ezyang / ezyang/htmlpurifier

"Trying to get property 'browsable' of non-object" in HTMLPurifier_AttrTransform_* methods, because parse or getSchemeObj of HTMLPurifier_URIParser can return false

Open
#343 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
3.4k
Forks
361
Avg merge
3d 41m
Merged PRs (30d)
2

Description

Hi!
I have an PHP error "Trying to get property 'browsable' of non-object" when I execute code in HTMLPurifier_AttrTransform_TargetBlank and HTMLPurifier_AttrTransform_Nofollow, because, they don't check results of

(new HTMLPurifier_URIParser())->parse (can return false)
(new HTMLPurifier_URIParser())->parse->getSchemeObj (also can return false)

for false value. Methods suggest, that only object can be returned.

$url = $this->parser->parse($attr['href']);
$scheme = $url->getSchemeObj($config, $context);

if ($scheme->browsable && !$url->isLocal($config, $context)) {

need replace to something like that:

$url = $this->parser->parse($attr['href']);
if(!$url) return $attr;
$scheme = $url->getSchemeObj($config, $context);
if(!$scheme) return $attr;
if ($scheme->browsable && !$url->isLocal($config, $context)) {

You can test purify on html like this:

<a href="javascript:">some text</a>

My config for new HTMLPurifier:

$config = HTMLPurifier_Config::createDefault();
$config->set("HTML.Nofollow", true);
$config->set("HTML.TargetNoreferrer", true);
$config->set("HTML.TargetNoopener", true);
$config->set("HTML.TargetBlank", true);
$config->set('Attr.EnableID', true);
$def = $config->getHTMLDefinition(true);
$def->addAttribute('img', 'src', new ParameterURIDefinition($this->whiteListedResources));
$def->addAttribute('div', 'data-react', new \HTMLPurifier_AttrDef_Text());
$def->addAttribute('a', 'href', new \HTMLPurifier_AttrDef_Text());

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate HTMLPurifier_AttrTransform_TargetBlank and HTMLPurifier_AttrTransform_Nofollow, then trace HTMLPurifier_URIParser::parse and getSchemeObj. Reproduce the warning with an href of javascript:, and confirm processing safely handles false results without accessing browsable.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.