Replace attr type aliases with explicit AttrDef instances

This reduces api surface area. Removed type aliases: Integer, Float and Datetime.
xemlock · Nov 16, 2022 · 0105fef · 0105fef
1 parent 1c228b1
commit 0105fef
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 11 deletions.
diff --git a/library/HTMLPurifier/HTML5Definition.php b/library/HTMLPurifier/HTML5Definition.php
@@ -45,14 +45,6 @@ public static function setupHTMLDefinition(HTMLPurifier_HTMLDefinition $def, HTM
         // one provided with 4.6.0
         $def->manager->attrTypes->set('Bool', new HTMLPurifier_AttrDef_HTML_Bool2());
 
-        // Add missing definition for Integer, required by tabindex
-        $def->manager->attrTypes->set('Integer', new HTMLPurifier_AttrDef_Integer());
-
-        // Add support for Floating point number attributes
-        $def->manager->attrTypes->set('Float', new HTMLPurifier_AttrDef_HTML5_Float());
-
-        $def->manager->attrTypes->set('Datetime', new HTMLPurifier_AttrDef_HTML5_Datetime());
-
         return $def;
     }
 }
diff --git a/library/HTMLPurifier/HTMLModule/HTML5/CommonAttributes.php b/library/HTMLPurifier/HTMLModule/HTML5/CommonAttributes.php
@@ -19,7 +19,10 @@ public function setup($config)
                 'id'    => 'ID',
                 'title' => 'CDATA',
                 // tabindex attribute is supported on all elements (global attributes)
-                'tabindex' => 'Integer',
+                // Built-in 'Number' type can't be used here, as it only allows positive integers.
+                // Any integer is a valid tabindex value, also negative values are not dangerous
+                // per se, although their presence may affect a11y.
+                'tabindex' => new HTMLPurifier_AttrDef_Integer(),
                 // Final spec for inputmode global attribute has been published on 15 Dec 2017
                 // https://web.archive.org/web/20171215142138/https://html.spec.whatwg.org/#input-modalities:-the-inputmode-attribute
                 // The 'none' value has been intentionally omitted from the list of

diff --git a/library/HTMLPurifier/HTMLModule/HTML5/SafeForms.php b/library/HTMLPurifier/HTMLModule/HTML5/SafeForms.php
@@ -46,8 +46,8 @@ public function setup($config)
             'Inline',
             'Common',
             array(
-                'value' => 'Float#min:0',
-                'max' => 'Float#min:0',
+                'value' => new HTMLPurifier_AttrDef_HTML5_Float(array('min' => 0)),
+                'max' => new HTMLPurifier_AttrDef_HTML5_Float(array('min' => 0)),
             )
         );
         $progress->excludes = array('progress' => true);