htmlpurifier

HTML filter that is HTML5 compliant

由 有些话、适合烂在心里 提交于 2019-11-28 03:46:59
Is there a simple approach to add a HTML5 ruleset for HTMLPurifier? HP can be configured to recognize new tags with: // setup configurable HP instance $config = HTMLPurifier_Config::createDefault(); $config->set('HTML.DefinitionID', 'html5 draft'); $config->set('HTML.DefinitionRev', 1); $config->set('Cache.DefinitionImpl', null); // no caching $def = $config->getHTMLDefinition(true); // add a new tag $form = $def->addElement( 'article', // name 'Block', // content set 'Flow', // allowed children 'Common', // attribute collection array( // attributes ) ); // add a new attribute $def-

HTML Purifier: Removing an element conditionally based on its attributes

由 主宰稳场 提交于 2019-11-27 15:47:25
As per the HTML Purifier smoketest , 'malformed' URIs are occasionally discarded to leave behind an attribute-less anchor tag, e.g. <a href="javascript:document.location='http://www.google.com/'">XSS</a> becomes <a>XSS</a> ...as well as occasionally being stripped down to the protocol, e.g. <a href="http://1113982867/">XSS</a> becomes <a href="http:/">XSS</a> While that's unproblematic, per se, it's a bit ugly. Instead of trying to strip these out with regular expressions, I was hoping to use HTML Purifier's own library capabilities / injectors / plug-ins / whathaveyou. Point of reference:

Script tags being rendered after purification in WYSIWYG

由 让人想犯罪 __ 提交于 2019-11-27 07:29:16
问题 I'm having an issue with using the HTMLPurifier php library. I'm using a WYSIWYG editor named 'Summernote' for all text areas on my application. When writing something inside sommernote like: <script>alert('test');</script> The post data comes through as <p><script>alert('test');</script></p> However, once this is ran through the HTMLPurifier, it doesn't remove the script tags that are converted into regular characters. So when I go to edit this text inside summernote, it actually runs the

HTML filter that is HTML5 compliant

由 ⅰ亾dé卋堺 提交于 2019-11-27 05:13:22
问题 Is there a simple approach to add a HTML5 ruleset for HTMLPurifier? HP can be configured to recognize new tags with: // setup configurable HP instance $config = HTMLPurifier_Config::createDefault(); $config->set('HTML.DefinitionID', 'html5 draft'); $config->set('HTML.DefinitionRev', 1); $config->set('Cache.DefinitionImpl', null); // no caching $def = $config->getHTMLDefinition(true); // add a new tag $form = $def->addElement( 'article', // name 'Block', // content set 'Flow', // allowed

HTML Purifier: Removing an element conditionally based on its attributes

由 假装没事ソ 提交于 2019-11-26 17:17:32
问题 As per the HTML Purifier smoketest, 'malformed' URIs are occasionally discarded to leave behind an attribute-less anchor tag, e.g. <a href="javascript:document.location='http://www.google.com/'">XSS</a> becomes <a>XSS</a> ...as well as occasionally being stripped down to the protocol, e.g. <a href="http://1113982867/">XSS</a> becomes <a href="http:/">XSS</a> While that's unproblematic, per se, it's a bit ugly. Instead of trying to strip these out with regular expressions, I was hoping to use

remove script tag from HTML content

由 一曲冷凌霜 提交于 2019-11-26 01:49:23
问题 I am using HTML Purifier (http://htmlpurifier.org/) I just want to remove <script> tags only. I don\'t want to remove inline formatting or any other things. How can I achieve this? One more thing, it there any other way to remove script tags from HTML 回答1: Because this question is tagged with regex I'm going to answer with poor man's solution in this situation: $html = preg_replace('#<script(.*?)>(.*?)</script>#is', '', $html); However, regular expressions are not for parsing HTML/XML, even

remove script tag from HTML content

由 做~自己de王妃 提交于 2019-11-26 01:19:58
I am using HTML Purifier (http://htmlpurifier.org/) I just want to remove <script> tags only. I don't want to remove inline formatting or any other things. How can I achieve this? One more thing, it there any other way to remove script tags from HTML Because this question is tagged with regex I'm going to answer with poor man's solution in this situation: $html = preg_replace('#<script(.*?)>(.*?)</script>#is', '', $html); However, regular expressions are not for parsing HTML/XML, even if you write the perfect expression it will break eventually, it's not worth it, although, in some cases it's
订阅 htmlpurifier