@@ -40,7 +40,6 @@ module Text.Pandoc.Readers.HTML (
4040 extractTagType,
4141 htmlBlockElement,
4242 htmlComment,
43− unsanitaryURI
4443 ) where
4544
4645import Text.ParserCombinators.Parsec
@@ -51,7 +50,6 @@ import Text.Pandoc.CharacterReferences ( decodeCharacterReferences )
5150import Data.Maybe ( fromMaybe )
5251import Data.List ( isPrefixOf, isSuffixOf, intercalate )
5352import Data.Char ( toLower, isAlphaNum )
54−import Network.URI ( parseURIReference, URI (..) )
5553import Control.Monad ( liftM, when )
5654
5755-- | Convert HTML-formatted string to 'Pandoc' document.
@@ -85,36 +83,6 @@ blockHtmlTags = ["address", "blockquote", "body", "center", "dir", "div",
8583 "dt", "frameset", "li", "tbody", "td", "tfoot",
8684 "th", "thead", "tr", "script", "style"]
8785
88−sanitaryTags :: [[Char]]
89−sanitaryTags = ["a", "abbr", "acronym", "address", "area", "b", "big",
90− "blockquote", "br", "button", "caption", "center",
91− "cite", "code", "col", "colgroup", "dd", "del", "dfn",
92− "dir", "div", "dl", "dt", "em", "fieldset", "font",
93− "form", "h1", "h2", "h3", "h4", "h5", "h6", "hr",
94− "i", "img", "input", "ins", "kbd", "label", "legend",
95− "li", "map", "menu", "ol", "optgroup", "option", "p",
96− "pre", "q", "s", "samp", "select", "small", "span",
97− "strike", "strong", "sub", "sup", "table", "tbody",
98− "td", "textarea", "tfoot", "th", "thead", "tr", "tt",
99− "u", "ul", "var"]
100−
101−sanitaryAttributes :: [[Char]]
102−sanitaryAttributes = ["abbr", "accept", "accept-charset",
103− "accesskey", "action", "align", "alt", "axis",
104− "border", "cellpadding", "cellspacing", "char",
105− "charoff", "charset", "checked", "cite", "class",
106− "clear", "cols", "colspan", "color", "compact",
107− "coords", "datetime", "dir", "disabled",
108− "enctype", "for", "frame", "headers", "height",
109− "href", "hreflang", "hspace", "id", "ismap",
110− "label", "lang", "longdesc", "maxlength", "media",
111− "method", "multiple", "name", "nohref", "noshade",
112− "nowrap", "prompt", "readonly", "rel", "rev",
113− "rows", "rowspan", "rules", "scope", "selected",
114− "shape", "size", "span", "src", "start",
115− "summary", "tabindex", "target", "title", "type",
116− "usemap", "valign", "value", "vspace", "width"]
117−
11886-- taken from HXT and extended
11987
12088closes :: String -> String -> Bool
@@ -153,41 +121,6 @@ _ `closes` _ = False
153121-- HTML utility functions
154122--
155123
156−-- | Returns @True@ if sanitization is specified and the specified tag is
157−-- not on the sanitized tag list.
158−unsanitaryTag :: [Char]
159− -> GenParser tok ParserState Bool
160−unsanitaryTag tag = do
161− st <- getState
162− return $ stateSanitizeHTML st && tag `notElem` sanitaryTags
163−
164−-- | returns @True@ if sanitization is specified and the specified attribute
165−-- is not on the sanitized attribute list.
166−unsanitaryAttribute :: ([Char], String, t)
167− -> GenParser tok ParserState Bool
168−unsanitaryAttribute (attr, val, _) = do
169− st <- getState
170− return $ stateSanitizeHTML st &&
171− (attr `notElem` sanitaryAttributes ||
172− (attr `elem` ["href","src"] && unsanitaryURI val))
173−
174−-- | Returns @True@ if the specified URI is potentially a security risk.
175−unsanitaryURI :: String -> Bool
176−unsanitaryURI u =
177− let safeURISchemes = [ "", "http:", "https:", "ftp:", "mailto:", "file:",
178− "telnet:", "gopher:", "aaa:", "aaas:", "acap:", "cap:", "cid:",
179− "crid:", "dav:", "dict:", "dns:", "fax:", "go:", "h323:", "im:",
180− "imap:", "ldap:", "mid:", "news:", "nfs:", "nntp:", "pop:",
181− "pres:", "sip:", "sips:", "snmp:", "tel:", "urn:", "wais:",
182− "xmpp:", "z39.50r:", "z39.50s:", "aim:", "callto:", "cvs:",
183− "ed2k:", "feed:", "fish:", "gg:", "irc:", "ircs:", "lastfm:",
184− "ldaps:", "magnet:", "mms:", "msnim:", "notes:", "rsync:",
185− "secondlife:", "skype:", "ssh:", "sftp:", "smb:", "sms:",
186− "snews:", "webcal:", "ymsgr:"]
187− in case parseURIReference (escapeURI u) of
188− Just p -> (map toLower $ uriScheme p) `notElem` safeURISchemes
189− Nothing -> True
190−
191124-- | Read blocks until end tag.
192125blocksTilEnd :: String -> GenParser Char ParserState [Block]
193126blocksTilEnd tag = do
@@ -240,10 +173,7 @@ anyHtmlTag = try $ do
240173 char '>'
241174 let result = "<" ++ tag ++
242175 concatMap (\(_, _, raw) -> (' ':raw)) attribs ++ ender' ++ ">"
243− unsanitary <- unsanitaryTag tag
244− if unsanitary
245− then return $ "<!-- unsafe HTML removed -->"
246− else return result
176+ return result
247177
248178anyHtmlEndTag :: GenParser Char ParserState [Char]
249179anyHtmlEndTag = try $ do
@@ -255,10 +185,7 @@ anyHtmlEndTag = try $ do
255185 spaces
256186 char '>'
257187 let result = "</" ++ tag ++ ">"
258− unsanitary <- unsanitaryTag tag
259− if unsanitary
260− then return $ "<!-- unsafe HTML removed -->"
261− else return result
188+ return result
262189
263190htmlTag :: Bool
264191 -> String
@@ -294,16 +221,10 @@ quoted quoteChar = do
294221 (many (noneOf [quoteChar]))
295222 return (result, [quoteChar])
296223
297−nullAttribute :: ([Char], [Char], [Char])
298−nullAttribute = ("", "", "")
299−
300224htmlAttribute :: GenParser Char ParserState ([Char], [Char], [Char])
301225htmlAttribute = do
302226 attr <- htmlRegularAttribute <|> htmlMinimizedAttribute
303− unsanitary <- unsanitaryAttribute attr
304− if unsanitary
305− then return nullAttribute
306− else return attr
227+ return attr
307228
308229-- minimized boolean attribute
309230htmlMinimizedAttribute :: GenParser Char st ([Char], [Char], [Char])
@@ -364,10 +285,7 @@ htmlScript = try $ do
364285 lookAhead $ htmlOpenTag "script"
365286 open <- anyHtmlTag
366287 rest <- liftM concat $ manyTill scriptChunk (htmlEndTag "script")
367− st <- getState
368− if stateSanitizeHTML st && not ("script" `elem` sanitaryTags)
369− then return "<!-- unsafe HTML removed -->"
370− else return $ open ++ rest ++ "</script>"
288+ return $ open ++ rest ++ "</script>"
371289
372290scriptChunk :: GenParser Char ParserState [Char]
373291scriptChunk = jsComment <|> jsString <|> jsChars
@@ -399,10 +317,7 @@ htmlStyle = try $ do
399317 lookAhead $ htmlOpenTag "style"
400318 open <- anyHtmlTag
401319 rest <- manyTill anyChar (htmlEndTag "style")
402− st <- getState
403− if stateSanitizeHTML st && not ("style" `elem` sanitaryTags)
404− then return "<!-- unsafe HTML removed -->"
405− else return $ open ++ rest ++ "</style>"
320+ return $ open ++ rest ++ "</style>"
406321
407322htmlBlockElement :: GenParser Char ParserState [Char]
408323htmlBlockElement = choice [ htmlScript, htmlStyle, htmlComment, xmlDec, definition ]