public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-15 18:35:57 +00:00
Code Issues Releases Wiki Activity

add prototype simple remover of baaaad tags based on domdocument

Browse Source
This commit is contained in:
Andrew Dolgov
2013-03-19 11:13:57 +04:00
parent 0717e16b3c
commit 254a3f56a9
2 changed files with 36 additions and 729 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
include/functions.php
View File

@@ -2611,18 +2611,48 @@
}
}
//$node = $doc->getElementsByTagName('body')->item(0);
$entries = $xpath->query('//iframe');
foreach ($entries as $entry) {
$entry->setAttribute('sandbox', true);
}
$doc->removeChild($doc->firstChild); //remove doctype
$doc = strip_harmful_tags($doc);
$res = $doc->saveHTML();
$config = array('safe' => 1, 'deny_attribute' => 'style, width, height, class, id', 'comment' => 1, 'cdata' => 1, 'balance' => 0);
$spec = 'img=width,height';
$res = htmLawed($res, $config, $spec);
return $res;
}
function strip_harmful_tags($doc) {
$entries = $doc->getElementsByTagName("*");
$allowed_elements = array('p', 'br', 'div', 'table', 'tr', 'td', 'th',
'ul', 'ol', 'li', 'blockquote', 'span', 'html', 'body', 'a', 'img',
'iframe', 'video', 'audio', 'source');
$disallowed_attributes = array('id', 'style', 'class');
foreach ($entries as $entry) {
if (!in_array($entry->nodeName, $allowed_elements)) {
$entry->parentNode->removeChild($entry);
}
if ($entry->hasAttributes()) {
foreach (iterator_to_array($entry->attributes) as $attr) {
if (strpos($attr->nodeName, 'on') === 0) {
$entry->removeAttributeNode($attr);
}
if (in_array($attr->nodeName, $disallowed_attributes)) {
$entry->removeAttributeNode($attr);
}
}
}
}
return $doc;
}
function check_for_update($link) {
if (CHECK_FOR_NEW_VERSION && $_SESSION['access_level'] >= 10) {
$version_url = "http://tt-rss.org/version.php?ver=" . VERSION .