Lines 27-39
use HTML::Scrubber;
Link Here
|
27 |
use C4::Context; |
27 |
use C4::Context; |
28 |
|
28 |
|
29 |
my %scrubbertypes = ( |
29 |
my %scrubbertypes = ( |
30 |
default => {}, # place holder, default settings are below as fallbacks in call to constructor |
30 |
default => {}, # place holder, default settings are below as fallbacks in call to constructor |
31 |
comment => { allow => [qw( br b i em big small strong )], }, |
31 |
comment => { allow => [qw( br b i em big small strong )], }, |
32 |
note => { allow => [qw[ br b i em big small strong u hr span div p ]] }, |
32 |
note => { allow => [qw[ br b i em big small strong u hr span div p ]] }, |
|
|
33 |
record_display => { |
34 |
deny => [ |
35 |
qw( script noscript style iframe frame frameset noframes object embed applet meta link base head title body html canvas audio video source track) |
36 |
], |
37 |
default => [ 1 => { '*' => 1 } ], |
38 |
rules => [ |
39 |
'*' => { |
40 |
|
41 |
# Scrub all of the "on" event handlers in attributes |
42 |
onclick => 0, |
43 |
ondblclick => 0, |
44 |
onmousedown => 0, |
45 |
onmouseup => 0, |
46 |
onmouseover => 0, |
47 |
onmousemove => 0, |
48 |
onmouseout => 0, |
49 |
onkeypress => 0, |
50 |
onkeydown => 0, |
51 |
onkeyup => 0, |
52 |
onload => 0, |
53 |
onunload => 0, |
54 |
onfocus => 0, |
55 |
onblur => 0, |
56 |
onchange => 0, |
57 |
onselect => 0, |
58 |
onsubmit => 0, |
59 |
onreset => 0, |
60 |
onresize => 0, |
61 |
onscroll => 0, |
62 |
onerror => 0, |
63 |
onabort => 0, |
64 |
ondragstart => 0, |
65 |
ondrag => 0, |
66 |
ondragend => 0, |
67 |
ondrop => 0, |
68 |
ondragover => 0, |
69 |
ondragenter => 0, |
70 |
ondragleave => 0, |
71 |
oncontextmenu => 0, |
72 |
onwheel => 0, |
73 |
ontouchstart => 0, |
74 |
ontouchend => 0, |
75 |
ontouchmove => 0, |
76 |
ontouchcancel => 0, |
77 |
|
78 |
#Scrub formaction |
79 |
formaction => 0, |
80 |
|
81 |
# Block dangerous URLs in href/src |
82 |
href => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i, |
83 |
src => qr{^(?!javascript:|data:(?!image/)|vbscript:|file:|about:)}i, |
84 |
|
85 |
# Block dangerous XML/XLink attributes |
86 |
'xmlns:xlink' => 0, |
87 |
'xlink:href' => 0, |
88 |
}, |
89 |
], |
90 |
}, |
33 |
); |
91 |
); |
34 |
|
92 |
|
35 |
sub new { |
93 |
sub new { |
36 |
shift; # ignore our class we are wrapper |
94 |
shift; # ignore our class we are wrapper |
37 |
my $type = (@_) ? shift : 'default'; |
95 |
my $type = (@_) ? shift : 'default'; |
38 |
if ( !exists $scrubbertypes{$type} ) { |
96 |
if ( !exists $scrubbertypes{$type} ) { |
39 |
croak "New called with unrecognized type '$type'"; |
97 |
croak "New called with unrecognized type '$type'"; |