From d548e22a1ded8a10fa6a6b3f0cff10a01024f708 Mon Sep 17 00:00:00 2001 From: Atsushi Matsuo Date: Mon, 11 May 2026 11:42:25 +0900 Subject: [PATCH 1/2] fix: Replace the methods of the SplObjectStorage class which have been deprecated in PHP 8.5 (#476) --- .../HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php index 42d514447..822ba7bda 100644 --- a/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php +++ b/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php @@ -74,7 +74,7 @@ public function handleElement(&$token) if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') { // Mark closing span tag for deletion - $this->markForDeletion->attach($current); + $this->markForDeletion->offsetSet($current); // Delete open span tag $token = false; } @@ -85,8 +85,8 @@ public function handleElement(&$token) */ public function handleEnd(&$token) { - if ($this->markForDeletion->contains($token)) { - $this->markForDeletion->detach($token); + if ($this->markForDeletion->offsetExists($token)) { + $this->markForDeletion->offsetUnset($token); $token = false; } } From 43674d55981915e7e34c24d02d27d4673f66e6a2 Mon Sep 17 00:00:00 2001 From: Atsushi Matsuo Date: Mon, 11 May 2026 12:04:23 +0900 Subject: [PATCH 2/2] fix: Suppress the output of the message "Using null as an array offset is deprecated, use an empty string instead" in PHP 8.5 (#483) --- library/HTMLPurifier/URISchemeRegistry.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/library/HTMLPurifier/URISchemeRegistry.php b/library/HTMLPurifier/URISchemeRegistry.php index 4ac8a0b76..7dcaf9ab6 100644 --- a/library/HTMLPurifier/URISchemeRegistry.php +++ b/library/HTMLPurifier/URISchemeRegistry.php @@ -44,6 +44,10 @@ public function getScheme($scheme, $config, $context) $config = HTMLPurifier_Config::createDefault(); } + if ($scheme === null) { + return; + } + // important, otherwise attacker could include arbitrary file $allowed_schemes = $config->get('URI.AllowedSchemes'); if (!$config->get('URI.OverrideAllowedSchemes') &&