Revision history for Perl extension HTML::TagFilter.

1.03  Wed Nov 7 2005
	- updated manifest to include new tests and test subclass module. d'oh.

1.02  Wed Nov 7 2005
	- callbacks will now call method of same (triggerpoint) name if no
	  coderef has been supplied. This means that people who prefer to 
	  override in subclass just need a method with the triggerpoint name.
	- fixed silly bug where setting xss_allow_local_links to zero was ignored
	- fixed very silly operator precedence bug in xss test for local urls. 
	  (Both these last two thanks to kolya@mail.ru)

1.01  Sun Oct 15 2005
    - tweaked trigger points so that tag acceptability tests are called
      first: avoids situations where the callback sub is doing something
      with a tag that will then be rejected. stupido! 
    - also fixed a couple of minor bugs in sample code
    - tweaked default acceptance rules to include <strong>

1.0	  Sun Oct 15 2005
	- handy hooks added in response to various requests for added 
	  functionality. See spanner.org/tagfilter for recipes.
	- documentation tidied up.
	- No bug reports for a year now, so we'll call this version 1.

0.091 Fri Aug 13 2004
    - silly bug fixed in mailto obfuscation (the mailto: part has to be left
      in clear, as any fule kno).

0.09 Fri Jul 9 2004
    - mailto: obfuscation added. switchable-off.
    - url filtering properly integrated with other attribute rules, so that 
      naughty url attributes are omitted instead of empty.
    - xss logging brought into line with other filters, thanks to Brian Hirt.
    - 'reason' value added to filter log, mostly for later use
    - entification of <> now switchable-off too.
    - method documentation improved. rules docs still longer than bible :(
    - xss configuration (eg attributes to watch out for) made easier to change.

0.08 Wed Jun 2 2004
    - By popular demand, a filter with only denial rules lets through everything
      that is not explicitly denied. Makes it easier to strip out a few tags and
      leave the rest.
    - bugfix: supplying an empty set of rules to allow_tags or deny_tags now
      clears that part of the rule set, as the docs promise.
    - clear_rules method added to simplify the interface.
    - Tests now use Test::More like proper grown-ups.

0.075 Wed Oct 8 2003
    - noticed that cross-site safeguards were preventing mailto: hrefs from 
      getting through. Corrected.

0.074 Tues Jul 23 2003
    - tidied up a bit
    - extended the default list of xss vulnerable tags to: src, lowsrc, 
      href, background, cite. Also made it user-modifiable in subclass.
    - a few remaining variables turned into subs to facilitate subclassing

0.073  Tues Jul 22 2003
    - cross-site scripting protection improved: parser allowed to entify
      again (that was silly), but values for certain vulnerable attributes
      are subjected to extra tests to ensure urlness not scriptness.
    - tests added for the xss protection and other recent fixes

0.072  Tues Jul 22 2003
    - attribute order now preserved (requested by GA long ago)
    - parser instructed not to de-entify: closes a loophole that
      could allow an attacker to hide forbidden tags (eg script)
      within attribute values, to be revealed when Parser turned &quot;
      into "
    - all attributes s/javascript:// just in case.
    - bug corrected where 'none' was not magic in rule set, but just 
      treated as another attribute (d'oh)

0.071  Mon Jul 21 2003
    - changed default handler to escape < and > in order
      to prevent a common cross-site attack, thanks to bug report 
      by nick cleaton

0.07  Thu Oct 25 2001
    - no more warnings
    - error() reporting. can now write 
      $foo = $tf->filter($bar) || die $tf->error 
      and get sensible output. main tests in place. 

0.06 Sun Oct 21 2001
    - Simplified interface with addition of ->filter() and ->report() methods
    - Abandoned attempts to preserve tag order: put back on to do list :(
    - Made pod even more windy.
    - Added 'echo' option to direct output to STDOUT as a proper child 
      of HTML::Parser should, at Gisle Aas' suggestion. makes it more 
      useful to networking applications, apparently.

0.05  Wed Sep 20 2001
    - Added tag/attribute removal logging, and 'log' option, in order 
      that users may be chastised in detail for putting in naughty html.

0.04  Wed Sep 19 2001
    - Added _check() method to allow testing of values deep in HoHoHo 
      without autovivification and subsequent mess. 
    - Denial rules become less ambitious, more useful. 
    - Pod grows more verbose.

0.03  Tues Sep 18 2001
    - Changed from trying to work out meaning of empty lists to using 
      reserved words 'any', 'all', 'none'. 
    - Denial rules work sporadically.

0.02  Mon Sep 17 2001
    - Added denial rules. 
    - Didn't work very well.

0.01  Fri Sep 14 01:19:43 2001
    - Only permission filter: no denial rules.
    - Worked quite well.