search

ezyang / htmlpurifier

Standards compliant HTML filter written in PHP
http://htmlpurifier.org
GNU Lesser General Public License v2.1
3.07k stars 327 forks source link

data uri rule is too strict #232

Open ywfkp opened 4 years ago

ywfkp commented 4 years ago

jpeg picture generate base64 uri like this [data:image/jpg;base64,/9xxxxxxxxxx] in my iphone but it can't pass the data uri rule.

for example this img can't pass the rule 
        $img1 = '<img src="data:image/jpg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAkGBwgHBhUIBwgWEBUWFxUWFxUVGBceIRsVHRciHRwdHR0kICggISYxHh8YITEtJSkvLi4uHSAzODMtNygtLisBCgoKDQUFDgUFDisZExkrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrK//AABEIAJYA8AMBIgACEQEDEQH/xAAbAAEAAgMBAQAAAAAAAAAAAAAABgcBAgQFA//EADUQAAIBAwIDBgQEBgMAAAAAAAABAgMEEQUGEiExBxNBUWFxFDKRoRUiQvEzgcHR4fAWF3L/xAAVAQEBAAAAAAAAAAAAAAAAAAAAAf/EABYRAQEBAAAAAAAAAAAAAAAAAAARAf/aAAwDAQACEQMRAD8AvEwZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABh8iL7v3rp22VGjVhKtXqfw6FJZnJ+3gvX6ZAlIK2he9qGsrvLWxtdPg+iqtynj1SyvshKHappse/dxZ3qXWmk4tryTxHn/MCyQRbZe8bfc0J0KlvK3uKLxWoT6xfmvNepKQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARXdu99N20429SMq9efyW9JZnLPRteC9fpkk9R8MHJrpkrXsis6erKvu6/XHXr1qkYyf6KcXhRXl/ZID6/8ALd/cHxT2Ou768PfR48e3n6YOHsl4de12+3LqNnJVnVUId4n+Snh/ki2uqxh48l5lq4WMGsYRj0X7gbJYXINZWDIAqjfOp2W0O0601yvPghVoVoVuFZclFflbS6vLil/5O9dout3cfiNJ2Pc1KXXjm1BuPmlh5+5LtT2xo2q6nT1LULCNWrS+SUs8lnK5dHh81k9jhWMJARjaG9dO3M50KVOdCvT/AIlCqsTj648V6/XBKSsO022hoev2O57JcFRXFOjUa/XSnnKfnhKWPf0LNTSXNgbAwnlGQAAAAAAAAAAAAAAAAAAAAAAAAMNZWCqqj1Lsx1atcUrKVzptabqvg+ahN/Ny8vthLp42q+hWe9I1d277pbPdaULeFP4i54XhzWcRhny6fXPggJntfcmnbo0z8Q0ubcOJx/NFpqSxlNfzR7RyadYWmmWcbSwoRpQisRjFYSX++J0TmoRy2BuGfCnVecVD7PpyAZMSkorMmcr4uNpVH1HCm8tt+5BFO0TbV/uuxpUtPvY0XTqxqrji2m4p8OcdObfgQHe9bfjr0dv3evUp1LmaiqdtFxlweMpPCaS+/PyZYHaXrOp6BtOpqWkOCnBwTc1nEZSUcpZ65a6muxdn0tOn+O6jdyvLqtFN1p/pjJZxBeC5/t0KJTpFn+H6XSsu9c+7hGHFLq+FJZb83g7jCWEZAAAAAAAAAAAAAAAAAAAAAAAAAw+hWm+KF3tjeEN521tKtRdLubmMPmjFPMZpeSwvp6lmGkoRnHEllf0A8LRNxaTrlsq+l6nGon4KS4l6OL5p+5xbt3bp22LPvK0+9rS5UqMXmc5Pkkl1S9Tn1fsv2lqlbv56Z3Un1dGUoc/ZcvsfbbvZ1trb12ryysnOoulSrJza9s8k/VLIGmxt22+6tL7yoo0q8XKNahnnBptdHzw/8EmSklhTZGdy9nWh69e/HuM7av41qEuCTfm/Bv1xk8v/AK01NLhW+r7h8uPw98iYPc3VuzSdr2jqX1wnUafBRjznOXgklzw349CAbS3/AHui0q0d26feuVSq6lNOlJ8NOSTUVJ4f2Jztvs70HQbn42NKVxW699Xlxyz5rwT9Us+pLmk1zQFT6hV1rtLnDTrfS6llY8cZ1atZcMqii8qMY+/v9sFq0acaNJU4LCSSXslhI+mF5GQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//Z">';

but this img can pass the rule

       $img2 = '<img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAkGBwgHBhUIBwgWEBUWFxUWFxUVGBceIRsVHRciHRwdHR0kICggISYxHh8YITEtJSkvLi4uHSAzODMtNygtLisBCgoKDQUFDgUFDisZExkrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrK//AABEIAJYA8AMBIgACEQEDEQH/xAAbAAEAAgMBAQAAAAAAAAAAAAAABgcBAgQFA//EADUQAAIBAwIDBgQEBgMAAAAAAAABAgMEEQUGEiExBxNBUWFxFDKRoRUiQvEzgcHR4fAWF3L/xAAVAQEBAAAAAAAAAAAAAAAAAAAAAf/EABYRAQEBAAAAAAAAAAAAAAAAAAARAf/aAAwDAQACEQMRAD8AvEwZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABh8iL7v3rp22VGjVhKtXqfw6FJZnJ+3gvX6ZAlIK2he9qGsrvLWxtdPg+iqtynj1SyvshKHappse/dxZ3qXWmk4tryTxHn/MCyQRbZe8bfc0J0KlvK3uKLxWoT6xfmvNepKQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARXdu99N20429SMq9efyW9JZnLPRteC9fpkk9R8MHJrpkrXsis6erKvu6/XHXr1qkYyf6KcXhRXl/ZID6/8ALd/cHxT2Ou768PfR48e3n6YOHsl4de12+3LqNnJVnVUId4n+Snh/ki2uqxh48l5lq4WMGsYRj0X7gbJYXINZWDIAqjfOp2W0O0601yvPghVoVoVuFZclFflbS6vLil/5O9dout3cfiNJ2Pc1KXXjm1BuPmlh5+5LtT2xo2q6nT1LULCNWrS+SUs8lnK5dHh81k9jhWMJARjaG9dO3M50KVOdCvT/AIlCqsTj648V6/XBKSsO022hoev2O57JcFRXFOjUa/XSnnKfnhKWPf0LNTSXNgbAwnlGQAAAAAAAAAAAAAAAAAAAAAAAAMNZWCqqj1Lsx1atcUrKVzptabqvg+ahN/Ny8vthLp42q+hWe9I1d277pbPdaULeFP4i54XhzWcRhny6fXPggJntfcmnbo0z8Q0ubcOJx/NFpqSxlNfzR7RyadYWmmWcbSwoRpQisRjFYSX++J0TmoRy2BuGfCnVecVD7PpyAZMSkorMmcr4uNpVH1HCm8tt+5BFO0TbV/uuxpUtPvY0XTqxqrji2m4p8OcdObfgQHe9bfjr0dv3evUp1LmaiqdtFxlweMpPCaS+/PyZYHaXrOp6BtOpqWkOCnBwTc1nEZSUcpZ65a6muxdn0tOn+O6jdyvLqtFN1p/pjJZxBeC5/t0KJTpFn+H6XSsu9c+7hGHFLq+FJZb83g7jCWEZAAAAAAAAAAAAAAAAAAAAAAAAAw+hWm+KF3tjeEN521tKtRdLubmMPmjFPMZpeSwvp6lmGkoRnHEllf0A8LRNxaTrlsq+l6nGon4KS4l6OL5p+5xbt3bp22LPvK0+9rS5UqMXmc5Pkkl1S9Tn1fsv2lqlbv56Z3Un1dGUoc/ZcvsfbbvZ1trb12ryysnOoulSrJza9s8k/VLIGmxt22+6tL7yoo0q8XKNahnnBptdHzw/8EmSklhTZGdy9nWh69e/HuM7av41qEuCTfm/Bv1xk8v/AK01NLhW+r7h8uPw98iYPc3VuzSdr2jqX1wnUafBRjznOXgklzw349CAbS3/AHui0q0d26feuVSq6lNOlJ8NOSTUVJ4f2Jztvs70HQbn42NKVxW699Xlxyz5rwT9Us+pLmk1zQFT6hV1rtLnDTrfS6llY8cZ1atZcMqii8qMY+/v9sFq0acaNJU4LCSSXslhI+mF5GQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//Z">';
ywfkp commented 4 years ago

oh my god the code is missing

ezyang commented 4 years ago

The data validator uses ImageMagick to verify if the image is well formed or not. Maybe there is something wrong with the upper image.