DisplayRemoteLinkURI injector

I've created a new injector named AutoFilter.DisplayRemoteLinkURI and explained at the link below about how to add it. It works like DisplayLinkURI but just for remote URL's. Local URL's stay the same. And I couldn't figure how to use DisableExternal URIFilter inside it, so I wrote a temporary function to check if link is remote or local.

http://stackoverflow.com/a/9804323/1262700

Just wanted to inform you. If it's hacking the core and not allowed, I'd remove that.

It seems basically reasonable. I'm wondering if it should be integrated into the existing code, or should live as a standalone; I think I'd be interested in putting this into the core.

Thank you, some people would need it too, I think. But I still think the remote or local check should be different from what I've applied inside the code. Your code in DisableExternals filter seems more reliable to me.

OK. You're running into something of a bad design decision in HTML Purifier, but what I would suggest is parsing the URI with HTMLPurifier_URI and then invoking the appropriate filter on it. But it's all a bit convoluted.

Yes, I know that'd be a bad design decision if i would cross-cable them. Well, I think the current code would work fine. How much can an URI be complicated, right?

Well, it can be pretty complicated. "What if it's a mailto?" Cross-cabling may be the right thing to do.

Well, using php's parse_url gives the domain even if it is a mailto. And how can a mail be remote or local? It should always be considered as remote in my opinion.

By the heuristic in your code, mail is local (it has no authority segment.) You probably care about whether or not the scheme is browsable or not as well.

yes I just tested and it gives any host information that i expected. And considered as local. I expected the result would be like this :

Array ( "scheme" => "mailto:", "host" => "gmail.com", "username" = "tpaksu" )

But it gives the mail adress as "path". And BTW, "javascript:" href's would be a problem too. What else may happen?

The reason why this is the case is because you only have an authority if you have a // after the scheme. So mailto doesn't, so you go straight to the path.

In general, managing the different schemes is the trickiest part of handling this, which is why I suggest using HTML Purifier's built in stuff. Check out library/HTMLPurifier/AttrTransform/Nofollow.php for an eample.