Server geändert
This commit is contained in:
@ -3,6 +3,6 @@ HTML.AllowedElements = b,i,p,a
|
||||
HTML.AllowedAttributes = a.href,*.id
|
||||
--HTML--
|
||||
<p>Par.</p>
|
||||
<p>Para<a href="http://google.com/">gr</a>aph</p>
|
||||
<p>Para<a href="https://google.com/">gr</a>aph</p>
|
||||
Text<b>Bol<i>d</i></b>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -2,5 +2,5 @@
|
||||
HTML.SafeObject = true
|
||||
Output.FlashCompat = true
|
||||
--HTML--
|
||||
<object width="425" height="350" data="http://www.youtube.com/v/BdU--T8rLns" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/BdU--T8rLns" /><param name="wmode" value="window" /></object>
|
||||
<object width="425" height="350" data="https://www.youtube.com/v/BdU--T8rLns" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="https://www.youtube.com/v/BdU--T8rLns" /><param name="wmode" value="window" /></object>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -5,8 +5,8 @@ URI.Munge = "/redirect?s=%s&t=%t&r=%r&n=%n&m=%m&p=%p"
|
||||
URI.MungeSecretKey = "foo"
|
||||
URI.MungeResources = true
|
||||
--HTML--
|
||||
<a href="http://example.com">Link</a>
|
||||
<img src="http://example.com" style="background-image:url(http://example.com);" alt="example.com" />
|
||||
<a href="https://example.com">Link</a>
|
||||
<img src="https://example.com" style="background-image:url(https://example.com);" alt="example.com" />
|
||||
--EXPECT--
|
||||
<a href="/redirect?s=http%3A%2F%2Fexample.com&t=c763c4a30204eee8470a3292e0f0cd91a639654d039d45f1495a50207847e954&r=&n=a&m=href&p=">Link</a>
|
||||
<img src="/redirect?s=http%3A%2F%2Fexample.com&t=c763c4a30204eee8470a3292e0f0cd91a639654d039d45f1495a50207847e954&r=1&n=img&m=src&p=" style="background-image:url("/redirect?s=http%3A%2F%2Fexample.com&t=c763c4a30204eee8470a3292e0f0cd91a639654d039d45f1495a50207847e954&r=1&n=img&m=style&p=background-image");" alt="example.com" />
|
||||
|
@ -8,11 +8,11 @@ URI.AllowedSchemes = http,ftp,file
|
||||
<a href="///google.com">foo</a>
|
||||
<a href="////google.com">foo</a>
|
||||
|
||||
<a href="http:google.com">foo</a>
|
||||
<a href="http:/google.com">foo</a>
|
||||
<a href="http://google.com">foo</a>
|
||||
<a href="http:///google.com">foo</a>
|
||||
<a href="http:////google.com">foo</a>
|
||||
<a href="https:google.com">foo</a>
|
||||
<a href="https:/google.com">foo</a>
|
||||
<a href="https://google.com">foo</a>
|
||||
<a href="https:///google.com">foo</a>
|
||||
<a href="https:////google.com">foo</a>
|
||||
|
||||
<a href="ftp:google.com">foo</a>
|
||||
<a href="ftp:/google.com">foo</a>
|
||||
|
@ -1,8 +1,8 @@
|
||||
--INI--
|
||||
HTML.SafeIframe = true
|
||||
URI.SafeIframeRegexp = "%^http://maps.google.com/%"
|
||||
URI.SafeIframeRegexp = "%^https://maps.google.com/%"
|
||||
--HTML--
|
||||
<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="http://maps.google.com/?ie=UTF8&ll=37.0625,-95.677068&spn=24.455808,37.353516&z=4&output=embed"></iframe>
|
||||
<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="https://maps.google.com/?ie=UTF8&ll=37.0625,-95.677068&spn=24.455808,37.353516&z=4&output=embed"></iframe>
|
||||
--EXPECT--
|
||||
<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="http://maps.google.com/?ie=UTF8&ll=37.0625,-95.677068&spn=24.455808,37.353516&z=4&output=embed"></iframe>
|
||||
<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="https://maps.google.com/?ie=UTF8&ll=37.0625,-95.677068&spn=24.455808,37.353516&z=4&output=embed"></iframe>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -1,7 +1,7 @@
|
||||
--INI--
|
||||
HTML.SafeIframe = true
|
||||
--HTML--
|
||||
<iframe src="http://www.example.com/"></iframe>
|
||||
<iframe src="https://www.example.com/"></iframe>
|
||||
--EXPECT--
|
||||
<iframe></iframe>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -1,8 +1,8 @@
|
||||
--INI--
|
||||
HTML.SafeIframe = true
|
||||
URI.SafeIframeRegexp = "%^http://www.youtube.com/embed/%"
|
||||
URI.SafeIframeRegexp = "%^https://www.youtube.com/embed/%"
|
||||
--HTML--
|
||||
<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen></iframe>
|
||||
<iframe title="YouTube video player" width="480" height="390" src="https://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen></iframe>
|
||||
--EXPECT--
|
||||
<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0"></iframe>
|
||||
<iframe title="YouTube video player" width="480" height="390" src="https://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0"></iframe>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -1,14 +1,14 @@
|
||||
--INI--
|
||||
HTML.SafeIframe = true
|
||||
URI.SafeIframeRegexp = "%(^http://www.example.com/|^https?://dev.example.com/)%"
|
||||
URI.SafeIframeRegexp = "%(^https://www.example.com/|^https?://dev.example.com/)%"
|
||||
--HTML--
|
||||
<iframe src="http://www.example.com/"></iframe>
|
||||
<iframe src="http://malicious.host.com/?http://www.example.com/"></iframe>
|
||||
<iframe src="http://dev.example.com/"></iframe>
|
||||
<iframe src="https://www.example.com/"></iframe>
|
||||
<iframe src="https://malicious.host.com/?https://www.example.com/"></iframe>
|
||||
<iframe src="https://dev.example.com/"></iframe>
|
||||
<iframe src="https://dev.example.com/"></iframe>
|
||||
--EXPECT--
|
||||
<iframe src="http://www.example.com/"></iframe>
|
||||
<iframe src="https://www.example.com/"></iframe>
|
||||
<iframe></iframe>
|
||||
<iframe src="http://dev.example.com/"></iframe>
|
||||
<iframe src="https://dev.example.com/"></iframe>
|
||||
<iframe src="https://dev.example.com/"></iframe>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -6,7 +6,7 @@ HTML.SafeEmbed = true
|
||||
URI.Munge = "/redirect.php?url=%s&check=%t"
|
||||
URI.MungeSecretKey = "foo"
|
||||
--HTML--
|
||||
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
|
||||
<object width="425" height="344"><param name="movie" value="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
|
||||
--EXPECT--
|
||||
<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
|
||||
<object width="425" height="344" data="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -2,7 +2,7 @@
|
||||
HTML.SafeObject = true
|
||||
HTML.SafeEmbed = true
|
||||
--HTML--
|
||||
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
|
||||
<object width="425" height="344"><param name="movie" value="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
|
||||
--EXPECT--
|
||||
<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
|
||||
<object width="425" height="344" data="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="https://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
|
||||
--# vim: et sw=4 sts=4
|
||||
|
@ -4,9 +4,9 @@ return !function_exists('hash_hmac');
|
||||
URI.Munge = "/redirect.php?url=%s&check=%t"
|
||||
URI.MungeSecretKey = "foo"
|
||||
--HTML--
|
||||
<a href="http://localhost">foo</a>
|
||||
<img src="http://localhost" alt="local" />
|
||||
<a href="https://localhost">foo</a>
|
||||
<img src="https://localhost" alt="local" />
|
||||
--EXPECT--
|
||||
<a href="/redirect.php?url=http%3A%2F%2Flocalhost&check=c0efad89696082f5cb925d28636b0f4260f346391c92c70c8e9eba72591c2a73">foo</a>
|
||||
<img src="http://localhost" alt="local" />
|
||||
<img src="https://localhost" alt="local" />
|
||||
--# vim: et sw=4 sts=4
|
||||
|
Reference in New Issue
Block a user