4 Here are some theoretical configuration ideas that we could implement some
5 time. Note the naming convention: %Namespace.Directive
7 %Attr.IDPrefix - prefix all ids with this
9 %Attr.RewriteFragments - if there's %Attr.IDPrefix we may want to transparently
10 rewrite the URLs we parse too. However, we can only do it when it's a pure
11 anchor link, so it's not foolproof
15 %Attr.ClassPolicy - determines what classes are allowed. When
16 %Attr.ClassPolicy is set to Blacklist, only allow those not in
17 %Attr.ClassBlacklist. When it's Whitelist, only allow those in
20 %Attr.LangAlphaOnly - designate whether or not to allow numerals in language
22 * RFC 1766, the current standard referenced by XML, does not permit
24 * RFC 3066, the superseding best practice standard since January 2001,
26 We allow numbers by default, but you generally never see them
27 at all, which makes this a little more sane.
30 %Attr.MaxHeight - caps for width and height related checks.
31 (a hack in Pixels for an image crashing attack could be replaced by this)
33 %URI.Munge - will munge all URIs to a different URI, which should redirect
34 the user to the applicable page. A urlencoded version of the URI
35 will replace any instances of %s in the string. One possible
36 string is 'http://www.google.com/url?q=%s'. Useful for preventing
37 pagerank from being sent to other sites
39 %URI.AddRelNofollow - will add rel="nofollow" to all links, preventing the
40 spread of ill-gotten pagerank
42 %URI.RelativeToAbsolute - transforms all relative URIs to absolute form
44 %URI.HostBlacklist - strings that if found in the host of a URI are disallowed
45 %URI.HostBlacklistRegex - regexes that if matching the host are disallowed
46 %URI.HostWhitelist - domain names that are excluded from the host blacklist
47 %URI.HostPolicy - determines whether or not its reject all and then whitelist
48 or allow all in then do specific blacklists with whitelist intervening.
49 'DenyAll' or 'AllowAll' (default)
51 %URI.DisableIPHosts - URIs that have IP addresses for hosts are disallowed.
52 Be sure to also grab unusual encodings (dword, hex and octal)
54 %URI.DisableExternalResources - disallow resource links (i.e. URIs that result
55 in immediate requests, such as src in IMG) to external websites