HTMLPurifier_HTMLModule_SafeScripting Class Reference

A "safe" script module. More...

Inheritance diagram for HTMLPurifier_HTMLModule_SafeScripting:

Collaboration diagram for HTMLPurifier_HTMLModule_SafeScripting:

Public Member Functions
	setup ($config)
Public Member Functions inherited from HTMLPurifier_HTMLModule
	getChildDef ($def)
	Retrieves a proper HTMLPurifier_ChildDef subclass based on content_model and content_model_type member variables of the HTMLPurifier_ElementDef class.
	addElement ($element, $type, $contents, $attr_includes=array(), $attr=array())
	Convenience function that sets up a new element.
	addBlankElement ($element)
	Convenience function that creates a totally blank, non-standalone element.
	addElementToContentSet ($element, $type)
	Convenience function that registers an element to a content set.
	parseContents ($contents)
	Convenience function that transforms single-string contents into separate content model and content model type.
	mergeInAttrIncludes (&$attr, $attr_includes)
	Convenience function that merges a list of attribute includes into an attribute array.
	makeLookup ($list)
	Convenience function that generates a lookup table with boolean true as value.

Data Fields
	$name = 'SafeScripting'
	string
Data Fields inherited from HTMLPurifier_HTMLModule
	$name
	Short unique string identifier of the module.
	$elements = array()
	Informally, a list of elements this module changes.
	$info = array()
	Associative array of element names to element definitions.
	$content_sets = array()
	Associative array of content set names to content set additions.
	$attr_collections = array()
	Associative array of attribute collection names to attribute collection additions.
	$info_tag_transform = array()
	Associative array of deprecated tag name to HTMLPurifier_TagTransform.
	$info_attr_transform_pre = array()
	List of HTMLPurifier_AttrTransform to be performed before validation.
	$info_attr_transform_post = array()
	List of HTMLPurifier_AttrTransform to be performed after validation.
	$info_injector = array()
	List of HTMLPurifier_Injector to be performed during well-formedness fixing.
	$defines_child_def = false
	Boolean flag that indicates whether or not getChildDef is implemented.
	$safe = true
	Boolean flag whether or not this module is safe.

Detailed Description

A "safe" script module.

No inline JS is allowed, and pointed to JS files must match whitelist.

Definition at line 7 of file SafeScripting.php.

Member Function Documentation

HTMLPurifier_HTMLModule_SafeScripting::setup

(

$config

)

Parameters

HTMLPurifier_Config

$config

Reimplemented from HTMLPurifier_HTMLModule.

Definition at line 17 of file SafeScripting.php.

References HTMLPurifier_HTMLModule\addElement().

    {
        // These definitions are not intrinsically safe: the attribute transforms
        // are a vital part of ensuring safety.

        $allowed = $config->get('HTML.SafeScripting');
        $script = $this->addElement(
            'script',
            'Inline',
            'Empty',
            null,
            array(
                // While technically not required by the spec, we're forcing
                // it to this value.
                'type' => 'Enum#text/javascript',
                'src*' => new HTMLPurifier_AttrDef_Enum(array_keys($allowed))
            )
        );
        $script->attr_transform_pre[] =
        $script->attr_transform_post[] = new HTMLPurifier_AttrTransform_ScriptRequired();
    }

Here is the call graph for this function:

Field Documentation

HTMLPurifier_HTMLModule_SafeScripting::$name = 'SafeScripting'

string

Definition at line 12 of file SafeScripting.php.

---

The documentation for this class was generated from the following file:

• Services/Html/HtmlPurifier/library/HTMLPurifier/HTMLModule/SafeScripting.php