index.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   4 <html
   5   xmlns="http://www.w3.org/1999/xhtml"
   6   xmlns:xi="http://www.w3.org/2001/XInclude"
   7   xmlns:xc="urn:xhtml-compiler"
   8   xmlns:svn="urn:xhtml-compiler:Subversion"
   9   svn:head-url="$HeadURL$"
  10   svn:revision="$Revision$"
  11   xc:rss-from-svn="yes"
  12   xml:lang="en">
  13 <head>
  14 <title>HTML Purifier - Filter your HTML the standards-compliant way!</title>
  15 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
  16 <meta name="description"
  17   content="HTML filter that guards against XSS and ensures standards-compliant output." />
  18 <meta name="keywords"
  19   content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, XSS, PHP, security, library, open source, LGPL, whitelist" />
  20 <!-- See news.xhtml for definition -->
  21 <link rel="alternate" type="application/rss+xml" title="News - HTML Purifier" href="news.rss" />
  22 <script defer="defer" type="text/javascript" src="del.icio.us.js" xc:absolute="src"></script>
  23 <!-- OpenID for Edward Z. Yang -->
  24 <link rel="openid.server" href="https://pip.verisignlabs.com/server" />
  25 <link rel="openid.delegate" href="http://edwardzyang.pip.verisignlabs.com/" />
  26 <!-- Google OpenSearch -->
  27 <link rel="search" href="opensearchdescription.xml"
  28   type="application/opensearchdescription+xml"
  29   title="HTML Purifier" />
  30 </head>
  31 <body>
  32
  33 <div id="branding">
  34   <h1>
  35     <span class="html">HTML</span>
  36     <span class="purifier">Purifier</span>
  37   </h1>
  38   <blockquote>
  39     <p>
  40       Standards-Compliant HTML Filtering
  41     </p>
  42   </blockquote>
  43 </div>
  44
  45 <xi:include href="common-navigation.xml" xpointer="xpointer(/*/node())" />
  46
  47 <div id="content">
  48
  49 <div id="summary">
  50   <h2>Summary</h2>
  51   <div id="summary-safe">
  52     <h3>Safe</h3>
  53     <p>
  54       HTML Purifier defeats XSS with an audited whitelist
  55     </p>
  56   </div>
  57   <div id="summary-clean">
  58     <h3>Clean</h3>
  59     <p>
  60       HTML Purifier ensures standards-compliant output
  61     </p>
  62   </div>
  63   <div id="summary-open">
  64     <h3>Open</h3>
  65     <p>
  66       HTML Purifier is open-source and highly customizable
  67     </p>
  68   </div>
  69 </div>
  70
  71 <div id="intro">
  72   <div class="warning" style="margin-left:0; margin-right:0;">
  73     A security vulnerability was found in versions of HTML Purifier earlier
  74     than 3.1.0 and 2.1.4. <strong>Affected versions include but are not
  75     limited to 3.0.0, 3.1.0rc1 and 2.1.3.</strong>
  76     Although no exploit was found in the wild for this vulnerability, please
  77     update as quickly as possible.
  78   </div>
  79
  80   <p><strong>HTML Purifier</strong> is a standards-compliant
  81   <abbr>HTML</abbr> filter library written in
  82   <abbr>PHP</abbr>. HTML Purifier will not only remove all malicious
  83   code (better known as <abbr>XSS</abbr>) with a thoroughly audited,
  84   secure <em>yet</em> permissive <strong><a
  85   href="live/smoketests/printDefinition.php">whitelist</a></strong>,
  86   it will also make sure your documents are
  87   <strong>standards compliant</strong>, something only achievable with a
  88   comprehensive knowledge of <abbr>W3C</abbr>'s specifications.
  89   Tired of using BBCode due to the current landscape of deficient or
  90   insecure <abbr>HTML</abbr> filters? Have a
  91   <strong><acronym>WYSIWYG</acronym></strong> editor but never been able to use it? Looking
  92   for high-quality, standards-compliant, open-source components for that
  93   application you're building? HTML Purifier is for you!</p>
  94
  95   <blockquote class="fancy">
  96   <div class="quote">
  97       I'd just like to say we use HTML Purifier in <a href="http://www.iris.ac/">IRIS</a> for
  98       filtering emails against XSS attacks and we've been more than impressed.
  99   </div>
 100   <div class="origin">&mdash; Chris Corbyn, <em>Senior IRIS Developer</em></div>
 101   </blockquote>
 102
 103   <xi:include href="download-box.xml" xpointer="xpointer(/*/node())" />
 104
 105 </div>
 106
 107 <h2 id="Background" class="clear">Background</h2>
 108
 109 <p>There are a number of open-source <abbr>HTML</abbr> filtering solutions out
 110 there on the web already
 111 (i.e. <acronym>PEAR</acronym>'s
 112 <a href="http://pear.php.net/package/HTML_Safe">HTML_Safe</a>,
 113 <a href="http://sourceforge.net/projects/kses">kses</a>
 114 and
 115 <a href="http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker">
 116 SafeHtmlChecker.class.php</a>).  What sets HTML Purifier apart from them?
 117 Aren't all of these choices <q>secure</q>?</p>
 118
 119 <p>When it comes to <abbr>HTML</abbr>, <strong>attention to
 120 detail</strong> is key. Does the library demonstrate an in-depth
 121 knowledge of the <abbr>DTD</abbr> that defines
 122 <abbr>HTML</abbr>? Does it perform its filtering off a robust
 123 whitelist rather than a usually out-dated blacklist? Does it go through
 124 the care to check every single attribute in the document for validity?
 125 Does it actually understand tag markup, or pay lip-service with a series
 126 of deficient regexes and str_replace's?</p>
 127
 128 <p>Somewhere along the way, all of HTML Purifier's predecessors fall
 129 flat. HTML_Safe dooms itself to attacks of the future by using a
 130 blacklist. Configurable filters like kses and PHP Input Filter still
 131 cannot validate the contents inside attributes. With all these gaps in
 132 coverage, none of the usual libraries come close to achieving
 133 <strong>standards-compliance</strong>. There is a user-unfriendly,
 134 draconic <abbr>XML</abbr>-based filter called Safe HTML Checker,
 135 but even it forgets that <code>&lt;a&gt;</code> tags cannot be nested
 136 within each other!</p>
 137
 138 <p><strong>Know thy enemy.</strong> Wily hackers have a huge arsenal of
 139 <abbr>XSS</abbr> hidden within the depths of the
 140 <abbr>HTML</abbr> specification. HTML Purifier takes its
 141 effectiveness from the fact that it will decompose the whole document
 142 into tokens, and rigorously process the tokens by removing
 143 non-whitelisted elements, transforming bad practice tags like font into
 144 span, properly checking the nesting of tags and their children and
 145 validating all attributes according to their <abbr>RFC</abbr>s.
 146 HTML Purifier's comprehensive algorithms are complemented by a
 147 <strong>breadth of knowledge</strong>, ensuring that richly formatted
 148 documents pass through unstripped.</p>
 149
 150 <p>To my knowledge, there is nothing else in the wild that offers
 151 protection from <abbr>XSS</abbr>, standards-compliance, and the
 152 corrective processing of poorly formed <abbr>HTML</abbr>
 153 simultaneously. Don't take my word for it though:
 154 do your research. Investigate the other libraries, and decide for
 155 yourself who you would prefer to be the <strong>gatekeeper</strong> to
 156 your system.</p>
 157
 158 <p>To find out more, you can read the
 159 <a href="comparison.html"><strong>Comparison</strong></a>
 160 for a play-by-play analysis of the major filter libraries currently
 161 out there.</p>
 162
 163 <blockquote class="fancy">
 164 <div class="quote">
 165     [Y]ou save my day by allowing me not to write another damned HTML parser.
 166 </div>
 167 <div class="origin">
 168     &mdash; Joseph Halter, <em>Technical Director at Akira Web</em>
 169 </div>
 170 </blockquote>
 171
 172 <h2 id="Plugins">Plugins</h2>
 173
 174 <p>HTML Purifier is a great library to integrate with existing
 175 <abbr>CMS</abbr>es and other applications or <acronym>WYSIWYG</acronym>
 176 editors.  Currently, we have plugins for these applications:</p>
 177
 178 <ul>
 179     <li><a href="http://www.phorum.org/phorum5/read.php?62,127035">Phorum</a> (in use at our very own forums!)</li>
 180     <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/plugins/modx.txt">MODx</a></li>
 181     <li><a href="http://bart.motd.be/projects/html-purifier-drupal-module">Drupal</a> by Bart Jansens</li>
 182     <li><a href="http://urbangiraffe.com/plugins/html-purified/">Wordpress</a> by John Godley</li>
 183     <li><a href="http://extensions.joomla.org/component/option,com_mtree/task,viewlink/link_id,4094/Itemid,35/">Joomla</a> by Double D</li>
 184     <li><a href="http://www.mindloop.be/nieuws/nieuwe-ontwikkelingen/htmlpurifier-and-the-codeigniter-framework">CodeIgniter</a> by Andy Mathijs</li>
 185 </ul>
 186
 187 <p>
 188     <strong>Notice:</strong>
 189     Any plugin provided by a third party has not been vetted by us: use
 190     them at your own risk. If you are having a problem with the plugin,
 191     please consult the plugin author before asking for help here (we'll
 192     be more than happy to help, but it might be a problem with the
 193     plugin rather than HTML Purifier.)
 194 </p>
 195
 196 <blockquote class="fancy">
 197 <div class="quote">
 198     This plugin is on top of my favorite list[.] I am going to heavily
 199     depend on it since my clients insist on having <acronym>WYSIWYG</acronym> and I insist on
 200     having pages that validate and are semantically sound.
 201 </div>
 202 <div class="origin">
 203     &mdash; David Molliere, <em>MODx Marketing &amp; Design Team</em>
 204 </div>
 205 </blockquote>
 206
 207 <p>Plugins for other major applications gladly accepted!</p>
 208
 209
 210 <h2 id="Users">Users</h2>
 211
 212 <p>Here are some open-source applications that use HTML Purifier:</p>
 213
 214 <ul>
 215     <li><a href="http://www.bitweaver.org/">BitWeaver</a> (<a href="http://www.bitweaver.org/wiki/HTMLPurifier">via PEAR</a>, see <a href="http://bitweaver.cvs.sourceforge.net/bitweaver/_bit_install/install_checks.php?view=markup">install_checks.php</a>)</li>
 216     <li><a href="http://www.aliro.org/">Aliro</a> (<a href="http://aliro-svn.cvsdude.com/aliro/trunk/extclasses/HTMLPurifier.php">3.1.0rc1</a>)</li>
 217     <li><a href="http://php-ids.org/">WPIDS</a> (<a href="http://code.google.com/p/wpids/source/browse/trunk/htmlpurifier/HTMLPurifier.php">3.0.0</a>)</li>
 218     <li><a href="http://kohanaphp.com/home.html">Kohana</a> (<a href="http://trac.kohanaphp.com/browser/trunk/system/vendor">3.1.0rc1</a>)</li>
 219 </ul>
 220
 221 <p>If I've forgotten anyone, drop me a line with a link to both
 222 your application and the use of HTML Purifier in your code repository,
 223 and I'll add your application to this list.</p>
 224
 225 <h3>Hall of Limbo: PHP4</h3>
 226
 227 <p>The following applications are using HTML Purifier 2.1.3, for PHP4 compatibility.
 228 While this is fine, I would much rather they go PHP5!</p>
 229
 230 <ul>
 231     <li><a href="http://getlilina.org/">Lilina News Aggregator</a> (<a href="http://lilina.googlecode.com/svn/trunk/lilina/inc/contrib/HTMLPurifier.standalone.php">2.1.3</a>)</li>
 232     <li><a href="http://brilaps.com/index.php?content=mia">Mia</a> (<a href="http://code.google.com/p/mia-chat/source/browse/trunk/mia_0_x/includes/htmlpurifier/HTMLPurifier.php">2.1.3</a>)</li>
 233     <li><a href="">TikiWiki</a> (<a href="http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/1.10/lib/HTMLPurifier.php?view=markup">2.1.3</a>)</li>
 234 </ul>
 235
 236
 237 <h3>Hall of Shame</h3>
 238
 239 <p>The following users package HTML Purifier with their software, but either are not
 240 up-to-date or are improperly using the cutting-edge development versions in
 241 stable releases. If you're a user or developer for these projects, please
 242 raise your voice and help to get them fixed!</p>
 243
 244 <ul>
 245     <li>PHProjekt (<a href="http://thinkforge.org/plugins/scmcvs/cvsweb.php/phprojekt50/lib/html/library/HTMLPurifier.php?rev=HEAD;content-type=text%2Fplain;cvsroot=phprojekt5">1.6.0</a>)</li>
 246     <li>Lichen Webmail (<a href="http://trac.lichen-mail.org/browser/trunk/libs/HTMLPurifier.php">2.0.1</a>, see <a href="https://trac.lichen-mail.org/ticket/79">ticket #79</a>)</li>
 247 </ul>
 248
 249 <h2 id="Propaganda">Spread the Word!</h2>
 250
 251 <p>Help spread awareness about HTML Purifier by:</p>
 252
 253 <ul>
 254 <li><a
 255 href="http://del.icio.us/post?v=4&amp;noui&amp;url=http://htmlpurifier.org/&amp;title=HTML%20Purifier%20-%20Filter%20your%20HTML%20the%20standards-compliant%20way!"
 256 id="delicious">Bookmarking this website</a> on your <strong>del.icio.us</strong> account, and/or</li>
 257 <li>
 258     <div>Including this little <strong>label</strong> on your website:
 259     <a href="http://htmlpurifier.org/"><img
 260     src="live/art/powered.png"
 261     alt="Powered by HTML Purifier" border="0" /></a>, with this code:
 262     </div>
 263     <pre class="long">&lt;a href=&quot;http://htmlpurifier.org/&quot;&gt;&lt;img
 264 src=&quot;http://htmlpurifier.org/live/art/powered.png&quot;
 265 alt=&quot;Powered by HTML Purifier&quot; border=&quot;0&quot; /&gt;&lt;/a&gt;</pre>
 266 </li>
 267 </ul>
 268
 269 </div>
 270
 271 </body>
 272 </html>