StarMirror/blackfriday
1
0
Fork 0
mirror of https://github.com/russross/blackfriday.git synced 2024-03-22 13:40:34 +08:00
Code Issues Projects Releases Wiki Activity
364 Commits 8 Branches 14 Tags 3.7 MiB
05a79218ed
Commit Graph

364 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Graham Miller
d71c759108 add HTML_NOFOLLOW_LINKS 2014-02-25 09:21:57 -05:00
Vytautas Šaltenis
e5937643a9 Fix bug in autolink with trailing semicolon 
In case the link ends with escaped html entity, the semicolon is a part
of the link and should not be interpreted as punctuation.
 2014-02-17 21:09:04 +02:00
Vytautas Šaltenis
b0bdfbec4c Fix bug in autolink overescaping html entities 
If autolink encounters a link which already has an escaped html entity,
it would escape the ampersand again, producing things like these:
    &  --> &
    " --> "
This commit solves that by first looking for all entity-looking things
in the link and copying those ranges verbatim, only considering the rest
of the string for escaping.
Doesn't seem to have considerable performance impact.
The mailto: links are processed the old way.
 2014-02-17 21:09:04 +02:00
Vytautas Šaltenis
cc0d56d092 Extract a chain of ifs into separate func 
This gives a ~10% slowdown of a full test run, which is tolerable.
Switch statement is still slightly slower (~5%). Using map turned out to
be unacceptably slow (~3x slowdown).
 2014-02-17 21:09:04 +02:00
Vytautas Šaltenis
84ee8e62f6 Add a note about JavaScript injections to README 2014-02-17 21:09:03 +02:00
Vytautas Šaltenis
31a96c6ce7 go fmt 2014-02-17 21:09:03 +02:00
Vytautas Šaltenis
f2d43f69a4 Fix bug in autolink termination 
Detect the end of link when it is immediately followed by an element.
 2014-02-17 21:09:03 +02:00
Vytautas Šaltenis
9fc8c9d866 Fix bug with overzealous autolink processing 
When the source Markdown contains an anchor tag with URL as link text
(i.e. <a href=...>http://foo.bar</a>), autolink converts that link text
into another anchor tag, which is nonsense. Detect this situation with
regexp and early exit autolink processing.
 2014-02-17 21:09:03 +02:00
Vytautas Šaltenis
2f50a53f8e Rename HTML_SKIP_SCRIPT to HTML_SANITIZE_OUTPUT 2014-01-22 01:23:43 +02:00
Vytautas Šaltenis
55cd82008e Rewrite protection against JavaScript injection 
This drops the naive approach at <script> tag stripping and resorts to
full sanitization of html. The general idea (and the regexps) is grabbed
from Stack Exchange's PageDown JavaScript Markdown processor[1]. Like in
PageDown, it's implemented as a separate pass over resulting html.

Includes a metric ton (but not all) of test cases from here[2]. Several
are commented out since they don't pass yet.

Stronger (but still incomplete) fix for #11.

[1] http://code.google.com/p/pagedown/wiki/PageDown
[2] https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
 2014-01-22 01:14:35 +02:00
Vytautas Šaltenis
e02c392dc6 Extract useful code to separate func 2014-01-22 00:45:43 +02:00
Vytautas Šaltenis
5405274d99 Merge pull request #44 from FreakyDazio/safe-relatives 
Relative URIs are considered safe
 2014-01-08 11:51:13 -08:00
Vytautas Šaltenis
0c38d23ca2 Merge pull request #43 from microcosm-cc/master 
Cells in THEAD > TR are now TH.
 2014-01-08 11:46:30 -08:00
Darren Coxall
607ec21435 Tests for links when using HTML_SAFELINK 2013-12-19 10:00:47 +00:00
Darren Coxall
59358adea8 Relative URIs are considered safe 2013-12-09 14:41:37 +00:00
Russ Ross
d0e587acc8 Change GOROOT references to GOPATH in README 2013-11-21 08:47:41 -07:00
David Kitchen
5b954f1f77 Updated tests to check for th tags instead of td tags within thead blocks 2013-10-17 10:35:44 +01:00
David Kitchen
6e6572e913 Added th to table headers so that styling with things like Twitter Bootstrap and typeset.css work as expected. Cells in headers should always be TH unless they are advisory cells within headers in which case TD is acceptable (but being Markdown a user with such needs could just enter HTML for this) 2013-10-16 11:36:33 +01:00
Russ Ross
48d1f9d9cc fix smartypants to pass single backticks through, issue #38 2013-10-01 13:55:34 -06:00
athom
4c11f72496 allow \~ to escape as ~ 2013-10-01 16:14:04 +08:00
Russ Ross
ca82b8db3a panic fix (issue #33) with test case 2013-09-11 12:47:43 -06:00
Lancee
472fe3a756 Merge pull request #32 from bertzzie/master 
Enable Parsing Inside a Link
 2013-09-08 23:16:18 -07:00
Alex Xandra Albert Sim
e250348279 Image inside a link now works. 2013-09-09 12:51:46 +07:00
Alex Xandra Albert Sim
da8f2753e2 Added test for link inside image 2013-09-09 12:51:20 +07:00
Vytautas Šaltenis
3f24fadb28 Merge pull request #31 from aybabtme/patch-1 
Fix typo.
 2013-09-01 11:56:32 -07:00
Antoine Grondin
bd3e6c9492 Fix typo. 2013-09-01 10:59:06 -07:00
Russ Ross
d4bdd8db21 update license language to match OSI 2013-08-14 07:43:17 -06:00
Vytautas Šaltenis
8395200adf Merge pull request #29 from athom/master 
add EXTENSION_NO_EMPTY_LINE_BEFORE_BLOCK flag to make it closer to GFM
 2013-08-10 13:13:13 -07:00
athom
31798e0eab add testcase for GFM autolink 2013-08-09 17:24:26 +08:00
athom
16c09b01bd make autolink peforms like GFM 2013-08-09 16:28:35 +08:00
athom
8751c35d1a add EXTENSION_NO_EMPTY_LINE_BEFORE_BLOCK flag to make it closer to GFM(Github flavor Markdown) 2013-07-30 10:32:11 +08:00
Vytautas Šaltenis
264c82ed4b Merge pull request #27 from moshee/master 
Footnotes (addresses #14)
 2013-07-08 23:03:42 -07:00
moshee
3ea84a5811 parser no longer returns prematurely from empty footnote ref 2013-07-08 22:34:12 +00:00
moshee
4513607d62 leftover debug stuff 2013-07-08 09:42:29 +00:00
moshee
1a73bae554 added slice bounds check 2013-07-08 06:54:25 +00:00
moshee
c23099e5ee Implementation and some tests for inline footnotes. Also I noticed the list items had the wrong ids, that was silly of me. 2013-07-01 01:37:52 +00:00
moshee
8346559a1a Referenced footnotes appear to be functional. Inline still unimplemented. 2013-06-26 16:09:27 +00:00
moshee
7bdb82c53a new tests pass but old tests now fail... 2013-06-26 15:57:51 +00:00
moshee
be082a1ef2 First attempt at supporting Pandoc-style footnotes. The existing tests have not broken but the new functionality does not work yet. 2013-06-25 01:18:47 +00:00
Vytautas Šaltenis
2336fd3109 Merge pull request #22 from rtfb/master 
Add some protection against script injection
 2013-05-21 13:19:17 -07:00
Russ Ross
015b0af435 Merge pull request #24 from subosito/sample-fixes 
Fix table syntax example on README
 2013-05-20 15:15:38 -07:00
Alif Rachmawadi
227e2c0094 fix table syntax example 2013-05-05 10:35:09 +07:00
Vytautas Šaltenis
8226238289 Improve html element stripping code 2013-04-18 03:15:47 +03:00
Vytautas Šaltenis
079a55851d Fix typo 2013-04-14 01:44:18 +03:00
Vytautas Šaltenis
375cae5dbe Add HTML_SKIP_SCRIPT to MarkdownCommon 2013-04-14 01:43:21 +03:00
Vytautas Šaltenis
85e2207cd0 Couple more tests 2013-04-14 01:42:47 +03:00
Vytautas Šaltenis
dcaaa9b5dc More <script> stripping 
Partially addresses issue #11.
 2013-04-13 23:24:30 +03:00
Vytautas Šaltenis
fb923cdb78 Add an option to strip <script> elements 
Partially addresses issue #11.
 2013-04-13 22:57:16 +03:00
Vytautas Šaltenis
b79e720a36 Make isHtmlTag() case insensitive 2013-04-13 22:34:37 +03:00
Vytautas Šaltenis
a2fda5e98f Extract repetitive code to a func 2013-04-13 22:26:29 +03:00