| Subject: | HTML::StripScripts not allowing 'title' attribute in 'a'. |
| Date: | Wed, 13 Feb 2013 12:56:04 +0000 |
| To: | bug-HTML-StripScripts [...] rt.cpan.org |
| From: | Bruce James <custard [...] cpan.org> |
While using HTML::StripScripts with the following config we discovered that
'title' attributes seem to be being stripped despite the 'Rules' section.
Tried everything to get it to work and the only way I discovered was to
insert an entry into the attrib_whitelist.
I believe that 'title' should be included along with 'style' as a default
global attribute.
Config:
my $hss = HTML::StripScripts::Parser->new(
{
Context => 'Flow',
Rules => {
'*' => 0,
p => 1,
h1 => 1,
h2 => 1,
h3 => 1,
h4 => 1,
h5 => 1,
ul => 1,
ol => 1,
li => 1,
br => 1,
em => 1,
span => 1,
strong => 1,
a => {
title => 1,
},
img => {
src => 1,
alt => 1,
},
script => 0, ## Disallow script tag
},
AllowHref => 1,
AllowRelURL => 1,
AllowSrc => 1,
AllowMailto => 1,
},
strict_comment => 1, ## HTML::Parser options
strict_names => 1,
);
# BEJ - Had to hack the 'title' attribute in. Don't know why it's not
in StripScripts.
# This line avoids having to subclass. I'll try and submit a fix to
CPAN.
$hss->{_hssAttrib}->{a}->{title} = 'text';
HTML::StripScripts 1.05
See line: 1034. I think this should read:
my %attr = ( 'title' => 'text', 'style' => 'style' );
1015 =item init_attrib_whitelist ()
1016
1017 Returns a reference to the C<Attrib> whitelist, which determines which
1018 attributes each tag can have and the values that those attributes can
1019 take.
1020
1021 It is a hash, and the keys are lowercase tag names.
1022
1023 The values in the hash are hashrefs. The keys in these subhashes are
1024 lowercase attribute names, and the values are attribute value class
names,
1025 which are short strings describing the type of values that the
1026 attribute can take, such as C<color> or C<number>.
1027
1028 =cut
1029
1030 use vars qw(%_Attrib);
1031
1032 BEGIN {
1033
1034 my %attr = ( 'style' => 'style' );
1035
Unless of course I'm doing it wrong or you have a better idea? :-)
B
--
http://custard-cat.blogspot.com/
http://pomegranate.ltd.uk/+
http://twitter.com/CustardCat