league/commonmark
Extensible PHP Markdown parser supporting the full CommonMark spec and GitHub-Flavored Markdown. Works with PHP 7.4+ (mbstring) and provides simple converters to turn Markdown into HTML with configurable safety options.
This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.
DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.8.1...2.8.2
This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.
DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.8.0...2.8.1
HighlightExtension for marking important text using == syntax (#1100)AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.7.1...2.8.0
RegexHelper to improve performance (#674, #1086)EmbedProcessor no longer calls updateEmbeds() when there are no embeds to update (#1081)benchmark.php CSV path validation for non-existent files (#1068, #1085)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.7.0...2.7.1
This is a security release to address a potential cross-site scripting (XSS) vulnerability when using the AttributesExtension with untrusted user input.
attributes/allow config option to specify which attributes users are allowed to set on elements (default allows virtually all attributes)AttributesExtension blocks all attributes starting with on unless explicitly allowed via the attributes/allow config optionallow_unsafe_links option is now respected by the AttributesExtension when users specify href and src attributesFull Changelog: https://github.com/thephpleague/commonmark/compare/2.6.1...2.6.2
Full Changelog: https://github.com/thephpleague/commonmark/compare/2.6.0...2.6.1
This is a security release to address potential denial of service attacks when parsing specially crafted, malicious input from untrusted sources (like user input). See https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf for more details.
max_delimiters_per_line config option to prevent denial of service attacks when parsing malicious inputtable/max_autocompleted_cells config option to prevent denial of service attacks when parsing large tablesAttributesExtension now supports attributes without values (#985, #986)AutolinkExtension exposes two new configuration options to override the default behavior (#969, #987):
autolink/allowed_protocols - an array of protocols to allow autolinking forautolink/default_protocol - the default protocol to use when none is specifiedRegexHelper::isWhitespace() method to check if a given character is an ASCII whitespace characterCacheableDelimiterProcessorInterface to ensure linear complexity for dynamic delimiter processingBracket delimiter type to optimize bracket parsing[ and ] are no longer added as Delimiter objects on the stack; a new Bracket type with its own stack is used insteadUrlAutolinkParser no longer parses URLs with more than 127 subdomainsDelimiterInterface::getIndex()
DelimiterStack now accepts integer positions for any $stackBottom argumentsource, add search to list of recognized block tagsFull Changelog: https://github.com/thephpleague/commonmark/compare/2.5.2...2.5.3
true value (#1040)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.5.1...2.5.2
Table start line numbers (#1037)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.5.0...2.5.1
AttributesExtension now supports attributes without values (#985, #986)AutolinkExtension exposes two new configuration options to override the default behavior (#969, #987):
autolink/allowed_protocols - an array of protocols to allow autolinking forautolink/default_protocol - the default protocol to use when none is specifiedParagraphs only containing link reference definitions will be kept in the AST until the Document is finalized
Paragraph)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.4.4...2.5.0
Full Changelog: https://github.com/thephpleague/commonmark/compare/2.4.3...2.4.4
UrlAutolinkParser incorrectly parsing text containing www anywhere before an autolink (#1025)Full Changelog: https://github.com/thephpleague/commonmark/compare/2.4.2...2.4.3
FencedCodeRenderer: don't add language- to class if already prefixedFull Changelog: https://github.com/thephpleague/commonmark/compare/2.4.1...2.4.2
ExternalLinkProcessor not fully disabling the rel attribute when configured to do so (#992)See the upgrading guide for more information about the exception-related changes
CommonMarkException marker interface for all exceptions thrown by the libraryAlreadyInitializedExceptionInvalidArgumentExceptionIOExceptionLogicExceptionMissingDependencyExceptionNoMatchingRendererExceptionParserLogicExceptionheading_permalink/apply_id_to_heading - When true, the id attribute will be applied to the heading element itself instead of the <a> tagheading_permalink/heading_class - class to apply to the heading elementheading_permalink/insert - now accepts none to prevent the creation of the <a> linktable/alignment_attributes configuration option to control how table cell alignment is rendered (#959)RuntimeException to LogicException (or something extending it), including:
CallbackGenerators that fail to set a URL or return an expected valueMarkdownParser when deactivating the last block parser or attempting to get an active block parser when they've all been closedEnvironmentNode when no renderer has been registered for itHeadingPermalinkProcessor now throws InvalidConfigurationException instead of RuntimeException when invalid config values are given.HtmlElement::setAttribute() no longer requires the second parameter for boolean attributes[@throws](https://github.com/throws) docblocks throughout the codebase, including ConverterInterface, MarkdownConverter, and MarkdownConverterInterface.
\RuntimeExceptions were thrown, which was inaccurate as \LogicExceptions were also possible.mb_internal_encoding() is set to something other than UTF-8 (#951)TaskListItemMarkerRenderer not including HTML attributes set on the node by other extensions (#947).) (#943)InlineParserEngine when no inline parsers are registered in the Environment (#908)EmbedStartParser to always capture embed-like lines in container blocks, regardless of parent block typeEmbedProcessor to also remove Embed blocks that aren't direct children of the DocumentEmbedProcessor to 1010EmbedExtension not parsing embeds following a list block (#898)DomainFilteringAdapter not reindexing the embed list (#884, #885)EmbedExtension (#805)DocumentRendererInterface as a replacement for the now-deprecated MarkdownRendererInterfaceMarkdownRendererInterface; use DocumentRendererInterface insteadHow can I help you explore Laravel packages today?