1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
|
NAME
HTML::Scrubber - Perl extension for scrubbing/sanitizing html
VERSION
version 0.09
SYNOPSIS
use HTML::Scrubber;
my $scrubber = HTML::Scrubber->new( allow => [ qw[ p b i u hr br ] ] );
print $scrubber->scrub('<p><b>bold</b> <em>missing</em></p>');
# output is: <p><b>bold</b> </p>
# more complex input
my $html = q[
<style type="text/css"> BAD { background: #666; color: #666;} </style>
<script language="javascript"> alert("Hello, I am EVIL!"); </script>
<HR>
a => <a href=1>link </a>
br => <br>
b => <B> bold </B>
u => <U> UNDERLINE </U>
];
print $scrubber->scrub($html);
$scrubber->deny( qw[ p b i u hr br ] );
print $scrubber->scrub($html);
DESCRIPTION
If you wanna "scrub" or "sanitize" html input in a reliable and flexible
fashion, then this module is for you.
I wasn't satisfied with HTML::Sanitizer because it is based on
HTML::TreeBuilder, so I thought I'd write something similar that works
directly with HTML::Parser.
METHODS
First a note on documentation: just study the EXAMPLE below. It's all
the documentation you could need
Also, be sure to read all the comments as well as How does it work?.
If you're new to perl, good luck to you.
comment
warn "comments are ", $p->comment ? 'allowed' : 'not allowed';
$p->comment(0); # off by default
process
warn "process instructions are ", $p->process ? 'allowed' : 'not allowed';
$p->process(0); # off by default
script
warn "script tags (and everything in between) are supressed"
if $p->script; # off by default
$p->script( 0 || 1 );
** Please note that this is implemented using HTML::Parser's
ignore_elements function, so if "script" is set to true, all script tags
encountered will be validated like all other tags.
style
warn "style tags (and everything in between) are supressed"
if $p->style; # off by default
$p->style( 0 || 1 );
** Please note that this is implemented using HTML::Parser's
ignore_elements function, so if "style" is set to true, all style tags
encountered will be validated like all other tags.
allow
$p->allow(qw[ t a g s ]);
deny
$p->deny(qw[ t a g s ]);
rules
$p->rules(
img => {
src => qr{^(?!http://)}i, # only relative image links allowed
alt => 1, # alt attribute allowed
'*' => 0, # deny all other attributes
},
b => 1,
...
);
default
print "default is ", $p->default();
$p->default(1); # allow tags by default
$p->default(
undef, # don't change
{ # default attribute rules
'*' => 1, # allow attributes by default
}
);
scrub_file
$html = $scrubber->scrub_file('foo.html'); ## returns giant string
die "Eeek $!" unless defined $html; ## opening foo.html may have failed
$scrubber->scrub_file('foo.html', 'new.html') or die "Eeek $!";
$scrubber->scrub_file('foo.html', *STDOUT)
or die "Eeek $!"
if fileno STDOUT;
scrub
print $scrubber->scrub($html); ## returns giant string
$scrubber->scrub($html, 'new.html') or die "Eeek $!";
$scrubber->scrub($html', *STDOUT)
or die "Eeek $!"
if fileno STDOUT;
*default* handler, used by both _scrub and _scrub_fh Moved all the
common code (ie all of it) into a single routine for ease of maintenance
*default* handler, does the scrubbing if we're scrubbing out to a file.
Now calls _scrub_str and pushes that out to a file.
*default* handler, does the scrubbing if we're returning a giant string.
Now calls _scrub_str and appends that to the output string.
How does it work?
When a tag is encountered, HTML::Scrubber allows/denies the tag using
the explicit rule if one exists.
If no explicit rule exists, Scrubber applies the default rule.
If an explicit rule exists, but it's a simple rule(1), the default
attribute rule is applied.
EXAMPLE
#!/usr/bin/perl -w
use HTML::Scrubber;
use strict;
my @allow = qw[ br hr b a ];
my @rules = (
script => 0,
img => {
src => qr{^(?!http://)}i, # only relative image links allowed
alt => 1, # alt attribute allowed
'*' => 0, # deny all other attributes
},
);
my @default = (
0 => # default rule, deny all tags
{
'*' => 1, # default rule, allow all attributes
'href' => qr{^(?!(?:java)?script)}i,
'src' => qr{^(?!(?:java)?script)}i,
# If your perl doesn't have qr
# just use a string with length greater than 1
'cite' => '(?i-xsm:^(?!(?:java)?script))',
'language' => 0,
'name' => 1, # could be sneaky, but hey ;)
'onblur' => 0,
'onchange' => 0,
'onclick' => 0,
'ondblclick' => 0,
'onerror' => 0,
'onfocus' => 0,
'onkeydown' => 0,
'onkeypress' => 0,
'onkeyup' => 0,
'onload' => 0,
'onmousedown' => 0,
'onmousemove' => 0,
'onmouseout' => 0,
'onmouseover' => 0,
'onmouseup' => 0,
'onreset' => 0,
'onselect' => 0,
'onsubmit' => 0,
'onunload' => 0,
'src' => 0,
'type' => 0,
}
);
my $scrubber = HTML::Scrubber->new();
$scrubber->allow( @allow );
$scrubber->rules( @rules ); # key/value pairs
$scrubber->default( @default );
$scrubber->comment(1); # 1 allow, 0 deny
## preferred way to create the same object
$scrubber = HTML::Scrubber->new(
allow => \@allow,
rules => \@rules,
default => \@default,
comment => 1,
process => 0,
);
require Data::Dumper,die Data::Dumper::Dumper($scrubber) if @ARGV;
my $it = q[
<?php echo(" EVIL EVIL EVIL "); ?> <!-- asdf -->
<hr>
<I FAKE="attribute" > IN ITALICS WITH FAKE="attribute" </I><br>
<B> IN BOLD </B><br>
<A NAME="evil">
<A HREF="javascript:alert('die die die');">HREF=JAVA <!></A>
<br>
<A HREF="image/bigone.jpg" ONMOUSEOVER="alert('die die die');">
<IMG SRC="image/smallone.jpg" ALT="ONMOUSEOVER JAVASCRIPT">
</A>
</A> <br>
];
print "#original text",$/, $it, $/;
print
"#scrubbed text (default ",
$scrubber->default(), # no arguments returns the current value
" comment ",
$scrubber->comment(),
" process ",
$scrubber->process(),
" )",
$/,
$scrubber->scrub($it),
$/;
$scrubber->default(1); # allow all tags by default
$scrubber->comment(0); # deny comments
print
"#scrubbed text (default ",
$scrubber->default(),
" comment ",
$scrubber->comment(),
" process ",
$scrubber->process(),
" )",
$/,
$scrubber->scrub($it),
$/;
$scrubber->process(1); # allow process instructions (dangerous)
$default[0] = 1; # allow all tags by default
$default[1]->{'*'} = 0; # deny all attributes by default
$scrubber->default(@default); # set the default again
print
"#scrubbed text (default ",
$scrubber->default(),
" comment ",
$scrubber->comment(),
" process ",
$scrubber->process(),
" )",
$/,
$scrubber->scrub($it),
$/;
FUN
If you have Test::Inline (and you've installed HTML::Scrubber), try
pod2test Scrubber.pm >scrubber.t
perl scrubber.t
SEE ALSO
HTML::Parser, Test::Inline, HTML::Sanitizer.
INSTALLATION
See perlmodinstall for information and options on installing Perl
modules.
BUGS AND LIMITATIONS
No bugs have been reported.
Please report any bugs or feature requests through the web interface at
<http://rt.cpan.org/Public/Dist/Display.html?Name=HTML-Scrubber>.
AVAILABILITY
The project homepage is <http://search.cpan.org/dist/HTML-Scrubber>.
The latest version of this module is available from the Comprehensive
Perl Archive Network (CPAN). Visit <http://www.perl.com/CPAN/> to find a
CPAN site near you, or see <http://search.cpan.org/dist/HTML-Scrubber/>.
The development version lives at
<http://github.com/nigelm/html-scrubber> and may be cloned from
<git://github.com/nigelm/html-scrubber.git>. Instead of sending patches,
please fork this project using the standard git and github
infrastructure.
AUTHORS
* Nigel Metheringham <nigelm@cpan.org>
* D. H. <podmaster@cpan.org>
COPYRIGHT AND LICENSE
This software is copyright (c) 2011 by Nigel Metheringham, 2003-2004 D.
H..
This is free software; you can redistribute it and/or modify it under
the same terms as the Perl 5 programming language system itself.
|
