1
0
mirror of https://github.com/erusev/parsedown.git synced 2023-08-10 21:13:06 +03:00

Compare commits

..

1 Commits

Author SHA1 Message Date
87b57bf3cb Add test to prevent regression 2019-04-10 21:54:34 +01:00
5 changed files with 48 additions and 53 deletions

View File

@ -1,25 +1,23 @@
language: php language: php
dist: trusty
sudo: false
matrix: matrix:
include: include:
- php: 5.3 - php: 5.3
dist: precise dist: precise
- php: 5.4 - php: 5.4
dist: trusty
- php: 5.5 - php: 5.5
dist: trusty
- php: 5.6 - php: 5.6
dist: xenial
- php: 7.0 - php: 7.0
dist: xenial
- php: 7.1 - php: 7.1
dist: bionic
- php: 7.2 - php: 7.2
dist: bionic
- php: 7.3 - php: 7.3
dist: bionic - php: nightly
- php: 7.4 fast_finish: true
dist: bionic allow_failures:
- php: nightly
install: install:
- composer install --prefer-dist --no-interaction --no-progress - composer install --prefer-dist --no-interaction --no-progress

View File

@ -107,7 +107,6 @@ class Parsedown
'ftp://', 'ftp://',
'ftps://', 'ftps://',
'mailto:', 'mailto:',
'tel:',
'data:image/png;base64,', 'data:image/png;base64,',
'data:image/gif;base64,', 'data:image/gif;base64,',
'data:image/jpeg;base64,', 'data:image/jpeg;base64,',
@ -556,7 +555,7 @@ class Parsedown
$Block = array( $Block = array(
'element' => array( 'element' => array(
'name' => 'h' . $level, 'name' => 'h' . min(6, $level),
'handler' => array( 'handler' => array(
'function' => 'lineElements', 'function' => 'lineElements',
'argument' => $text, 'argument' => $text,
@ -1134,9 +1133,6 @@ class Parsedown
protected function lineElements($text, $nonNestables = array()) protected function lineElements($text, $nonNestables = array())
{ {
# standardize line breaks
$text = str_replace(array("\r\n", "\r"), "\n", $text);
$Elements = array(); $Elements = array();
$nonNestables = (empty($nonNestables) $nonNestables = (empty($nonNestables)
@ -1494,7 +1490,7 @@ class Parsedown
protected function inlineSpecialCharacter($Excerpt) protected function inlineSpecialCharacter($Excerpt)
{ {
if (substr($Excerpt['text'], 1, 1) !== ' ' and strpos($Excerpt['text'], ';') !== false if ($Excerpt['text'][1] !== ' ' and strpos($Excerpt['text'], ';') !== false
and preg_match('/^&(#?+[0-9a-zA-Z]++);/', $Excerpt['text'], $matches) and preg_match('/^&(#?+[0-9a-zA-Z]++);/', $Excerpt['text'], $matches)
) { ) {
return array( return array(

View File

@ -1,61 +1,60 @@
<!-- ![Parsedown](https://i.imgur.com/yE8afYV.png) --> > I also make [Caret](https://caret.io?ref=parsedown) - a Markdown editor for Mac and PC.
<p align="center"><img alt="Parsedown" src="https://i.imgur.com/fKVY6Kz.png" width="240" /></p> ## Parsedown
<h1>Parsedown</h1> [![Build Status](https://img.shields.io/travis/erusev/parsedown/master.svg?style=flat-square)](https://travis-ci.org/erusev/parsedown)
<!--[![Total Downloads](http://img.shields.io/packagist/dt/erusev/parsedown.svg?style=flat-square)](https://packagist.org/packages/erusev/parsedown)-->
[![Build Status](https://travis-ci.org/erusev/parsedown.svg)](https://travis-ci.org/erusev/parsedown) Better Markdown Parser in PHP
[![Total Downloads](https://poser.pugx.org/erusev/parsedown/d/total.svg)](https://packagist.org/packages/erusev/parsedown)
[![Version](https://poser.pugx.org/erusev/parsedown/v/stable.svg)](https://packagist.org/packages/erusev/parsedown)
[![License](https://poser.pugx.org/erusev/parsedown/license.svg)](https://packagist.org/packages/erusev/parsedown)
Better Markdown Parser in PHP - <a href="http://parsedown.org/demo">Demo</a>. [Demo](http://parsedown.org/demo) |
[Benchmarks](http://parsedown.org/speed) |
[Tests](http://parsedown.org/tests/) |
[Documentation](https://github.com/erusev/parsedown/wiki/)
## Features ### Features
* One File * One File
* No Dependencies * No Dependencies
* [Super Fast](http://parsedown.org/speed) * Super Fast
* Extensible * Extensible
* [GitHub flavored](https://github.github.com/gfm) * [GitHub flavored](https://help.github.com/articles/github-flavored-markdown)
* [Tested](http://parsedown.org/tests/) in 5.3 to 7.3 * Tested in 5.3 to 7.2 and in HHVM
* [Markdown Extra extension](https://github.com/erusev/parsedown-extra) * [Markdown Extra extension](https://github.com/erusev/parsedown-extra)
## Installation ### Installation
#### Composer
Install the [composer package]: Install the [composer package] by running the following command:
composer require erusev/parsedown composer require erusev/parsedown
Or download the [latest release] and include `Parsedown.php` #### Manual
1. Download the "Source code" from the [latest release]
2. Include `Parsedown.php`
[composer package]: https://packagist.org/packages/erusev/parsedown "The Parsedown package on packagist.org" [composer package]: https://packagist.org/packages/erusev/parsedown "The Parsedown package on packagist.org"
[latest release]: https://github.com/erusev/parsedown/releases/latest "The latest release of Parsedown" [latest release]: https://github.com/erusev/parsedown/releases/latest "The latest release of Parsedown"
## Example ### Example
```php ``` php
$Parsedown = new Parsedown(); $Parsedown = new Parsedown();
echo $Parsedown->text('Hello _Parsedown_!'); # prints: <p>Hello <em>Parsedown</em>!</p> echo $Parsedown->text('Hello _Parsedown_!'); # prints: <p>Hello <em>Parsedown</em>!</p>
``` // you can also parse inline markdown only
You can also parse inline markdown only:
```php
echo $Parsedown->line('Hello _Parsedown_!'); # prints: Hello <em>Parsedown</em>! echo $Parsedown->line('Hello _Parsedown_!'); # prints: Hello <em>Parsedown</em>!
``` ```
More examples in [the wiki](https://github.com/erusev/parsedown/wiki/) and in [this video tutorial](http://youtu.be/wYZBY8DEikI). More examples in [the wiki](https://github.com/erusev/parsedown/wiki/) and in [this video tutorial](http://youtu.be/wYZBY8DEikI).
## Security ### Security
Parsedown is capable of escaping user-input within the HTML that it generates. Additionally Parsedown will apply sanitisation to additional scripting vectors (such as scripting link destinations) that are introduced by the markdown syntax itself. Parsedown is capable of escaping user-input within the HTML that it generates. Additionally Parsedown will apply sanitisation to additional scripting vectors (such as scripting link destinations) that are introduced by the markdown syntax itself.
To tell Parsedown that it is processing untrusted user-input, use the following: To tell Parsedown that it is processing untrusted user-input, use the following:
```php ```php
$Parsedown->setSafeMode(true); $parsedown = new Parsedown;
$parsedown->setSafeMode(true);
``` ```
If instead, you wish to allow HTML within untrusted user-input, but still want output to be free from XSS it is recommended that you make use of a HTML sanitiser that allows HTML tags to be whitelisted, like [HTML Purifier](http://htmlpurifier.org/). If instead, you wish to allow HTML within untrusted user-input, but still want output to be free from XSS it is recommended that you make use of a HTML sanitiser that allows HTML tags to be whitelisted, like [HTML Purifier](http://htmlpurifier.org/).
@ -66,19 +65,18 @@ In both cases you should strongly consider employing defence-in-depth measures,
Safe mode does not necessarily yield safe results when using extensions to Parsedown. Extensions should be evaluated on their own to determine their specific safety against XSS. Safe mode does not necessarily yield safe results when using extensions to Parsedown. Extensions should be evaluated on their own to determine their specific safety against XSS.
## Escaping HTML ### Escaping HTML
> ⚠️  **WARNING:** This method isn't safe from XSS!
> **WARNING:** This method isn't safe from XSS!
If you wish to escape HTML **in trusted input**, you can use the following: If you wish to escape HTML **in trusted input**, you can use the following:
```php ```php
$Parsedown->setMarkupEscaped(true); $parsedown = new Parsedown;
$parsedown->setMarkupEscaped(true);
``` ```
Beware that this still allows users to insert unsafe scripting vectors, such as links like `[xss](javascript:alert%281%29)`. Beware that this still allows users to insert unsafe scripting vectors, such as links like `[xss](javascript:alert%281%29)`.
## Questions ### Questions
**How does Parsedown work?** **How does Parsedown work?**
@ -92,12 +90,8 @@ It passes most of the CommonMark tests. Most of the tests that don't pass deal w
**Who uses it?** **Who uses it?**
[Laravel Framework](https://laravel.com/), [Bolt CMS](http://bolt.cm/), [Grav CMS](http://getgrav.org/), [Herbie CMS](http://www.getherbie.org/), [Kirby CMS](http://getkirby.com/), [October CMS](http://octobercms.com/), [Pico CMS](http://picocms.org), [Statamic CMS](http://www.statamic.com/), [phpDocumentor](http://www.phpdoc.org/), [RaspberryPi.org](http://www.raspberrypi.org/), [Symfony Demo](https://github.com/symfony/demo) and [more](https://packagist.org/packages/erusev/parsedown/dependents). [Laravel Framework](https://laravel.com/), [Bolt CMS](http://bolt.cm/), [Grav CMS](http://getgrav.org/), [Herbie CMS](http://www.getherbie.org/), [Kirby CMS](http://getkirby.com/), [October CMS](http://octobercms.com/), [Pico CMS](http://picocms.org), [Statamic CMS](http://www.statamic.com/), [phpDocumentor](http://www.phpdoc.org/), [RaspberryPi.org](http://www.raspberrypi.org/), [Symfony demo](https://github.com/symfony/symfony-demo) and [more](https://packagist.org/packages/erusev/parsedown/dependents).
**How can I help?** **How can I help?**
Use it, star it, share it and if you feel generous, [donate](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=528P3NZQMP8N2). Use it, star it, share it and if you feel generous, [donate](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=528P3NZQMP8N2).
**What else should I know?**
I also make [Nota](https://nota.md/) — a writing app designed for Markdown files :)

View File

@ -16,3 +16,5 @@ still a fenced code block</code></pre>
bar</code></pre> bar</code></pre>
<pre><code class="language-php">&lt;?php
echo "Hello World";</code></pre>

View File

@ -36,3 +36,8 @@ foo
bar bar
``` ```
```php some-class
<?php
echo "Hello World";
```