vanilla/htmlawed

A composer wrapper for the htmLawed library to purify & filter HTML. Tested with PHPUnit and PhantomJS!

Monday, April 2, 2018
by tburry
Repository
14 Watchers
23 Stars
62,383 Installations

HTML
4 Dependents
0 Suggesters
6 Forks
0 Open issues
22 Versions
12 % Grown

The README.md

htmLawed

LGPL-3.0 , _(*1)

A composer wrapper for the htmLawed library to purify & filter HTML. Tested with PHPUnit and PhantomJS., _(*2)

Why use htmLawed?

If your website has any user-generated content then you need to worry about cross-site scripting (XSS). htmLawed will take a piece of potentially malicious html and remove the malicious code, leaving the rest of html behind., _(*3)

Beyond the base htmLawed library, this package makes htmLawed a composer package and wraps it in an object so that it can be autoloaded., _(*4)

Installation

htmLawed requres PHP 5.4 or higher, _(*5)

htmLawed is PSR-4 compliant and can be installed using composer. Just add vanilla/htmlawed to your composer.json., _(*6)

"require": {
    "vanilla/htmlawed": "~1.0"
}

Example

echo Htmlawed::filter('

<

h1>Hello world!');
// Outputs: '

Hello world!

'.

echo Htmlawed::filter('<i>nothing to see</i>')
// Outputs: '<i>nothing to see</i>alert("xss")'

Configs and Specs

The htmLawed filter takes two optional parameters: $config and $spec. This library provides sensible defaults to these parameters, but you can override them in Htmlawed::filter()., _(*7)

$xss = "<i>nothing to see ";

// Pass an empty config and spec for no filtering of malicious code.
echo Htmlawed::filter($xss, [], []);
// Outputs: '<i>nothing to see </i>'

// Pass safe=1 to turn on all the safe options.
echo Htmlawed::filter($xss, ['safe' => 1]);
// Outputs: '<i>nothing to see alert("xss")</i>'

// We provide a convenience method that strips all tags that aren't supposed to be in rss feeds.
echo Htmlawed::filterRSS('<html><body>

Hello world!

</body></html>');
// Outputs: '

Hello world!

'

See the htmLawed documentation for the full list of options., _(*8)

Differences in Vanilla's version of Htmlawed

We try and use the most recent version of htmLawed with as few changes as possible so that bug fixes and security releases can be merged from the main project. However, We've made a few changes in the source code., _(*9)

Balance tags (hl_bal) before validating tags (hl_tag). We found some cases where an unbalanced script tag would not get removed and this addresses that issue.
Don't add an extra <div> inside of <blockquote> tags.
Remove naked <span>.
Change indentation from 1 space to 4 spaces.

If the original author of htmLawed wants to make any of these changes upstream please get in contact with support@vanillaforums.com., _(*10)

The Versions

02/04 2018

dev-fix/htmllawed-strip-download

A composer wrapper for the htmLawed library to purify & filter HTML. Tested with PHPUnit and PhantomJS!

library htmlawed

A composer wrapper for the htmLawed library to purify & filter HTML. Tested with PHPUnit and PhantomJS!

vanilla/htmlawed

The README.md

htmLawed

Why use htmLawed?

Installation

Example

Hello world!

Configs and Specs

Hello world!

Hello world!

Differences in Vanilla's version of Htmlawed

The Versions

dev-fix/htmllawed-strip-download

The Requires

The Development Requires

by Todd Burry

dev-master

The Requires

The Development Requires

by Todd Burry

v2.2.4.1

The Requires

The Development Requires

by Todd Burry

dev-feature/travis-php72

The Requires

The Development Requires

by Todd Burry

dev-fix/hhvm

The Requires

The Development Requires

by Todd Burry

v2.2.1.1

The Requires

The Development Requires

by Todd Burry

dev-feature/update-1dot2dot1dot1

The Requires

The Development Requires

by Todd Burry

v2.2.1

The Requires

The Development Requires

by Todd Burry

dev-feature/update-1dot2dot1

The Requires

The Development Requires

by Todd Burry

v2.2.0.1

The Requires

The Development Requires

by Todd Burry

dev-upstream

dev-fix/remove-empty-paragraphs

The Requires

The Development Requires

by Todd Burry

v2.2

The Requires

The Development Requires

by Todd Burry

v2.1.22

The Requires

The Development Requires

by Todd Burry

v1.2.4

The Requires

The Development Requires

by Todd Burry

dev-hotfix/aggressive-span-stripping

The Requires

The Development Requires

by Todd Burry

v1.2.3

The Requires

The Development Requires

by Todd Burry

v1.2.2