|
Lines 27-39
use HTML::Scrubber;
Link Here
|
| 27 |
use C4::Context; |
27 |
use C4::Context; |
| 28 |
|
28 |
|
| 29 |
my %scrubbertypes = ( |
29 |
my %scrubbertypes = ( |
| 30 |
default => {}, # place holder, default settings are below as fallbacks in call to constructor |
30 |
default => {}, # place holder, default settings are below as fallbacks in call to constructor |
| 31 |
comment => { allow => [qw( br b i em big small strong )], }, |
31 |
comment => { allow => [qw( br b i em big small strong )], }, |
| 32 |
note => { allow => [qw[ br b i em big small strong u hr span div p ]] }, |
32 |
note => { allow => [qw[ br b i em big small strong u hr span div p ]] }, |
|
|
33 |
record_display => { |
| 34 |
deny => [ |
| 35 |
qw( script noscript style iframe frame frameset noframes object embed applet meta link base head title body html canvas audio video source track) |
| 36 |
], |
| 37 |
default => [ 1 => { '*' => 1 } ], |
| 38 |
rules => [ |
| 39 |
'*' => { |
| 40 |
|
| 41 |
# Scrub all of the "on" event handlers in attributes |
| 42 |
onclick => 0, |
| 43 |
ondblclick => 0, |
| 44 |
onmousedown => 0, |
| 45 |
onmouseup => 0, |
| 46 |
onmouseover => 0, |
| 47 |
onmousemove => 0, |
| 48 |
onmouseout => 0, |
| 49 |
onkeypress => 0, |
| 50 |
onkeydown => 0, |
| 51 |
onkeyup => 0, |
| 52 |
onload => 0, |
| 53 |
onunload => 0, |
| 54 |
onfocus => 0, |
| 55 |
onblur => 0, |
| 56 |
onchange => 0, |
| 57 |
onselect => 0, |
| 58 |
onsubmit => 0, |
| 59 |
onreset => 0, |
| 60 |
onresize => 0, |
| 61 |
onscroll => 0, |
| 62 |
onerror => 0, |
| 63 |
onabort => 0, |
| 64 |
ondragstart => 0, |
| 65 |
ondrag => 0, |
| 66 |
ondragend => 0, |
| 67 |
ondrop => 0, |
| 68 |
ondragover => 0, |
| 69 |
ondragenter => 0, |
| 70 |
ondragleave => 0, |
| 71 |
oncontextmenu => 0, |
| 72 |
onwheel => 0, |
| 73 |
ontouchstart => 0, |
| 74 |
ontouchend => 0, |
| 75 |
ontouchmove => 0, |
| 76 |
ontouchcancel => 0, |
| 77 |
|
| 78 |
#Scrub formaction |
| 79 |
formaction => 0, |
| 80 |
|
| 81 |
# Block dangerous URLs in href/src |
| 82 |
href => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i, |
| 83 |
src => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i, |
| 84 |
|
| 85 |
# Block dangerous XML/XLink attributes |
| 86 |
'xmlns:xlink' => 0, |
| 87 |
'xlink:href' => 0, |
| 88 |
}, |
| 89 |
], |
| 90 |
}, |
| 33 |
); |
91 |
); |
| 34 |
|
92 |
|
| 35 |
sub new { |
93 |
sub new { |
| 36 |
shift; # ignore our class we are wrapper |
94 |
shift; # ignore our class we are wrapper |
| 37 |
my $type = (@_) ? shift : 'default'; |
95 |
my $type = (@_) ? shift : 'default'; |
| 38 |
if ( !exists $scrubbertypes{$type} ) { |
96 |
if ( !exists $scrubbertypes{$type} ) { |
| 39 |
croak "New called with unrecognized type '$type'"; |
97 |
croak "New called with unrecognized type '$type'"; |