| 1 |
lars |
1 |
SafeHTML
|
|
|
2 |
--------
|
|
|
3 |
Version 1.3.7.
|
|
|
4 |
http://pixel-apes.com/safehtml/
|
|
|
5 |
--------
|
|
|
6 |
|
|
|
7 |
This parser strips down all potentially dangerous content within HTML:
|
|
|
8 |
* opening tag without its closing tag
|
|
|
9 |
* closing tag without its opening tag
|
|
|
10 |
* any of these tags: "base", "basefont", "head", "html", "body", "applet", "object",
|
|
|
11 |
"iframe", "frame", "frameset", "script", "layer", "ilayer", "embed", "bgsound",
|
|
|
12 |
"link", "meta", "style", "title", "blink", "xml" etc.
|
|
|
13 |
* any of these attributes: on*, data*, dynsrc
|
|
|
14 |
* javascript:/vbscript:/about: etc. protocols
|
|
|
15 |
* expression/behavior etc. in styles
|
|
|
16 |
* any other active content
|
|
|
17 |
It also tries to convert code to XHTML valid, but htmltidy is far better solution for this task.
|
|
|
18 |
|
|
|
19 |
If you found any bugs in this parser, please inform me -- ICQ:551593 or mailto:thingol@mail.ru
|
|
|
20 |
|
|
|
21 |
Please, subscribe to http://pixel-apes.com/safehtml/feed/rss feed in order to receive notices
|
|
|
22 |
when SAFEHTML will be updated.
|
|
|
23 |
|
|
|
24 |
-- Roman Ivanov.
|
|
|
25 |
-- Pixel-Apes ( http://pixel-apes.com ).
|
|
|
26 |
-- JetStyle ( http://jetstyle.ru/ ).
|
|
|
27 |
|
|
|
28 |
|
|
|
29 |
|
|
|
30 |
--------
|
|
|
31 |
Version history:
|
|
|
32 |
--------
|
|
|
33 |
1.3.7.
|
|
|
34 |
* Added 'dl' to the list of 'lists' tags.
|
|
|
35 |
* Added 'callto' to the white list of protocols.
|
|
|
36 |
* Added white list of "namespaced" attributes.
|
|
|
37 |
1.3.6.
|
|
|
38 |
* More accurate UTF-7 decoding.
|
|
|
39 |
1.3.5.
|
|
|
40 |
* Two serious security flaws fixed: UTF-7 XSS and CSS comments handling.
|
|
|
41 |
1.3.2.
|
|
|
42 |
* Security flaw (improper quotes handling in attributes' values) fixed. Big thanks to Nick Cleaton.
|
|
|
43 |
1.3.1.
|
|
|
44 |
* Dumb bug fixed (some closing tags were ignored).
|
|
|
45 |
1.3.0.
|
|
|
46 |
* Two holes (with decimal HTML entities and with \x00 symbol) fixed.
|
|
|
47 |
* Class rewritten under PEAR coding standarts.
|
|
|
48 |
* Class now uses unmodified HTMLSax3 from PEAR.
|
|
|
49 |
* To the list of table tags added: "caption", "col", "colgroup".
|
|
|
50 |
1.2.1.
|
|
|
51 |
* It was possible to create XSS with hexadecimal HTML entities. Fixed. Big thanks to Christian Stocker.
|
|
|
52 |
1.2.0.
|
|
|
53 |
* "id" and "name" attributes added to dangerous attributes list, because malefactor can broke legal javascript by spoofing ID or NAME of some element.
|
|
|
54 |
* New method parse() allows to do all parsing process in two lines of code. Examples also updated.
|
|
|
55 |
* New array, closeParagraph, contains list of block-level elements. When we open such elemet, we should close paragraph before. . It allows SafeHTML to produce more XHTML compliant code.
|
|
|
56 |
* Added "webcal" to white list of protocols for those who uses calendar programs (Mozilla/iCal/etc).
|
|
|
57 |
* Now SafeHTML strips down table elements when we are not inside table.
|
|
|
58 |
* Now SafeHTML correctly closes unclosed "li" tags: before opening "li" of the same nesting level.
|
|
|
59 |
1.1.0.
|
|
|
60 |
* New "dangerous" protocols: hcp, ms-help, help, disk, vnd.ms.radio, opera, res, resource, chrome, mocha, livescript.
|
|
|
61 |
* <XML> tag was moved from "tags for deletion" to "tags for deletion with content".
|
|
|
62 |
* New "dangerous" CSS instruction "include-source" (NN4 specific).
|
|
|
63 |
* New array, Attributes, contains list of attributes for removal. If you need to remove "id" or "name" attribute,
|
|
|
64 |
just add it to this array.
|
|
|
65 |
* Now it is possible to choose between white-list and black-list filtering of protocols. Defaults are "white-list".
|
|
|
66 |
This list is: "http", "https", "ftp", "telnet", "news", "nntp", "gopher", "mailto", "file".
|
|
|
67 |
* For speed purposes, we now filter protocols only from these attributes: src, href, action, lowsrc, dynsrc,
|
|
|
68 |
background, codebase.
|
|
|
69 |
* Opera6 XSS bug ([\xC0][\xBC]script>alert(1)[\xC0][\xBC]/script> [UTF-8] workarounded.
|
|
|
70 |
1.0.4.
|
|
|
71 |
New "dangerous" tag: plaintext.
|
|
|
72 |
1.0.3.
|
|
|
73 |
Added array of elements that can have no closing tag.
|
|
|
74 |
1.0.2.
|
|
|
75 |
Bug fix: <img src="javascript:alert(1);"> attack.
|
|
|
76 |
Thanks to shmel.
|
|
|
77 |
1.0.1.
|
|
|
78 |
Bug fix: safehtml hangs on <style></style></style> code.
|
|
|
79 |
Thanks to lj user=electrocat.
|
|
|
80 |
1.0.0.
|
|
|
81 |
First public release
|