MDL-16668 import htmlpurifier 3.1.1 to HEAD
This commit is contained in:
skodak
@@ -0,0 +1,15 @@
|
||||
CSS.MaxImgLength
|
||||
TYPE: string/null
|
||||
DEFAULT: '1200px'
|
||||
VERSION: 3.1.1
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
This parameter sets the maximum allowed length on <code>img</code> tags,
|
||||
effectively the <code>width</code> and <code>height</code> properties.
|
||||
Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is
|
||||
in place to prevent imagecrash attacks, disable with null at your own risk.
|
||||
This directive is similar to %HTML.MaxImgLength, and both should be
|
||||
concurrently edited, although there are
|
||||
subtle differences in the input format (the CSS max is a number with
|
||||
a unit).
|
||||
</p>
|
||||
@@ -0,0 +1,13 @@
|
||||
HTML.MaxImgLength
|
||||
TYPE: int/null
|
||||
DEFAULT: 1200
|
||||
VERSION: 3.1.1
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
This directive controls the maximum number of pixels in the width and
|
||||
height attributes in <code>img</code> tags. This is
|
||||
in place to prevent imagecrash attacks, disable with null at your own risk.
|
||||
This directive is similar to %CSS.MaxImgLength, and both should be
|
||||
concurrently edited, although there are
|
||||
subtle differences in the input format (the HTML max is an integer).
|
||||
</p>
|
||||
@@ -0,0 +1,13 @@
|
||||
HTML.SafeEmbed
|
||||
TYPE: bool
|
||||
VERSION: 3.1.1
|
||||
DEFAULT: false
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
Whether or not to permit embed tags in documents, with a number of extra
|
||||
security features added to prevent script execution. This is similar to
|
||||
what websites like MySpace do to embed tags. Embed is a proprietary
|
||||
element and will cause your website to stop validating. You probably want
|
||||
to enable this with %HTML.SafeObject.
|
||||
<strong>Highly experimental.</strong>
|
||||
</p>
|
||||
@@ -0,0 +1,13 @@
|
||||
HTML.SafeObject
|
||||
TYPE: bool
|
||||
VERSION: 3.1.1
|
||||
DEFAULT: false
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
Whether or not to permit object tags in documents, with a number of extra
|
||||
security features added to prevent script execution. This is similar to
|
||||
what websites like MySpace do to object tags. You may also want to
|
||||
enable %HTML.SafeEmbed for maximum interoperability with Internet Explorer,
|
||||
although embed tags will cause your website to stop validating.
|
||||
<strong>Highly experimental.</strong>
|
||||
</p>
|
||||
@@ -6,7 +6,7 @@ DEFAULT: NULL
|
||||
|
||||
<p>
|
||||
Munges all browsable (usually http, https and ftp)
|
||||
absolute URI's into another URI, usually a URI redirection service.
|
||||
absolute URIs into another URI, usually a URI redirection service.
|
||||
This directive accepts a URI, formatted with a <code>%s</code> where
|
||||
the url-encoded original URI should be inserted (sample:
|
||||
<code>http://www.google.com/url?q=%s</code>).
|
||||
@@ -19,13 +19,64 @@ DEFAULT: NULL
|
||||
Prevent PageRank leaks, while being fairly transparent
|
||||
to users (you may also want to add some client side JavaScript to
|
||||
override the text in the statusbar). <strong>Notice</strong>:
|
||||
Many security experts believe that this form of protection does
|
||||
not deter spam-bots.
|
||||
Many security experts believe that this form of protection does not deter spam-bots.
|
||||
</li>
|
||||
<li>
|
||||
Redirect users to a splash page telling them they are leaving your
|
||||
website. While this is poor usability practice, it is often
|
||||
mandated
|
||||
website. While this is poor usability practice, it is often mandated
|
||||
in corporate environments.
|
||||
</li>
|
||||
</ul>
|
||||
<p>
|
||||
Prior to HTML Purifier 3.1.1, this directive also enabled the munging
|
||||
of browsable external resources, which could break things if your redirection
|
||||
script was a splash page or used <code>meta</code> tags. To revert to
|
||||
previous behavior, please use %URI.MungeResources.
|
||||
</p>
|
||||
<p>
|
||||
You may want to also use %URI.MungeSecretKey along with this directive
|
||||
in order to enforce what URIs your redirector script allows. Open
|
||||
redirector scripts can be a security risk and negatively affect the
|
||||
reputation of your domain name.
|
||||
</p>
|
||||
<p>
|
||||
Starting with HTML Purifier 3.1.1, there is also these substitutions:
|
||||
</p>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Key</th>
|
||||
<th>Description</th>
|
||||
<th>Example <code><a href=""></code></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>%r</td>
|
||||
<td>1 - The URI embeds a resource<br />(blank) - The URI is merely a link</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>%n</td>
|
||||
<td>The name of the tag this URI came from</td>
|
||||
<td>a</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>%m</td>
|
||||
<td>The name of the attribute this URI came from</td>
|
||||
<td>href</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>%p</td>
|
||||
<td>The name of the CSS property this URI came from, or blank if irrelevant</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p>
|
||||
Admittedly, these letters are somewhat arbitrary; the only stipulation
|
||||
was that they couldn't be a through f. r is for resource (I would have preferred
|
||||
e, but you take what you can get), n is for name, m
|
||||
was picked because it came after n (and I couldn't use a), p is for
|
||||
property.
|
||||
</p>
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
URI.MungeResources
|
||||
TYPE: bool
|
||||
VERSION: 3.1.1
|
||||
DEFAULT: false
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
If true, any URI munging directives like %URI.Munge
|
||||
will also apply to embedded resources, such as <code><img src=""></code>.
|
||||
Be careful enabling this directive if you have a redirector script
|
||||
that does not use the <code>Location</code> HTTP header; all of your images
|
||||
and other embedded resources will break.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Warning:</strong> It is strongly advised you use this in conjunction
|
||||
%URI.MungeSecretKey to mitigate the security risk of an open redirector.
|
||||
</p>
|
||||
@@ -0,0 +1,29 @@
|
||||
URI.MungeSecretKey
|
||||
TYPE: string/null
|
||||
VERSION: 3.1.1
|
||||
DEFAULT: NULL
|
||||
--DESCRIPTION--
|
||||
<p>
|
||||
This directive enables secure checksum generation along with %URI.Munge.
|
||||
It should be set to a secure key that is not shared with anyone else.
|
||||
The checksum can be placed in the URI using %t. Use of this checksum
|
||||
affords an additional level of protection by allowing a redirector
|
||||
to check if a URI has passed through HTML Purifier with this line:
|
||||
</p>
|
||||
|
||||
<pre>$checksum === sha1($secret_key . ':' . $url)</pre>
|
||||
|
||||
<p>
|
||||
If the output is TRUE, the redirector script should accept the URI.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Please note that it would still be possible for an attacker to procure
|
||||
secure hashes en-mass by abusing your website's Preview feature or the
|
||||
like, but this service affords an additional level of protection
|
||||
that should be combined with website blacklisting.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Remember this has no effect if %URI.Munge is not on.
|
||||
</p>
|
||||
Reference in New Issue
Block a user