X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/89256ab870299242c2f62858680c4a2870600a14..37bf6114d5aa19180001aedd78fef84e2fd6c103:/doc/plugins/htmlscrubber.mdwn?ds=inline diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn index 7db372e1b..08c81212b 100644 --- a/doc/plugins/htmlscrubber.mdwn +++ b/doc/plugins/htmlscrubber.mdwn @@ -6,12 +6,13 @@ to avoid XSS attacks and the like. It excludes all html tags and attributes except for those that are whitelisted using the same lists as used by Mark Pilgrim's Universal Feed -Parser, documented at . +Parser, documented at +. Notably it strips `style` and `link` tags, and the `style` attribute. -All attributes that can be used to specify an url are checked to make sure -that the url is in a known, safe scheme, and to block embedded javascript -in such urls. +Any attributes that could be used to specify a URL are checked to ensure +that they are known, safe schemes. It will also block embedded javascript +in such URLs. It uses the [[!cpan HTML::Scrubber]] perl module to perform its html sanitisation, and this perl module also deals with various entity encoding @@ -32,10 +33,11 @@ other HTML-related functionality, such as whether [[meta]] allows potentially unsafe HTML tags. The `htmlscrubber_skip` configuration setting can be used to skip scrubbing -of some pages. Set it to a [[PageSpec]], such as "!*/Discussion", and pages -matching that can have all the evil CSS, JavsScript, and unsafe html -elements you like. One safe way to use this is to use [[lockedit]] to lock -those pages, so only admins can edit them. +of some pages. Set it to a [[ikiwiki/PageSpec]], such as +`posts/* and !comment(*) and !*/Discussion`, and pages matching that can have +all the evil CSS, JavsScript, and unsafe html elements you like. One safe +way to use this is to use [[lockedit]] to lock those pages, so only admins +can edit them. ----