projets / aidenligne_francais_universite.git / blame
| Commit | Line | Data |
|---|---|---|
| c495c100 P |
1 | SafeHTML |
| 2 | -------- | |
| 3 | Version 1.3.7. | |
| 4 | http://pixel-apes.com/safehtml/ | |
| 5 | -------- | |
| 6 | ||
| 7 | This parser strips down all potentially dangerous content within HTML: | |
| 8 | * opening tag without its closing tag | |
| 9 | * closing tag without its opening tag | |
| 10 | * any of these tags: "base", "basefont", "head", "html", "body", "applet", "object", | |
| 11 | "iframe", "frame", "frameset", "script", "layer", "ilayer", "embed", "bgsound", | |
| 12 | "link", "meta", "style", "title", "blink", "xml" etc. | |
| 13 | * any of these attributes: on*, data*, dynsrc | |
| 14 | * javascript:/vbscript:/about: etc. protocols | |
| 15 | * expression/behavior etc. in styles | |
| 16 | * any other active content | |
| 17 | It also tries to convert code to XHTML valid, but htmltidy is far better solution for this task. | |
| 18 | ||
| 19 | If you found any bugs in this parser, please inform me -- ICQ:551593 or mailto:thingol@mail.ru | |
| 20 | ||
| 21 | Please, subscribe to http://pixel-apes.com/safehtml/feed/rss feed in order to receive notices | |
| 22 | when SAFEHTML will be updated. | |
| 23 | ||
| 24 | -- Roman Ivanov. | |
| 25 | -- Pixel-Apes ( http://pixel-apes.com ). | |
| 26 | -- JetStyle ( http://jetstyle.ru/ ). | |
| 27 | ||
| 28 | ||
| 29 | ||
| 30 | -------- | |
| 31 | Version history: | |
| 32 | -------- | |
| 33 | 1.3.7. | |
| 34 | * Added 'dl' to the list of 'lists' tags. | |
| 35 | * Added 'callto' to the white list of protocols. | |
| 36 | * Added white list of "namespaced" attributes. | |
| 37 | 1.3.6. | |
| 38 | * More accurate UTF-7 decoding. | |
| 39 | 1.3.5. | |
| 40 | * Two serious security flaws fixed: UTF-7 XSS and CSS comments handling. | |
| 41 | 1.3.2. | |
| 42 | * Security flaw (improper quotes handling in attributes' values) fixed. Big thanks to Nick Cleaton. | |
| 43 | 1.3.1. | |
| 44 | * Dumb bug fixed (some closing tags were ignored). | |
| 45 | 1.3.0. | |
| 46 | * Two holes (with decimal HTML entities and with \x00 symbol) fixed. | |
| 47 | * Class rewritten under PEAR coding standarts. | |
| 48 | * Class now uses unmodified HTMLSax3 from PEAR. | |
| 49 | * To the list of table tags added: "caption", "col", "colgroup". | |
| 50 | 1.2.1. | |
| 51 | * It was possible to create XSS with hexadecimal HTML entities. Fixed. Big thanks to Christian Stocker. | |
| 52 | 1.2.0. | |
| 53 | * "id" and "name" attributes added to dangerous attributes list, because malefactor can broke legal javascript by spoofing ID or NAME of some element. | |
| 54 | * New method parse() allows to do all parsing process in two lines of code. Examples also updated. | |
| 55 | * New array, closeParagraph, contains list of block-level elements. When we open such elemet, we should close paragraph before. . It allows SafeHTML to produce more XHTML compliant code. | |
| 56 | * Added "webcal" to white list of protocols for those who uses calendar programs (Mozilla/iCal/etc). | |
| 57 | * Now SafeHTML strips down table elements when we are not inside table. | |
| 58 | * Now SafeHTML correctly closes unclosed "li" tags: before opening "li" of the same nesting level. | |
| 59 | 1.1.0. | |
| 60 | * New "dangerous" protocols: hcp, ms-help, help, disk, vnd.ms.radio, opera, res, resource, chrome, mocha, livescript. | |
| 61 | * <XML> tag was moved from "tags for deletion" to "tags for deletion with content". | |
| 62 | * New "dangerous" CSS instruction "include-source" (NN4 specific). | |
| 63 | * New array, Attributes, contains list of attributes for removal. If you need to remove "id" or "name" attribute, | |
| 64 | just add it to this array. | |
| 65 | * Now it is possible to choose between white-list and black-list filtering of protocols. Defaults are "white-list". | |
| 66 | This list is: "http", "https", "ftp", "telnet", "news", "nntp", "gopher", "mailto", "file". | |
| 67 | * For speed purposes, we now filter protocols only from these attributes: src, href, action, lowsrc, dynsrc, | |
| 68 | background, codebase. | |
| 69 | * Opera6 XSS bug ([\xC0][\xBC]script>alert(1)[\xC0][\xBC]/script> [UTF-8] workarounded. | |
| 70 | 1.0.4. | |
| 71 | New "dangerous" tag: plaintext. | |
| 72 | 1.0.3. | |
| 73 | Added array of elements that can have no closing tag. | |
| 74 | 1.0.2. | |
| 75 | Bug fix: <img src="javascript:alert(1);"> attack. | |
| 76 | Thanks to shmel. | |
| 77 | 1.0.1. | |
| 78 | Bug fix: safehtml hangs on <style></style></style> code. | |
| 79 | Thanks to lj user=electrocat. | |
| 80 | 1.0.0. | |
| 81 | First public release |