Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and when they are shown.
2026-09-25 21:34:10 +02:00
parent e881ddb458
commit 00e1829f8b
385 changed files with 33174 additions and 12 deletions
@@ -0,0 +1,45 @@
+<?php
+
+/**
+ * Validate all attributes in the tokens.
+ */
+
+class HTMLPurifier_Strategy_ValidateAttributes extends HTMLPurifier_Strategy
+{
+
+    /**
+     * @param HTMLPurifier_Token[] $tokens
+     * @param HTMLPurifier_Config $config
+     * @param HTMLPurifier_Context $context
+     * @return HTMLPurifier_Token[]
+     */
+    public function execute($tokens, $config, $context)
+    {
+        // setup validator
+        $validator = new HTMLPurifier_AttrValidator();
+
+        $token = false;
+        $context->register('CurrentToken', $token);
+
+        foreach ($tokens as $key => $token) {
+
+            // only process tokens that have attributes,
+            //   namely start and empty tags
+            if (!$token instanceof HTMLPurifier_Token_Start && !$token instanceof HTMLPurifier_Token_Empty) {
+                continue;
+            }
+
+            // skip tokens that are armored
+            if (!empty($token->armor['ValidateAttributes'])) {
+                continue;
+            }
+
+            // note that we have no facilities here for removing tokens
+            $validator->validateToken($token, $config, $context);
+        }
+        $context->destroy('CurrentToken');
+        return $tokens;
+    }
+}
+
+// vim: et sw=4 sts=4