Re: Using kses HTML filter

Thijs Kinkhorst wrote:
> 
> On Fri, May 9, 2008 00:29, Paul Lesniewski wrote:
>>> SquirrelMail uses html_filter which can be switched to blacklist or
>>> whitelist mode. You are using blacklist.
>>
>> There is also this more recent incarnation of kses:
>>
>> http://bioinformatics.org/phplabware/internal_utilities/htmLawed
>>
>> Or:
>>
>> http://htmlpurifier.org/
> 
> We clearly need some kind of pluggable interface for that. Wouldn't be
> very complicated: gets raw HTML string, has to deliver it back sanitised.
> 

Unsafe images and attached images. Integration with email links. Regression
tests against all issues reported about htmlfilter vulnerabilities or bugs.
Regression tests against known vulnerabilities of new filtering solution.
Reverse engineering vulnerability tests with minimal information provided by
new filter's author. Reverse engineering all IE issues covered by
html_filter code, if Konstantin does not provide the list.



> Any volunteers? :-)
> 

switch ($filter) {
case 'kses':
  run_kses($args);
  break;
case 'html_filter':
default:
  magicHTML($args);
}

-- 
View this message in context: http://www.nabble.com/Using-kses-HTML-filter-tp17133105p17145122.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel