X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/4c1a4402f92204abee5a9425e74864825799f5d2..73f4a8835876c8cb07808367cd72d9ae972893e8:/IkiWiki/Plugin/htmlscrubber.pm?ds=sidebyside diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm index bc613f924..a249cdf7a 100644 --- a/IkiWiki/Plugin/htmlscrubber.pm +++ b/IkiWiki/Plugin/htmlscrubber.pm @@ -3,21 +3,71 @@ package IkiWiki::Plugin::htmlscrubber; use warnings; use strict; -use IkiWiki 2.00; +use IkiWiki 3.00; -sub import { #{{{ +# This regexp matches urls that are in a known safe scheme. +# Feel free to use it from other plugins. +our $safe_url_regexp; + +sub import { + hook(type => "getsetup", id => "htmlscrubber", call => \&getsetup); hook(type => "sanitize", id => "htmlscrubber", call => \&sanitize); -} # }}} -sub sanitize (@) { #{{{ + # Only known uri schemes are allowed to avoid all the ways of + # embedding javascrpt. + # List at http://en.wikipedia.org/wiki/URI_scheme + my $uri_schemes=join("|", map quotemeta, + # IANA registered schemes + "http", "https", "ftp", "mailto", "file", "telnet", "gopher", + "aaa", "aaas", "acap", "cap", "cid", "crid", + "dav", "dict", "dns", "fax", "go", "h323", "im", "imap", + "ldap", "mid", "news", "nfs", "nntp", "pop", "pres", + "sip", "sips", "snmp", "tel", "urn", "wais", "xmpp", + "z39.50r", "z39.50s", + # Selected unofficial schemes + "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg", + "irc", "ircs", "lastfm", "ldaps", "magnet", "mms", + "msnim", "notes", "rsync", "secondlife", "skype", "ssh", + "sftp", "smb", "sms", "snews", "webcal", "ymsgr", + ); + # data is a special case. Allow data:image/*, but + # disallow data:text/javascript and everything else. + $safe_url_regexp=qr/^(?:(?:$uri_schemes):|data:image\/|[^:]+(?:$|\/))/i; +} + +sub getsetup () { + return + plugin => { + safe => 1, + rebuild => undef, + }, + htmlscrubber_skip => { + type => "pagespec", + example => "!*/Discussion", + description => "PageSpec specifying pages not to scrub", + link => "ikiwiki/PageSpec", + safe => 1, + rebuild => undef, + }, +} + +sub sanitize (@) { my %params=@_; + + if (exists $config{htmlscrubber_skip} && + length $config{htmlscrubber_skip} && + exists $params{destpage} && + pagespec_match($params{destpage}, $config{htmlscrubber_skip})) { + return $params{content}; + } + return scrubber()->scrub($params{content}); -} # }}} +} my $_scrubber; -sub scrubber { #{{{ +sub scrubber { return $_scrubber if defined $_scrubber; - + eval q{use HTML::Scrubber}; error($@) if $@; # Lists based on http://feedparser.org/docs/html-sanitization.html @@ -35,25 +85,32 @@ sub scrubber { #{{{ }], default => [undef, { ( map { $_ => 1 } qw{ - abbr accept accept-charset accesskey action + abbr accept accept-charset accesskey align alt axis border cellpadding cellspacing - char charoff charset checked cite class + char charoff charset checked class clear cols colspan color compact coords datetime dir disabled enctype for frame - headers height href hreflang hspace id ismap - label lang longdesc maxlength media method + headers height hreflang hspace id ismap + label lang maxlength media method multiple name nohref noshade nowrap prompt readonly rel rev rows rowspan rules scope - selected shape size span src start summary - tabindex target title type usemap valign + selected shape size span start summary + tabindex target title type valign value vspace width - poster autoplay loopstart loopend end + autoplay loopstart loopend end playcount controls } ), "/" => 1, # emit proper