web commit by joey: change to plugin interface

[ikiwiki.git] / doc / htmlsanitization.mdwn

diff --git a/doc/htmlsanitization.mdwn b/doc/htmlsanitization.mdwn
index 617753e86a4361420c27455ef34ae2ee4bc701c3..2c814e8e42a5e1dc3620788d8842d9cf4ce8a3fd 100644 (file)
--- a/doc/htmlsanitization.mdwn
+++ b/doc/htmlsanitization.mdwn
@@ -1,5 +1,5 @@
-When run with the --sanitize switch, which is turned on by default (see
-[[usage]], ikiwiki sanitizes the html on pages it renders to avoid XSS
+When run with the `--sanitize` switch, which is turned on by default (see
+[[usage]]), ikiwiki sanitizes the html on pages it renders to avoid XSS

 attacks and the like.
 
 ikiwiki excludes all html tags and attributes except for those that are
 attacks and the like.
 
 ikiwiki excludes all html tags and attributes except for those that are


@@ -11,13 +11,13 @@ ikiwiki uses the HTML::Scrubber perl module to perform its html
 sanitisation, and this perl module also deals with various entity encoding
 tricks.
 
 sanitisation, and this perl module also deals with various entity encoding
 tricks.
 

-While I beleive that this makes ikiwiki as resistant to malicious html
+While I believe that this makes ikiwiki as resistant to malicious html

 content as anything else on the web, I cannot guarantee that it will
 actually protect every user of every browser from every browser security
 hole, badly designed feature, etc. I can provide NO WARRANTY, like it says
 content as anything else on the web, I cannot guarantee that it will
 actually protect every user of every browser from every browser security
 hole, badly designed feature, etc. I can provide NO WARRANTY, like it says

-in ikiwiki's [[GPL]] license. 
+in ikiwiki's [GPL](GPL) license. 

 
 

-The web's security model is *fundamntally broken*; ikiwiki's HTML
+The web's security model is *fundamentally broken*; ikiwiki's html

 sanitisation is only a patch on the underlying gaping hole that is your web
 browser.
 
 sanitisation is only a patch on the underlying gaping hole that is your web
 browser.
 


@@ -25,6 +25,6 @@ browser.
 
 Some examples of embedded javascript that won't be let through.
 
 
 Some examples of embedded javascript that won't be let through.
 

-<span style="background: url(javascript:window.location='http://example.org/')">test</span>
-<span style="&#x61;&#x6e;&#x79;&#x3a;&#x20;&#x65;&#x78;&#x70;&#x72;&#x65;&#x73;&#x73;&#x69;&#x6f;&#x6e;&#x28;&#x77;&#x69;&#x6e;&#x64;&#x6f;&#x77;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x74;&#x69;&#x6f;&#x6e;&#x3d;&#x27;&#x68;&#x74;&#x74;&#x70;&#x3a;&#x2f;&#x2f;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x6f;&#x72;&#x67;&#x2f;&#x27;&#x29;">test</span>
-<span style="&#97;&#110;&#121;&#58;&#32;&#101;&#120;&#112;&#114;&#101;&#115;&#115;&#105;&#111;&#110;&#40;&#119;&#105;&#110;&#100;&#111;&#119;&#46;&#108;&#111;&#99;&#97;&#116;&#105;&#111;&#110;&#61;&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#101;&#120;&#97;&#109;&#112;&#108;&#101;&#46;&#111;&#114;&#103;&#47;&#39;&#41;">test</span>
+* <span style="background: url(javascript:window.location='http://example.org/')">test</span>
+* <span style="&#x61;&#x6e;&#x79;&#x3a;&#x20;&#x65;&#x78;&#x70;&#x72;&#x65;&#x73;&#x73;&#x69;&#x6f;&#x6e;&#x28;&#x77;&#x69;&#x6e;&#x64;&#x6f;&#x77;&#x2e;&#x6c;&#x6f;&#x63;&#x61;&#x74;&#x69;&#x6f;&#x6e;&#x3d;&#x27;&#x68;&#x74;&#x74;&#x70;&#x3a;&#x2f;&#x2f;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x6f;&#x72;&#x67;&#x2f;&#x27;&#x29;">test</span>
+* <span style="&#97;&#110;&#121;&#58;&#32;&#101;&#120;&#112;&#114;&#101;&#115;&#115;&#105;&#111;&#110;&#40;&#119;&#105;&#110;&#100;&#111;&#119;&#46;&#108;&#111;&#99;&#97;&#116;&#105;&#111;&#110;&#61;&#39;&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#101;&#120;&#97;&#109;&#112;&#108;&#101;&#46;&#111;&#114;&#103;&#47;&#39;&#41;">test</span>