view release on metacpan or  search on metacpan

README  view on Meta::CPAN

=head1 Security

Security advice to ensure the proper usage of this module.

=head2 Database Manipulation

The default settings of AUBBC.pm is not good for most forums, blogs, wiki's and bulletin boards
because by default AUBBC should work and be secure. The other reason is these programs will want some
of the user input editable and portable.

For editing and portability purposes you would want to retain the tags or user input as they typed it,
but always use the script_escape before saving to a back-end. This will allow you to change the settings
of AUBBC on the fly so the tags remain portable to setting changes.
The script_escape filter is vital to security for many reasons and provides a standard format for other
methods of AUBBC. There is a file in the examples folder called Database_Manipulation.pm that try's to explain what settings
to change and how to stay safe.

=head2 Mixing HTML and BBcode

Since the script_escape method will disable HTML and JavaScript, I came up with a way
to mix the two. The recommended use of mixing is for Administrator's of the program only,
because giving anyone the ability to post unfiltered codes is just wrong.

The mixing method is good for themes, information pages and wiki's just to name a few.

for some tags when script_escape is disabled you can just run do_all_ubbc on variables with HTML mixed
with BBcode and it will work because those tags didn't need the script_escape method to make them work,
but for other tags the script_escape method is needed.
So this is where my solution comes in.
see Mixing_HTML_and_BBcode.pm file in the examples folder

=head2 Build your own tags

When adding a custom tag you will have to remember that the methods for building
custom tags try's to secure the tags. But it can not be 100% secure without
the developer of the tag knowing if and what security issues the new tag may have.

The adding method restricts characters from being used in some variables of
the tags, like name and pattern.

See the other "Build your own tags" for usage

=head2 XSS protection and settings

The script_escape filter will disable XSS so the text of the code can be seen in
HTML/XHTML and the XSS code will not work in anyway.
Some parts use standard requirements allowing only these linking path formats:

 protocal://location/web/path/or/file
 /local/web/path/or/file

There are some uncontrollable security issues with allowing images [img] and link [url] auto-link tags,
you can disable [img] tags by setting "no_img => 1," to 1 as shown.
Security issues with the [url] and auto-link tags is not as bad since you have to click it to
get to the risky web site, unlike an image loading.

=head2 FYI

XHTML has better JavaScript security standards then HTML.
Developers can also use cookies with "httponly" flags to disable JavaScript from
reading that cookie, but the browsers must support it.
XSS, browser hijacking and other security risks can change by settings, browser vendors and program versions.

=head1 Tag Security Access

New to v4.05. Assign security levels for links, images, build and code tags.
Default settings allows all tags to be seen so there would be no changes needed
if you just wanted the latest version and not use this method yet.

This method works with your current authentication and will be explained more later.

Note: The smilies is not controled by this security.

=head2 User Security Levels

Default security levels are from low to high!!!

        # The array numbers >>:    0        1         2             3
        $aubbc->security_levels('Guest', 'User', 'Moderator','Administrator')

1) The security levels array needs to have the security levels from low to high in it!!

2) The names must be spelled the same as the name passed to method user_level();

3) Security access is determined by low to high numbers and with the default Guest
will be number/level 0 in the array. if the links was set for User
the links level will have to be 1 = User making any lower level unable to
see any bbcode links but, the Administrator would still see all.

=head2 Tag Security Levels

To change the security level of links, images and code use this method this way:

        $aubbc->tag_security(
                code         => { level => 0, text => 'register to see this', },
                img          => { level => 0, text => 'register to see this', },
                url          => { level => 0, text => 'register to see this', },
        );

level - the array number of the security level

text  - the text or HTML to show if user has no access

Build your own tags has 2 new variables now:

  $aubbc->add_build_tag(
        name     => 'ok',
        pattern  => 'l,s',
        type     => 1,
        function => 'My_Message::check_ok_tag',
        level    => 3,
        error    => 'register to see this',
        );

level - the array number of the security level

error - the text or HTML to show if user has no access

For the build tags leaving the variables blank will default level to 0 and
error to the $AUBBC::BAD_MESSAGE string.

README  view on Meta::CPAN

filters in "script_escape to conver the & to an amp and ; to #59;" and
"html_to_text to conver amp to & and #59 to ;". This fix also helped in allowing
the regex's for highlighting subroutines to be made.

Fixed - had to add a null byte marker to escape_aubbc so the code tag's
highlighter can detect the escaped character and change it back. In do_all_ubbc
All markers get removed before the message is returned because FireFox can see
the null bytes as an error.

Addition - Perl subroutine highlighting for the code tag highlighter. Had a
problem making this till this version because a HTML code name can look like
&TheName; and a Perl subroutine looked the same till ; got converted.

Addition - AUBBC::make_image($align,$src,$width,$height,$alt) this is useful enough
to mention once.

v4.00 - 11/02/2010

Addition - New feature to the code tags aubbc_setting code_download.
the default setting for code_download is '^Download above code^' this message will
be the links name. the link will open a JavaScript pop-up window and write the
code in it to be copied or printed to a printer. A new JavaScript function was
added to the js_print method called MyCodePrint. JavaScript makes this feature
portable and dynamic. the link for code_download is added after the code_extra
setting so a disclaimer can be added before the code_download link

Addition - $AUBBC::MEMOIZE This setting can turn AUBBC's usage of Memoize on or off.
Default setting 1 will check if it needs to load Memoize, if loaded then load the sub's that need the speed.
Setting 0 will not use Memoize.

Addition - AUBBC::make_link($link,$name,$javascript,$target) this is useful enough
to mention once.

Improvement - After lots of testing I have removed all /o in the regex. One main
reason is Memoize provides enough speed.

v3.13 - 09/30/2010

Addition - do_ubbc New built-in tag [list][*=1]... [*]... [/list], This will
follow XHTML or HTML Transitional element style and XHTML or HTML Strict will not
support the elements that tag [*=1] in the [list] will produce
(use the other enumerated List Block tags for XHTML or HTML Strict).

Addition - do_ubbc New built-in tag [em]Hello[/em]

Addition - New value for setting line_break 2 for old <br style. This effects script_escape.

Addition - This module now uses Memoize for a massive speed improvement.
If you thought it was fast before, I hope your sitting down when you bench this version. LOL

Addition - added setting highlight_function to replace the highlighting method
of AUBBC with a costume one.

Fixed - in do_ubbc the line breaks was invalidating HTML for List Block elements

Improvement - in do_all_ubbc changed defining $msg each time. there could have
been a bug in past versions if an undefined variable was used after a defined message was
converted. was going to allow do_all_ubbc to pass the last message but decided
other people may see that as a bug.

Improvement - in do_all_ubbc moved if $do_flag[4] for no_bypass to a better spot

Improvement - in do_all_ubbc moved if for for_links to a better spot

Improvement - changed tags left,right and center to only convert balanced tags

v3.00 - 09/14/2010

Improvement - made it balls to the wall faster.

v2.21 - 09/09/2010 16:32:34

Fixed -  -withoutworldwriteables, bug with making an archive on windows to PAUSE.

v2.20 - 09/08/2010 19:40:55

Addition - in examples folder there is a bench.pl to test the speed and support
of all the Perl BBcode modules. BBCode::Parser Parse::BBCode HTML::BBCode HTML::BBReverse

Fixed - fixed a line break and new line sandbox bug

Improvement - Massive speed improvement to the hole module and no features lost.
changed new for faster loading, the module uses vars for some variables,
re-spaced the hole code.

v2.10 - 08/31/2010 11:17:13

Addition - adding type 4 to add_build_tag this will use style 3 but will work
different then the other built functions. Type 4 will print the text defined in
function and not point to a defined Perl subroutine.

Addition - added line_break setting to have control over the script_escape and
html_to_text methods converting html line break <br> and new line \n

Addition - added fix_amp this setting finds all the & that need to covert to the amp; html code name
so the w3c xhtml validation checks ok.

Addition - added no_img this setting will allow some control for using [img] tags
for security reasons

Fixed - bug in settings_prep when a setting gets changed html_type could change

Fixed - Better support for XHTML 1.0 Strict for some tags having issues in do_ubbc

Fixed - in do_ubbc the [url] tag produces a bug if a link is used as a name
the fix converts the period and/or colon of the name so its not seen as a new
link.

Improvement - in do_unicode removed then changed the two regexs to do a 3 in 1 filter.

Improvement - in html_to_text added a code to fix a <br> bug if ppl use html or xhtml line break.

Improvement - moved the pattern building code from do_build_tag to add_build_tag
so it only runs one time

Improvement - in add_build_tag using a hash array to store the build tag data so
there is no need to use split in do_build_tag

Improvement - in do_all_ubbc moved script_escape to a location where one call
to the function is needed