.\" Automatically generated by Pod::Man 4.09 (Pod::Simple 3.35) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .if !\nF .nr F 0 .if \nF>0 \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} .\} .\" ======================================================================== .\" .IX Title "HTML::Scrubber 3pm" .TH HTML::Scrubber 3pm "2017-11-11" "perl v5.26.1" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" HTML::Scrubber \- Perl extension for scrubbing/sanitizing HTML .SH "VERSION" .IX Header "VERSION" version 0.17 .SH "SYNOPSIS" .IX Header "SYNOPSIS" .Vb 1 \& use HTML::Scrubber; \& \& my $scrubber = HTML::Scrubber\->new( allow => [ qw[ p b i u hr br ] ] ); \& print $scrubber\->scrub(\*(Aq

bold missing

\*(Aq); \& # output is:

bold

\& \& # more complex input \& my $html = q[ \& \& \&
\& a => link \& br =>
\& b => bold \& u => UNDERLINE \& ]; \& \& print $scrubber\->scrub($html); \& \& $scrubber\->deny( qw[ p b i u hr br ] ); \& \& print $scrubber\->scrub($html); .Ve .SH "DESCRIPTION" .IX Header "DESCRIPTION" If you want to \*(L"scrub\*(R" or \*(L"sanitize\*(R" html input in a reliable and flexible fashion, then this module is for you. .PP I wasn't satisfied with HTML::Sanitizer because it is based on HTML::TreeBuilder, so I thought I'd write something similar that works directly with HTML::Parser. .SH "METHODS" .IX Header "METHODS" First a note on documentation: just study the \s-1EXAMPLE\s0 below. It's all the documentation you could need. .PP Also, be sure to read all the comments as well as How does it work?. .PP If you're new to perl, good luck to you. .SS "new" .IX Subsection "new" .Vb 1 \& my $scrubber = HTML::Scrubber\->new( allow => [ qw[ p b i u hr br ] ] ); .Ve .PP Build a new HTML::Scrubber. The arguments are the initial values for the following directives:\- .IP "\(bu" 4 default .IP "\(bu" 4 allow .IP "\(bu" 4 deny .IP "\(bu" 4 rules .IP "\(bu" 4 process .IP "\(bu" 4 comment .SS "comment" .IX Subsection "comment" .Vb 2 \& warn "comments are ", $p\->comment ? \*(Aqallowed\*(Aq : \*(Aqnot allowed\*(Aq; \& $p\->comment(0); # off by default .Ve .SS "process" .IX Subsection "process" .Vb 2 \& warn "process instructions are ", $p\->process ? \*(Aqallowed\*(Aq : \*(Aqnot allowed\*(Aq; \& $p\->process(0); # off by default .Ve .SS "script" .IX Subsection "script" .Vb 3 \& warn "script tags (and everything in between) are supressed" \& if $p\->script; # off by default \& $p\->script( 0 || 1 ); .Ve .PP \&\fB**\fR Please note that this is implemented using HTML::Parser's \&\f(CW\*(C`ignore_elements\*(C'\fR function, so if \f(CW\*(C`script\*(C'\fR is set to true, all script tags encountered will be validated like all other tags. .SS "style" .IX Subsection "style" .Vb 3 \& warn "style tags (and everything in between) are supressed" \& if $p\->style; # off by default \& $p\->style( 0 || 1 ); .Ve .PP \&\fB**\fR Please note that this is implemented using HTML::Parser's \&\f(CW\*(C`ignore_elements\*(C'\fR function, so if \f(CW\*(C`style\*(C'\fR is set to true, all style tags encountered will be validated like all other tags. .SS "allow" .IX Subsection "allow" .Vb 1 \& $p\->allow(qw[ t a g s ]); .Ve .SS "deny" .IX Subsection "deny" .Vb 1 \& $p\->deny(qw[ t a g s ]); .Ve .SS "rules" .IX Subsection "rules" .Vb 12 \& $p\->rules( \& img => { \& src => qr{^(?!http://)}i, # only relative image links allowed \& alt => 1, # alt attribute allowed \& \*(Aq*\*(Aq => 0, # deny all other attributes \& }, \& a => { \& href => sub { ... }, # check or adjust with a callback \& }, \& b => 1, \& ... \& ); .Ve .PP Updates a set of attribute rules. Each rule can be 1/0, a regular expression or a callback. Values longer than 1 char are treated as regexps. The callback is called with the following arguments: the current object, tag name, attribute name, and attribute value; the callback should return an empty list to drop the attribute, \f(CW\*(C`undef\*(C'\fR to keep it without a value, or a new scalar value. .SS "default" .IX Subsection "default" .Vb 8 \& print "default is ", $p\->default(); \& $p\->default(1); # allow tags by default \& $p\->default( \& undef, # don\*(Aqt change \& { # default attribute rules \& \*(Aq*\*(Aq => 1, # allow attributes by default \& } \& ); .Ve .SS "scrub_file" .IX Subsection "scrub_file" .Vb 6 \& $html = $scrubber\->scrub_file(\*(Aqfoo.html\*(Aq); ## returns giant string \& die "Eeek $!" unless defined $html; ## opening foo.html may have failed \& $scrubber\->scrub_file(\*(Aqfoo.html\*(Aq, \*(Aqnew.html\*(Aq) or die "Eeek $!"; \& $scrubber\->scrub_file(\*(Aqfoo.html\*(Aq, *STDOUT) \& or die "Eeek $!" \& if fileno STDOUT; .Ve .SS "scrub" .IX Subsection "scrub" .Vb 5 \& print $scrubber\->scrub($html); ## returns giant string \& $scrubber\->scrub($html, \*(Aqnew.html\*(Aq) or die "Eeek $!"; \& $scrubber\->scrub($html\*(Aq, *STDOUT) \& or die "Eeek $!" \& if fileno STDOUT; .Ve .PP \&\fIdefault\fR handler, used by both \f(CW\*(C`_scrub\*(C'\fR and \f(CW\*(C`_scrub_fh\*(C'\fR. Moved all the common code (basically all of it) into a single routine for ease of maintenance. .PP \&\fIdefault\fR handler, does the scrubbing if we're scrubbing out to a file. Now calls \f(CW\*(C`_scrub_str\*(C'\fR and pushes that out to a file. .PP \&\fIdefault\fR handler, does the scrubbing if we're returning a giant string. Now calls \f(CW\*(C`_scrub_str\*(C'\fR and appends that to the output string. .SH "How does it work?" .IX Header "How does it work?" When a tag is encountered, HTML::Scrubber allows/denies the tag using the explicit rule if one exists. .PP If no explicit rule exists, Scrubber applies the default rule. .PP If an explicit rule exists, but it's a simple \fIrule\fR\|(1), then the default attribute rule is applied. .SS "\s-1EXAMPLE\s0" .IX Subsection "EXAMPLE" .Vb 3 \& #!/usr/bin/perl \-w \& use HTML::Scrubber; \& use strict; \& \& my @allow = qw[ br hr b a ]; \& \& my @rules = ( \& script => 0, \& img => { \& src => qr{^(?!http://)}i, # only relative image links allowed \& alt => 1, # alt attribute allowed \& \*(Aq*\*(Aq => 0, # deny all other attributes \& }, \& ); \& \& my @default = ( \& 0 => # default rule, deny all tags \& { \& \*(Aq*\*(Aq => 1, # default rule, allow all attributes \& \*(Aqhref\*(Aq => qr{^(?:http|https|ftp)://}i, \& \*(Aqsrc\*(Aq => qr{^(?:http|https|ftp)://}i, \& \& # If your perl doesn\*(Aqt have qr \& # just use a string with length greater than 1 \& \*(Aqcite\*(Aq => \*(Aq(?i\-xsm:^(?:http|https|ftp):)\*(Aq, \& \*(Aqlanguage\*(Aq => 0, \& \*(Aqname\*(Aq => 1, # could be sneaky, but hey ;) \& \*(Aqonblur\*(Aq => 0, \& \*(Aqonchange\*(Aq => 0, \& \*(Aqonclick\*(Aq => 0, \& \*(Aqondblclick\*(Aq => 0, \& \*(Aqonerror\*(Aq => 0, \& \*(Aqonfocus\*(Aq => 0, \& \*(Aqonkeydown\*(Aq => 0, \& \*(Aqonkeypress\*(Aq => 0, \& \*(Aqonkeyup\*(Aq => 0, \& \*(Aqonload\*(Aq => 0, \& \*(Aqonmousedown\*(Aq => 0, \& \*(Aqonmousemove\*(Aq => 0, \& \*(Aqonmouseout\*(Aq => 0, \& \*(Aqonmouseover\*(Aq => 0, \& \*(Aqonmouseup\*(Aq => 0, \& \*(Aqonreset\*(Aq => 0, \& \*(Aqonselect\*(Aq => 0, \& \*(Aqonsubmit\*(Aq => 0, \& \*(Aqonunload\*(Aq => 0, \& \*(Aqsrc\*(Aq => 0, \& \*(Aqtype\*(Aq => 0, \& } \& ); \& \& my $scrubber = HTML::Scrubber\->new(); \& $scrubber\->allow(@allow); \& $scrubber\->rules(@rules); # key/value pairs \& $scrubber\->default(@default); \& $scrubber\->comment(1); # 1 allow, 0 deny \& \& ## preferred way to create the same object \& $scrubber = HTML::Scrubber\->new( \& allow => \e@allow, \& rules => \e@rules, \& default => \e@default, \& comment => 1, \& process => 0, \& ); \& \& require Data::Dumper, die Data::Dumper::Dumper($scrubber) if @ARGV; \& \& my $it = q[ \& \&
\& IN ITALICS WITH FAKE="attribute"
\& IN BOLD
\& \& HREF=JAVA <!> \&
\& \& ONMOUSEOVER JAVASCRIPT \& \&
\& ]; \& \& print "#original text", $/, $it, $/; \& print \& "#scrubbed text (default ", $scrubber\->default(), # no arguments returns the current value \& " comment ", $scrubber\->comment(), " process ", $scrubber\->process(), " )", $/, $scrubber\->scrub($it), $/; \& \& $scrubber\->default(1); # allow all tags by default \& $scrubber\->comment(0); # deny comments \& \& print \& "#scrubbed text (default ", \& $scrubber\->default(), \& " comment ", \& $scrubber\->comment(), \& " process ", \& $scrubber\->process(), \& " )", $/, \& $scrubber\->scrub($it), \& $/; \& \& $scrubber\->process(1); # allow process instructions (dangerous) \& $default[0] = 1; # allow all tags by default \& $default[1]\->{\*(Aq*\*(Aq} = 0; # deny all attributes by default \& $scrubber\->default(@default); # set the default again \& \& print \& "#scrubbed text (default ", \& $scrubber\->default(), \& " comment ", \& $scrubber\->comment(), \& " process ", \& $scrubber\->process(), \& " )", $/, \& $scrubber\->scrub($it), \& $/; .Ve .SS "\s-1FUN\s0" .IX Subsection "FUN" If you have Test::Inline (and you've installed HTML::Scrubber), try .PP .Vb 2 \& pod2test Scrubber.pm >scrubber.t \& perl scrubber.t .Ve .SH "SEE ALSO" .IX Header "SEE ALSO" HTML::Parser, Test::Inline. .PP The HTML::Sanitizer module is no longer available on \s-1CPAN.\s0 .SH "VERSION REQUIREMENTS" .IX Header "VERSION REQUIREMENTS" As of version 0.14 I have added a perl minimum version requirement of 5.8. This is basically due to failures on the smokers perl 5.6 installations \- which appears to be down to installation mechanisms and requirements. .PP Since I don't want to spend the time supporting a version that is so old (and may not work for reasons on \s-1UTF\s0 support etc), I have added a \f(CW\*(C`use 5.008;\*(C'\fR to the main module. .PP If this is problematic I am very willing to accept patches to fix this up, although I do not personally see a good reason to support a release that has been obsolete for 13 years. .SH "CONTRIBUTING" .IX Header "CONTRIBUTING" If you want to contribute to the development of this module, the code is on GitHub . You'll need a perl environment with Dist::Zilla, and if you're just getting started, there's some documentation on using Vagrant and Perlbrew here . .PP There is now a \f(CW\*(C`.perltidyrc\*(C'\fR and a \f(CW\*(C`.tidyallrc\*(C'\fR file within the repository for the standard perltidy settings used \- I will apply these before new releases. Please do not let formatting prevent you from sending in patches etc \&\- this can be sorted out as part of the release process. Info on \f(CW\*(C`tidyall\*(C'\fR can be found at . .SH "AUTHORS" .IX Header "AUTHORS" .IP "\(bu" 4 Ruslan Zakirov .IP "\(bu" 4 Nigel Metheringham .IP "\(bu" 4 D. H. .SH "COPYRIGHT AND LICENSE" .IX Header "COPYRIGHT AND LICENSE" This software is copyright (c) 2017 by Ruslan Zakirov, Nigel Metheringham, 2003\-2004 D. H. .PP This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. .SH "SUPPORT" .IX Header "SUPPORT" .SS "Perldoc" .IX Subsection "Perldoc" You can find documentation for this module with the perldoc command. .PP .Vb 1 \& perldoc HTML::Scrubber .Ve .SS "Websites" .IX Subsection "Websites" The following websites have more information about this module, and may be of help to you. As always, in addition to those websites please use your favorite search engine to discover more resources. .IP "\(bu" 4 MetaCPAN .Sp A modern, open-source \s-1CPAN\s0 search engine, useful to view \s-1POD\s0 in \s-1HTML\s0 format. .Sp .IP "\(bu" 4 Search \s-1CPAN\s0 .Sp The default \s-1CPAN\s0 search engine, useful to view \s-1POD\s0 in \s-1HTML\s0 format. .Sp .IP "\(bu" 4 \&\s-1RT: CPAN\s0's Bug Tracker .Sp The \s-1RT\s0 ( Request Tracker ) website is the default bug/issue tracking system for \s-1CPAN.\s0 .Sp .IP "\(bu" 4 AnnoCPAN .Sp The AnnoCPAN is a website that allows community annotations of Perl module documentation. .Sp .IP "\(bu" 4 \&\s-1CPAN\s0 Ratings .Sp The \s-1CPAN\s0 Ratings is a website that allows community ratings and reviews of Perl modules. .Sp .IP "\(bu" 4 \&\s-1CPAN\s0 Forum .Sp The \s-1CPAN\s0 Forum is a web forum for discussing Perl modules. .Sp .IP "\(bu" 4 \&\s-1CPANTS\s0 .Sp The \s-1CPANTS\s0 is a website that analyzes the Kwalitee ( code metrics ) of a distribution. .Sp .IP "\(bu" 4 \&\s-1CPAN\s0 Testers .Sp The \s-1CPAN\s0 Testers is a network of smokers who run automated tests on uploaded \s-1CPAN\s0 distributions. .Sp .IP "\(bu" 4 \&\s-1CPAN\s0 Testers Matrix .Sp The \s-1CPAN\s0 Testers Matrix is a website that provides a visual overview of the test results for a distribution on various Perls/platforms. .Sp .IP "\(bu" 4 \&\s-1CPAN\s0 Testers Dependencies .Sp The \s-1CPAN\s0 Testers Dependencies is a website that shows a chart of the test results of all dependencies for a distribution. .Sp .SS "Bugs / Feature Requests" .IX Subsection "Bugs / Feature Requests" Please report any bugs or feature requests by email to \f(CW\*(C`bug\-html\-scrubber at rt.cpan.org\*(C'\fR, or through the web interface at . You will be automatically notified of any progress on the request by the system. .SS "Source Code" .IX Subsection "Source Code" The code is open to the world, and available for you to hack on. Please feel free to browse it and play with it, or whatever. If you want to contribute patches, please send me a diff or prod me to pull from your repository :) .PP .PP .Vb 1 \& git clone https://github.com/nigelm/html\-scrubber.git .Ve .SH "CONTRIBUTORS" .IX Header "CONTRIBUTORS" .IP "\(bu" 4 Andrei Vereha .IP "\(bu" 4 Lee Johnson .IP "\(bu" 4 Michael Caron .IP "\(bu" 4 Michael Caron .IP "\(bu" 4 Nigel Metheringham .IP "\(bu" 4 Paul Cochrane .IP "\(bu" 4 Ruslan Zakirov .IP "\(bu" 4 Sergey Romanov .IP "\(bu" 4 vagrant