oop.kses.changelog.txt 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205
  1. kses ChangeLog
  2. ==============
  3. KSES5
  4. * 1.0.2
  5. KSES4
  6. * 0.2.2
  7. - Folded in code from kses 0.2.2.
  8. KSES5
  9. * 1.0.1rc
  10. KSES4
  11. * 0.2.2rc
  12. - Added SetProtocols() to make protocol replacement a single step
  13. to fully answer concerns in bug #892477
  14. KSES5
  15. * 1.0.0
  16. - Turned many methods private
  17. - Now using __construct default constructor
  18. - Only runs in PHP5 or better
  19. - All method names changed to reflect verb status
  20. - Folded sinlge line functions into calling methods
  21. - Deprecated _hook(), Protocols()
  22. - Added AddProtocols() to replace Protocols()
  23. - Added filterKsesTextHook() to replace _hook()
  24. - Added RemoveProtocol() and RemoveProtocols() to remove protocols
  25. singly, or batch. This should clear bug #892477
  26. - Version number is 1.0.0
  27. KSES4
  28. * 0.2.1
  29. - Synced version number to procedural code
  30. - Deprecated _hook(), Protocols()
  31. - Added AddProtocols() to replace Protocols()
  32. - Added filterKsesTextHook() to replace _hook()
  33. - Added RemoveProtocol() and RemoveProtocols() to remove protocols singly,
  34. or batch. This should clear bug #892477
  35. OOP
  36. - Forked code into PHP4 and PHP5 versions. Use '$myKses = new kses[45]'
  37. from now on.
  38. - Modified code to run in E_STRICT. This should clear bug #918493
  39. - Added phpDoc commenting
  40. OOP
  41. * 0.0.2
  42. - Fixed a bug in AddProtocol that wasn't adding new protocols to
  43. $this->allowed_protocols
  44. - Modified internal methods to correspond to kses 0.2.1 modifications.
  45. - Created a basic test suite that can be run via web or CLI.
  46. - Started CVSing the code.
  47. OOP
  48. * 0.0.1
  49. - Turned all the kses_function_name functions to _function_name methods.
  50. - Added a couple of properties (allowed_protocols, allowed_html) with
  51. $this->allowed_protocols defaulting to the lion's share of usual
  52. protocols.
  53. - Modified the applicable use of preg_replace() functions to point to
  54. internal class methods.
  55. - Reduced the parameter list of some methods since internal properties
  56. are now being used.
  57. - Added "public" methods to set up the allowed protocols and HTML.
  58. Procedural
  59. * 0.2.1
  60. 0.2.1 was released on the 29th of September 2003.
  61. It has the following changes:
  62. - There is now an additional version of kses, using the object-oriented
  63. paradigm. Thanks a lot to Richard R. Vasquez, Jr., who created it!
  64. Anyone who wants to make functional programming, logical programming or
  65. spaghetti programming versions of kses as well (or any other programming
  66. paradigm that you like), go ahead! All the people who like old
  67. procedural programming for web applications shouldn't despair, though,
  68. as both versions will be maintained with each release.
  69. - kses now has some new attribute value checks: minlen, minval and
  70. valueless. See docs/attribute-value-checks for an explanation.
  71. - For some reason, the Opera developers decided to make chr(173) a
  72. whitespace character in URL protocols, both when it occurs raw and in an
  73. entity. kses now handles this.
  74. - The URL protocol whitelisting system now decodes entities before
  75. removing NULLs and whitespaces.
  76. Procedural
  77. * 0.2.0
  78. 0.2.0 was released on the 25th of July 2003.
  79. It has the following changes:
  80. - kses now supports checking of attribute values, and not just element
  81. names and attribute names. The attribute value checks that exist so far
  82. are 'maxlen' (checks how long attribute values are, to avoid Buffer
  83. Overflows) and 'maxval' (checks how big an integer value is, to avoid
  84. Denial of Service attacks).
  85. Buffer Overflows could both be a problem for WWW clients and different
  86. servers on the Internet that an HTML document links to. One example is
  87. <frame src="ftp://ftp.v1ct1m.com/AAAAAA..thousands_of_A's...">.
  88. Denial of Service attacks can take the form of too big sizes of iframes
  89. or other things. One example is <iframe src="http://some.web.server/"
  90. width="20000" height="2000">, which makes some client machines
  91. completely overloaded.
  92. - kses' old feature of removing "javascript:" from attribute values has
  93. been improved. It now has a whole system for white listing of URL
  94. protocols, so you can specify that it's acceptable with http:, https:,
  95. ftp: and gopher:, but no other protocols in attribute values. The system
  96. tries pretty hard to do the right thing with whitespace, upper/lower
  97. case, HTML entities ("jav&#97;script:") and repeated entries
  98. ("javascript:javascript:alert(57)").
  99. - kses now supports both HTML and XHTML code, by allowing " /" at the end
  100. of tags.
  101. - kses now removes Netscape 4's JavaScript entities, having the form
  102. "&{alert(57)};". They don't even seem to work on all versions of
  103. Netscape 4, but for completeness' sake it seemed like a good feature to
  104. add.
  105. - A bug with NULLs in javascript: URLs was fixed.
  106. (Reported by Simon Cornelius P. Umacob - thanks!)
  107. - As a nice side effect of the white listing of URL protocols, kses now
  108. also normalizes all HTML entities in documents. It will change HTML code
  109. with bad entities to the right form, for example "AT&T" will be
  110. converted to "AT&amp;T" and "<a href='lyrics.php?band=ladytron&lyrics=
  111. playgirl'>" will be converted to "<a href='lyrics.php?band=
  112. ladytron&amp;lyrics=playgirl'>". "&#000058;" will be converted to
  113. "&#58;", "&#XYZZY;" will be converted to "&amp;#XYZZY;", "&auml!;" will
  114. be converted to "&amp;auml!;" and so on.
  115. As shown above, it will process HTML entities that it doesn't
  116. understand. It will also deal with too big numbers in numeric HTML
  117. entities, which is helpful as many browsers seem to wrap them around at
  118. 2 ** 32, so the characters 58, 58 + (2 ** 32), 58 + (2 ** 64) etcetera
  119. are all colons to the web browser.
  120. - You can now use upper case letters in your $allowed_html array, in
  121. element names, attribute names and attribute value check names. Version
  122. 0.1.0 required everything in that array to be in lower case, but that's
  123. not necessary any more. You can also use upper case letters in
  124. $allowed_protocols.
  125. - The "Really malformed thing" bug from the TODO file was fixed.
  126. It used to convert this string:
  127. x > 5 <a href="blah">
  128. to:
  129. x &gt; 5 &lt;a href=&quot;blah&quot;&gt;
  130. and now it converts it to:
  131. x &gt; 5 <a href="blah">
  132. - The "Weird malformed thing" bug from the TODO file was fixed.
  133. It used to convert this string:
  134. <a href="5 href=6>
  135. to:
  136. <a href="6">
  137. because of the way kses restarts after a parse error in kses_hair().
  138. Now it converts it to:
  139. <a>
  140. - A problem with slashes in HTML tags was fixed.
  141. - examples/filter.php used to use $SCRIPT_NAME, which doesn't work on
  142. Windows.
  143. (Reported by Simon Cornelius P. Umacob - thanks!)
  144. - kses now allows dashes in attribute names, for things like
  145. <meta http-equiv=..>.
  146. Procedural
  147. * 0.1.0, first public version
  148. 0.1.0 was released on the 9th of June 2003.
  149. It was announced on three security related mailing lists on Friday the
  150. 13th of June (nothing bad happened to it though).