To Xooxer

ID:39672
 
Feb 26 2008, 6:06 pm (Edited on Feb 26 2008, 6:55 pm)
 
var/list/legal_tags = list("b", "i", "u")

proc/sanitize_html(string)
    . = ""
    var
        previous = 1
        start
        end

    do
        start = findtext(string, "<", end + 1)
        end = start && findtext(string, ">", start)

        if(start && end)
            var/tag = copytext(string, start + 1, end)
            if(!(ckey(tag) in legal_tags))
                . += copytext(string, previous, start) + "&lt;[tag]&gt;"
                previous = end + 1

    while(start && end)

    . += copytext(string, previous)


[Edit]

Alright, code to help test:

mob/Login()
    world << sanitize_html("<i>Test.</i>")
    world << sanitize_html("<br>Test.")
    world << sanitize_html("<b>Test</b>")
    world << sanitize_html("<font size=200>Test</font>")
    world << sanitize_html("<u>Test</u>")
    world << sanitize_html("<script>Test</script>")
Feb 26 2008, 6:48 pm
Can't and won't aren't the same. Fizz. Also, your code won't work. Try again.
Feb 26 2008, 6:50 pm
Uh, yes it will. I tested it in multiple cases before I posted it.
Feb 26 2008, 7:04 pm
Popisfizzy wrote:
Uh, yes it will. I tested it in multiple cases before I posted it.

You never tested it in Chatters. You're not dealing with a mere test demo. You'll need to do better than that in order to get it to work.
Feb 26 2008, 7:10 pm
Hah, like I'm going to even bother dealing with Chatters source. To put it in Chatters source would be relatively simple, based on what little I looked at before I decided on not caring.
Feb 26 2008, 7:15 pm
Popisfizzy wrote:
Hah, like I'm going to even bother dealing with Chatters source. To put it in Chatters source would be relatively simple, based on what little I looked at before I decided on not caring.

You suuure look like you're not caring. Yes sir. Sure sounded like not caring in Chatters too. So exactly at what point did you stop caring, and start trolling?
Feb 26 2008, 7:18 pm
I stopped caring the moment my connection to Chatters died by your hand.
Feb 26 2008, 7:19 pm
Popisfizzy wrote:
I stopped caring the moment my connection to Chatters died by your hand.

Good.
Feb 26 2008, 7:34 pm
sorry, but BBCode sucks. It always has, always will. It's not simple to use, and is more of a hassle as it is some shitty markup syntax some asshole probably invented because he wanted to make peoples heads hurt.

HTML is fine, stop arguing children!



oh and fizz your css sucks oh my god
Feb 26 2008, 7:41 pm
Blame Koil; he made it. Personally, I'm content, but I also am one of two people I know of that can tolerate my DM color scheme, and the other person still modifies it.
Feb 26 2008, 7:43 pm
it hurts gray on gray on gray on black
Feb 27 2008, 6:29 am
"It Sucks" is not an acceptable excuse.
Feb 27 2008, 8:04 am
Make a poll. BBCode vs HTML.
Feb 27 2008, 3:22 pm
That code wouldn't work very well, fizz. There are several ways around that.
Feb 27 2008, 4:12 pm
Like how? =/
Feb 27 2008, 9:22 pm
Well, for one thing, inevitably, people would take that and put in the "a" and "img" tags as safe, when both are supurb ways to ruin someone's day if handled improperly. Now, the text window is a little bit safer, but not completely. Also, depending on the context it's used, &lt;b&gt;, &lt;i&gt;, &lt;strong&gt;, &lt;em&gt;, &lt;font&gt;, etc. tags need to be checked for closing tags; if there's no closing tag, they should be invalid. I think in BYOND you also have to account for escapes such as \red.

bleh, looks like the BYOND site processes entities as tags. icky hack.
Feb 28 2008, 2:47 pm
...so it's my fault if someone uses my code to do something stupid? I'm sorry, but I don't really think I know of any method to get the compiler to hit them on the nose with a newspaper if they put things in that shouldn't be there. This simply filters out tags that invalid, regardless if they're opening or closing tags. I don't know of any chat program that checks to see if the tags are opened and closed.
Feb 28 2008, 2:56 pm
...so it's my fault if someone uses my code to do something stupid?

Yeah, pretty much :P

But my point is that you shouldn't implement your own tag filtering if it's going to be as secure as swiss cheese. It's one of those situations where it's either all or nothing; if you don't know what you're doing, remove all tags with BYOND's internal function, but if you do use your own function, take every precaution to secure it.
Feb 28 2008, 2:58 pm
...I know what I'm doing. I'm not particularly new at "this stuff".