X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/7f1313c0525570bdd8c660f436bf95ef764fad45..ee1ad53c4c2710aa7ded61bdc56f3a8cce514f22:/doc/plugins/htmlscrubber.mdwn diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn index bc2173890..0aa0ab3c0 100644 --- a/doc/plugins/htmlscrubber.mdwn +++ b/doc/plugins/htmlscrubber.mdwn @@ -1,3 +1,6 @@ +[[template id=plugin name=htmlscrubber core=1 author="[[Joey]]"]] +[[tag type/html]] + This plugin is enabled by default. It sanitizes the html on pages it renders to avoid XSS attacks and the like. @@ -6,7 +9,7 @@ whitelisted using the same lists as used by Mark Pilgrim's Universal Feed Parser, documented at . Notably it strips `style`, `link`, and the `style` attribute. -It uses the HTML::Scrubber perl module to perform its html +It uses the [[cpan HTML::Scrubber]] perl module to perform its html sanitisation, and this perl module also deals with various entity encoding tricks. @@ -14,12 +17,16 @@ While I believe that this makes ikiwiki as resistant to malicious html content as anything else on the web, I cannot guarantee that it will actually protect every user of every browser from every browser security hole, badly designed feature, etc. I can provide NO WARRANTY, like it says -in ikiwiki's [GPL](GPL) license. +in ikiwiki's [[GPL]] license. The web's security model is *fundamentally broken*; ikiwiki's html sanitisation is only a patch on the underlying gaping hole that is your web browser. +Note that enabling or disabling the htmlscrubber plugin also affects some other +HTML-related functionality, such as whether [[meta]] allows potentially unsafe +HTML tags. + ---- Some examples of embedded javascript that won't be let through when this @@ -28,5 +35,3 @@ plugin is active: * test * test * test - -[[tag plugins/type/html plugins/type/core]]