_null($uri->host)) { + // network path, don't bother + return true; + } + if ($uri->path === '') { + $uri->path = $this->base->path; + } elseif ($uri->path[0] !== '/') { + // relative path, needs more complicated processing + $stack = explode('/', $uri->path); + $new_stack = array_merge($this->basePathStack, $stack); + if ($new_stack[0] !== '' && !is_null($this->base->host)) { + array_unshift($new_stack, ''); + } + $new_stack = $this->_collapseStack($new_stack); + $uri->path = implode('/', $new_stack); + } else { + // absolute path, but still we should collapse + $uri->path = implode('/', $this->_collapseStack(explode('/', $uri->path))); + } + // re-combine + $uri->scheme = $this->base->scheme; + if (is_null($uri->userinfo)) { + $uri->userinfo = $this->base->userinfo; + } + if (is_null($uri->host)) { + $uri->host = $this->base->host; + } + if (is_null($uri->port)) { + $uri->port = $this->base->port; + } + return true; + } + + /** + * Resolve dots and double-dots in a path stack + * @param array $stack + * @return array + */ + private function _collapseStack($stack) + { + $result = array(); + $is_folder = false; + for ($i = 0; isset($stack[$i]); $i++) { + $is_folder = false; + // absorb an internally duplicated slash + if ($stack[$i] == '' && $i && isset($stack[$i + 1])) { + continue; + } + if ($stack[$i] == '..') { + if (!empty($result)) { + $segment = array_pop($result); + if ($segment === '' && empty($result)) { + // error case: attempted to back out too far: + // restore the leading slash + $result[] = ''; + } elseif ($segment === '..') { + $result[] = '..'; // cannot remove .. with .. + } + } else { + // relative path, preserve the double-dots + $result[] = '..'; + } + $is_folder = true; + continue; + } + if ($stack[$i] == '.') { + // silently absorb + $is_folder = true; + continue; + } + $result[] = $stack[$i]; + } + if ($is_folder) { + $result[] = ''; + } + return $result; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/Munge.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/Munge.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/Munge.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/Munge.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,115 @@ +target = $config->get('URI.' . $this->name); + $this->parser = new HTMLPurifier_URIParser(); + $this->doEmbed = $config->get('URI.MungeResources'); + $this->secretKey = $config->get('URI.MungeSecretKey'); + if ($this->secretKey && !function_exists('hash_hmac')) { + throw new Exception("Cannot use %URI.MungeSecretKey without hash_hmac support."); + } + return true; + } + + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function filter(&$uri, $config, $context) + { + if ($context->get('EmbeddedURI', true) && !$this->doEmbed) { + return true; + } + + $scheme_obj = $uri->getSchemeObj($config, $context); + if (!$scheme_obj) { + return true; + } // ignore unknown schemes, maybe another postfilter did it + if (!$scheme_obj->browsable) { + return true; + } // ignore non-browseable schemes, since we can't munge those in a reasonable way + if ($uri->isBenign($config, $context)) { + return true; + } // don't redirect if a benign URL + + $this->makeReplace($uri, $config, $context); + $this->replace = array_map('rawurlencode', $this->replace); + + $new_uri = strtr($this->target, $this->replace); + $new_uri = $this->parser->parse($new_uri); + // don't redirect if the target host is the same as the + // starting host + if ($uri->host === $new_uri->host) { + return true; + } + $uri = $new_uri; // overwrite + return true; + } + + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + */ + protected function makeReplace($uri, $config, $context) + { + $string = $uri->toString(); + // always available + $this->replace['%s'] = $string; + $this->replace['%r'] = $context->get('EmbeddedURI', true); + $token = $context->get('CurrentToken', true); + $this->replace['%n'] = $token ? $token->name : null; + $this->replace['%m'] = $context->get('CurrentAttr', true); + $this->replace['%p'] = $context->get('CurrentCSSProperty', true); + // not always available + if ($this->secretKey) { + $this->replace['%t'] = hash_hmac("sha256", $string, $this->secretKey); + } + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/SafeIframe.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/SafeIframe.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/SafeIframe.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter/SafeIframe.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,68 @@ +regexp = $config->get('URI.SafeIframeRegexp'); + return true; + } + + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function filter(&$uri, $config, $context) + { + // check if filter not applicable + if (!$config->get('HTML.SafeIframe')) { + return true; + } + // check if the filter should actually trigger + if (!$context->get('EmbeddedURI', true)) { + return true; + } + $token = $context->get('CurrentToken', true); + if (!($token && $token->name == 'iframe')) { + return true; + } + // check if we actually have some whitelists enabled + if ($this->regexp === null) { + return false; + } + // actually check the whitelists + return preg_match($this->regexp, $uri->toString()); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIFilter.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,74 @@ +percentEncoder = new HTMLPurifier_PercentEncoder(); + } + + /** + * Parses a URI. + * @param $uri string URI to parse + * @return HTMLPurifier_URI representation of URI. This representation has + * not been validated yet and may not conform to RFC. + */ + public function parse($uri) + { + $uri = $this->percentEncoder->normalize($uri); + + // Regexp is as per Appendix B. + // Note that ["<>] are an addition to the RFC's recommended + // characters, because they represent external delimeters. + $r_URI = '!'. + '(([a-zA-Z0-9\.\+\-]+):)?'. // 2. Scheme + '(//([^/?#"<>]*))?'. // 4. Authority + '([^?#"<>]*)'. // 5. Path + '(\?([^#"<>]*))?'. // 7. Query + '(#([^"<>]*))?'. // 8. Fragment + '!'; + + $matches = array(); + $result = preg_match($r_URI, $uri, $matches); + + if (!$result) return false; // *really* invalid URI + + // seperate out parts + $scheme = !empty($matches[1]) ? $matches[2] : null; + $authority = !empty($matches[3]) ? $matches[4] : null; + $path = $matches[5]; // always present, can be empty + $query = !empty($matches[6]) ? $matches[7] : null; + $fragment = !empty($matches[8]) ? $matches[9] : null; + + // further parse authority + if ($authority !== null) { + $r_authority = "/^((.+?)@)?(\[[^\]]+\]|[^:]*)(:(\d*))?/"; + $matches = array(); + preg_match($r_authority, $authority, $matches); + $userinfo = !empty($matches[1]) ? $matches[2] : null; + $host = !empty($matches[3]) ? $matches[3] : ''; + $port = !empty($matches[4]) ? (int) $matches[5] : null; + } else { + $port = $host = $userinfo = null; + } + + return new HTMLPurifier_URI( + $scheme, $userinfo, $host, $port, $path, $query, $fragment); + } + +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URI.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URI.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URI.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URI.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,316 @@ +scheme = is_null($scheme) || ctype_lower($scheme) ? $scheme : strtolower($scheme); + $this->userinfo = $userinfo; + $this->host = $host; + $this->port = is_null($port) ? $port : (int)$port; + $this->path = $path; + $this->query = $query; + $this->fragment = $fragment; + } + + /** + * Retrieves a scheme object corresponding to the URI's scheme/default + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return HTMLPurifier_URIScheme Scheme object appropriate for validating this URI + */ + public function getSchemeObj($config, $context) + { + $registry = HTMLPurifier_URISchemeRegistry::instance(); + if ($this->scheme !== null) { + $scheme_obj = $registry->getScheme($this->scheme, $config, $context); + if (!$scheme_obj) { + return false; + } // invalid scheme, clean it out + } else { + // no scheme: retrieve the default one + $def = $config->getDefinition('URI'); + $scheme_obj = $def->getDefaultScheme($config, $context); + if (!$scheme_obj) { + if ($def->defaultScheme !== null) { + // something funky happened to the default scheme object + trigger_error( + 'Default scheme object "' . $def->defaultScheme . '" was not readable', + E_USER_WARNING + ); + } // suppress error if it's null + return false; + } + } + return $scheme_obj; + } + + /** + * Generic validation method applicable for all schemes. May modify + * this URI in order to get it into a compliant form. + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool True if validation/filtering succeeds, false if failure + */ + public function validate($config, $context) + { + // ABNF definitions from RFC 3986 + $chars_sub_delims = '!$&\'()*+,;='; + $chars_gen_delims = ':/?#[]@'; + $chars_pchar = $chars_sub_delims . ':@'; + + // validate host + if (!is_null($this->host)) { + $host_def = new HTMLPurifier_AttrDef_URI_Host(); + $this->host = $host_def->validate($this->host, $config, $context); + if ($this->host === false) { + $this->host = null; + } + } + + // validate scheme + // NOTE: It's not appropriate to check whether or not this + // scheme is in our registry, since a URIFilter may convert a + // URI that we don't allow into one we do. So instead, we just + // check if the scheme can be dropped because there is no host + // and it is our default scheme. + if (!is_null($this->scheme) && is_null($this->host) || $this->host === '') { + // support for relative paths is pretty abysmal when the + // scheme is present, so axe it when possible + $def = $config->getDefinition('URI'); + if ($def->defaultScheme === $this->scheme) { + $this->scheme = null; + } + } + + // validate username + if (!is_null($this->userinfo)) { + $encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . ':'); + $this->userinfo = $encoder->encode($this->userinfo); + } + + // validate port + if (!is_null($this->port)) { + if ($this->port < 1 || $this->port > 65535) { + $this->port = null; + } + } + + // validate path + $segments_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/'); + if (!is_null($this->host)) { // this catches $this->host === '' + // path-abempty (hier and relative) + // http://www.example.com/my/path + // //www.example.com/my/path (looks odd, but works, and + // recognized by most browsers) + // (this set is valid or invalid on a scheme by scheme + // basis, so we'll deal with it later) + // file:///my/path + // ///my/path + $this->path = $segments_encoder->encode($this->path); + } elseif ($this->path !== '') { + if ($this->path[0] === '/') { + // path-absolute (hier and relative) + // http:/my/path + // /my/path + if (strlen($this->path) >= 2 && $this->path[1] === '/') { + // This could happen if both the host gets stripped + // out + // http://my/path + // //my/path + $this->path = ''; + } else { + $this->path = $segments_encoder->encode($this->path); + } + } elseif (!is_null($this->scheme)) { + // path-rootless (hier) + // http:my/path + // Short circuit evaluation means we don't need to check nz + $this->path = $segments_encoder->encode($this->path); + } else { + // path-noscheme (relative) + // my/path + // (once again, not checking nz) + $segment_nc_encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . '@'); + $c = strpos($this->path, '/'); + if ($c !== false) { + $this->path = + $segment_nc_encoder->encode(substr($this->path, 0, $c)) . + $segments_encoder->encode(substr($this->path, $c)); + } else { + $this->path = $segment_nc_encoder->encode($this->path); + } + } + } else { + // path-empty (hier and relative) + $this->path = ''; // just to be safe + } + + // qf = query and fragment + $qf_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/?'); + + if (!is_null($this->query)) { + $this->query = $qf_encoder->encode($this->query); + } + + if (!is_null($this->fragment)) { + $this->fragment = $qf_encoder->encode($this->fragment); + } + return true; + } + + /** + * Convert URI back to string + * @return string URI appropriate for output + */ + public function toString() + { + // reconstruct authority + $authority = null; + // there is a rendering difference between a null authority + // (http:foo-bar) and an empty string authority + // (http:///foo-bar). + if (!is_null($this->host)) { + $authority = ''; + if (!is_null($this->userinfo)) { + $authority .= $this->userinfo . '@'; + } + $authority .= $this->host; + if (!is_null($this->port)) { + $authority .= ':' . $this->port; + } + } + + // Reconstruct the result + // One might wonder about parsing quirks from browsers after + // this reconstruction. Unfortunately, parsing behavior depends + // on what *scheme* was employed (file:///foo is handled *very* + // differently than http:///foo), so unfortunately we have to + // defer to the schemes to do the right thing. + $result = ''; + if (!is_null($this->scheme)) { + $result .= $this->scheme . ':'; + } + if (!is_null($authority)) { + $result .= '//' . $authority; + } + $result .= $this->path; + if (!is_null($this->query)) { + $result .= '?' . $this->query; + } + if (!is_null($this->fragment)) { + $result .= '#' . $this->fragment; + } + + return $result; + } + + /** + * Returns true if this URL might be considered a 'local' URL given + * the current context. This is true when the host is null, or + * when it matches the host supplied to the configuration. + * + * Note that this does not do any scheme checking, so it is mostly + * only appropriate for metadata that doesn't care about protocol + * security. isBenign is probably what you actually want. + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function isLocal($config, $context) + { + if ($this->host === null) { + return true; + } + $uri_def = $config->getDefinition('URI'); + if ($uri_def->host === $this->host) { + return true; + } + return false; + } + + /** + * Returns true if this URL should be considered a 'benign' URL, + * that is: + * + * - It is a local URL (isLocal), and + * - It has a equal or better level of security + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function isBenign($config, $context) + { + if (!$this->isLocal($config, $context)) { + return false; + } + + $scheme_obj = $this->getSchemeObj($config, $context); + if (!$scheme_obj) { + return false; + } // conservative approach + + $current_scheme_obj = $config->getDefinition('URI')->getDefaultScheme($config, $context); + if ($current_scheme_obj->secure) { + if (!$scheme_obj->secure) { + return false; + } + } + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/data.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/data.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/data.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/data.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,136 @@ + true, + 'image/gif' => true, + 'image/png' => true, + ); + // this is actually irrelevant since we only write out the path + // component + /** + * @type bool + */ + public $may_omit_host = true; + + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function doValidate(&$uri, $config, $context) + { + $result = explode(',', $uri->path, 2); + $is_base64 = false; + $charset = null; + $content_type = null; + if (count($result) == 2) { + list($metadata, $data) = $result; + // do some legwork on the metadata + $metas = explode(';', $metadata); + while (!empty($metas)) { + $cur = array_shift($metas); + if ($cur == 'base64') { + $is_base64 = true; + break; + } + if (substr($cur, 0, 8) == 'charset=') { + // doesn't match if there are arbitrary spaces, but + // whatever dude + if ($charset !== null) { + continue; + } // garbage + $charset = substr($cur, 8); // not used + } else { + if ($content_type !== null) { + continue; + } // garbage + $content_type = $cur; + } + } + } else { + $data = $result[0]; + } + if ($content_type !== null && empty($this->allowed_types[$content_type])) { + return false; + } + if ($charset !== null) { + // error; we don't allow plaintext stuff + $charset = null; + } + $data = rawurldecode($data); + if ($is_base64) { + $raw_data = base64_decode($data); + } else { + $raw_data = $data; + } + if ( strlen($raw_data) < 12 ) { + // error; exif_imagetype throws exception with small files, + // and this likely indicates a corrupt URI/failed parse anyway + return false; + } + // XXX probably want to refactor this into a general mechanism + // for filtering arbitrary content types + if (function_exists('sys_get_temp_dir')) { + $file = tempnam(sys_get_temp_dir(), ""); + } else { + $file = tempnam("/tmp", ""); + } + file_put_contents($file, $raw_data); + if (function_exists('exif_imagetype')) { + $image_code = exif_imagetype($file); + unlink($file); + } elseif (function_exists('getimagesize')) { + set_error_handler(array($this, 'muteErrorHandler')); + $info = getimagesize($file); + restore_error_handler(); + unlink($file); + if ($info == false) { + return false; + } + $image_code = $info[2]; + } else { + trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR); + } + $real_content_type = image_type_to_mime_type($image_code); + if ($real_content_type != $content_type) { + // we're nice guys; if the content type is something else we + // support, change it over + if (empty($this->allowed_types[$real_content_type])) { + return false; + } + $content_type = $real_content_type; + } + // ok, it's kosher, rewrite what we need + $uri->userinfo = null; + $uri->host = null; + $uri->port = null; + $uri->fragment = null; + $uri->query = null; + $uri->path = "$content_type;base64," . base64_encode($raw_data); + return true; + } + + /** + * @param int $errno + * @param string $errstr + */ + public function muteErrorHandler($errno, $errstr) + { + } +} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/file.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/file.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/file.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/file.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,44 @@ +userinfo = null; + // file:// makes no provisions for accessing the resource + $uri->port = null; + // While it seems to work on Firefox, the querystring has + // no possible effect and is thus stripped. + $uri->query = null; + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/ftp.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/ftp.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/ftp.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/ftp.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,58 @@ +query = null; + + // typecode check + $semicolon_pos = strrpos($uri->path, ';'); // reverse + if ($semicolon_pos !== false) { + $type = substr($uri->path, $semicolon_pos + 1); // no semicolon + $uri->path = substr($uri->path, 0, $semicolon_pos); + $type_ret = ''; + if (strpos($type, '=') !== false) { + // figure out whether or not the declaration is correct + list($key, $typecode) = explode('=', $type, 2); + if ($key !== 'type') { + // invalid key, tack it back on encoded + $uri->path .= '%3B' . $type; + } elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') { + $type_ret = ";type=$typecode"; + } + } else { + $uri->path .= '%3B' . $type; + } + $uri->path = str_replace(';', '%3B', $uri->path); + $uri->path .= $type_ret; + } + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/http.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/http.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/http.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/http.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,36 @@ +userinfo = null; + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/https.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/https.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/https.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/https.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,18 @@ +userinfo = null; + $uri->host = null; + $uri->port = null; + // we need to validate path against RFC 2368's addr-spec + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/news.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/news.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/news.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/news.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,35 @@ +userinfo = null; + $uri->host = null; + $uri->port = null; + $uri->query = null; + // typecode check needed on path + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/nntp.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/nntp.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/nntp.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/nntp.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,32 @@ +userinfo = null; + $uri->query = null; + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/tel.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/tel.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/tel.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme/tel.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,46 @@ +userinfo = null; + $uri->host = null; + $uri->port = null; + + // Delete all non-numeric characters, non-x characters + // from phone number, EXCEPT for a leading plus sign. + $uri->path = preg_replace('/(?!^\+)[^\dx]/', '', + // Normalize e(x)tension to lower-case + str_replace('X', 'x', $uri->path)); + + return true; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URIScheme.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,102 @@ +, resolves edge cases + * with making relative URIs absolute + * @type bool + */ + public $hierarchical = false; + + /** + * Whether or not the URI may omit a hostname when the scheme is + * explicitly specified, ala file:///path/to/file. As of writing, + * 'file' is the only scheme that browsers support his properly. + * @type bool + */ + public $may_omit_host = false; + + /** + * Validates the components of a URI for a specific scheme. + * @param HTMLPurifier_URI $uri Reference to a HTMLPurifier_URI object + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool success or failure + */ + abstract public function doValidate(&$uri, $config, $context); + + /** + * Public interface for validating components of a URI. Performs a + * bunch of default actions. Don't overload this method. + * @param HTMLPurifier_URI $uri Reference to a HTMLPurifier_URI object + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool success or failure + */ + public function validate(&$uri, $config, $context) + { + if ($this->default_port == $uri->port) { + $uri->port = null; + } + // kludge: browsers do funny things when the scheme but not the + // authority is set + if (!$this->may_omit_host && + // if the scheme is present, a missing host is always in error + (!is_null($uri->scheme) && ($uri->host === '' || is_null($uri->host))) || + // if the scheme is not present, a *blank* host is in error, + // since this translates into '///path' which most browsers + // interpret as being 'http://path'. + (is_null($uri->scheme) && $uri->host === '') + ) { + do { + if (is_null($uri->scheme)) { + if (substr($uri->path, 0, 2) != '//') { + $uri->host = null; + break; + } + // URI is '////path', so we cannot nullify the + // host to preserve semantics. Try expanding the + // hostname instead (fall through) + } + // first see if we can manually insert a hostname + $host = $config->get('URI.Host'); + if (!is_null($host)) { + $uri->host = $host; + } else { + // we can't do anything sensible, reject the URL. + return false; + } + } while (false); + } + return $this->doValidate($uri, $config, $context); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URISchemeRegistry.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URISchemeRegistry.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/URISchemeRegistry.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/URISchemeRegistry.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,81 @@ +get('URI.AllowedSchemes'); + if (!$config->get('URI.OverrideAllowedSchemes') && + !isset($allowed_schemes[$scheme]) + ) { + return; + } + + if (isset($this->schemes[$scheme])) { + return $this->schemes[$scheme]; + } + if (!isset($allowed_schemes[$scheme])) { + return; + } + + $class = 'HTMLPurifier_URIScheme_' . $scheme; + if (!class_exists($class)) { + return; + } + $this->schemes[$scheme] = new $class(); + return $this->schemes[$scheme]; + } + + /** + * Registers a custom scheme to the cache, bypassing reflection. + * @param string $scheme Scheme name + * @param HTMLPurifier_URIScheme $scheme_obj + */ + public function register($scheme, $scheme_obj) + { + $this->schemes[$scheme] = $scheme_obj; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Flexible.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Flexible.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Flexible.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Flexible.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,130 @@ + $j) { + $var[$i] = trim($j); + } + if ($type === self::HASH) { + // key:value,key2:value2 + $nvar = array(); + foreach ($var as $keypair) { + $c = explode(':', $keypair, 2); + if (!isset($c[1])) { + continue; + } + $nvar[trim($c[0])] = trim($c[1]); + } + $var = $nvar; + } + } + if (!is_array($var)) { + break; + } + $keys = array_keys($var); + if ($keys === array_keys($keys)) { + if ($type == self::ALIST) { + return $var; + } elseif ($type == self::LOOKUP) { + $new = array(); + foreach ($var as $key) { + $new[$key] = true; + } + return $new; + } else { + break; + } + } + if ($type === self::ALIST) { + trigger_error("Array list did not have consecutive integer indexes", E_USER_WARNING); + return array_values($var); + } + if ($type === self::LOOKUP) { + foreach ($var as $key => $value) { + if ($value !== true) { + trigger_error( + "Lookup array has non-true value at key '$key'; " . + "maybe your input array was not indexed numerically", + E_USER_WARNING + ); + } + $var[$key] = true; + } + } + return $var; + default: + $this->errorInconsistent(__CLASS__, $type); + } + $this->errorGeneric($var, $type); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Native.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Native.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Native.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParser/Native.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,38 @@ +evalExpression($var); + } + + /** + * @param string $expr + * @return mixed + * @throws HTMLPurifier_VarParserException + */ + protected function evalExpression($expr) + { + $var = null; + $result = eval("\$var = $expr;"); + if ($result === false) { + throw new HTMLPurifier_VarParserException("Fatal error in evaluated code"); + } + return $var; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParserException.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParserException.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParserException.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/VarParserException.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,11 @@ + self::C_STRING, + 'istring' => self::ISTRING, + 'text' => self::TEXT, + 'itext' => self::ITEXT, + 'int' => self::C_INT, + 'float' => self::C_FLOAT, + 'bool' => self::C_BOOL, + 'lookup' => self::LOOKUP, + 'list' => self::ALIST, + 'hash' => self::HASH, + 'mixed' => self::C_MIXED + ); + + /** + * Lookup table of types that are string, and can have aliases or + * allowed value lists. + */ + public static $stringTypes = array( + self::C_STRING => true, + self::ISTRING => true, + self::TEXT => true, + self::ITEXT => true, + ); + + /** + * Validate a variable according to type. + * It may return NULL as a valid type if $allow_null is true. + * + * @param mixed $var Variable to validate + * @param int $type Type of variable, see HTMLPurifier_VarParser->types + * @param bool $allow_null Whether or not to permit null as a value + * @return string Validated and type-coerced variable + * @throws HTMLPurifier_VarParserException + */ + final public function parse($var, $type, $allow_null = false) + { + if (is_string($type)) { + if (!isset(HTMLPurifier_VarParser::$types[$type])) { + throw new HTMLPurifier_VarParserException("Invalid type '$type'"); + } else { + $type = HTMLPurifier_VarParser::$types[$type]; + } + } + $var = $this->parseImplementation($var, $type, $allow_null); + if ($allow_null && $var === null) { + return null; + } + // These are basic checks, to make sure nothing horribly wrong + // happened in our implementations. + switch ($type) { + case (self::C_STRING): + case (self::ISTRING): + case (self::TEXT): + case (self::ITEXT): + if (!is_string($var)) { + break; + } + if ($type == self::ISTRING || $type == self::ITEXT) { + $var = strtolower($var); + } + return $var; + case (self::C_INT): + if (!is_int($var)) { + break; + } + return $var; + case (self::C_FLOAT): + if (!is_float($var)) { + break; + } + return $var; + case (self::C_BOOL): + if (!is_bool($var)) { + break; + } + return $var; + case (self::LOOKUP): + case (self::ALIST): + case (self::HASH): + if (!is_array($var)) { + break; + } + if ($type === self::LOOKUP) { + foreach ($var as $k) { + if ($k !== true) { + $this->error('Lookup table contains value other than true'); + } + } + } elseif ($type === self::ALIST) { + $keys = array_keys($var); + if (array_keys($keys) !== $keys) { + $this->error('Indices for list are not uniform'); + } + } + return $var; + case (self::C_MIXED): + return $var; + default: + $this->errorInconsistent(get_class($this), $type); + } + $this->errorGeneric($var, $type); + } + + /** + * Actually implements the parsing. Base implementation does not + * do anything to $var. Subclasses should overload this! + * @param mixed $var + * @param int $type + * @param bool $allow_null + * @return string + */ + protected function parseImplementation($var, $type, $allow_null) + { + return $var; + } + + /** + * Throws an exception. + * @throws HTMLPurifier_VarParserException + */ + protected function error($msg) + { + throw new HTMLPurifier_VarParserException($msg); + } + + /** + * Throws an inconsistency exception. + * @note This should not ever be called. It would be called if we + * extend the allowed values of HTMLPurifier_VarParser without + * updating subclasses. + * @param string $class + * @param int $type + * @throws HTMLPurifier_Exception + */ + protected function errorInconsistent($class, $type) + { + throw new HTMLPurifier_Exception( + "Inconsistency in $class: " . HTMLPurifier_VarParser::getTypeName($type) . + " not implemented" + ); + } + + /** + * Generic error for if a type didn't work. + * @param mixed $var + * @param int $type + */ + protected function errorGeneric($var, $type) + { + $vtype = gettype($var); + $this->error("Expected type " . HTMLPurifier_VarParser::getTypeName($type) . ", got $vtype"); + } + + /** + * @param int $type + * @return string + */ + public static function getTypeName($type) + { + static $lookup; + if (!$lookup) { + // Lazy load the alternative lookup table + $lookup = array_flip(HTMLPurifier_VarParser::$types); + } + if (!isset($lookup[$type])) { + return 'unknown'; + } + return $lookup[$type]; + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Zipper.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Zipper.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier/Zipper.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier/Zipper.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,157 @@ +front = $front; + $this->back = $back; + } + + /** + * Creates a zipper from an array, with a hole in the + * 0-index position. + * @param Array to zipper-ify. + * @return Tuple of zipper and element of first position. + */ + static public function fromArray($array) { + $z = new self(array(), array_reverse($array)); + $t = $z->delete(); // delete the "dummy hole" + return array($z, $t); + } + + /** + * Convert zipper back into a normal array, optionally filling in + * the hole with a value. (Usually you should supply a $t, unless you + * are at the end of the array.) + */ + public function toArray($t = NULL) { + $a = $this->front; + if ($t !== NULL) $a[] = $t; + for ($i = count($this->back)-1; $i >= 0; $i--) { + $a[] = $this->back[$i]; + } + return $a; + } + + /** + * Move hole to the next element. + * @param $t Element to fill hole with + * @return Original contents of new hole. + */ + public function next($t) { + if ($t !== NULL) array_push($this->front, $t); + return empty($this->back) ? NULL : array_pop($this->back); + } + + /** + * Iterated hole advancement. + * @param $t Element to fill hole with + * @param $i How many forward to advance hole + * @return Original contents of new hole, i away + */ + public function advance($t, $n) { + for ($i = 0; $i < $n; $i++) { + $t = $this->next($t); + } + return $t; + } + + /** + * Move hole to the previous element + * @param $t Element to fill hole with + * @return Original contents of new hole. + */ + public function prev($t) { + if ($t !== NULL) array_push($this->back, $t); + return empty($this->front) ? NULL : array_pop($this->front); + } + + /** + * Delete contents of current hole, shifting hole to + * next element. + * @return Original contents of new hole. + */ + public function delete() { + return empty($this->back) ? NULL : array_pop($this->back); + } + + /** + * Returns true if we are at the end of the list. + * @return bool + */ + public function done() { + return empty($this->back); + } + + /** + * Insert element before hole. + * @param Element to insert + */ + public function insertBefore($t) { + if ($t !== NULL) array_push($this->front, $t); + } + + /** + * Insert element after hole. + * @param Element to insert + */ + public function insertAfter($t) { + if ($t !== NULL) array_push($this->back, $t); + } + + /** + * Splice in multiple elements at hole. Functional specification + * in terms of array_splice: + * + * $arr1 = $arr; + * $old1 = array_splice($arr1, $i, $delete, $replacement); + * + * list($z, $t) = HTMLPurifier_Zipper::fromArray($arr); + * $t = $z->advance($t, $i); + * list($old2, $t) = $z->splice($t, $delete, $replacement); + * $arr2 = $z->toArray($t); + * + * assert($old1 === $old2); + * assert($arr1 === $arr2); + * + * NB: the absolute index location after this operation is + * *unchanged!* + * + * @param Current contents of hole. + */ + public function splice($t, $delete, $replacement) { + // delete + $old = array(); + $r = $t; + for ($i = $delete; $i > 0; $i--) { + $old[] = $r; + $r = $this->delete(); + } + // insert + for ($i = count($replacement)-1; $i >= 0; $i--) { + $this->insertAfter($r); + $r = $replacement[$i]; + } + return array($old, $r); + } +} diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.autoload-legacy.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.autoload-legacy.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.autoload-legacy.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.autoload-legacy.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,15 @@ +purify($html, $config); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.includes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.includes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.includes.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.includes.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,234 @@ + $attributes) { + $allowed_elements[$element] = true; + foreach ($attributes as $attribute => $x) { + $allowed_attributes["$element.$attribute"] = true; + } + } + $config->set('HTML.AllowedElements', $allowed_elements); + $config->set('HTML.AllowedAttributes', $allowed_attributes); + if ($allowed_protocols !== null) { + $config->set('URI.AllowedSchemes', $allowed_protocols); + } + $purifier = new HTMLPurifier($config); + return $purifier->purify($string); +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,296 @@ +config = HTMLPurifier_Config::create($config); + $this->strategy = new HTMLPurifier_Strategy_Core(); + } + + /** + * Adds a filter to process the output. First come first serve + * + * @param HTMLPurifier_Filter $filter HTMLPurifier_Filter object + */ + public function addFilter($filter) + { + trigger_error( + 'HTMLPurifier->addFilter() is deprecated, use configuration directives' . + ' in the Filter namespace or Filter.Custom', + E_USER_WARNING + ); + $this->filters[] = $filter; + } + + /** + * Filters an HTML snippet/document to be XSS-free and standards-compliant. + * + * @param string $html String of HTML to purify + * @param HTMLPurifier_Config $config Config object for this operation, + * if omitted, defaults to the config object specified during this + * object's construction. The parameter can also be any type + * that HTMLPurifier_Config::create() supports. + * + * @return string Purified HTML + */ + public function purify($html, $config = null) + { + // :TODO: make the config merge in, instead of replace + $config = $config ? HTMLPurifier_Config::create($config) : $this->config; + + // implementation is partially environment dependant, partially + // configuration dependant + $lexer = HTMLPurifier_Lexer::create($config); + + $context = new HTMLPurifier_Context(); + + // setup HTML generator + $this->generator = new HTMLPurifier_Generator($config, $context); + $context->register('Generator', $this->generator); + + // set up global context variables + if ($config->get('Core.CollectErrors')) { + // may get moved out if other facilities use it + $language_factory = HTMLPurifier_LanguageFactory::instance(); + $language = $language_factory->create($config, $context); + $context->register('Locale', $language); + + $error_collector = new HTMLPurifier_ErrorCollector($context); + $context->register('ErrorCollector', $error_collector); + } + + // setup id_accumulator context, necessary due to the fact that + // AttrValidator can be called from many places + $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context); + $context->register('IDAccumulator', $id_accumulator); + + $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context); + + // setup filters + $filter_flags = $config->getBatch('Filter'); + $custom_filters = $filter_flags['Custom']; + unset($filter_flags['Custom']); + $filters = array(); + foreach ($filter_flags as $filter => $flag) { + if (!$flag) { + continue; + } + if (strpos($filter, '.') !== false) { + continue; + } + $class = "HTMLPurifier_Filter_$filter"; + $filters[] = new $class; + } + foreach ($custom_filters as $filter) { + // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat + $filters[] = $filter; + } + $filters = array_merge($filters, $this->filters); + // maybe prepare(), but later + + for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) { + $html = $filters[$i]->preFilter($html, $config, $context); + } + + // purified HTML + $html = + $this->generator->generateFromTokens( + // list of tokens + $this->strategy->execute( + // list of un-purified tokens + $lexer->tokenizeHTML( + // un-purified HTML + $html, + $config, + $context + ), + $config, + $context + ) + ); + + for ($i = $filter_size - 1; $i >= 0; $i--) { + $html = $filters[$i]->postFilter($html, $config, $context); + } + + $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context); + $this->context =& $context; + return $html; + } + + /** + * Filters an array of HTML snippets + * + * @param string[] $array_of_html Array of html snippets + * @param HTMLPurifier_Config $config Optional config object for this operation. + * See HTMLPurifier::purify() for more details. + * + * @return string[] Array of purified HTML + */ + public function purifyArray($array_of_html, $config = null) + { + $context_array = array(); + foreach($array_of_html as $key=>$value){ + if (is_array($value)) { + $array[$key] = $this->purifyArray($value, $config); + } else { + $array[$key] = $this->purify($value, $config); + } + $context_array[$key] = $this->context; + } + $this->context = $context_array; + return $array; + } + + /** + * Singleton for enforcing just one HTML Purifier in your system + * + * @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype + * HTMLPurifier instance to overload singleton with, + * or HTMLPurifier_Config instance to configure the + * generated version with. + * + * @return HTMLPurifier + */ + public static function instance($prototype = null) + { + if (!self::$instance || $prototype) { + if ($prototype instanceof HTMLPurifier) { + self::$instance = $prototype; + } elseif ($prototype) { + self::$instance = new HTMLPurifier($prototype); + } else { + self::$instance = new HTMLPurifier(); + } + } + return self::$instance; + } + + /** + * Singleton for enforcing just one HTML Purifier in your system + * + * @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype + * HTMLPurifier instance to overload singleton with, + * or HTMLPurifier_Config instance to configure the + * generated version with. + * + * @return HTMLPurifier + * @note Backwards compatibility, see instance() + */ + public static function getInstance($prototype = null) + { + return HTMLPurifier::instance($prototype); + } +} + +// vim: et sw=4 sts=4 diff -Nru php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.safe-includes.php php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.safe-includes.php --- php-htmlpurifier-4.10.0/HTMLPurifier-4.11.0/HTMLPurifier.safe-includes.php 1970-01-01 00:00:00.000000000 +0000 +++ php-htmlpurifier-4.11.0/HTMLPurifier-4.11.0/HTMLPurifier.safe-includes.php 2019-07-14 19:19:38.000000000 +0000 @@ -0,0 +1,228 @@ +admin@htmlpurifier.orgyes -2018-02-23 - +2019-07-14 +- 4.10.0 -4.10 +4.11.0 +4.11 stable @@ -25,19 +25,13 @@LGPL -HTML Purifier 4.9.x is a maintenance release, collecting a year -of accumulated bug fixes plus a few new features. New features -include support for min/max-width/height CSS, and rgba/hsl/hsla -in color specifications. Major bugfixes include improvements -in the Serializer cache to avoid chmod'ing directories, better -entity decoding (we won't accidentally encode entities that occur -in URLs) and rel="noopener" on links with target attributes, -to prevent them from overwriting the original frame. - -4.9.3 works around an infinite loop bug in PHP 7.1 with the opcode -cache (and has one other, minor bugfix, avoiding using autoloading -when testing for DOMDocument presence). If these bugs do not -affect you, you do not need to upgrade. +HTML Purifier 4.11.x is a maintenance release, collecting a year +and a half of accumulated bug fixes. Most notable fixes are +compatibility with PHP 7.3, and case-sensitive matching for +the SafeScripting whitelist. There are a number small feature +enhancements, including an expanded supported color list, +initial and inherit support for {min-,max-,}{width,height} +and multidimensional array support for purifyArray. @@ -49,11 +43,11 @@ - - + + - + @@ -62,7 +56,7 @@ - + @@ -96,7 +90,7 @@ - + @@ -137,7 +131,7 @@ - + @@ -174,7 +168,7 @@ - + @@ -205,7 +199,7 @@ - + @@ -214,8 +208,9 @@ + - + @@ -335,7 +330,7 @@ - + @@ -360,18 +355,18 @@ - - + + - + - + @@ -404,16 +399,16 @@ - + - + - + - 4.10.0 -4.10 +4.11.0 +4.11 stable stable 2018-02-22 +2019-07-14 LGPL -HTML Purifier 4.9.x is a maintenance release, collecting a year -of accumulated bug fixes plus a few new features. New features -include support for min/max-width/height CSS, and rgba/hsl/hsla -in color specifications. Major bugfixes include improvements -in the Serializer cache to avoid chmod'ing directories, better -entity decoding (we won't accidentally encode entities that occur -in URLs) and rel="noopener" on links with target attributes, -to prevent them from overwriting the original frame. - -4.9.3 works around an infinite loop bug in PHP 7.1 with the opcode -cache (and has one other, minor bugfix, avoiding using autoloading -when testing for DOMDocument presence). If these bugs do not -affect you, you do not need to upgrade. +HTML Purifier 4.11.x is a maintenance release, collecting a year +and a half of accumulated bug fixes. Most notable fixes are +compatibility with PHP 7.3, and case-sensitive matching for +the SafeScripting whitelist. There are a number small feature +enhancements, including an expanded supported color list, +initial and inherit support for {min-,max-,}{width,height} +and multidimensional array support for purifyArray.