Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Whitelist Sanitizer #600

Merged
merged 59 commits into from
Apr 28, 2017
Merged

Add Whitelist Sanitizer #600

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
59 commits
Select commit Hold shift + click to select a range
e975181
Initial commit to allowed-tags-sanitizer branch.
Dec 14, 2016
47fd538
Adding generated amp allowed tags and initial copy of allowed-tags-sa…
Dec 15, 2016
ec1637d
Adding initial version of python script to generate allowed tags list
Dec 15, 2016
6f43c22
Add alternate names for allowed attributes and globally allowed attri…
delputnam Dec 15, 2016
71d160c
Completed python code to generate full attr_spec lists.
delputnam Dec 18, 2016
9430d36
Added the rest of the tag_spec rules.
delputnam Dec 18, 2016
0585ff8
Added spec_url and spec_name. Also corrected header text and removed …
delputnam Dec 18, 2016
5b46e77
Include tag in .
delputnam Dec 18, 2016
babec99
Wrapped tag and attribute definitions in a class.
delputnam Dec 19, 2016
e7e51f0
Adding basic whitelist sanitizer proof-of-concept.
delputnam Dec 20, 2016
589385c
Converted 'True' and 'False' strings into true and false bools in gen…
delputnam Dec 21, 2016
9e0c629
check for mandatory attributes and values during validation
delputnam Dec 21, 2016
2fb2aad
Include check for mandatory attributes alternate names.
delputnam Dec 21, 2016
09f175e
Added protocol checks to attr_spec validation.
delputnam Dec 21, 2016
db857e7
Added relative url check for attr rules.
delputnam Dec 21, 2016
a3fe590
Added disallowed empty attribute check.
delputnam Dec 21, 2016
4a1cda3
Added disallowed domain checks.
delputnam Dec 21, 2016
1f64134
Remove disallowed attributes and blacklisted attribute values from no…
delputnam Dec 22, 2016
e50207a
Check for empty array before deleting attributes from the attrs_to_re…
delputnam Dec 22, 2016
14de8eb
Remove disallowed attribute values.
delputnam Dec 23, 2016
b89f5dc
Removed some unused commented out code.
delputnam Dec 23, 2016
ffcca80
Some optimizations to reduce the number of extraneous function calls.
delputnam Dec 23, 2016
22fa869
Changed name of sanitizer to better reflect its actual function.
delputnam Dec 24, 2016
dbdb95b
Fixed class and file name and references.
delputnam Dec 24, 2016
971f6d6
Better attr_spec validation
delputnam Dec 24, 2016
ae3596e
Adding tests.
delputnam Dec 24, 2016
2a4644a
Added tag/attr_spec validation filters.
delputnam Dec 24, 2016
08f576b
Moved all sanitizers to filters.
delputnam Dec 25, 2016
9aaf807
More consistent function naming.
delputnam Dec 25, 2016
49bf688
Unit tests for validation functions.
delputnam Dec 25, 2016
71ab56b
Initial commit of benchmark tests.
delputnam Dec 26, 2016
17ee3b5
Additional tests to allow some sanitizers to fail faster for performa…
delputnam Dec 26, 2016
9af5b73
Removed filters and combined some functions to improve performance.
delputnam Dec 26, 2016
52844a1
Fixed typos
delputnam Dec 26, 2016
812b137
Fixed comments
delputnam Dec 27, 2016
b15e997
Unit tests update
delputnam Dec 27, 2016
1ebe8f3
Moved all benchmark data to subdirectory tests/benchmark/test-data.
delputnam Dec 28, 2016
c420698
Optimization: removed checking for allowed protocol in loop and repla…
delputnam Dec 28, 2016
87fd611
Added benchmark test data with AMP errors.
delputnam Dec 28, 2016
68da2ad
Better banchmark output.
delputnam Dec 28, 2016
a598ec9
Benchmark script to generate combined cachegrind output for multiple …
delputnam Dec 28, 2016
74bb6e0
Added tests for multiple srcset URLs without src attribute and bug fi…
delputnam Dec 29, 2016
d47fd4d
Allow attributes by whitelisted regex (speficically data-*)
delputnam Dec 29, 2016
79f8bd1
Moved layout allowed attributes to generated class file.
delputnam Dec 29, 2016
7e5b1f9
Allow experimental tags ('amp-share-tracking') with no protoascii file
delputnam Dec 29, 2016
b5e50eb
Commented out section to write sanitized data to file for analysis.
delputnam Dec 29, 2016
7e38560
Added comments at top of the file to explain how to use it to generat…
delputnam Dec 29, 2016
23c88cd
Added comments to all attribute rule test functions.
delputnam Dec 29, 2016
933512c
Skip processing of CDATA, to allow necessary javascript in nodes such…
delputnam Dec 30, 2016
2361ae6
Temporarily remove bad script tests.
delputnam Dec 30, 2016
eee8c25
More tests
delputnam Dec 30, 2016
702eaab
Removed extraneous files from benchmark test data
delputnam Dec 30, 2016
32a2c58
Fixed typo in global variable declaration.
delputnam Dec 30, 2016
fa2d0bd
Removed unfinished attribute tests that should not work yet.
delputnam Dec 30, 2016
1389956
Moving const arrays to static arrays to support older versions of php.
delputnam Dec 30, 2016
5e00162
Temporarily disabling tests that use ReflectionMethod::setAccessible …
delputnam Dec 30, 2016
4eb4b39
Removed benchmark from tests since this is not really a unit test.
delputnam Dec 30, 2016
87af18c
Moved private function tests to different file/testunit
delputnam Jan 1, 2017
1cbcb07
Handle edge cases for url checks with multiple values or alternative …
delputnam Jan 3, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
597 changes: 597 additions & 0 deletions bin/amp_wp_build.py
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 3 additions & 1 deletion includes/class-amp-post-template.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@

require_once( AMP__DIR__ . '/includes/sanitizers/class-amp-style-sanitizer.php' );
require_once( AMP__DIR__ . '/includes/sanitizers/class-amp-blacklist-sanitizer.php' );
require_once( AMP__DIR__ . '/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php' );
require_once( AMP__DIR__ . '/includes/sanitizers/class-amp-img-sanitizer.php' );
require_once( AMP__DIR__ . '/includes/sanitizers/class-amp-video-sanitizer.php' );
require_once( AMP__DIR__ . '/includes/sanitizers/class-amp-iframe-sanitizer.php' );
Expand Down Expand Up @@ -230,13 +231,14 @@ private function build_post_content() {
), $this->post ),
apply_filters( 'amp_content_sanitizers', array(
'AMP_Style_Sanitizer' => array(),
'AMP_Blacklist_Sanitizer' => array(),
// 'AMP_Blacklist_Sanitizer' => array(),
'AMP_Img_Sanitizer' => array(),
'AMP_Video_Sanitizer' => array(),
'AMP_Audio_Sanitizer' => array(),
'AMP_Iframe_Sanitizer' => array(
'add_placeholder' => true,
),
'AMP_Tag_And_Attribute_Sanitizer' => array(),
), $this->post ),
array(
'content_max_width' => $this->get( 'content_max_width' ),
Expand Down
Loading