Merge pull request #18 from Kdecherf/feat/prune-selfclosed-tags

Neutralize or remove illegal self-closing tags
fossar · Sep 1, 2023 · 3721c9d · 3721c9d
2 parents 7619855 + 2295cf7
commit 3721c9d
Show file tree

Hide file tree

Showing 2 changed files with 46 additions and 1 deletion.
diff --git a/htmLawed.php b/htmLawed.php
@@ -966,7 +966,7 @@ function hl_tag($t)
   if ($t == '>') {
     return '&gt;';
   }
-  if (!preg_match('`^<(/?)([a-zA-Z][^\s>]*)([^>]*?)\s?>$`m', $t, $m)) { // Get tag with element name and attributes
+  if (!preg_match('`^<(/?)([a-zA-Z][^\s>]*)([^>]*?)\s?(?P<selfclosing> /)?>$`m', $t, $m)) { // Get tag with element name and attributes
     return str_replace(array('<', '>'), array('&lt;', '&gt;'), $t);
   }
 
@@ -1008,6 +1008,13 @@ function hl_tag($t)
   // Handle closing tag.
 
   static $emptyEleAr = array('area'=>1, 'br'=>1, 'col'=>1, 'command'=>1, 'embed'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'isindex'=>1, 'keygen'=>1, 'link'=>1, 'meta'=>1, 'param'=>1, 'source'=>1, 'track'=>1, 'wbr'=>1);
+  if (!empty($m['selfclosing']) || false !== strpos($m[2], '/')) {
+    if (!isset($emptyEleAr[$ele])) {
+      return ($C['keep_bad'] % 2
+      ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t)
+      : '');
+    }
+  }
   if (!empty($m[1])) {
     return(
       !isset($emptyEleAr[$ele])

diff --git a/tests/HTMLawedTest.php b/tests/HTMLawedTest.php
@@ -42,4 +42,42 @@ public function testPictureBlocks()
         $output = htmLawed($input);
         $this->assertSame($input, $output);
     }
+
+    public function dataForSelfClosingTags()
+    {
+        return [
+            'void element, missing trailing slash' => [
+                '<div><img src="a.jpg" alt="image"></div>',
+                '<div><img src="a.jpg" alt="image" /></div>',
+            ],
+            'void element, trailing slash' => [
+                '<div><img src="a.jpg" alt="image" /></div>',
+            ],
+            'standard element, end tag' => [
+                '<div><p>Hello world</p></div>',
+            ],
+            'standard element, illegal self-closing tag' => [
+                '<div><p/></div>',
+                '<div></div>',
+            ],
+            'standard element with attributes, illegal self-closing tag' => [
+                '<div><p id="a" /></div>',
+                '<div></div>',
+            ],
+            'standard element, missing end tag' => [
+                '<div><p>Hello world</p>',
+                '<div><p>Hello world</p></div>',
+            ],
+        ];
+    }
+
+    /**
+     * @dataProvider dataForSelfClosingTags
+     */
+    public function testSelfClosingTags($input, $expectedOutput = null)
+    {
+        $output = htmLawed($input);
+
+        $this->assertSame($expectedOutput ?: $input, $output);
+    }
 }