summaryrefslogtreecommitdiff
path: root/IkiWiki/Plugin/htmlscrubber.pm
blob: 329afde26ceda5835bbe17f47536bc16adb5f40f (plain)
  1. #!/usr/bin/perl
  2. package IkiWiki::Plugin::htmlscrubber;
  3. use warnings;
  4. use strict;
  5. use IkiWiki 2.00;
  6. # This regexp matches urls that are in a known safe scheme.
  7. # Feel free to use it from other plugins.
  8. our $safe_url_regexp;
  9. sub import { #{{{
  10. hook(type => "sanitize", id => "htmlscrubber", call => \&sanitize);
  11. # Only known uri schemes are allowed to avoid all the ways of
  12. # embedding javascrpt.
  13. # List at http://en.wikipedia.org/wiki/URI_scheme
  14. my $uri_schemes=join("|",
  15. # IANA registered schemes
  16. "http", "https", "ftp", "mailto", "file", "telnet", "gopher",
  17. "aaa", "aaas", "acap", "cap", "cid", "crid",
  18. "dav", "dict", "dns", "fax", "go", "h323", "im", "imap",
  19. "ldap", "mid", "news", "nfs", "nntp", "pop", "pres",
  20. "sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
  21. "z39\.50r", "z39\.50s",
  22. # Selected unofficial schemes
  23. "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
  24. "irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
  25. "msnim", "notes", "rsync", "secondlife", "skype", "ssh",
  26. "sftp", "smb", "sms", "snews", "webcal", "ymsgr",
  27. );
  28. # data is a special case. Allow data:image/*, but
  29. # disallow data:text/javascript and everything else.
  30. $safe_url_regexp=qr/^(?:(?:$uri_schemes):|data:image\/|[^:]+$)/i;
  31. } # }}}
  32. sub sanitize (@) { #{{{
  33. my %params=@_;
  34. return scrubber()->scrub($params{content});
  35. } # }}}
  36. my $_scrubber;
  37. sub scrubber { #{{{
  38. return $_scrubber if defined $_scrubber;
  39. eval q{use HTML::Scrubber};
  40. error($@) if $@;
  41. # Lists based on http://feedparser.org/docs/html-sanitization.html
  42. # With html 5 video and audio tags added.
  43. $_scrubber = HTML::Scrubber->new(
  44. allow => [qw{
  45. a abbr acronym address area b big blockquote br br/
  46. button caption center cite code col colgroup dd del
  47. dfn dir div dl dt em fieldset font form h1 h2 h3 h4
  48. h5 h6 hr hr/ i img input ins kbd label legend li map
  49. menu ol optgroup option p p/ pre q s samp select small
  50. span strike strong sub sup table tbody td textarea
  51. tfoot th thead tr tt u ul var
  52. video audio
  53. }],
  54. default => [undef, { (
  55. map { $_ => 1 } qw{
  56. abbr accept accept-charset accesskey
  57. align alt axis border cellpadding cellspacing
  58. char charoff charset checked class
  59. clear cols colspan color compact coords
  60. datetime dir disabled enctype for frame
  61. headers height hreflang hspace id ismap
  62. label lang maxlength media method
  63. multiple name nohref noshade nowrap prompt
  64. readonly rel rev rows rowspan rules scope
  65. selected shape size span start summary
  66. tabindex target title type valign
  67. value vspace width
  68. autoplay loopstart loopend end
  69. playcount controls
  70. } ),
  71. "/" => 1, # emit proper <hr /> XHTML
  72. href => $safe_url_regexp,
  73. src => $safe_url_regexp,
  74. action => $safe_url_regexp,
  75. cite => $safe_url_regexp,
  76. longdesc => $safe_url_regexp,
  77. poster => $safe_url_regexp,
  78. usemap => $safe_url_regexp,
  79. }],
  80. );
  81. return $_scrubber;
  82. } # }}}
  83. 1