web commit by JoshTriplett

[git.ikiwiki.info.git] / doc / plugins / htmlscrubber.mdwn

diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn
index a064c49012ecc5bd754aab82d19c9ff975870838..7962b3b52f9b7b667f1dc5a3f67d53e19ca5b10c 100644 (file)
--- a/doc/plugins/htmlscrubber.mdwn
+++ b/doc/plugins/htmlscrubber.mdwn
@@ -1,6 +1,5 @@
-[[template id=plugin name=htmlscrubber core=1 included=1
-author="[[Joey]]"]]
-[[tag type/html type/core]]
+[[template id=plugin name=htmlscrubber core=1 author="[[Joey]]"]]
+[[tag type/html]]

 
 This plugin is enabled by default. It sanitizes the html on pages it renders
 to avoid XSS attacks and the like.
 
 This plugin is enabled by default. It sanitizes the html on pages it renders
 to avoid XSS attacks and the like.


@@ -18,17 +17,22 @@ While I believe that this makes ikiwiki as resistant to malicious html
 content as anything else on the web, I cannot guarantee that it will
 actually protect every user of every browser from every browser security
 hole, badly designed feature, etc. I can provide NO WARRANTY, like it says
 content as anything else on the web, I cannot guarantee that it will
 actually protect every user of every browser from every browser security
 hole, badly designed feature, etc. I can provide NO WARRANTY, like it says

-in ikiwiki's [GPL](GPL) license. 
+in ikiwiki's [[GPL]] license. 

 
 The web's security model is *fundamentally broken*; ikiwiki's html
 sanitisation is only a patch on the underlying gaping hole that is your web
 browser.
 
 
 The web's security model is *fundamentally broken*; ikiwiki's html
 sanitisation is only a patch on the underlying gaping hole that is your web
 browser.
 

+Note that enabling or disabling the htmlscrubber plugin also affects some other
+HTML-related functionality, such as whether [[meta]] allows potentially unsafe
+HTML tags.
+

 ----
 
 Some examples of embedded javascript that won't be let through when this
 plugin is active:
 
 ----
 
 Some examples of embedded javascript that won't be let through when this
 plugin is active:
 

-* <span style="background: url(javascript:window.location='http://example.org/')">test</span>
-* <span style="&#x61;&#x6e;&#x79;&#x3a;&#x20;&#x65;&#x78;&#x70;&#x72;&#x65;&#x73;&#x73;&#x69;&#x6f;&#x6e;&#x28;&#x77;&#x69;&#x6e;&#x64;&#x6f;&#x77;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x74;&#x69;&#x6f;&#x6e;&#x3d;&#x27;&#x68;&#x74;&#x74;&#x70;&#x3a;&#x2f;&#x2f;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x6f;&#x72;&#x67;&#x2f;&#x27;&#x29;">test</span>
-* <span style="&#97;&#110;&#121;&#58;&#32;&#101;&#120;&#112;&#114;&#101;&#115;&#115;&#105;&#111;&#110;&#40;&#119;&#105;&#110;&#100;&#111;&#119;&#46;&#108;&#111;&#99;&#97;&#116;&#105;&#111;&#110;&#61;&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#101;&#120;&#97;&#109;&#112;&#108;&#101;&#46;&#111;&#114;&#103;&#47;&#39;&#41;">test</span>
+* script tag test <script>window.location='http://example.org';</script>
+* <span style="background: url(javascript:window.location='http://example.org/')">CSS script test</span>
+* <span style="&#x61;&#x6e;&#x79;&#x3a;&#x20;&#x65;&#x78;&#x70;&#x72;&#x65;&#x73;&#x73;&#x69;&#x6f;&#x6e;&#x28;&#x77;&#x69;&#x6e;&#x64;&#x6f;&#x77;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x74;&#x69;&#x6f;&#x6e;&#x3d;&#x27;&#x68;&#x74;&#x74;&#x70;&#x3a;&#x2f;&#x2f;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x6f;&#x72;&#x67;&#x2f;&#x27;&#x29;">entity-encoded CSS script test</span>
+* <span style="&#97;&#110;&#121;&#58;&#32;&#101;&#120;&#112;&#114;&#101;&#115;&#115;&#105;&#111;&#110;&#40;&#119;&#105;&#110;&#100;&#111;&#119;&#46;&#108;&#111;&#99;&#97;&#116;&#105;&#111;&#110;&#61;&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#101;&#120;&#97;&#109;&#112;&#108;&#101;&#46;&#111;&#114;&#103;&#47;&#39;&#41;">entity-encoded CSS script test</span>