L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-74823 lib: HTMLPurifier upgrade to 4.16.0

Browse Source 
Signed-off-by: Daniel Ziegenberg <[email protected]>
This commit is contained in:
Daniel Ziegenberg
2022-11-17 18:26:28 +01:00
parent be7f6d4834
commit 877ac800cd
21 changed files with 72 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/htmlpurifier/HTMLPurifier.php
+3 -3
View File
@@ -19,7 +19,7 @@
*/
/*
HTML Purifier 4.14.0 - Standards Compliant HTML Filtering
HTML Purifier 4.15.0 - Standards Compliant HTML Filtering
Copyright (C) 2006-2008 Edward Z. Yang
This library is free software; you can redistribute it and/or
@@ -58,12 +58,12 @@ class HTMLPurifier
* Version of HTML Purifier.
* @type string
*/
public $version = '4.14.0';
public $version = '4.15.0';
/**
* Constant with version of HTML Purifier.
*/
const VERSION = '4.14.0';
const VERSION = '4.15.0';
/**
* Global configuration object.
lib/htmlpurifier/HTMLPurifier.safe-includes.php
+1
View File
@@ -101,6 +101,7 @@ require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Nmtokens.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Class.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Color.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/ContentEditable.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/FrameTarget.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/ID.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Pixels.php';
lib/htmlpurifier/HTMLPurifier/AttrDef/HTML/ContentEditable.php
+16
View File
@@ -0,0 +1,16 @@
<?php
class HTMLPurifier_AttrDef_HTML_ContentEditable extends HTMLPurifier_AttrDef
{
public function validate($string, $config, $context)
{
$allowed = array('false');
if ($config->get('HTML.Trusted')) {
$allowed = array('', 'true', 'false');
}
$enum = new HTMLPurifier_AttrDef_Enum($allowed);
return $enum->validate($string, $config, $context);
}
}
lib/htmlpurifier/HTMLPurifier/AttrTransform/NameSync.php
+5
View File
@@ -8,6 +8,11 @@
class HTMLPurifier_AttrTransform_NameSync extends HTMLPurifier_AttrTransform
{
/**
* @type HTMLPurifier_AttrDef_HTML_ID
*/
public $idDef;
public function __construct()
{
$this->idDef = new HTMLPurifier_AttrDef_HTML_ID();
lib/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php
+5
View File
@@ -24,6 +24,11 @@ class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
*/
private $uri;
/**
* @type HTMLPurifier_AttrDef_Enum
*/
public $wmode;
public function __construct()
{
$this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded
lib/htmlpurifier/HTMLPurifier/AttrTypes.php
+1
View File
@@ -41,6 +41,7 @@ class HTMLPurifier_AttrTypes
$this->info['IAlign'] = self::makeEnum('top,middle,bottom,left,right');
$this->info['LAlign'] = self::makeEnum('top,bottom,left,right');
$this->info['FrameTarget'] = new HTMLPurifier_AttrDef_HTML_FrameTarget();
$this->info['ContentEditable'] = new HTMLPurifier_AttrDef_HTML_ContentEditable();
// unimplemented aliases
$this->info['ContentType'] = new HTMLPurifier_AttrDef_Text();
lib/htmlpurifier/HTMLPurifier/ChildDef/List.php
+2
View File
@@ -22,6 +22,8 @@ class HTMLPurifier_ChildDef_List extends HTMLPurifier_ChildDef
// XXX: This whole business with 'wrap' is all a bit unsatisfactory
public $elements = array('li' => true, 'ul' => true, 'ol' => true);
public $whitespace;
/**
* @param array $children
* @param HTMLPurifier_Config $config
lib/htmlpurifier/HTMLPurifier/Config.php
+1 -1
View File
@@ -21,7 +21,7 @@ class HTMLPurifier_Config
* HTML Purifier's version
* @type string
*/
public $version = '4.14.0';
public $version = '4.15.0';
/**
* Whether or not to automatically finalize
lib/htmlpurifier/HTMLPurifier/ElementDef.php
+1 -1
View File
@@ -176,7 +176,7 @@ class HTMLPurifier_ElementDef
if (!empty($def->content_model)) {
$this->content_model =
str_replace("#SUPER", $this->content_model, $def->content_model);
str_replace("#SUPER", (string)$this->content_model, $def->content_model);
$this->child = false;
}
if (!empty($def->content_model_type)) {
lib/htmlpurifier/HTMLPurifier/Encoder.php
+4 -4
View File
@@ -398,8 +398,8 @@ class HTMLPurifier_Encoder
// characters to their true byte-wise ASCII/UTF-8 equivalents.
$str = strtr($str, self::testEncodingSupportsASCII($encoding));
return $str;
} elseif ($encoding === 'iso-8859-1') {
$str = utf8_encode($str);
} elseif ($encoding === 'iso-8859-1' && function_exists('mb_convert_encoding')) {
$str = mb_convert_encoding($str, 'UTF-8', 'ISO-8859-1');
return $str;
}
$bug = HTMLPurifier_Encoder::testIconvTruncateBug();
@@ -450,8 +450,8 @@ class HTMLPurifier_Encoder
// Normal stuff
$str = self::iconv('utf-8', $encoding . '//IGNORE', $str);
return $str;
} elseif ($encoding === 'iso-8859-1') {
$str = utf8_decode($str);
} elseif ($encoding === 'iso-8859-1' && function_exists('mb_convert_encoding')) {
$str = mb_convert_encoding($str, 'ISO-8859-1', 'UTF-8');
return $str;
}
trigger_error('Encoding not supported', E_USER_ERROR);
lib/htmlpurifier/HTMLPurifier/HTMLModule/CommonAttributes.php
+1
View File
@@ -17,6 +17,7 @@ class HTMLPurifier_HTMLModule_CommonAttributes extends HTMLPurifier_HTMLModule
'class' => 'Class',
'id' => 'ID',
'title' => 'CDATA',
'contenteditable' => 'ContentEditable',
),
'Lang' => array(),
'I18N' => array(
lib/htmlpurifier/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
+13 -2
View File
@@ -31,6 +31,16 @@ class HTMLPurifier_Injector_RemoveSpansWithoutAttributes extends HTMLPurifier_In
*/
private $context;
/**
* @type SplObjectStorage
*/
private $markForDeletion;
public function __construct()
{
$this->markForDeletion = new SplObjectStorage();
}
public function prepare($config, $context)
{
$this->attrValidator = new HTMLPurifier_AttrValidator();
@@ -64,7 +74,7 @@ class HTMLPurifier_Injector_RemoveSpansWithoutAttributes extends HTMLPurifier_In
if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') {
// Mark closing span tag for deletion
$current->markForDeletion = true;
$this->markForDeletion->attach($current);
// Delete open span tag
$token = false;
}
@@ -75,7 +85,8 @@ class HTMLPurifier_Injector_RemoveSpansWithoutAttributes extends HTMLPurifier_In
*/
public function handleEnd(&$token)
{
if ($token->markForDeletion) {
if ($this->markForDeletion->contains($token)) {
$this->markForDeletion->detach($token);
$token = false;
}
}
lib/htmlpurifier/HTMLPurifier/Length.php
+1 -1
View File
@@ -78,7 +78,7 @@ class HTMLPurifier_Length
if ($this->n === '0' && $this->unit === false) {
return true;
}
if (!ctype_lower($this->unit)) {
if ($this->unit === false || !ctype_lower($this->unit)) {
$this->unit = strtolower($this->unit);
}
if (!isset(HTMLPurifier_Length::$allowedUnits[$this->unit])) {
lib/htmlpurifier/HTMLPurifier/Lexer.php
+7 -2
View File
@@ -48,6 +48,11 @@ class HTMLPurifier_Lexer
*/
public $tracksLineNumbers = false;
/**
* @type HTMLPurifier_EntityParser
*/
private $_entity_parser;
// -- STATIC ----------------------------------------------------------
/**
@@ -306,8 +311,8 @@ class HTMLPurifier_Lexer
{
// normalize newlines to \n
if ($config->get('Core.NormalizeNewlines')) {
$html = str_replace("\r\n", "\n", $html);
$html = str_replace("\r", "\n", $html);
$html = str_replace("\r\n", "\n", (string)$html);
$html = str_replace("\r", "\n", (string)$html);
}
if ($config->get('HTML.Trusted')) {
lib/htmlpurifier/HTMLPurifier/Lexer/PH5P.php
+1 -1
View File
@@ -4410,7 +4410,7 @@ class HTML5TreeConstructer
foreach ($token['attr'] as $attr) {
if (!$el->hasAttribute($attr['name'])) {
$el->setAttribute($attr['name'], $attr['value']);
$el->setAttribute($attr['name'], (string)$attr['value']);
}
}
lib/htmlpurifier/HTMLPurifier/PropertyListIterator.php
+1
View File
@@ -29,6 +29,7 @@ class HTMLPurifier_PropertyListIterator extends FilterIterator
/**
* @return bool
*/
#[\ReturnTypeWillChange]
public function accept()
{
$key = $this->getInnerIterator()->key();
lib/htmlpurifier/HTMLPurifier/StringHash.php
+1
View File
@@ -20,6 +20,7 @@ class HTMLPurifier_StringHash extends ArrayObject
* @param mixed $index
* @return mixed
*/
#[\ReturnTypeWillChange]
public function offsetGet($index)
{
$this->accessed[$index] = true;
lib/htmlpurifier/HTMLPurifier/URIFilter/HostBlacklist.php
+1 -1
View File
@@ -35,7 +35,7 @@ class HTMLPurifier_URIFilter_HostBlacklist extends HTMLPurifier_URIFilter
public function filter(&$uri, $config, $context)
{
foreach ($this->blacklist as $blacklisted_host_fragment) {
if (strpos($uri->host, $blacklisted_host_fragment) !== false) {
if ($uri->host !== null && strpos($uri->host, $blacklisted_host_fragment) !== false) {
return false;
}
}
lib/htmlpurifier/HTMLPurifier/URIFilter/Munge.php
+5 -5
View File
@@ -100,11 +100,11 @@ class HTMLPurifier_URIFilter_Munge extends HTMLPurifier_URIFilter
$string = $uri->toString();
// always available
$this->replace['%s'] = $string;
$this->replace['%r'] = $context->get('EmbeddedURI', true);
$token = $context->get('CurrentToken', true);
$this->replace['%n'] = $token ? $token->name : null;
$this->replace['%m'] = $context->get('CurrentAttr', true);
$this->replace['%p'] = $context->get('CurrentCSSProperty', true);
$this->replace['%r'] = $context->get('EmbeddedURI', true) ?: '';
$token = $context->get('CurrentToken', true) ?: '';
$this->replace['%n'] = $token ? $token->name : '';
$this->replace['%m'] = $context->get('CurrentAttr', true) ?: '';
$this->replace['%p'] = $context->get('CurrentCSSProperty', true) ?: '';
// not always available
if ($this->secretKey) {
$this->replace['%t'] = hash_hmac("sha256", $string, $this->secretKey);
lib/thirdpartylibs.xml
+1 -1
View File
@@ -73,7 +73,7 @@
<location>htmlpurifier</location>
<name>HTML Purifier</name>
<description>Filters HTML.</description>
<version>4.14.0</version>
<version>4.16.0</version>
<license>LGPL</license>
<licenseversion>2.1+</licenseversion>
<repository>https://github.com/ezyang/htmlpurifier</repository>
lib/upgrade.txt
+1 -1
View File
@@ -2,7 +2,7 @@ This files describes API changes in core libraries and APIs,
information provided here is intended especially for developers.
=== 4.1 ===
* HTMLPurifier has been upgraded to the latest version - 4.14.0
* HTMLPurifier has been upgraded to the latest version - 4.16.0
* A process to deprecate capabilities by flagging them in the access.php by adding a $deprecatedcapabilities variable (an array).
This array will list the deprecated capabilities and a possible replacement. Once we declare the capability as deprecated, a debugging
message will be displayed (in DEBUG_DEVELOPPER mode only) when using the deprecated capability.