diff --git a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php index 42d514447..822ba7bda 100644 --- a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php +++ b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php @@ -74,7 +74,7 @@ public function handleElement(&$token) if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') { // Mark closing span tag for deletion - $this->markForDeletion->attach($current); + $this->markForDeletion->offsetSet($current); // Delete open span tag $token = false; } @@ -85,8 +85,8 @@ public function handleElement(&$token) */ public function handleEnd(&$token) { - if ($this->markForDeletion->contains($token)) { - $this->markForDeletion->detach($token); + if ($this->markForDeletion->offsetExists($token)) { + $this->markForDeletion->offsetUnset($token); $token = false; } } diff --git a/library/HTMLPurifier/URISchemeRegistry.php b/library/HTMLPurifier/URISchemeRegistry.php index 4ac8a0b76..7dcaf9ab6 100644 --- a/library/HTMLPurifier/URISchemeRegistry.php +++ b/library/HTMLPurifier/URISchemeRegistry.php @@ -44,6 +44,10 @@ public function getScheme($scheme, $config, $context) $config = HTMLPurifier_Config::createDefault(); } + if ($scheme === null) { + return; + } + // important, otherwise attacker could include arbitrary file $allowed_schemes = $config->get('URI.AllowedSchemes'); if (!$config->get('URI.OverrideAllowedSchemes') &&