Commit Graph

57 Commits

Author SHA1 Message Date
Aidan Woods b1e5aebaf6
add single safeMode option that encompasses protection from link destination xss and plain markup based xss into a single on/off switch 2017-05-09 19:22:58 +01:00
Aidan Woods 054ba3c487
urlencode urls that are potentially unsafe:
this should break urls that attempt to include a protocol, or port (these are absolute URLs and should have a whitelisted protocol for use)
but URLs that are relative, or relative from the site root should be preserved (though characters non essential for the URL structure may be urlencoded)

this approach has significant advantages over attempting to locate something like `javascript:alert(1)` or `javascript:alert(1)` (which are both valid) because browsers have been known to ignore ridiculous characters when encountered (meaning something like `jav\ta\0\0script:alert(1)` would be xss :( ). Instead of trying to chase down a way to interpret a URL to decide whether there is a protocol, this approach ensures that two essential characters needed to achieve a colon are encoded `:` (obviously) and `;` (from `:`). If these characters appear in a relative URL then they are equivalent to their URL encoded form and so this change will be non breaking for that case.
2017-05-03 17:01:27 +01:00
Aidan Woods af04ac92e2
add xss tests 2017-05-01 03:33:49 +01:00
Emanuil Rusev 4367f89a74 attempt to fix failing builds on 5.3 2017-03-29 19:30:24 +03:00
Emanuil Rusev 0a09d5ad45 update tests to reflect changes in phpunit 6.0 2017-03-23 20:21:18 +02:00
gene_sis 48351504de adjust two regex pattern within inlineLink() to reduce backtracking
add test with base64 image
2017-01-07 00:45:38 +01:00
Yoan Blanc bc21988fe5
Fix include from ParsedownTest
I wasn't able to run all the tests from ParsedownExtra because of it.
2016-11-02 09:27:35 +01:00
Aidan Woods 932bafe0f0 update test for new feature 2016-10-04 17:43:37 +01:00
Aidan Woods ac857809ab update test for new feature 2016-10-04 17:41:57 +01:00
Aidan Woods c145a75848 update test for new feature 2016-10-04 15:44:50 +01:00
Haralan Dobrev 5f40cab3e7 Use late static binding for Parsedown::instance()
Fixes erusev/parsedown-extra#67.

This introduces PHP 5.3+ late static binding to the Singleton pattern in Parsedown.
It will return an instance of Parsedown which inherits the class which
called the `instance()` method rather than always returning instance of just `Parsedown`.

Tests are testing this feature with a test class which inherits from Parsedown.
Notice that calling `instance()` with the default arguments after an instance of
`Parsedown` was already created, it will return it even though it is from just
an instance of `Parsedown`. So this is fixing the problem just partially.
2015-08-13 13:29:33 +03:00
Jeff Standen b828fe7c8d Fixes #283 2015-02-03 13:58:47 -08:00
Emanuil Rusev ffd9d3b407 improve tests 2015-01-24 14:37:40 +02:00
Emanuil Rusev e94ecf4adc resolve #277 2015-01-24 14:21:55 +02:00
Emanuil Rusev 4d3079b908 resolve #274 2015-01-24 14:03:05 +02:00
Emanuil Rusev b4a8eb3315 resolve #156 2015-01-16 00:04:18 +02:00
Emanuil Rusev a06cdfb814 improve fix for #184 2015-01-15 21:32:18 +02:00
Emanuil Rusev 6bee326c92 resolve #184 2015-01-15 21:10:09 +02:00
Emanuil Rusev 9ed72ccd09 resolve #126 2015-01-15 02:24:39 +02:00
Emanuil Rusev 859b1b10c1 update tests 2015-01-12 02:57:20 +02:00
Emanuil Rusev 06135cd75a improve CommonMark compliance 2015-01-10 02:45:51 +02:00
Emanuil Rusev 7d3af6bf83 update commonmark test 2015-01-09 00:08:14 +02:00
Emanuil Rusev 38cc1ca7e0 resolve #251 2014-12-16 13:58:33 +02:00
Emanuil Rusev ac68800717 improve extensibility 2014-12-15 01:07:29 +02:00
Emanuil Rusev 1aade35c5e update test 2014-12-15 00:56:22 +02:00
Emanuil Rusev 361febf7c6 improve CommonMark compliance 2014-12-15 00:52:03 +02:00
Emanuil Rusev 4c24e68b42 Merge remote-tracking branch 'origin/commonmark'
Conflicts:
	Parsedown.php
	phpunit.xml.dist
	test/ParsedownTest.php
2014-12-06 02:50:54 +02:00
Emanuil Rusev 094cb88dac update test 2014-12-02 23:53:19 +02:00
Emanuil Rusev 7ab3c60a77 improve CommonMark compliance 2014-12-02 22:23:43 +02:00
Emanuil Rusev 2438c1a43d improve output readability 2014-11-29 23:53:38 +02:00
Emanuil Rusev 46196c1ac3 markup formatting shouldn't impact results 2014-11-29 22:58:42 +02:00
Emanuil Rusev aa3d4d6eb7 simplify 2014-11-29 21:39:42 +02:00
Emanuil Rusev 6fb534bc34 improve consistency 2014-11-29 21:34:46 +02:00
Emanuil Rusev 28a202ee9e simplify 2014-11-29 20:18:23 +02:00
Emanuil Rusev e46be110fb Merge branch 'master' into commonmark 2014-11-29 16:42:04 +02:00
Emanuil Rusev 5bc6d90f8b resolve #248 2014-11-28 14:03:12 +02:00
Emanuil Rusev 9816507a75 markup should preserve empty lines 2014-11-19 20:18:56 +02:00
naNuke 74926c9831 Add test of escaped html comment. 2014-10-10 20:07:41 +02:00
Emanuil Rusev f91e4dece3 improve consistency 2014-09-26 13:06:40 +03:00
Emanuil Rusev c62365adc4 improve extensibility of test case 2014-09-26 02:06:16 +03:00
Emanuil Rusev 59c77e706b improve consistency 2014-09-22 02:36:42 +03:00
Haralan Dobrev 0a3fde3774 Add `noMarkup` option to escape user HTML
Resolves #106.

This change introduces a new option - `noMarkup`. You could set it the
`setNoMarkup()` method similar to the `setBreaksEnabled()` one.

Example usage:

``` php
<?php

$parsedown = new Parsedown();
$parsedown->setNoMarkup(true);
$parsedown->text('<div><strong>*Some text*</strong></div>');

// Outputs:
// <p>&lt;div>&lt;strong><em>Some text</em>&lts;/strong>&lt;/div></p>
```
2014-09-20 14:53:19 +03:00
Haralan Dobrev 42222e6b01 Rename everything to CommonMark 2014-09-14 00:11:18 +03:00
Haralan Dobrev ce4a29aec5 Rename Standard Markdown to CommonMark
http://blog.codinghorror.com/standard-markdown-is-now-common-markdown/

2d37920c39
2014-09-06 01:12:35 +03:00
Haralan Dobrev c18ff7f370 Add Docblock and attribution to JS test runner 2014-09-05 23:28:07 +03:00
Haralan Dobrev 6f1fac9823 Add Standard Markdown testsuite.
You could run the Parsedown testsuite only with:
    phpunit --testsuite ParsedownTests

And you could run the Standard Markdown one with:
    phpunit --testsuite StandardMarkdown

See more at http://standardmarkdown.com/
2014-09-05 23:12:33 +03:00
Jannik Zschiesche 512cc1f065 Limit generated headlines to h6 2014-08-25 21:06:03 +02:00
Haralan Dobrev 1127681d56 Allow slashes in HTML attributes 2014-08-13 23:54:52 +03:00
Emanuil Rusev d24439ada0 improve test suite 2014-05-21 23:20:46 +03:00
Emanuil Rusev 2da10d277b resolve #105 2014-05-14 13:14:49 +03:00