X-Git-Url: https://scripts.mit.edu/gitweb/www/ikiwiki.git/blobdiff_plain/37ac7f55ae259296d2734670d5cddfea3e2d0e21..5487c524df984d7e2f79dd8f9c01edf08403e07c:/doc/plugins/htmlscrubber.mdwn diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn index 3ce40d991..08c81212b 100644 --- a/doc/plugins/htmlscrubber.mdwn +++ b/doc/plugins/htmlscrubber.mdwn @@ -6,12 +6,13 @@ to avoid XSS attacks and the like. It excludes all html tags and attributes except for those that are whitelisted using the same lists as used by Mark Pilgrim's Universal Feed -Parser, documented at . +Parser, documented at +. Notably it strips `style` and `link` tags, and the `style` attribute. -All attributes that can be used to specify an url are checked to make sure -that the url is in a known, safe scheme, and to block embedded javascript -in such urls. +Any attributes that could be used to specify a URL are checked to ensure +that they are known, safe schemes. It will also block embedded javascript +in such URLs. It uses the [[!cpan HTML::Scrubber]] perl module to perform its html sanitisation, and this perl module also deals with various entity encoding