Handle a few other CSS tricks.
Patch by fu.
diffs (108 lines):
diff -r aa701ad5eac3 -r 67727c33900b cgi-bin/LJ/CleanHTML.pm
--- a/cgi-bin/LJ/CleanHTML.pm Mon Nov 15 12:59:06 2010 +0800
+++ b/cgi-bin/LJ/CleanHTML.pm Mon Nov 15 13:00:49 2010 +0800
@@ -686,6 +686,26 @@ sub clean
if ($remove_positioning) {
$hash->{style} =~ s/margin.*?(?:;|$)//gi;
$hash->{style} =~ s/height\s*?:.*?(?:;|$)//gi;
+ $hash->{style} =~
s/display\s*?:\s*?none\s*?(?:;|$)//gi;
+
+ my $too_large = 0;
+ PADDING: while ( $hash->{style} =~
/padding.*?:\s*?(.*?)(?:;|$)/gi ) {
+ my $padding_value = $1;
+
+ foreach ( split /\s+/, $padding_value ) {
+ next unless $_;
+ if ( ( int( $_ ) || 0 ) > 500 ) {
+ $too_large = 1;
+ last PADDING;
+ }
+ }
+ }
+
+ $hash->{style} =~ s/padding.*?(?:;|$)//gi
+ if $too_large;
+ }
+ if ($extractlinks) {
+ $hash->{style} =~ s/url\(.*?\)//gi;
}
}
diff -r aa701ad5eac3 -r 67727c33900b t/clean-comment.t
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/t/clean-comment.t Mon Nov 15 13:00:49 2010 +0800
@@ -0,0 +1,74 @@
+# -*-perl-*-
+
+use strict;
+use Test::More;
+plan tests => 10;
+
+use lib "$ENV{LJHOME}/cgi-bin";
+require 'ljlib.pl';
+use LJ::CleanHTML;
+
+my $orig_comment;
+my $clean_comment;
+
+my $clean = sub {
+ my $opts = shift;
+
+ LJ::CleanHTML::clean_comment(\$orig_comment, $opts);
+};
+
+# remove various positioning and display rules
+$orig_comment = qq{<span style="display: none; display:none; display : none;
display: inline">};
+$clean_comment = qq{<span style="\\s*display: inline\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~ /^$clean_comment$/, "Removed display:none
($orig_comment)");
+
+$orig_comment = qq{<span style="margin-top: 10px;">};
+$clean_comment = qq{<span style="\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~ /^$clean_comment$/, "Removed margin ($orig_comment)");
+
+$orig_comment = qq{<span style="height: 150px;">};
+$clean_comment = qq{<span style="\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~ /^$clean_comment$/, "Removed height");
+
+# handle unreasonably large padding values
+$orig_comment = qq{<span style="padding-top: 9999999px; padding-left:
9999999px; padding-top: 9999999px; padding-bottom: 9999999px"></span>};
+$clean_comment = qq{<span style="\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~/^$clean_comment$/, "All padding removed. (Multiple rules,
all too large)");
+
+$orig_comment = qq{<span style="padding: 999px 999px 999px 999px"></span>};
+$clean_comment = qq{<span style="\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~/^$clean_comment$/, "All padding removed. (Combined into
one rule, all too large)");
+
+$orig_comment = qq{<span style="padding-left: 999px; padding-right:
200px;"></span>};
+$clean_comment = qq{<span style="\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~/^$clean_comment$/, "All padding removed. (Multiple rules,
mixed too large and small enough)");
+
+$orig_comment = qq{<span style="padding: 999px 200px;"></span>};
+$clean_comment = qq{<span style="\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~/^$clean_comment$/, "All padding removed. (One dimension in
a combined rule, mixed too large and small enough)");
+
+$orig_comment = qq{<span style="padding-top: 200px; padding-left: 200px;
padding-right: 150px; padding-bottom: 150px;"></span>};
+$clean_comment = qq{<span style="\\s*padding-top: 200px;\\s*padding-left:
200px;\\s*padding-right: 150px;\\s*padding-bottom: 150px;\\s*"><\\/span>};
+$clean->({ remove_positioning => 1 });
+ok($orig_comment =~ /^$clean_comment$/, "Padding not removed; of reasonable
size.");
+
+
+# remove background urls from logged out users
+$orig_comment = qq{<span style="background:
url('http://www.example.com/example.gif');"></span>};
+$clean_comment = qq{<span style="\\s*background:
url\\(&\\#39;http://www.example.com/example.gif&\\#39;\\);\\s*"><\\/span>};
+$clean->();
+ok($orig_comment =~ /^$clean_comment$/, "Background URL not cleaned: logged-in
user");
+
+$orig_comment = qq{<span style="background:
url('http://www.example.com/example.gif');"></span>};
+$clean_comment = qq{<span style="background:\\s*;\\s*"><\\/span>};
+$clean->({ anon_comment => 1 });
+ok($orig_comment =~ /^$clean_comment$/, "Background URL removed: anonymous
comment");
+
+1;
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
