如何仅允许特定的HTML标记集和&使用通用正则表达式的特定属性集？
允许的HTML标记：
p|body|b|u|em|strong|ul|ol|li|h1|h2|h3|h4|h5|h6|hr|a|br|img|tr|td|table|tbody|label|div|sup|sub|caption
允许的HTML属性：
alt|href|tcmuri|title|height|width|align|valign|rowspan|colspan|src|summary|class|id|name|title|target|nowrap|scope|axis|cellpadding|cellspacing|dir|lang|rel
Regex下方用于定位属性：
((alt|href|tcmuri|title|height|width|align|valign|rowspan|colspan|src|summary|class|id|name|title|target|nowrap|scope|axis|cellpadding|cellspacing|dir|lang|rel)\s*=\s*["|']?[/.?=&#\w\s:;-]+["|']?)
Regex下方用于定位HTML标记：
<(?>/?)(?:[^p|body|b|u|em|strong|ul|ol|li|h1|h2|h3|h4|h5|h6|hr|a|br|img|tr|td|table|tbody|label|div|sup|sub|caption|P]|[p|cufontext|cufoncanvas|P][^\s>/])[^>]*>
我试图合并这样的东西,但它没有正确过滤： –
<(?>/?)(?:[^p|body|b|u|em|strong|ul|ol|li|h1|h2|h3|h4|h5|h6|hr|a|br|img|tr|td|table|tbody|label|div|sup|sub|caption|P]|[p|cufontext|cufoncanvas|P]|((alt|href|tcmuri|title|height|width|align|valign|rowspan|colspan|src|summary|class|id|name|title|target|nowrap|scope|axis|cellpadding|cellspacing|dir|lang|rel)\s*=\s*["|']?[/.?=&#\w\s:;-]+["|']?)[^\s>/])[^>]*>
我的目的是只允许这组Attributes和HTML标签.
例：
输入HTML：
<h2 class="callout" cufid="2"><cufon style="width: 88px; height: 18px" class="cufon cufon-vml" alt="Lorem "><cufoncanvas style="height: 29px; top: -5px; left: -2px"><cvml:shape style="width: 107px; height: 29px" path=" m39,-257 l75,-257,75,39,-257 x e m-41,-394 l2097,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-41,-394" coordsize="2138,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m61,-157 c67,-174,93,-193,115,-192,142,167,-170,166,-142 l166,131,-137 c134,-180,68,61,-142 l61,27,26,-189,-157 x e m-144,-394 l1994,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-144,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m68,-172 l68,33,-172,3,-172 c32,-188,54,-208,-232 l68,108,-168 c100,-173,82,-172 x e m-326,-394 l1812,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-326,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m63,-154 c69,-182,103,-204,127,-183 l127,-152 c107,-185,64,-157,63,-128 l63,29,-154 x e m-427,-394 l1711,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-427,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m11,-94 c11,-144,47,94,146,177,-149,-94,-44,141,2,41,1,11,-39,-94 x m93,-178 c29,34,-21,-14,155,-20,157,-178 x e m-548,-394 l1590,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-548,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m15,-86 c15,-142,46,95,114,133,-174 l133,168,-34 c154,-10,130,52,15,-42,-86 x m134,-153 c128,-167,117,-177,98,-178,-147,-86,-24,-24 x e m-728,-394 l1410,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-728,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m62,-51 c61,-9,125,-16,132,-47 l132,-28 c125,106,81,-2,5,36,-116,28,-189 l62,62,-51 x e m-909,-394 l1229,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-909,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m150,-6 c86,20,16,-89,-163,78,-215,150,-182 l150,-158 c112,-211,48,-154,55,49,-36,110,12,149,-31 x e m-1093,-394 l1045,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-1093,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m67,0 l32,32,-190,67,0 x m69,-241 c69,-229,60,-221,38,-230,-241,-252,-261,69,-253,-241 x e m-1248,-394 l890,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-1248,-157 x e m-1336,-394 l802,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-1336,-88 c6,-164,80,134,-175 l134,-189 c159,-82,207,86,87,79,45,31,66 l31,39 c68,59,-18,37,6,-25,-88 x m96,-178 c35,119,-15,128,-31 l133,-156 c121,-171,96,-178 x e m-1518,-394 l620,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-1518,577"></cvml:shape><cvml:shape style="width: 107px; height: 29px" path=" m-1693,-394 l445,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-1693,577"></cvml:shape></cufoncanvas><cufontext>Lorem </cufontext></cufon><cufon style="width: 45px; height: 18px" class="cufon cufon-vml" alt="Lorem "><cufoncanvas style="height: 29px; top: -5px; left: -2px"><cvml:shape style="width: 65px; height: 29px" path=" m60,-58 c71,152,-36 l151,-13 c94,-19,-91,-143,44,124,-99,-58 x m120,-149 c121,109,-179,-115,-75,-95,120,-108,-149 x e m-41,-394 l1256,-394" coordsize="1297,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m44,-175 c74,147,-194,-143 l147,112,-23 c96,7,13,14,-45,18,-97,-114,126,-130,84,-175,66,53,-166,-149 l44,-175 x m112,-116 c94,-84,-43,-8,-31 l112,-116 x e m-201,-394 l1096,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-201,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m13,-36 c28,-4,92,-11,88,-53,9,-100,77,-176 l110,-152 c100,-176,50,-156,-111,121,-110,-59,-6,-12 l13,-36 x e m-360,-394 l937,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-360,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m67,-241 x e m-483,-394 l814,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-483,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m60,-149 x e m-571,-394 l726,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-571,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m63,-154 x e m-731,-394 l566,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-731,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m-852,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-852,577"></cvml:shape></cufoncanvas><cufontext>Lorem </cufontext></cufon><cufon style="width: 45px; height: 18px" class="cufon cufon-vml" alt="Lorem "><cufoncanvas style="height: 29px; top: -5px; left: -2px"><cvml:shape style="width: 65px; height: 29px" path=" m85,-32 c85,-74,123,-134,113,-189 l148,187,-33 c191,214,226,-189 l254,-189 c238,-128,211,-64,202,0 l160,-118 c121,-77,104,-37,100,0 l59,42,-189 x e m-41,-394 l1251,-394" coordsize="1292,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m11,-178 x e m-292,-394 l1000,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-292,-154 x e m-472,-394 l820,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-472,0 l27,0 x e m-593,-394 l699,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-593,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m15,-24 x e m-666,-394 l626,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-666,577"></cvml:shape><cvml:shape style="width: 65px; height: 29px" path=" m-847,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-847,577"></cvml:shape></cufoncanvas><cufontext>Lorem </cufontext></cufon><cufon style="width: 44px; height: 18px" class="cufon cufon-vml" alt="Lorem "><cufoncanvas style="height: 29px; top: -5px; left: -2px"><cvml:shape style="width: 64px; height: 29px" path=" m68,-172 x e m-41,-394 l1226,-394" coordsize="1267,577"></cvml:shape><cvml:shape style="width: 64px; height: 29px" path=" m63,-154 x e m-142,-394 l1125,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-142,577"></cvml:shape><cvml:shape style="width: 64px; height: 29px" path=" m44,-116 x e m-263,-394 l1004,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-263,577"></cvml:shape><cvml:shape style="width: 64px; height: 29px" path=" m95,-27 c108,122,-119,145,-189 l174,-189 c155,-66,0 l70,-189 x e m-422,-394 l845,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-422,577"></cvml:shape><cvml:shape style="width: 64px; height: 29px" path=" m60,-149 x e m-589,-394 l678,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-589,0 x e m-749,-394 l518,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-749,577"></cvml:shape><cvml:shape style="width: 64px; height: 29px" path=" m-822,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-822,577"></cvml:shape></cufoncanvas><cufontext>Lorem </cufontext></cufon><cufon style="width: 36px; height: 18px" class="cufon cufon-vml" alt="Lorem "><cufoncanvas style="height: 29px; top: -5px; left: -2px"><cvml:shape style="width: 55px; height: 29px" path=" m85,-394 l1063,-394" coordsize="1104,577"></cvml:shape><cvml:shape style="width: 55px; height: 29px" path=" m67,-241 x e m-292,-394 l812,577"></cvml:shape><cvml:shape style="width: 55px; height: 29px" path=" m68,-172 x e m-376,-394 l728,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-376,577"></cvml:shape><cvml:shape style="width: 55px; height: 29px" path=" m61,-160 c90,-207,171,-202,-141 l171,136,-140 c133,-145 l61,-160 x e m-477,-394 l627,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-477,577"></cvml:shape><cvml:shape style="width: 55px; height: 29px" path=" m-659,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-659,577"></cvml:shape></cufoncanvas><cufontext>Lorem </cufontext></cufon><cufon style="width: 60px; height: 18px" class="cufon cufon-vml" alt="Lorem ipsum"><cufoncanvas style="height: 29px; top: -5px; left: -2px"><cvml:shape style="width: 78px; height: 29px" path=" m185,-35 c185,-12,172,-257 c84,-255,173,-268,179,169,-240,-239,-238 l63,-163 c102,138,148,-136,90,-143 l63,-20 c103,-22,170,185,-35 x e m-41,-394 l1514,-394" coordsize="1555,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m160,-158 c176,-210,259,-200,-141 l259,225,-138 c224,174,161,-142 l161,-139 c127,-141 l62,-158 c73,-198,-205,160,-158 x e m-217,-394 l1338,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-217,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m67,-241 x e m-492,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-492,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m63,-154 x e m-569,-394 l986,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-569,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m44,-116 x e m-690,-394 l865,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-690,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m68,-172 x e m-849,-394 l706,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-849,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m60,-149 x e m-950,-394 l605,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-950,577"></cvml:shape><cvml:shape style="width: 78px; height: 29px" path=" m13,-36 x e m-1110,183 ns e" stroked="f" fillcolor="#c0bbaf" coordorigin="-1110,577"></cvml:shape></cufoncanvas><cufontext>Lorem ipsum</cufontext><cvml:shape coordsize="1000,1000"></cvml:shape></cufon></h2> <div class="contentContainer"> <p>Lorem ipsum dolor sit amet,Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet</p> <p>Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet</p> </div>
预期的过滤输出
<h2>Lorem Lorem Lorem Lorem Lorem Lorem ipsum</h2> <div> <p>Lorem ipsum dolor sit amet,Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet</p> <p>Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet Lorem ipsum dolor sit amet</p> </div>
还有一个例子,为了更清楚： –
输入
>< abc id =“test”>新标记和已知属性< / abc>
>< a id =“test”href =“http://www.google.com/”xyz =“testattr”>已知标签,属性和一个未知attr< / a>
产量
>新标签和已知属性
>< a id =“test”href =“http://www.google.com/”>已知标记,属性和一个未知的attr< / a>
感谢您的帮助.
这是使用PCRE兼容的正则表达式的Perl解决方案.它不知道评论,doctype,CDATA等.应该添加这些以获得更完整的解决方案.
原文链接：https://www.f2er.com/regex/357243.html# allowed tag and attribute names
my $allowed_tags_open = 'p|body|b|u|em|strong|ul|ol|li|h1|h2|h3|h4|h5|h6|a|tr|td|table|tbody|label|div|sup|sub|caption';
my $allowed_tags_self_closing = 'img|br|hr';
my $allowed_attributes = 'alt|href|tcmuri|title|height|width|align|valign|rowspan|colspan|src|summary|class|id|name|title|target|nowrap|scope|axis|cellpadding|cellspacing|dir|lang|rel';
$allowed_attributes .= '|style'; # for testing
# definitions for matching allowed tag and attribute names
my $re_tags = qr~(?(DEFINE)
(?<tags_open>
/?+
(?>
(?: $allowed_tags_open )
(?! [^\s>/] ) # from (?&tagname)
)
)
(?<tags_self_closing>
(?>
(?: $allowed_tags_self_closing )
(?! [^\s>/] ) # from (?&tagname)
)
)
(?<tags> (?> (?&tags_open) | (?&tags_self_closing) ) )
(?<attribs>
(?>
(?: $allowed_attributes )
(?! [^\s=/>] ) # from (?&attname)
)
)
)~xi;
# definitions for matching the tags
# trying to follow compatible tokenization characteristics of modern browsers
my $re_defs = qr~(?(DEFINE)
(?<tagname> [a-z/][^\s>/]*+ ) # will match the leading / in closing tags
(?<attname> [^\s>/][^\s=/>]*+ ) # first char can be pretty much anything,including =
(?<attval> (?>
"[^"]*+" |
\'[^\']*+\' |
[^\s>]*+ # unquoted values can contain quotes,= and /
)
)
(?<attrib> (?&attname)
(?: \s*+
= \s*+
(?&attval)
)?+
)
(?<crap> (?!/>)[^\s>] ) # most crap inside tag is ignored,but don't eat the last / in self closing tags
(?<tag> <(?&tagname)
(?: \s*+ # spaces between attributes not required: <b/foo=">"style=color:red>bold red text</b>
(?>
(?&attrib) | # order matters
(?&crap) # if not an attribute,eat the crap
)
)*+
\s*+ /?+
>
)
)~xi;
sub sanitize_html{
my $str = shift;
$str =~ s/(?&tag) $re_defs/ sanitize_tag($&) /gexo;
return $str;
}
sub sanitize_tag{
my $tag = shift;
my ($name,$attr,$end) =
$tag =~ /^ < ((?&tags)) (.*?) ( \/?+ > ) $ $re_tags/xo
or return ''; # return empty string if not allowed tag
# return a new clean closing tag if it's a closing tag
return "<$name>" if substr($name,1) eq '/';
# clean attributes
return "<$name" . sanitize_attributes($attr) . $end;
}
sub sanitize_attributes{
my $attr = shift;
my $new = '';
$attr =~ s{
\G
\s*+ # spaces between attributes not required
(?>
( (?&attrib) ) | # order matters
(?&crap) # if not an attribute,eat the crap
)
$re_defs
}{
my $att = $1;
$new .= " $att" if $att && $att =~ /^(?&attribs) $re_tags/xo;
'';
}gexo;
return $new;
}
测试(ideone)：
my $test = <<'_TEST_';
<b>simple</b>
self <img>closing</img>
<abc id="test">new tag and known attribute</abc>
<a id="test" xyz="testattr" href="/foo">one unknown attr</a>
<a id="foo">attr in closing tag</a id="foo">
<b/#ñ%&/()!¢º`=">="">crap be gone</b> not bold<br/x"/>
<b/style=color:red;background:url("x.gif");/*="still.CSS*/ id="x"zz"<script class="x">tricky</b/ x=">"//> not bold
_TEST_
print $test,"\n";
print '-' x 70,"\n";
print sanitize_html $test;
输出：
<b>simple</b>
self <img>closing</img>
<abc id="test">new tag and known attribute</abc>
<a id="test" xyz="testattr" href="/foo">one unknown attr</a>
<a id="foo">attr in closing tag</a id="foo">
<b/#ñ%&/()!¢º`=">="">crap be gone</b> not bold<br/x"/>
<b/style=color:red;background:url("x.gif");/*="still.CSS*/ id="x"zz"<script class="x">tricky</b/ x=">"//> not bold
----------------------------------------------------------------------
<b>simple</b>
self <img>closing
new tag and known attribute
<a id="test" href="/foo">one unknown attr</a>
<a id="foo">attr in closing tag</a>
<b>crap be gone</b> not bold<br/>
<b style=color:red;background:url("x.gif");/*="still.CSS*/ id="x" class="x">tricky</b> not bold
可能相关：
> HTML Tokenization
> XSS Cheat Sheet
> HTML5 Security
> XML tag parsing
