Fixed \u200B crashing every party
authorAlexander Ebert <ebert@woltlab.com>
Mon, 5 Sep 2016 10:25:52 +0000 (12:25 +0200)
committerAlexander Ebert <ebert@woltlab.com>
Mon, 5 Sep 2016 13:15:19 +0000 (15:15 +0200)
wcfsetup/install/files/lib/system/html/node/AbstractHtmlNodeProcessor.class.php

index b2d70057ce712b6fdc972f29528c27aeebc31960..5c5cdaf5af598420fa7ff00c755380189f423c03 100644 (file)
@@ -53,6 +53,9 @@ abstract class AbstractHtmlNodeProcessor implements IHtmlNodeProcessor {
                $this->document = new \DOMDocument('1.0', 'UTF-8');
                $this->xpath = null;
                
+               // strip UTF-8 zero-width whitespace
+               $html = preg_replace('~\x{200B}~u', '', $html);
+               
                // Ignore all errors when loading the HTML string, because DOMDocument does not
                // provide a proper way to add custom HTML elements (even though explicitly allowed
                // in HTML5) and the input HTML has already been sanitized by HTMLPurifier.