From 254a3f56a901d94a99a1a425ceecf62e8fd06051 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@madoka.volgo-balt.ru>
Date: Tue, 19 Mar 2013 11:13:57 +0400
Subject: add prototype simple remover of baaaad tags based on domdocument

---
 include/functions.php | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

(limited to 'include/functions.php')

diff --git a/include/functions.php b/include/functions.php
index ad87c90c2..341177b0a 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -2611,16 +2611,46 @@
 			}
 		}
 
-		//$node = $doc->getElementsByTagName('body')->item(0);
+		$entries = $xpath->query('//iframe');
+		foreach ($entries as $entry) {
+			$entry->setAttribute('sandbox', true);
+		}
 
 		$doc->removeChild($doc->firstChild); //remove doctype
+		$doc = strip_harmful_tags($doc);
 		$res = $doc->saveHTML();
+		return $res;
+	}
 
-		$config = array('safe' => 1, 'deny_attribute' => 'style, width, height, class, id', 'comment' => 1, 'cdata' => 1, 'balance' => 0);
-		$spec = 'img=width,height';
-		$res = htmLawed($res, $config, $spec);
+	function strip_harmful_tags($doc) {
+		$entries = $doc->getElementsByTagName("*");
 
-		return $res;
+		$allowed_elements = array('p', 'br', 'div', 'table', 'tr', 'td', 'th',
+			'ul', 'ol', 'li', 'blockquote', 'span', 'html', 'body', 'a', 'img',
+			'iframe', 'video', 'audio', 'source');
+
+		$disallowed_attributes = array('id', 'style', 'class');
+
+		foreach ($entries as $entry) {
+			if (!in_array($entry->nodeName, $allowed_elements)) {
+				$entry->parentNode->removeChild($entry);
+			}
+
+			if ($entry->hasAttributes()) {
+				foreach (iterator_to_array($entry->attributes) as $attr) {
+
+					if (strpos($attr->nodeName, 'on') === 0) {
+						$entry->removeAttributeNode($attr);
+					}
+
+					if (in_array($attr->nodeName, $disallowed_attributes)) {
+						$entry->removeAttributeNode($attr);
+					}
+				}
+			}
+		}
+
+		return $doc;
 	}
 
 	function check_for_update($link) {
-- 
cgit v1.2.3