1
0
mirror of https://github.com/erusev/parsedown.git synced 2023-08-10 21:13:06 +03:00
Commit Graph

318 Commits

Author SHA1 Message Date
Luiz Paulo "Bills
9857334186
bump version 2018-03-07 22:04:55 -03:00
Luiz Paulo "Bills
ae7e8e5067
bump version 2018-03-07 21:51:35 -03:00
Aidan Woods
e941dcc3f0
Merge pull request #525 from aidantwoods/fix/infostring
Properly support fenced code block infostring
2018-02-28 17:06:25 +00:00
Aidan Woods
c192001a7e
Merge pull request #433 from aidantwoods/patch-3
Fix Issue #358 – preventing double nested links
2018-02-28 17:05:58 +00:00
Aidan Woods
5057e505d8
Merge pull request #475 from aidantwoods/loose-lists
Loose lists
2018-02-28 17:05:00 +00:00
Emanuil Rusev
6678d59be4
Merge pull request #495 from aidantwoods/anti-xss
Prevent various XSS attacks [rebase and update of #276]
2018-02-28 13:41:37 +02:00
Aidan Woods
0e1043a8d6
consistent li items for loose list 2018-01-29 14:38:19 +01:00
Emanuil Rusev
296ebf0e60
Merge pull request #429 from pablotheissen/patch-1
Support html tags containing dashes
2017-11-19 11:15:43 +02:00
Aidan Woods
4404201175
Properly support fenced code block infostring
Reference: http://spec.commonmark.org/0.28/#info-string
2017-08-20 10:28:46 +01:00
Aidan Woods
67c3efbea0
according to https://tools.ietf.org/html/rfc3986#section-3 the colon is a required part of the syntax, other methods of achieving the colon character (as to browser interpretation) should be taken care of by htmlencoding that is done on all attribute content 2017-05-10 16:57:18 +01:00
Aidan Woods
bbb7687f31
safeMode will either apply all sanitisation techniques to an element or none (note that encoding HTML entities is done regardless because it speaks to character context, and that the only attributes/elements we should permit are the ones we actually mean to create) 2017-05-09 19:31:36 +01:00
Aidan Woods
b1e5aebaf6
add single safeMode option that encompasses protection from link destination xss and plain markup based xss into a single on/off switch 2017-05-09 19:22:58 +01:00
Aidan Woods
c63b690a79
remove duplicates 2017-05-09 14:50:15 +01:00
Aidan Woods
226f636360
remove $safe flag 2017-05-07 13:45:59 +01:00
Aidan Woods
2e4afde68d
faster check substr at beginning of string 2017-05-06 16:32:51 +01:00
Aidan Woods
dc30cb441c
add more protocols to the whitelist 2017-05-05 21:32:27 +01:00
Aidan Woods
054ba3c487
urlencode urls that are potentially unsafe:
this should break urls that attempt to include a protocol, or port (these are absolute URLs and should have a whitelisted protocol for use)
but URLs that are relative, or relative from the site root should be preserved (though characters non essential for the URL structure may be urlencoded)

this approach has significant advantages over attempting to locate something like `javascript:alert(1)` or `javascript:alert(1)` (which are both valid) because browsers have been known to ignore ridiculous characters when encountered (meaning something like `jav\ta\0\0script:alert(1)` would be xss :( ). Instead of trying to chase down a way to interpret a URL to decide whether there is a protocol, this approach ensures that two essential characters needed to achieve a colon are encoded `:` (obviously) and `;` (from `:`). If these characters appear in a relative URL then they are equivalent to their URL encoded form and so this change will be non breaking for that case.
2017-05-03 17:01:27 +01:00
Aidan Woods
4bae1c9834
whitelist regex for good attribute (no
no chars that could form a delimiter allowed
2017-05-03 00:39:01 +01:00
Aidan Woods
aee3963e6b
jpeg, not jpg 2017-05-02 19:55:03 +01:00
Aidan Woods
4dc98b635d
whitelist changes:
* add gif and jpg as allowed data images
* ensure that user controlled content fall only in the "data section" of the data URI (and does not intersect content-type definition in any way (best to be safe than sorry ;-)))
  "data section" as defined in: https://tools.ietf.org/html/rfc2397#section-3
2017-05-02 19:48:25 +01:00
Aidan Woods
e4bb12329e
array_keys is probably faster 2017-05-02 01:32:24 +01:00
Aidan Woods
6d0156d707
dump attributes that contain characters that are impossible for validity, or very unlikely 2017-05-02 00:48:48 +01:00
Aidan Woods
131ba75851
filter onevent attributes 2017-05-01 15:44:04 +01:00
Aidan Woods
6bb66db00f
anti-xss
protect all attributes and content from xss via element method
filter special attributes (a href, img src)
expand url whitelist slightly to permit data images and mailto links
2017-05-01 03:25:07 +01:00
naNuke
b3d45c4bb9 Add html escaping to all attributes capable of holding user input. 2017-05-01 02:00:38 +01:00
naNuke
1d4296f34d Customizable whitelist of schemas for safeLinks 2017-05-01 01:58:34 +01:00
naNuke
bf5105cb1a Improve safeLinks with whitelist. 2017-05-01 01:58:34 +01:00
naNuke
1140613fc7 Prevent various XSS attacks 2017-05-01 01:58:34 +01:00
Emanuil Rusev
1bf24f7334 add kbd to text-level elements 2017-03-29 19:04:15 +03:00
Marek Skiba
7081afe8cb Removed double semicolon 2017-03-02 12:43:51 +01:00
Aidan Woods
0172d779d7 Trim surrounding whitespace from URL in inlineLink
Fixes https://github.com/erusev/parsedown-extra/issues/103
2017-01-21 11:06:41 +00:00
gene_sis
48351504de adjust two regex pattern within inlineLink() to reduce backtracking
add test with base64 image
2017-01-07 00:45:38 +01:00
Aidan Woods
3aef89b399 Line handler may prevent specified element nesting
Swap `under_scores` for `camelCasing`
2016-10-08 17:54:04 +01:00
Aidan Woods
5c22531e4d Allow parsedown to specify list start attribute
Syntax preferences
2016-10-05 18:27:54 +01:00
Aidan Woods
3978e33fd0 Allow parsedown to specify list start attribute
Remove github added tabs on blank lines
2016-10-05 18:17:12 +01:00
Aidan Woods
a37797ef34 Allow parsedown to specify list start attribute
Syntax preferences to match surrounding code
2016-10-05 18:15:47 +01:00
Aidan Woods
e3cd271f16 Allow parsedown to specify list start attribute
Performance: Swap preg_replace for stristr to obtain list start
2016-10-05 15:44:34 +01:00
Aidan Woods
f0b7b61c16 Allow parsedown to specify list start attribute
Should fix compatibility for PHP 5.3
2016-10-05 11:36:27 +01:00
Aidan Woods
ed41fcf3d6 Allow parsedown to specify list start attribute
oops
2016-10-05 10:06:40 +01:00
Aidan Woods
1fa8fae301 Allow parsedown to specify list start attribute
Readability improvements
2016-10-05 10:03:21 +01:00
Aidan Woods
543a6c4175 Line handler may prevent specified element nesting
Check if array is empty to shave some performance hits in the case than no non nestables are present.
2016-10-04 18:59:36 +01:00
Aidan Woods
a81aedeb10 Line handler may prevent specified element nesting
Removed granularity controls – elements are assumed to be non nestable indefinitely once declared.
2016-10-04 15:27:11 +01:00
Aidan Woods
50952b3243 Line handler may prevent specified element nesting
This commit serves to add comments detailing parts of the new functionality, and to adjust syntax preferences to match that of the surrounding document. The commit title also now reflects the most significant change made.
2016-10-02 18:26:13 +01:00
Aidan Woods
4d3600f273 Extend disallowed assertion depth capabilities
I've built on the functionality of feature 1. in the previous commit to allow non nestables to be asserted indefinitely, or to a specified depth.
2016-10-02 17:37:08 +01:00
Aidan Woods
d6d5f53ff4 Fix Issue #358 – preventing double nested links
1. Add the ability for a parsed element to enforce that the line handler not parse any (immediate) child elements of a specified type.
2. Use 1. to allow parsed Url elements to tell the line handler not to parse any child Links or Urls where they are immediate children.
2016-10-01 15:56:14 +01:00
Aidan Woods
f17aa0438a Update Parsedown.php 2016-09-27 02:15:35 +01:00
Aidan Woods
38f4027d5e Update Parsedown.php
Okay, so maybe I should have looked 20 lines or so above where I made the edit in the element function – looks like it already supports adding attributes ;p
Have amended the change to blocklist to use the already existing functionality, and have reverted the change that I made to the element function.
2016-09-27 02:15:09 +01:00
Aidan Woods
2cee8d8a2d Update Parsedown.php
Looks like I might need to return the pattern which was used previously
Reverting last change as build still failed

This build will still fail, but I'm hoping it will only fair where the list start value has been inserted
2016-09-27 01:23:22 +01:00
Aidan Woods
cceefafd55 test
Attempting to determine which function change is causing test jobs to fail (in unexpected ways)
2016-09-27 01:16:00 +01:00
Aidan Woods
1c58e9d8d5 oops
oops
2016-09-27 00:57:57 +01:00