Aidan Woods
b1e5aebaf6
add single safeMode option that encompasses protection from link destination xss and plain markup based xss into a single on/off switch
2017-05-09 19:22:58 +01:00
Aidan Woods
c63b690a79
remove duplicates
2017-05-09 14:50:15 +01:00
Aidan Woods
226f636360
remove $safe flag
2017-05-07 13:45:59 +01:00
Aidan Woods
2e4afde68d
faster check substr at beginning of string
2017-05-06 16:32:51 +01:00
Aidan Woods
dc30cb441c
add more protocols to the whitelist
2017-05-05 21:32:27 +01:00
Aidan Woods
054ba3c487
urlencode urls that are potentially unsafe:
...
this should break urls that attempt to include a protocol, or port (these are absolute URLs and should have a whitelisted protocol for use)
but URLs that are relative, or relative from the site root should be preserved (though characters non essential for the URL structure may be urlencoded)
this approach has significant advantages over attempting to locate something like `javascript:alert(1)` or `javascript:alert(1)` (which are both valid) because browsers have been known to ignore ridiculous characters when encountered (meaning something like `jav\ta\0\0script:alert(1)` would be xss :( ). Instead of trying to chase down a way to interpret a URL to decide whether there is a protocol, this approach ensures that two essential characters needed to achieve a colon are encoded `:` (obviously) and `;` (from `:`). If these characters appear in a relative URL then they are equivalent to their URL encoded form and so this change will be non breaking for that case.
2017-05-03 17:01:27 +01:00
Aidan Woods
4bae1c9834
whitelist regex for good attribute (no
...
no chars that could form a delimiter allowed
2017-05-03 00:39:01 +01:00
Aidan Woods
aee3963e6b
jpeg, not jpg
2017-05-02 19:55:03 +01:00
Aidan Woods
4dc98b635d
whitelist changes:
...
* add gif and jpg as allowed data images
* ensure that user controlled content fall only in the "data section" of the data URI (and does not intersect content-type definition in any way (best to be safe than sorry ;-)))
"data section" as defined in: https://tools.ietf.org/html/rfc2397#section-3
2017-05-02 19:48:25 +01:00
Aidan Woods
e4bb12329e
array_keys is probably faster
2017-05-02 01:32:24 +01:00
Aidan Woods
6d0156d707
dump attributes that contain characters that are impossible for validity, or very unlikely
2017-05-02 00:48:48 +01:00
Aidan Woods
131ba75851
filter onevent attributes
2017-05-01 15:44:04 +01:00
Aidan Woods
6bb66db00f
anti-xss
...
protect all attributes and content from xss via element method
filter special attributes (a href, img src)
expand url whitelist slightly to permit data images and mailto links
2017-05-01 03:25:07 +01:00
naNuke
b3d45c4bb9
Add html escaping to all attributes capable of holding user input.
2017-05-01 02:00:38 +01:00
naNuke
1d4296f34d
Customizable whitelist of schemas for safeLinks
2017-05-01 01:58:34 +01:00
naNuke
bf5105cb1a
Improve safeLinks with whitelist.
2017-05-01 01:58:34 +01:00
naNuke
1140613fc7
Prevent various XSS attacks
2017-05-01 01:58:34 +01:00
Aidan Woods
d7956e3ade
blockmarkup ends on interrupt by newline (CommonMark compliance)
2017-03-29 18:25:56 +01:00
Emanuil Rusev
1bf24f7334
add kbd to text-level elements
2017-03-29 19:04:15 +03:00
Marek Skiba
7081afe8cb
Removed double semicolon
2017-03-02 12:43:51 +01:00
Aidan Woods
0172d779d7
Trim surrounding whitespace from URL in inlineLink
...
Fixes https://github.com/erusev/parsedown-extra/issues/103
2017-01-21 11:06:41 +00:00
gene_sis
48351504de
adjust two regex pattern within inlineLink() to reduce backtracking
...
add test with base64 image
2017-01-07 00:45:38 +01:00
Daniel Rudolf
a3836b1853
Handle subsequent list items which aren't indented sufficiently
...
Subsequent list items which aren't indented sufficiently are treated as part of the original list, see CommonMark spec example [#256 ](http://spec.commonmark.org/0.26/#example-256 ).
2016-10-13 20:44:02 +02:00
Daniel Rudolf
a9e1163c85
Fix code formatting
2016-10-13 19:52:38 +02:00
Daniel Rudolf
7b1529fff0
Use the list marker width to determine whether a list item is continued
...
This basically represents [list item parsing](http://spec.commonmark.org/0.26/#list-items ), rule 1 of the CommonMark specs.
2016-10-13 19:51:32 +02:00
Daniel Rudolf
1d61f90bf9
Support list items starting with indented code
2016-10-13 19:47:06 +02:00
Daniel Rudolf
4b3b7df710
Support list items starting with a blank line
...
According to the CommonMark specs ([list items](http://spec.commonmark.org/0.26/#list-items ), rule 3), list items starting with a blank line basically behave like as if the \n doesn't exist. Also see example [#241 ](http://spec.commonmark.org/0.26/#example-241 ).
2016-10-13 19:46:29 +02:00
Daniel Rudolf
30ff5c6e75
Remove unused $placeholder variable
2016-10-13 19:31:35 +02:00
Daniel Rudolf
bdf537e9d5
Fix ordered list start argument
...
See CommonMark spec examples [#226 ](http://spec.commonmark.org/0.26/#example-226 ) to #229
2016-10-13 19:30:50 +02:00
Daniel Rudolf
81025cd468
Revert "Break less previously passed CommonMarkWeak tests"
...
This reverts commit 2db3199510
2016-10-13 19:25:43 +02:00
Daniel Rudolf
e691034861
Revert "Prevent failure with data set 77 in CommonMarkWeak"
...
This reverts commit 0a43799da4
2016-10-13 19:25:37 +02:00
Daniel Rudolf
eb853da92a
Revert "Prevent breaking remaining previously compliant CommonMarkWeak tests"
...
This reverts commit 6973302ca8
2016-10-13 19:25:30 +02:00
Aidan Woods
6973302ca8
Prevent breaking remaining previously compliant CommonMarkWeak tests
2016-10-13 15:55:13 +01:00
Aidan Woods
0a43799da4
Prevent failure with data set 77 in CommonMarkWeak
2016-10-13 14:29:52 +01:00
Aidan Woods
2db3199510
Break less previously passed CommonMarkWeak tests
2016-10-12 18:10:44 +01:00
Aidan Woods
d26b33c20f
Add ) as an ordered list marker
...
Also added marker check to ordered list case when deciding to continue the current list
2016-10-11 19:18:43 +01:00
Aidan Woods
0bd61a73ed
Check that the current line is a list before starting a new one
2016-10-11 13:48:38 +01:00
Aidan Woods
06c4344a71
Contextual limits on indentation stripping
2016-10-11 13:38:47 +01:00
Aidan Woods
c4d4a6800d
(beginning to) improve commonmark compliance:lists
...
These changes aren't fit for merge, nor do they work correctly (yet)
2016-10-11 12:05:33 +01:00
Aidan Woods
3aef89b399
Line handler may prevent specified element nesting
...
Swap `under_scores` for `camelCasing`
2016-10-08 17:54:04 +01:00
Aidan Woods
5c22531e4d
Allow parsedown to specify list start attribute
...
Syntax preferences
2016-10-05 18:27:54 +01:00
Aidan Woods
3978e33fd0
Allow parsedown to specify list start attribute
...
Remove github added tabs on blank lines
2016-10-05 18:17:12 +01:00
Aidan Woods
a37797ef34
Allow parsedown to specify list start attribute
...
Syntax preferences to match surrounding code
2016-10-05 18:15:47 +01:00
Aidan Woods
e3cd271f16
Allow parsedown to specify list start attribute
...
Performance: Swap preg_replace for stristr to obtain list start
2016-10-05 15:44:34 +01:00
Aidan Woods
f0b7b61c16
Allow parsedown to specify list start attribute
...
Should fix compatibility for PHP 5.3
2016-10-05 11:36:27 +01:00
Aidan Woods
ed41fcf3d6
Allow parsedown to specify list start attribute
...
oops
2016-10-05 10:06:40 +01:00
Aidan Woods
1fa8fae301
Allow parsedown to specify list start attribute
...
Readability improvements
2016-10-05 10:03:21 +01:00
Aidan Woods
543a6c4175
Line handler may prevent specified element nesting
...
Check if array is empty to shave some performance hits in the case than no non nestables are present.
2016-10-04 18:59:36 +01:00
Aidan Woods
a81aedeb10
Line handler may prevent specified element nesting
...
Removed granularity controls – elements are assumed to be non nestable indefinitely once declared.
2016-10-04 15:27:11 +01:00
Aidan Woods
50952b3243
Line handler may prevent specified element nesting
...
This commit serves to add comments detailing parts of the new functionality, and to adjust syntax preferences to match that of the surrounding document. The commit title also now reflects the most significant change made.
2016-10-02 18:26:13 +01:00
