Rewrite CSS url() and font-family output logic.
commitd3abcb90e30592c619047d878cf9c72b7c5836a3
authorEdward Z. Yang <ezyang@mit.edu>
Fri, 21 May 2010 15:53:52 +0000 (21 11:53 -0400)
committerEdward Z. Yang <ezyang@mit.edu>
Tue, 1 Jun 2010 01:45:21 +0000 (31 18:45 -0700)
treeb1b95531382c96c796f2a5f2495b096b22d6b628
parentdf3100b1b335f43945ed0624f6e78273482eb478
Rewrite CSS url() and font-family output logic.

The new logic is as follows:

* Given a URL to insert into url(), check that it is properly URL
  encoded (in particular, a doublequote and backslash never occurs
  within it) and then place it as url("http://example.com").

* Given a font name, if it is strictly alphanumeric, it is safe to omit
  quotes. Otherwise, wrap in double quotes and replace '"' with '\22 '
  (note trailing space) and '\' with '\5C ' (ditto).

We introduce expandCSSEscape() which is a hack for common parsing
idioms in CSS; this means that CSS escapes are now recognized inside
URLs as well as unquoted font names.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
15 files changed:
NEWS
library/HTMLPurifier/AttrDef.php
library/HTMLPurifier/AttrDef/CSS/FontFamily.php
library/HTMLPurifier/AttrDef/CSS/URI.php
tests/HTMLPurifier/AttrDef/CSS/BackgroundTest.php
tests/HTMLPurifier/AttrDef/CSS/FontFamilyTest.php
tests/HTMLPurifier/AttrDef/CSS/FontTest.php
tests/HTMLPurifier/AttrDef/CSS/ListStyleTest.php
tests/HTMLPurifier/AttrDef/CSS/URITest.php
tests/HTMLPurifier/AttrDef/CSSTest.php
tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php
tests/HTMLPurifier/HTMLT/munge-extra.htmlt
tests/HTMLPurifier/HTMLT/shift-jis-preserve-yen.htmlt
tests/HTMLPurifier/HTMLT/shift-jis-remove-yen.htmlt
tests/HTMLPurifier/HTMLT/tidy-background.htmlt