Show all posts by user

Re: Opencart & HTML purifier on AWS EC2 - 2 years ago

Unfortunately, if there isn't already an existing OpenCart plugin for using HTML Purifier, it will probably be quite difficult to integrate it. Your best bet is to pop over to OpenCart support and ask them if anyone has written a plugin of this sort.

by Ambush Commander - Support

Re: " onclick="alert('xss') - 2 years ago

asfd

by Ambush Commander - Test

Re: Why are "figure" and "figcaption" elements not included by default? - 2 years ago

Yes, the problem is that these are HTML5 elements, and no one has stepped up and submitted implementations for the bulk of HTML5.

by Ambush Commander - Support

Re: background-image in style - 2 years ago

find -name HTMLPurifier.php

by Ambush Commander - Support

Re: background-image in style - 2 years ago

Do you have the ability to edit HTML Purifier? Can you have it print out what the input output HTML is?

by Ambush Commander - Support

Re: background-image in style - 2 years ago

OK well if you make all those arrays empty that should put you back on something like the defaults.

by Ambush Commander - Support

Re: background-image in style - 2 years ago

If you post some code I'd be able to better help you. But usually you have some line like $config->set('Foo', 'Bar');; delete all those lines.

by Ambush Commander - Support

Re: background-image in style - 2 years ago

What I am asking is this: if you take your HTML Purifier configuration and delete all the lines involving the config object (i.e. stop setting HTML.Allowed and CSS.AllowedProperties), does your second example still get purified away?

by Ambush Commander - Support

Re: background-image in style - 2 years ago

Ah, but this one is OK with the demo. What if you use the default configuration; is there still a problem?

by Ambush Commander - Support

Re: background-image in style - 2 years ago

I guess the parser doesn't know how to deal with spaces. Would be worth fixing!

by Ambush Commander - Support

Re: background-image in style - 2 years ago

What is the HTML that is failing to purify? Here is a working sample.

by Ambush Commander - Support

Re: Allow meta tags for structured data - 2 years ago

Yeah, pipe syntax is not a thing. But if you just put URI that should be good enough, since all valid numbers are also valid URIs.

by Ambush Commander - Support

Re: Allow meta tags for structured data - 2 years ago

You need to pass the config object to the HTMLPurifier constructor.

by Ambush Commander - Support

Re: Relative Links & HTML.TargetBlank - 2 years ago

I'm not sure. Maybe the best thing to do is fix the ordering the problem, but that might be fragile. Alternately, a new option to unconditionally apply _blank to everything?

by Ambush Commander - Support

Re: Relative Links & HTML.TargetBlank - 2 years ago

Well, if you want to submit your change as a patch, I'd be happy to take that too :)

by Ambush Commander - Support

Re: Relative Links & HTML.TargetBlank - 2 years ago

I guess the trouble is probably the TargetBlank gets applied before we make URLs absolute, so there's an ordering problem. There isn't any way to affect the ordering but you could take library/HTMLPurifier/AttrTransform/TargetBlank.php and make your own version which unconditionally applies the target attribute.

by Ambush Commander - Support

Re: Filter.DynamicImageSize - 2 years ago

%CSS.MaxImgLength should handle it already

by Ambush Commander - General

Re: Filter.DynamicImageSize - 2 years ago

I did a grep through HTML Purifier's entire history, but I did not see any reference to a filter of this name. Are you sure it was called this?

by Ambush Commander - General

Re: How to add rel="noopener noreferrer" in every external anchor tag with target=_blank? - 3 years ago

Well, you don't have to turn on this feature if you want Amazon referrer links to work!

by Ambush Commander - Support

Re: Memory exhausted when parsing large files - 3 years ago

Yes, HTML Purifier is not the most memory friendly software, and there's probably not much non-code changes you could do to improve it. If you can post the HTML, there might just be some quadratic factor in the code that we could identify and fix.

by Ambush Commander - Support

Re: How to add rel="noopener noreferrer" in every external anchor tag with target=_blank? - 3 years ago

That's probably a good idea we should add, conditional on target="_blank" being set.

by Ambush Commander - Support

Re: Multilingual projects: Add array with hosts for isLocal? - 3 years ago

There's no way to do this with the given config options. But it's not too hard to adapt library/HTMLPurifier/AttrTransform/Nofollow.php into the version you need (you could patch it first; but you can also use http://htmlpurifier.org/docs/enduser-customize.html to write your own AttrTransform class, and then register it yourself.)

by Ambush Commander - Support

Re: Can I enable non-html tag in HTMLPurifier.such as "fb:name" - 3 years ago

Take a look at http://htmlpurifier.org/docs/enduser-utf8.html

by Ambush Commander - General

Re: How Can I use css attributes - 3 years ago

HTML Purifier's rule for 'display' doesn't support flex. You'll have to override the CSS (get a copy of CSSDefinition and then override the display definition; look at CSSDefinition.php for ideas).

by Ambush Commander - General

Re: Can I keep the name attribute without having id's? - 3 years ago

Oh oops, the problem is that the id validator is rejecting names with leading underscore. Set %HTML.Attr.Name.UseCDATA to true.

by Ambush Commander - Support

Re: Can I keep the name attribute without having id's? - 3 years ago

Your %HTML.Allowed syntax is not correct; use a pipe to separate values.

by Ambush Commander - Support

Re: Allow dynamically generated base64 encoded SVG image - 3 years ago

Ah! Well that certainly is a lot more specific problem. Not sure I can help about Chrome. If you contribute a patch to make data understand svg I'd be happy to take it.

by Ambush Commander - Support

Re: Allow dynamically generated base64 encoded SVG image - 3 years ago

It should work if you turn on the data scheme (don't modify anything else). Can you post some self-contained code that is filtering out the img?

by Ambush Commander - Support

Re: Its value permitted styles for each tag individually. - 3 years ago

Not in the base library. You'll have to write some code.

by Ambush Commander - General

Re: Updates - 3 years ago

You can subscribe to the mailing list: https://mailman.mit.edu/mailman/listinfo/htmlpurifier

by Ambush Commander - Support