ezyang / htmlpurifier

Standards compliant HTML filter written in PHP
http://htmlpurifier.org
GNU Lesser General Public License v2.1
3.02k stars 323 forks source link

Using HTML comments between nested tables nodes raises an exception #398

Open chrisvoo opened 4 months ago

chrisvoo commented 4 months ago

Using the following HTML comment raises the exception below:

<!-- [if gt mso 15]>
<style type="text/css" media="all">
/* Outlook 2016 Height Fix */
table, tr, td {border-collapse: collapse;}
tr { font-size:0px; line-height:0px; border-collapse: collapse; }
</style>
<![endif]-->
<table id="backgroundTable" style="width: 100%;" border="0" cellspacing="0" cellpadding="0">
    <tbody>
        <tr>
            <td style="padding-bottom: 10px;" align="center" valign="top" bgcolor="#eaebeb">
                <table class="fullWidth" style="width: 600px; min-width: 600px;" border="0" cellspacing="0"
                    cellpadding="0">
                    <tbody>
                        <tr><!-- Start header images -->
                            <td style="background-color: #ffffff;" align="center" valign="top">
                                <table class="fullWidth" style="width: 100%;" border="0" cellspacing="0"
                                    cellpadding="0">
                                    <tbody>
                                        <tr>
                                            <td align="center" valign="top">hi/td>
                                        </tr>
                                    </tbody>
                                </table>
                            </td>
                            <!-- End header images -->
                        </tr>
                        <tr><!-- 2 Col Grid Starts -->
                            <td style="background-color: #ffffff;" align="center" valign="top">
                                <table class="fullWidth" style="width: 600px;" border="0" cellspacing="0"
                                    cellpadding="0">
                                    <tbody>
                                        <tr><!-- Main Cell Starts -->
                                            <td class="fullWidth-left"
                                                style="padding-bottom: 10px; padding-top: 20px; vertical-align: top; font-weight: normal;"
                                                align="center" valign="top">
                                                <table class="mobileContentWidth" style="width: 540px;" border="0"
                                                    cellspacing="0" cellpadding="0">
                                                    <tbody>
                                                        <tr>
                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 23px; line-height: 28px; color: #007788; font-weight: bold; padding-bottom: 15px;"
                                                                align="left" valign="top">Hi
                                                            </td>
                                                        </tr>
                                                        <tr>
                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #231f20; padding-bottom: 15px;"
                                                                align="left" valign="top">Hi [first_name],</td>
                                                        </tr>
                                                        <tr>
                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #231f20;"
                                                                align="left" valign="top">Hi Hi Hi:</p>
                                                                <ul>
                                                                    <li>Hi</li>
                                                                    <li>Hi</li>
                                                                    <li>Hi</li>
                                                                </ul>
                                                            </td>
                                                        </tr>
                                                    </tbody>
                                                </table>
                                            </td>
                                            <!-- Main Cell Ends -->
                                        </tr>
                                    </tbody>
                                </table>
                            </td>
                            <!-- 2 Col Grid Ends -->
                        </tr>
                        <tr><!-- Table List Module Starts -->
                            <td style="background-color: #ffffff;" align="center" valign="top">
                                <table class="fullWidth" style="width: 600px;" border="0" cellspacing="0"
                                    cellpadding="0"><!-- Inner Table List Module Starts -->
                                    <tbody>
                                        <tr><!-- 2 Col Grid Starts -->
                                            <td style="padding-top: 5px; padding-bottom: 5px; background-color: #ffffff;"
                                                align="center" valign="top">
                                                <table class="fullWidth"
                                                    style="width: 600px; background-color: #ffffff;" border="0"
                                                    cellspacing="0" cellpadding="0">
                                                    <tbody>
                                                        <tr><!-- Main Cell Starts -->
                                                            <td class="fullWidth-left"
                                                                style="padding-bottom: 5px; padding-top: 5px; vertical-align: top; font-weight: normal;"
                                                                align="center" valign="top">
                                                                <table class="mobileContentWidth" style="width: 545px;"
                                                                    border="0" cellspacing="0" cellpadding="0"
                                                                    bgcolor="#ffffff">
                                                                    <tbody>
                                                                        <tr>
                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 18px; line-height: 21px; color: #f39200; background-color: #eaebeb; padding-top: 15px;"
                                                                                align="center" valign="top">
                                                                                <strong>Hi</strong>: Hi</td>
                                                                        </tr>
                                                                        <tr>
                                                                            <td style="border-bottom: 1px solid #ffffff; padding-bottom: 5px;"
                                                                                align="center" valign="top">
                                                                                <table class="fullWidth"
                                                                                    style="width: 100%;" border="0"
                                                                                    cellspacing="0" cellpadding="0">
                                                                                    <tbody>
                                                                                        <tr>
                                                                                            <th class="fullWidth"
                                                                                                style="padding-top: 20px; padding-bottom: 5px; font-weight: normal; vertical-align: top; background-color: #eaebeb;"
                                                                                                align="center"
                                                                                                valign="top">
                                                                                                <table class="fullWidth"
                                                                                                    style="width: 480px;"
                                                                                                    border="0"
                                                                                                    cellspacing="0"
                                                                                                    cellpadding="0"
                                                                                                    bgcolor="#eaebeb">
                                                                                                    <tbody>
                                                                                                        <tr>
                                                                                                            <td class="fullWidth-left"
                                                                                                                style="padding-bottom: 15px; padding-top: 0px; vertical-align: middle; font-weight: normal; background-color: #eaebeb;"
                                                                                                                align="center"
                                                                                                                valign="middle"
                                                                                                                width="150">
                                                                                                                <table
                                                                                                                    class="mobileContentWidth"
                                                                                                                    border="0"
                                                                                                                    width="100%"
                                                                                                                    cellspacing="0"
                                                                                                                    cellpadding="0">
                                                                                                                    <tbody>
                                                                                                                        <tr>
                                                                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #1d1d1b; font-weight: bold; padding-bottom: 10px;"
                                                                                                                                align="left"
                                                                                                                                valign="top">
                                                                                                                                Hi
                                                                                                                            </td>
                                                                                                                        </tr>
                                                                                                                        <tr>
                                                                                                                            <th class="fullWidth"
                                                                                                                                style="padding-bottom: 10px; font-weight: normal; vertical-align: top;"
                                                                                                                                align="center"
                                                                                                                                valign="top">
                                                                                                                                <table
                                                                                                                                    class="fullWidth"
                                                                                                                                    style="width: 100%;"
                                                                                                                                    border="0"
                                                                                                                                    cellspacing="0"
                                                                                                                                    cellpadding="0">
                                                                                                                                    <tbody>
                                                                                                                                        <tr>
                                                                                                                                            <td style="vertical-align: middle; font-weight: normal;"
                                                                                                                                                align="center"
                                                                                                                                                valign="middle"
                                                                                                                                                width="28">
                                                                                                                                                <table
                                                                                                                                                    class="mobileContentWidth"
                                                                                                                                                    border="0"
                                                                                                                                                    width="100%"
                                                                                                                                                    cellspacing="0"
                                                                                                                                                    cellpadding="0">
                                                                                                                                                    <tbody>
                                                                                                                                                        <tr>
                                                                                                                                                            <td style="padding-right: 10px;"
                                                                                                                                                                align="center"
                                                                                                                                                                valign="top">
                                                                                                                                                                Hi
                                                                                                                                                            </td>
                                                                                                                                                        </tr>
                                                                                                                                                    </tbody>
                                                                                                                                                </table>
                                                                                                                                            </td>
                                                                                                                                            <td class="fullWidth-left"
                                                                                                                                                style="vertical-align: middle; font-weight: normal;"
                                                                                                                                                align="center"
                                                                                                                                                valign="middle"
                                                                                                                                                width="100%">
                                                                                                                                                <table
                                                                                                                                                    class="mobileContentWidth"
                                                                                                                                                    border="0"
                                                                                                                                                    width="100%"
                                                                                                                                                    cellspacing="0"
                                                                                                                                                    cellpadding="0">
                                                                                                                                                    <tbody>
                                                                                                                                                        <tr>
                                                                                                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #1d1d1b;"
                                                                                                                                                                align="left"
                                                                                                                                                                valign="top">
                                                                                                                                                                Hi
                                                                                                                                                            </td>
                                                                                                                                                        </tr>
                                                                                                                                                    </tbody>
                                                                                                                                                </table>
                                                                                                                                            </td>
                                                                                                                                        </tr>
                                                                                                                                    </tbody>
                                                                                                                                </table>
                                                                                                                            </th>
                                                                                                                        </tr>

                                                                                                                    </tbody>
                                                                                                                </table>
                                                                                                            </td>
                                                                                                            <td class="fullWidth-left"
                                                                                                                style="padding-bottom: 15px; padding-top: 0px; vertical-align: middle; font-weight: normal; background-color: #eaebeb;"
                                                                                                                align="center"
                                                                                                                valign="middle"
                                                                                                                width="150">
                                                                                                                <table
                                                                                                                    class="mobileContentWidth"
                                                                                                                    border="0"
                                                                                                                    width="100%"
                                                                                                                    cellspacing="0"
                                                                                                                    cellpadding="0">
                                                                                                                    <tbody>
                                                                                                                        <tr>
                                                                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #1d1d1b; font-weight: bold; padding-bottom: 10px;"
                                                                                                                                align="left"
                                                                                                                                valign="top">
                                                                                                                                Hi
                                                                                                                            </td>
                                                                                                                        </tr>
                                                                                                                        <tr>
                                                                                                                            <th class="fullWidth"
                                                                                                                                style="padding-bottom: 10px; font-weight: normal; vertical-align: top;"
                                                                                                                                align="center"
                                                                                                                                valign="top">
                                                                                                                                <table
                                                                                                                                    class="fullWidth"
                                                                                                                                    style="width: 100%;"
                                                                                                                                    border="0"
                                                                                                                                    cellspacing="0"
                                                                                                                                    cellpadding="0">
                                                                                                                                    <tbody>
                                                                                                                                        <tr>
                                                                                                                                            <td style="vertical-align: middle; font-weight: normal;"
                                                                                                                                                align="center"
                                                                                                                                                valign="middle"
                                                                                                                                                width="28">
                                                                                                                                                <table
                                                                                                                                                    class="mobileContentWidth"
                                                                                                                                                    border="0"
                                                                                                                                                    width="100%"
                                                                                                                                                    cellspacing="0"
                                                                                                                                                    cellpadding="0">
                                                                                                                                                    <tbody>
                                                                                                                                                        <tr>
                                                                                                                                                            <td style="padding-right: 10px;"
                                                                                                                                                                align="center"
                                                                                                                                                                valign="top">
                                                                                                                                                                Hi
                                                                                                                                                            </td>
                                                                                                                                                        </tr>
                                                                                                                                                    </tbody>
                                                                                                                                                </table>
                                                                                                                                            </td>
                                                                                                                                            <td class="fullWidth-left"
                                                                                                                                                style="vertical-align: middle; font-weight: normal;"
                                                                                                                                                align="center"
                                                                                                                                                valign="middle"
                                                                                                                                                width="100%">
                                                                                                                                                <table
                                                                                                                                                    class="mobileContentWidth"
                                                                                                                                                    border="0"
                                                                                                                                                    width="100%"
                                                                                                                                                    cellspacing="0"
                                                                                                                                                    cellpadding="0">
                                                                                                                                                    <tbody>
                                                                                                                                                        <tr>
                                                                                                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #1d1d1b;"
                                                                                                                                                                align="left"
                                                                                                                                                                valign="top">
                                                                                                                                                                Hi
                                                                                                                                                            </td>
                                                                                                                                                        </tr>
                                                                                                                                                    </tbody>
                                                                                                                                                </table>
                                                                                                                                            </td>
                                                                                                                                        </tr>
                                                                                                                                    </tbody>
                                                                                                                                </table>
                                                                                                                            </th>
                                                                                                                        </tr>
                                                                                                                    </tbody>
                                                                                                                </table>
                                                                                                            </td>
                                                                                                            <td class="fullWidth-left"
                                                                                                                style="padding-bottom: 15px; padding-top: 0px; vertical-align: middle; font-weight: normal; background-color: #eaebeb;"
                                                                                                                align="center"
                                                                                                                valign="middle"
                                                                                                                width="150">
                                                                                                                <table
                                                                                                                    class="mobileContentWidth"
                                                                                                                    border="0"
                                                                                                                    width="100%"
                                                                                                                    cellspacing="0"
                                                                                                                    cellpadding="0">
                                                                                                                    <tbody>
                                                                                                                        <tr>
                                                                                                                            <td align="left"
                                                                                                                                valign="top">
                                                                                                                                <a style="border: none; outline: none; text-decoration: none;"
                                                                                                                                    href="[session_saml_link]"
                                                                                                                                    target="_blank">Hi</a>
                                                                                                                            </td>
                                                                                                                        </tr>
                                                                                                                    </tbody>
                                                                                                                </table>
                                                                                                            </td>
                                                                                                        </tr>
                                                                                                    </tbody>
                                                                                                </table>
                                                                                            </th>
                                                                                        </tr>
                                                                                        <tr>
                                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 21px; background-color: #eaebeb; padding-top: 0px; padding-left: 15px; pading-right: 15px; padding-bottom: 15px"
                                                                                                align="left"
                                                                                                valign="top">
                                                                                                <p>Hi</p>
                                                                                                <p>Hi</p>
                                                                                            </td>
                                                                                        </tr>
                                                                                    </tbody>
                                                                                </table>
                                                                            </td>
                                                                        </tr>
                                                                    </tbody>
                                                                </table>
                                                            </td>
                                                            <!-- Main Cell Ends -->
                                                        </tr>
                                                    </tbody>
                                                </table>
                                            </td>
                                            <!-- 2 Col Grid Ends -->
                                        </tr>
                                    </tbody>
                                    <!-- Inner Table List Module Ends -->
                                </table>
                            </td>
                            <!-- Table List Module Ends -->
                        </tr>
                        <tr><!-- 2 Col Grid Starts -->
                            <td style="background-color: #ffffff;" align="center" valign="top">
                                <table class="fullWidth" style="width: 600px;" border="0" cellspacing="0"
                                    cellpadding="0">
                                    <tbody>
                                        <tr><!-- Main Cell Starts -->
                                            <td class="fullWidth-left"
                                                style="padding-bottom: 30px; padding-top: 10px; vertical-align: top; font-weight: normal;"
                                                align="center" valign="top">
                                                <table class="mobileContentWidth" style="width: 540px;" border="0"
                                                    cellspacing="0" cellpadding="0">
                                                    <tbody>
                                                        <tr>
                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #231f20; padding-bottom: 15px;"
                                                                align="left" valign="top">
                                                                <p>Hi <a
                                                                        style="font-weight: bold; text-decoration: none; outline: none; color: #231f20;"
                                                                        href="mailto:hi@hi.hi"
                                                                        target="_blank">Hi@Hi.Hi</a>.</p>
                                                            </td>
                                                        </tr>
                                                        <tr>
                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #231f20;"
                                                                align="left" valign="top">Hi,</td>
                                                        </tr>
                                                        <tr>
                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 18px; color: #231f20;"
                                                                align="left" valign="top">Hi</td>
                                                        </tr>
                                                    </tbody>
                                                </table>
                                            </td>
                                            <!-- Main Cell Ends -->
                                        </tr>
                                    </tbody>
                                </table>
                            </td>
                            <!-- 2 Col Grid Ends -->
                        </tr>
                        <tr><!-- Footer Starts -->
                            <td style="height: 55px; background-color: #e1e3e3; padding-top: 5px;" align="center"
                                valign="top">
                                <table class="mobileContentWidth" style="width: 540px;" border="0" cellspacing="0"
                                    cellpadding="0"><!-- List Layout Table Starts -->
                                    <tbody>
                                        <tr>
                                            <th class="fullWidth-center"
                                                style="padding-top: 0px; padding-bottom: 5px; font-weight: normal; vertical-align: middle;"
                                                align="center" valign="middle">
                                                <table style="width: 100%;" border="0" cellspacing="0" cellpadding="0">
                                                    <tbody>
                                                        <tr>
                                                            <td style="padding-bottom: 10px; padding-top: 10px; vertical-align: middle;"
                                                                align="left" valign="middle">
                                                                <table style="width: 100px;" border="0" cellspacing="0"
                                                                    cellpadding="0">
                                                                    <tbody>
                                                                        <tr>
                                                                            <td align="left" valign="middle"><a
                                                                                    style="border: none; outline: none; text-decoration: none;"
                                                                                    href="https://www.google.com"
                                                                                    target="_blank">Hi</a></td>
                                                                            <td align="left" valign="middle"><a
                                                                                    style="border: none; outline: none; text-decoration: none;"
                                                                                    href="mailto:hi@hi.hi"
                                                                                    target="_blank">Hi</a></td>
                                                                        </tr>
                                                                    </tbody>
                                                                </table>
                                                            </td>
                                                        </tr>
                                                    </tbody>
                                                </table>
                                            </th>
                                            <th style="padding-top: 0px; padding-bottom: 5px; font-weight: normal; vertical-align: middle;"
                                                align="center" valign="middle">
                                                <table style="width: 100%;" border="0" cellspacing="0" cellpadding="0">
                                                    <tbody>
                                                        <tr>
                                                            <td style="padding-bottom: 10px; padding-top: 10px; vertical-align: middle;"
                                                                align="center" valign="middle">
                                                                <table style="width: 100%;" border="0" cellspacing="0"
                                                                    cellpadding="0">
                                                                    <tbody>
                                                                        <tr>
                                                                            <td style="font-family: Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; color: #231f20;"
                                                                                align="right" valign="top">Hi</td>
                                                                        </tr>
                                                                    </tbody>
                                                                </table>
                                                            </td>
                                                        </tr>
                                                    </tbody>
                                                </table>
                                            </th>
                                        </tr>
                                    </tbody>
                                    <!-- List Layout Table Ends -->
                                </table>
                            </td>
                        </tr>
                    </tbody>
                </table>
            </td>
        </tr>
    </tbody>
</table>
Undefined property: HTMLPurifier_Node_Comment::$name in /var/www/hydra/vendor/ezyang/htmlpurifier/library/HTMLPurifier/ChildDef/Table.php:193
Stack trace:
#0 /var/www/hydra/shared/components/DoceboErrorHandlerWeb.php(84): yii\base\ErrorHandler->handleError()
#1 /var/www/hydra/vendor/ezyang/htmlpurifier/library/HTMLPurifier/ChildDef/Table.php(193): app\shared\components\DoceboErrorHandlerWeb->handleError()
#2 /var/www/hydra/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Strategy/FixNesting.php(145): HTMLPurifier_ChildDef_Table->validateChildren()
#3 /var/www/hydra/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Strategy/Composite.php(24): HTMLPurifier_Strategy_FixNesting->execute()
#4 /var/www/hydra/vendor/ezyang/htmlpurifier/library/HTMLPurifier.php(211): HTMLPurifier_Strategy_Composite->execute()
#5 /var/www/hydra/vendor/yiisoft/yii2/helpers/BaseHtmlPurifier.php(58): HTMLPurifier->purify()
#6 /var/www/hydra/shared/components/security/DHtmlPurifier.php(176): yii\helpers\BaseHtmlPurifier::process()
#7 /var/www/hydra/shared/components/security/Infosec.php(179): app\shared\components\security\DHtmlPurifier::purify()
#8 [internal function]: app\shared\components\security\Infosec->app\shared\components\security\{closure}()
#9 /var/www/hydra/shared/components/security/Infosec.php(148): array_walk()
#10 [internal function]: app\shared\components\security\Infosec->app\shared\components\security\{closure}()
#11 /var/www/hydra/shared/components/security/Infosec.php(187): array_walk()
#12 /var/www/hydra/shared/components/api/MicroserviceApi.php(277): app\shared\components\security\Infosec->purifyData()
#13 /var/www/hydra/shared/components/api/MicroserviceApi.php(162): app\shared\components\api\MicroserviceApi->normalizeParameters()
#14 /var/www/hydra/apps/learn/modules/api/v1/Api.php(41): app\shared\components\api\MicroserviceApi->init()
#15 /var/www/hydra/vendor/yiisoft/yii2/base/BaseObject.php(109): app\apps\learn\modules\api\v1\Api->init()
#16 /var/www/hydra/vendor/yiisoft/yii2/base/Module.php(161): yii\base\BaseObject->__construct()
#17 [internal function]: yii\base\Module->__construct()
#18 /var/www/hydra/vendor/yiisoft/yii2/di/Container.php(411): ReflectionClass->newInstanceArgs()
#19 /var/www/hydra/vendor/yiisoft/yii2/di/Container.php(170): yii\di\Container->build()
#20 /var/www/hydra/vendor/yiisoft/yii2/BaseYii.php(365): yii\di\Container->get()
#21 /var/www/hydra/vendor/yiisoft/yii2/base/Module.php(445): yii\BaseYii::createObject()
#22 /var/www/hydra/vendor/yiisoft/yii2/base/Module.php(610): yii\base\Module->getModule()
#23 /var/www/hydra/vendor/yiisoft/yii2/base/Module.php(612): yii\base\Module->createController()
#24 /var/www/hydra/vendor/yiisoft/yii2/base/Module.php(546): yii\base\Module->createController()
#25 /var/www/hydra/vendor/yiisoft/yii2/web/Application.php(103): yii\base\Module->runAction()
#26 /var/www/hydra/vendor/yiisoft/yii2/base/Application.php(384): yii\web\Application->handleRequest()
#27 /var/www/hydra/shared/yii/web/Application.php(24): yii\base\Application->run()
#28 /var/www/hydra/web/index.php(41): app\shared\yii\web\Application->run()
#29 {main}

We should check if the $node has the property $name before accessing it here. Do you want a PR? Thanks

ezyang commented 4 months ago

Yes please!