Secure HTML parser and filter: Parse and filter insecure HTML tags and CSS styles

Recommend this page to a friend!

Download

Info

Example

Demos

Screenshots

Files

Install with Composer

Download

Reputation

Support forum

Blog

Links

Ratings				Unique User Downloads		Download Rankings
87%				Total: 1,955		All time: 2,011 This week: 47

Version		License		PHP version		Categories
`secure-html-filter` 1.0.0		BSD License		4		HTML, Security, Parsers

Description

Author

Manuel Lemos

This package can be used to parse and filter insecure HTML tags and CSS styles.

It comes with a general purpose markup parser class that can parse any type of markup documents like HTML, XML and DTD files.

There are several other classes that can be chained together to retrieve the document token elements returned by the main markup parser class and filter the document elements in an useful way.

The markup validator filter class validates a document against a DTD, eventually removing invalid tags and attributes.

The safe HTML filter class uses several white lists to process HTML tags and data returned by the markup validator class and discards potentially harmful HTML tags and CSS that could be used to perform cross-site scripting (XSS) or cross-site request forgery (CSRF) security attacks.

The filtered HTML tokens can be reassembled to return a well-formed and secure HTML document.

The HTML links filter class can extract the links contained in an HTML document.

The DTD parser and CSS parser are utility classes used by the other classes.

Manuel Lemos

Performance

Level

Name:	Manuel Lemos is available for providing paid consulting. Contact Manuel Lemos .
Classes:	45 packages by Manuel Lemos
Country:	Portugal
Age:	55
All time rank:	1
Week rank:	5	1 in Portugal

Level 3

Example


<?php

/*

 * test_safe_html_filter.php

 *

 * @(#) $Header: /home/mlemos/cvsroot/markupparser/test_safe_html_filter.php,v 1.10 2009/08/21 05:21:12 mlemos Exp $

 *

 */



    require_once('css_parser.php');

    require_once('dtd_parser.php');

    require_once('filecacheclass.php');

    require_once('markup_parser.php');

    require_once('markup_filter_validator.php');

    require_once('markup_filter_safe_html.php');



    $message_file = ((IsSet($_SERVER['argv']) && count($_SERVER['argv'])>1) ? $_SERVER['argv'][1] : 'test/sample/simple.html');



    $filter = new markup_filter_safe_html_class;



    /*  Set to 1 if you need to track line numbers of errors or element

     *  positions

     */

    $filter->track_lines = 1;



    /*  Add here the proprietary CSS properties that you know that are safe

     *  to allow.

     */

    $filter->safe_proprietary_css_properties = array(

        '-moz-border-radius'=>array(),

        '-moz-border-radius-topleft'=>array(),

        '-moz-border-radius-topright'=>array(),

        '-moz-border-radius-bottomleft'=>array(),

        '-moz-border-radius-bottomright'=>array(),

        '-webkit-border-radius'=>array(),

        '-webkit-border-top-left-radius'=>array(),

        '-webkit-border-top-right-radius'=>array(),

        '-webkit-border-bottom-left-radius'=>array(),

        '-webkit-border-bottom-right-radius'=>array(),

    );

    

    /*  Add here the CSS property function names properties that you know

     *  that are safe to allow.

     */

    $filter->safe_css_property_functions = array(

        'alpha'=>array()

    );



    $parameters=array(

        'File'=>$message_file,



        /* Read a markup from a string instead of a file                  */

        /* 'Data'=>'<html><head><title>My HTML data string</title></head>

                    <body><p>My HTML data string</p></body></html>',            */



        /*  Set to 1 if want to filter HTML that only contains the body

            part of a page                                                */

        'OnlyBody'=>0,



        /*  Set to the path of the directory where cache files will be

            stored with parsed DTD information to avoid parsing overhead,

            otherwise it may become very slow.                            */

        'DTDCachePath'=>'',

    );



/*

 * The following lines are for testing purposes.

 * Remove these lines when adapting this example to real applications.

 */

    if(defined('__TEST'))

    {

        if(IsSet($__test_options['parameters']))

            $parameters = $__test_options['parameters'];

    }



    $start = microtime();

    if(($success = $filter->StartParsing($parameters)))

    {

        $output = '';

        do

        {

            if(!($success = $filter->Parse($end, $elements)))

                break;

            $te = count($elements);

            for($e = 0; $e < $te; ++$e)

            {

                /*

                var_dump($elements[$e]);

                */

                if(!($success = $filter->RewriteElement($elements[$e], $markup)))

                    break;

                $output.= $markup;

            }

        }

        while(!$end);

        if($success)

            $success = $filter->FinishParsing();

        if($success)

            echo $output;

    }

    $end = microtime();

    if(!$success)

    {

        echo 'Markup parsing error: '.$filter->error.' at position '.$filter->error_position;

        if($filter->track_lines

        && $filter->GetPositionLine($filter->error_position, $line, $column))

            echo ' line '.$line.' column '.$column;

        echo "\n";

    }

    for($warning = 0, Reset($filter->warnings); $warning < count($filter->warnings); Next($filter->warnings), $warning++)

    {

        $w = Key($filter->warnings);

        echo 'Warning: ', $filter->warnings[$w], ' at position ', $w;

        if($filter->track_lines

        && $filter->GetPositionLine($w, $line, $column))

            echo ' line '.$line.' column '.$column;

        echo "\n";

    }

    if(!defined('__TEST'))

        echo 'Timer: ', doubleval(strtok($end,' ')) + doubleval(strtok('')) - doubleval(strtok($start,' ')) - doubleval(strtok('')), "\n";

?>

HTML and CSS filter

Screenshots (1)

Files (38)

File	Role	Description
`documentation` (6 files)
`test` (1 file, 3 directories)
`test_safe_html_filter.php`	Example	Example script that demonstrates how to parse and filter and HTML document file
`markup_filter_safe_html.php`	Class	Secure HTML filter class
`css_parser.php`	Class	CSS stylesheet parser class
`dtd_parser.php`	Class	DTD parser class
`markup_filter_get_html_links.php`	Class	HTML parser class to extract links from pages
`markup_filter_no_follow_html_links.php`	Class	No follow HTML links filter class
`markup_filter_validator.php`	Class	Filter class that validates HTML against a DTD
`markup_parser.php`	Class	Main markup parser class
`secure_html_filter.php`	Example	Script with forms to test the secure HTML filter classes
`test_css_parser.php`	Example	CSS parser test script
`test_get_html_links.php`	Example	Example script that demonstrates how to extract links from HTML pages
`test_markup_parser.php`	Example	Example script that demonstrates how to parse any markup document into token elements
`test_xss_attacks.php`	Test	Script that tests the results of the safe HTML filter class against the XSS attack vectors from ha.ckers.org

Files (38)

documentation

File	Role	Description
`css_parser_class.html`	Doc.	Documentation of the CSS parser class
`dtd_parser_class.html`	Doc.	Documentation of the DTD parser class
`markup_filter_get_html_links_class.html`	Doc.	Documentation of the filter get HTML links class
`markup_filter_safe_html_class.html`	Doc.	Documentation of the filter HTML safe class
`markup_filter_validator_class.html`	Doc.	Documentation of the filter validator class
`markup_parser_class.html`	Doc.	Documentation of the main markup parser class

Files (38)

test

File	Role	Description
`expect` (14 files)
`generated` (1 file)
`sample` (2 files)
`test.php`	Test	Markup parser unit test suite

Files (38)

test

expect

File	Role	Description
`entities.txt`	Data	Unit test expected results
`entitiesinunsafeurl.txt`	Data	Entities in unsafe URL test parsing output
`quoteseparatingunsafeattribute.txt`	Data	Quotes separating unsafe attribute test parsing output
`safehtmlfilter.txt`	Data	Test expected output
`selectors.txt`	Data	CSS selectors parsing output
`simple.txt`	Data	Unit test expected results
`track_lines.txt`	Data	Unit test expected results
`unfinishedquotedtagattribute.txt`	Data	Unit test expected results
`unfinishedquotedtagattributevalue.txt`	Data	Unit test expected results
`unfinishedtag.txt`	Data	Unit test expected results
`unfinishedtagattribute.txt`	Data	Unit test expected results
`unfinishedtagattributevalue.txt`	Data	Unit test expected results
`unfinishedtagend.txt`	Data	Unit test expected results
`unicodestylevalues.txt`	Data	Test expected output

Files (38)

test

generated

File	Role	Description
`.cvsignore`	Data	Dummy file to force the distribution of this directory

Files (38)

test

sample

File	Role	Description
`simple.html`	Data	HTML document used in the example scripts
`xssAttacks.xml`	Data	Definitions for the XSS attack vectors from ha.ckers.org

The PHP Classes site has supported package installation using the Composer tool since 2013, as you may verify by reading this instructions page.

Install with Composer

	secure-html-filter-2010-10-07.zip 122KB
	secure-html-filter-2010-10-07.tar.gz 103KB
	Install with Composer

Needed packages

Class	Download	Why it is needed	Dependency
PHP Forms Class with HTML Generator and JavaScript Validation	.zip .tar.gz	Used in the secure_html_filter.php Web interface test script	Conditional
Generic XML parser class	.zip .tar.gz	It is neeeded to parse the xssAttacks.xml file with tested XSS attack vectors definitions	Conditional
File cache class	.zip .tar.gz	It is necessary to manage parsed DTD cache files	Conditional

Version Control

Reuses

Unique User Downloads

Download Rankings

Total:	1,955
This week:	0

All time:	2,011
This week:	47

User Ratings

User Comments (1)

	All time
Utility:	100%
Consistency:	100%
Documentation:	91%
Examples:	95%
Tests:	87%
Videos:	-
Overall:	87%
Rank:	3

As always another top quality class from well known PHP guru!...
15 years ago (max costa)

82%

Applications that use this package

No pages of applications that use this class were specified.

If you know an application of this package, send a message to the author to add a link here.

Other classes that need this package

Class	Why it is needed	Dependency
PHP Markdown Parser	Convert parsed Markdown tags to HTML	Conditional

Pages that reference this package


Now, if you really need to accept HTML formatted user input, like you need to let the user enter an HTML formatted text, you need a really powerful HTML parser that recognizes dangerous HTML or malformed tags that could be used to make JavaScript code execute when the HTML is displayed...

Latest pages that reference packages

About us

Advertise on this site

For more information send a message to info at phpclasses dot org.