"Trying to get property 'browsable' of non-object" in HTMLPurifier_AttrTransform_* methods, because parse or getSchemeObj of HTMLPurifier_URIParser can return false
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
Hi!
I have an PHP error "Trying to get property 'browsable' of non-object" when I execute code in HTMLPurifier_AttrTransform_TargetBlank and HTMLPurifier_AttrTransform_Nofollow, because, they don't check results of
(new HTMLPurifier_URIParser())->parse (can return false)
(new HTMLPurifier_URIParser())->parse->getSchemeObj (also can return false)
for false value. Methods suggest, that only object can be returned.
$url = $this->parser->parse($attr['href']);
$scheme = $url->getSchemeObj($config, $context);
if ($scheme->browsable && !$url->isLocal($config, $context)) {
need replace to something like that:
$url = $this->parser->parse($attr['href']);
if(!$url) return $attr;
$scheme = $url->getSchemeObj($config, $context);
if(!$scheme) return $attr;
if ($scheme->browsable && !$url->isLocal($config, $context)) {
You can test purify on html like this:
<a href="javascript:">some text</a>
My config for new HTMLPurifier:
$config = HTMLPurifier_Config::createDefault();
$config->set("HTML.Nofollow", true);
$config->set("HTML.TargetNoreferrer", true);
$config->set("HTML.TargetNoopener", true);
$config->set("HTML.TargetBlank", true);
$config->set('Attr.EnableID', true);
$def = $config->getHTMLDefinition(true);
$def->addAttribute('img', 'src', new ParameterURIDefinition($this->whiteListedResources));
$def->addAttribute('div', 'data-react', new \HTMLPurifier_AttrDef_Text());
$def->addAttribute('a', 'href', new \HTMLPurifier_AttrDef_Text());
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate HTMLPurifier_AttrTransform_TargetBlank and HTMLPurifier_AttrTransform_Nofollow, then trace HTMLPurifier_URIParser::parse and getSchemeObj. Reproduce the warning with an href of javascript:, and confirm processing safely handles false results without accessing browsable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100