MDL-65742 lib: Upgrade HTMLPurifier lib to 4.10.0
This commit is contained in:
Mihail Geshoski
@@ -1,30 +1,30 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Composite strategy that runs multiple strategies on tokens.
|
||||
*/
|
||||
abstract class HTMLPurifier_Strategy_Composite extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* List of strategies to run tokens through.
|
||||
* @type HTMLPurifier_Strategy[]
|
||||
*/
|
||||
protected $strategies = array();
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
foreach ($this->strategies as $strategy) {
|
||||
$tokens = $strategy->execute($tokens, $config, $context);
|
||||
}
|
||||
return $tokens;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Composite strategy that runs multiple strategies on tokens.
|
||||
*/
|
||||
abstract class HTMLPurifier_Strategy_Composite extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* List of strategies to run tokens through.
|
||||
* @type HTMLPurifier_Strategy[]
|
||||
*/
|
||||
protected $strategies = array();
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
foreach ($this->strategies as $strategy) {
|
||||
$tokens = $strategy->execute($tokens, $config, $context);
|
||||
}
|
||||
return $tokens;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
@@ -1,17 +1,17 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Core strategy composed of the big four strategies.
|
||||
*/
|
||||
class HTMLPurifier_Strategy_Core extends HTMLPurifier_Strategy_Composite
|
||||
{
|
||||
public function __construct()
|
||||
{
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_RemoveForeignElements();
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_MakeWellFormed();
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_FixNesting();
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_ValidateAttributes();
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Core strategy composed of the big four strategies.
|
||||
*/
|
||||
class HTMLPurifier_Strategy_Core extends HTMLPurifier_Strategy_Composite
|
||||
{
|
||||
public function __construct()
|
||||
{
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_RemoveForeignElements();
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_MakeWellFormed();
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_FixNesting();
|
||||
$this->strategies[] = new HTMLPurifier_Strategy_ValidateAttributes();
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
@@ -1,181 +1,181 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Takes a well formed list of tokens and fixes their nesting.
|
||||
*
|
||||
* HTML elements dictate which elements are allowed to be their children,
|
||||
* for example, you can't have a p tag in a span tag. Other elements have
|
||||
* much more rigorous definitions: tables, for instance, require a specific
|
||||
* order for their elements. There are also constraints not expressible by
|
||||
* document type definitions, such as the chameleon nature of ins/del
|
||||
* tags and global child exclusions.
|
||||
*
|
||||
* The first major objective of this strategy is to iterate through all
|
||||
* the nodes and determine whether or not their children conform to the
|
||||
* element's definition. If they do not, the child definition may
|
||||
* optionally supply an amended list of elements that is valid or
|
||||
* require that the entire node be deleted (and the previous node
|
||||
* rescanned).
|
||||
*
|
||||
* The second objective is to ensure that explicitly excluded elements of
|
||||
* an element do not appear in its children. Code that accomplishes this
|
||||
* task is pervasive through the strategy, though the two are distinct tasks
|
||||
* and could, theoretically, be seperated (although it's not recommended).
|
||||
*
|
||||
* @note Whether or not unrecognized children are silently dropped or
|
||||
* translated into text depends on the child definitions.
|
||||
*
|
||||
* @todo Enable nodes to be bubbled out of the structure. This is
|
||||
* easier with our new algorithm.
|
||||
*/
|
||||
|
||||
class HTMLPurifier_Strategy_FixNesting extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return array|HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
|
||||
//####################################################################//
|
||||
// Pre-processing
|
||||
|
||||
// O(n) pass to convert to a tree, so that we can efficiently
|
||||
// refer to substrings
|
||||
$top_node = HTMLPurifier_Arborize::arborize($tokens, $config, $context);
|
||||
|
||||
// get a copy of the HTML definition
|
||||
$definition = $config->getHTMLDefinition();
|
||||
|
||||
$excludes_enabled = !$config->get('Core.DisableExcludes');
|
||||
|
||||
// setup the context variable 'IsInline', for chameleon processing
|
||||
// is 'false' when we are not inline, 'true' when it must always
|
||||
// be inline, and an integer when it is inline for a certain
|
||||
// branch of the document tree
|
||||
$is_inline = $definition->info_parent_def->descendants_are_inline;
|
||||
$context->register('IsInline', $is_inline);
|
||||
|
||||
// setup error collector
|
||||
$e =& $context->get('ErrorCollector', true);
|
||||
|
||||
//####################################################################//
|
||||
// Loop initialization
|
||||
|
||||
// stack that contains all elements that are excluded
|
||||
// it is organized by parent elements, similar to $stack,
|
||||
// but it is only populated when an element with exclusions is
|
||||
// processed, i.e. there won't be empty exclusions.
|
||||
$exclude_stack = array($definition->info_parent_def->excludes);
|
||||
|
||||
// variable that contains the start token while we are processing
|
||||
// nodes. This enables error reporting to do its job
|
||||
$node = $top_node;
|
||||
// dummy token
|
||||
list($token, $d) = $node->toTokenPair();
|
||||
$context->register('CurrentNode', $node);
|
||||
$context->register('CurrentToken', $token);
|
||||
|
||||
//####################################################################//
|
||||
// Loop
|
||||
|
||||
// We need to implement a post-order traversal iteratively, to
|
||||
// avoid running into stack space limits. This is pretty tricky
|
||||
// to reason about, so we just manually stack-ify the recursive
|
||||
// variant:
|
||||
//
|
||||
// function f($node) {
|
||||
// foreach ($node->children as $child) {
|
||||
// f($child);
|
||||
// }
|
||||
// validate($node);
|
||||
// }
|
||||
//
|
||||
// Thus, we will represent a stack frame as array($node,
|
||||
// $is_inline, stack of children)
|
||||
// e.g. array_reverse($node->children) - already processed
|
||||
// children.
|
||||
|
||||
$parent_def = $definition->info_parent_def;
|
||||
$stack = array(
|
||||
array($top_node,
|
||||
$parent_def->descendants_are_inline,
|
||||
$parent_def->excludes, // exclusions
|
||||
0)
|
||||
);
|
||||
|
||||
while (!empty($stack)) {
|
||||
list($node, $is_inline, $excludes, $ix) = array_pop($stack);
|
||||
// recursive call
|
||||
$go = false;
|
||||
$def = empty($stack) ? $definition->info_parent_def : $definition->info[$node->name];
|
||||
while (isset($node->children[$ix])) {
|
||||
$child = $node->children[$ix++];
|
||||
if ($child instanceof HTMLPurifier_Node_Element) {
|
||||
$go = true;
|
||||
$stack[] = array($node, $is_inline, $excludes, $ix);
|
||||
$stack[] = array($child,
|
||||
// ToDo: I don't think it matters if it's def or
|
||||
// child_def, but double check this...
|
||||
$is_inline || $def->descendants_are_inline,
|
||||
empty($def->excludes) ? $excludes
|
||||
: array_merge($excludes, $def->excludes),
|
||||
0);
|
||||
break;
|
||||
}
|
||||
};
|
||||
if ($go) continue;
|
||||
list($token, $d) = $node->toTokenPair();
|
||||
// base case
|
||||
if ($excludes_enabled && isset($excludes[$node->name])) {
|
||||
$node->dead = true;
|
||||
if ($e) $e->send(E_ERROR, 'Strategy_FixNesting: Node excluded');
|
||||
} else {
|
||||
// XXX I suppose it would be slightly more efficient to
|
||||
// avoid the allocation here and have children
|
||||
// strategies handle it
|
||||
$children = array();
|
||||
foreach ($node->children as $child) {
|
||||
if (!$child->dead) $children[] = $child;
|
||||
}
|
||||
$result = $def->child->validateChildren($children, $config, $context);
|
||||
if ($result === true) {
|
||||
// nop
|
||||
$node->children = $children;
|
||||
} elseif ($result === false) {
|
||||
$node->dead = true;
|
||||
if ($e) $e->send(E_ERROR, 'Strategy_FixNesting: Node removed');
|
||||
} else {
|
||||
$node->children = $result;
|
||||
if ($e) {
|
||||
// XXX This will miss mutations of internal nodes. Perhaps defer to the child validators
|
||||
if (empty($result) && !empty($children)) {
|
||||
$e->send(E_ERROR, 'Strategy_FixNesting: Node contents removed');
|
||||
} else if ($result != $children) {
|
||||
$e->send(E_WARNING, 'Strategy_FixNesting: Node reorganized');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//####################################################################//
|
||||
// Post-processing
|
||||
|
||||
// remove context variables
|
||||
$context->destroy('IsInline');
|
||||
$context->destroy('CurrentNode');
|
||||
$context->destroy('CurrentToken');
|
||||
|
||||
//####################################################################//
|
||||
// Return
|
||||
|
||||
return HTMLPurifier_Arborize::flatten($node, $config, $context);
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Takes a well formed list of tokens and fixes their nesting.
|
||||
*
|
||||
* HTML elements dictate which elements are allowed to be their children,
|
||||
* for example, you can't have a p tag in a span tag. Other elements have
|
||||
* much more rigorous definitions: tables, for instance, require a specific
|
||||
* order for their elements. There are also constraints not expressible by
|
||||
* document type definitions, such as the chameleon nature of ins/del
|
||||
* tags and global child exclusions.
|
||||
*
|
||||
* The first major objective of this strategy is to iterate through all
|
||||
* the nodes and determine whether or not their children conform to the
|
||||
* element's definition. If they do not, the child definition may
|
||||
* optionally supply an amended list of elements that is valid or
|
||||
* require that the entire node be deleted (and the previous node
|
||||
* rescanned).
|
||||
*
|
||||
* The second objective is to ensure that explicitly excluded elements of
|
||||
* an element do not appear in its children. Code that accomplishes this
|
||||
* task is pervasive through the strategy, though the two are distinct tasks
|
||||
* and could, theoretically, be seperated (although it's not recommended).
|
||||
*
|
||||
* @note Whether or not unrecognized children are silently dropped or
|
||||
* translated into text depends on the child definitions.
|
||||
*
|
||||
* @todo Enable nodes to be bubbled out of the structure. This is
|
||||
* easier with our new algorithm.
|
||||
*/
|
||||
|
||||
class HTMLPurifier_Strategy_FixNesting extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return array|HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
|
||||
//####################################################################//
|
||||
// Pre-processing
|
||||
|
||||
// O(n) pass to convert to a tree, so that we can efficiently
|
||||
// refer to substrings
|
||||
$top_node = HTMLPurifier_Arborize::arborize($tokens, $config, $context);
|
||||
|
||||
// get a copy of the HTML definition
|
||||
$definition = $config->getHTMLDefinition();
|
||||
|
||||
$excludes_enabled = !$config->get('Core.DisableExcludes');
|
||||
|
||||
// setup the context variable 'IsInline', for chameleon processing
|
||||
// is 'false' when we are not inline, 'true' when it must always
|
||||
// be inline, and an integer when it is inline for a certain
|
||||
// branch of the document tree
|
||||
$is_inline = $definition->info_parent_def->descendants_are_inline;
|
||||
$context->register('IsInline', $is_inline);
|
||||
|
||||
// setup error collector
|
||||
$e =& $context->get('ErrorCollector', true);
|
||||
|
||||
//####################################################################//
|
||||
// Loop initialization
|
||||
|
||||
// stack that contains all elements that are excluded
|
||||
// it is organized by parent elements, similar to $stack,
|
||||
// but it is only populated when an element with exclusions is
|
||||
// processed, i.e. there won't be empty exclusions.
|
||||
$exclude_stack = array($definition->info_parent_def->excludes);
|
||||
|
||||
// variable that contains the start token while we are processing
|
||||
// nodes. This enables error reporting to do its job
|
||||
$node = $top_node;
|
||||
// dummy token
|
||||
list($token, $d) = $node->toTokenPair();
|
||||
$context->register('CurrentNode', $node);
|
||||
$context->register('CurrentToken', $token);
|
||||
|
||||
//####################################################################//
|
||||
// Loop
|
||||
|
||||
// We need to implement a post-order traversal iteratively, to
|
||||
// avoid running into stack space limits. This is pretty tricky
|
||||
// to reason about, so we just manually stack-ify the recursive
|
||||
// variant:
|
||||
//
|
||||
// function f($node) {
|
||||
// foreach ($node->children as $child) {
|
||||
// f($child);
|
||||
// }
|
||||
// validate($node);
|
||||
// }
|
||||
//
|
||||
// Thus, we will represent a stack frame as array($node,
|
||||
// $is_inline, stack of children)
|
||||
// e.g. array_reverse($node->children) - already processed
|
||||
// children.
|
||||
|
||||
$parent_def = $definition->info_parent_def;
|
||||
$stack = array(
|
||||
array($top_node,
|
||||
$parent_def->descendants_are_inline,
|
||||
$parent_def->excludes, // exclusions
|
||||
0)
|
||||
);
|
||||
|
||||
while (!empty($stack)) {
|
||||
list($node, $is_inline, $excludes, $ix) = array_pop($stack);
|
||||
// recursive call
|
||||
$go = false;
|
||||
$def = empty($stack) ? $definition->info_parent_def : $definition->info[$node->name];
|
||||
while (isset($node->children[$ix])) {
|
||||
$child = $node->children[$ix++];
|
||||
if ($child instanceof HTMLPurifier_Node_Element) {
|
||||
$go = true;
|
||||
$stack[] = array($node, $is_inline, $excludes, $ix);
|
||||
$stack[] = array($child,
|
||||
// ToDo: I don't think it matters if it's def or
|
||||
// child_def, but double check this...
|
||||
$is_inline || $def->descendants_are_inline,
|
||||
empty($def->excludes) ? $excludes
|
||||
: array_merge($excludes, $def->excludes),
|
||||
0);
|
||||
break;
|
||||
}
|
||||
};
|
||||
if ($go) continue;
|
||||
list($token, $d) = $node->toTokenPair();
|
||||
// base case
|
||||
if ($excludes_enabled && isset($excludes[$node->name])) {
|
||||
$node->dead = true;
|
||||
if ($e) $e->send(E_ERROR, 'Strategy_FixNesting: Node excluded');
|
||||
} else {
|
||||
// XXX I suppose it would be slightly more efficient to
|
||||
// avoid the allocation here and have children
|
||||
// strategies handle it
|
||||
$children = array();
|
||||
foreach ($node->children as $child) {
|
||||
if (!$child->dead) $children[] = $child;
|
||||
}
|
||||
$result = $def->child->validateChildren($children, $config, $context);
|
||||
if ($result === true) {
|
||||
// nop
|
||||
$node->children = $children;
|
||||
} elseif ($result === false) {
|
||||
$node->dead = true;
|
||||
if ($e) $e->send(E_ERROR, 'Strategy_FixNesting: Node removed');
|
||||
} else {
|
||||
$node->children = $result;
|
||||
if ($e) {
|
||||
// XXX This will miss mutations of internal nodes. Perhaps defer to the child validators
|
||||
if (empty($result) && !empty($children)) {
|
||||
$e->send(E_ERROR, 'Strategy_FixNesting: Node contents removed');
|
||||
} else if ($result != $children) {
|
||||
$e->send(E_WARNING, 'Strategy_FixNesting: Node reorganized');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//####################################################################//
|
||||
// Post-processing
|
||||
|
||||
// remove context variables
|
||||
$context->destroy('IsInline');
|
||||
$context->destroy('CurrentNode');
|
||||
$context->destroy('CurrentToken');
|
||||
|
||||
//####################################################################//
|
||||
// Return
|
||||
|
||||
return HTMLPurifier_Arborize::flatten($node, $config, $context);
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,207 +1,207 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Removes all unrecognized tags from the list of tokens.
|
||||
*
|
||||
* This strategy iterates through all the tokens and removes unrecognized
|
||||
* tokens. If a token is not recognized but a TagTransform is defined for
|
||||
* that element, the element will be transformed accordingly.
|
||||
*/
|
||||
|
||||
class HTMLPurifier_Strategy_RemoveForeignElements extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return array|HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
$definition = $config->getHTMLDefinition();
|
||||
$generator = new HTMLPurifier_Generator($config, $context);
|
||||
$result = array();
|
||||
|
||||
$escape_invalid_tags = $config->get('Core.EscapeInvalidTags');
|
||||
$remove_invalid_img = $config->get('Core.RemoveInvalidImg');
|
||||
|
||||
// currently only used to determine if comments should be kept
|
||||
$trusted = $config->get('HTML.Trusted');
|
||||
$comment_lookup = $config->get('HTML.AllowedComments');
|
||||
$comment_regexp = $config->get('HTML.AllowedCommentsRegexp');
|
||||
$check_comments = $comment_lookup !== array() || $comment_regexp !== null;
|
||||
|
||||
$remove_script_contents = $config->get('Core.RemoveScriptContents');
|
||||
$hidden_elements = $config->get('Core.HiddenElements');
|
||||
|
||||
// remove script contents compatibility
|
||||
if ($remove_script_contents === true) {
|
||||
$hidden_elements['script'] = true;
|
||||
} elseif ($remove_script_contents === false && isset($hidden_elements['script'])) {
|
||||
unset($hidden_elements['script']);
|
||||
}
|
||||
|
||||
$attr_validator = new HTMLPurifier_AttrValidator();
|
||||
|
||||
// removes tokens until it reaches a closing tag with its value
|
||||
$remove_until = false;
|
||||
|
||||
// converts comments into text tokens when this is equal to a tag name
|
||||
$textify_comments = false;
|
||||
|
||||
$token = false;
|
||||
$context->register('CurrentToken', $token);
|
||||
|
||||
$e = false;
|
||||
if ($config->get('Core.CollectErrors')) {
|
||||
$e =& $context->get('ErrorCollector');
|
||||
}
|
||||
|
||||
foreach ($tokens as $token) {
|
||||
if ($remove_until) {
|
||||
if (empty($token->is_tag) || $token->name !== $remove_until) {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
if (!empty($token->is_tag)) {
|
||||
// DEFINITION CALL
|
||||
|
||||
// before any processing, try to transform the element
|
||||
if (isset($definition->info_tag_transform[$token->name])) {
|
||||
$original_name = $token->name;
|
||||
// there is a transformation for this tag
|
||||
// DEFINITION CALL
|
||||
$token = $definition->
|
||||
info_tag_transform[$token->name]->transform($token, $config, $context);
|
||||
if ($e) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Tag transform', $original_name);
|
||||
}
|
||||
}
|
||||
|
||||
if (isset($definition->info[$token->name])) {
|
||||
// mostly everything's good, but
|
||||
// we need to make sure required attributes are in order
|
||||
if (($token instanceof HTMLPurifier_Token_Start || $token instanceof HTMLPurifier_Token_Empty) &&
|
||||
$definition->info[$token->name]->required_attr &&
|
||||
($token->name != 'img' || $remove_invalid_img) // ensure config option still works
|
||||
) {
|
||||
$attr_validator->validateToken($token, $config, $context);
|
||||
$ok = true;
|
||||
foreach ($definition->info[$token->name]->required_attr as $name) {
|
||||
if (!isset($token->attr[$name])) {
|
||||
$ok = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!$ok) {
|
||||
if ($e) {
|
||||
$e->send(
|
||||
E_ERROR,
|
||||
'Strategy_RemoveForeignElements: Missing required attribute',
|
||||
$name
|
||||
);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
$token->armor['ValidateAttributes'] = true;
|
||||
}
|
||||
|
||||
if (isset($hidden_elements[$token->name]) && $token instanceof HTMLPurifier_Token_Start) {
|
||||
$textify_comments = $token->name;
|
||||
} elseif ($token->name === $textify_comments && $token instanceof HTMLPurifier_Token_End) {
|
||||
$textify_comments = false;
|
||||
}
|
||||
|
||||
} elseif ($escape_invalid_tags) {
|
||||
// invalid tag, generate HTML representation and insert in
|
||||
if ($e) {
|
||||
$e->send(E_WARNING, 'Strategy_RemoveForeignElements: Foreign element to text');
|
||||
}
|
||||
$token = new HTMLPurifier_Token_Text(
|
||||
$generator->generateFromToken($token)
|
||||
);
|
||||
} else {
|
||||
// check if we need to destroy all of the tag's children
|
||||
// CAN BE GENERICIZED
|
||||
if (isset($hidden_elements[$token->name])) {
|
||||
if ($token instanceof HTMLPurifier_Token_Start) {
|
||||
$remove_until = $token->name;
|
||||
} elseif ($token instanceof HTMLPurifier_Token_Empty) {
|
||||
// do nothing: we're still looking
|
||||
} else {
|
||||
$remove_until = false;
|
||||
}
|
||||
if ($e) {
|
||||
$e->send(E_ERROR, 'Strategy_RemoveForeignElements: Foreign meta element removed');
|
||||
}
|
||||
} else {
|
||||
if ($e) {
|
||||
$e->send(E_ERROR, 'Strategy_RemoveForeignElements: Foreign element removed');
|
||||
}
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} elseif ($token instanceof HTMLPurifier_Token_Comment) {
|
||||
// textify comments in script tags when they are allowed
|
||||
if ($textify_comments !== false) {
|
||||
$data = $token->data;
|
||||
$token = new HTMLPurifier_Token_Text($data);
|
||||
} elseif ($trusted || $check_comments) {
|
||||
// always cleanup comments
|
||||
$trailing_hyphen = false;
|
||||
if ($e) {
|
||||
// perform check whether or not there's a trailing hyphen
|
||||
if (substr($token->data, -1) == '-') {
|
||||
$trailing_hyphen = true;
|
||||
}
|
||||
}
|
||||
$token->data = rtrim($token->data, '-');
|
||||
$found_double_hyphen = false;
|
||||
while (strpos($token->data, '--') !== false) {
|
||||
$found_double_hyphen = true;
|
||||
$token->data = str_replace('--', '-', $token->data);
|
||||
}
|
||||
if ($trusted || !empty($comment_lookup[trim($token->data)]) ||
|
||||
($comment_regexp !== null && preg_match($comment_regexp, trim($token->data)))) {
|
||||
// OK good
|
||||
if ($e) {
|
||||
if ($trailing_hyphen) {
|
||||
$e->send(
|
||||
E_NOTICE,
|
||||
'Strategy_RemoveForeignElements: Trailing hyphen in comment removed'
|
||||
);
|
||||
}
|
||||
if ($found_double_hyphen) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Hyphens in comment collapsed');
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if ($e) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Comment removed');
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} else {
|
||||
// strip comments
|
||||
if ($e) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Comment removed');
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} elseif ($token instanceof HTMLPurifier_Token_Text) {
|
||||
} else {
|
||||
continue;
|
||||
}
|
||||
$result[] = $token;
|
||||
}
|
||||
if ($remove_until && $e) {
|
||||
// we removed tokens until the end, throw error
|
||||
$e->send(E_ERROR, 'Strategy_RemoveForeignElements: Token removed to end', $remove_until);
|
||||
}
|
||||
$context->destroy('CurrentToken');
|
||||
return $result;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Removes all unrecognized tags from the list of tokens.
|
||||
*
|
||||
* This strategy iterates through all the tokens and removes unrecognized
|
||||
* tokens. If a token is not recognized but a TagTransform is defined for
|
||||
* that element, the element will be transformed accordingly.
|
||||
*/
|
||||
|
||||
class HTMLPurifier_Strategy_RemoveForeignElements extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return array|HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
$definition = $config->getHTMLDefinition();
|
||||
$generator = new HTMLPurifier_Generator($config, $context);
|
||||
$result = array();
|
||||
|
||||
$escape_invalid_tags = $config->get('Core.EscapeInvalidTags');
|
||||
$remove_invalid_img = $config->get('Core.RemoveInvalidImg');
|
||||
|
||||
// currently only used to determine if comments should be kept
|
||||
$trusted = $config->get('HTML.Trusted');
|
||||
$comment_lookup = $config->get('HTML.AllowedComments');
|
||||
$comment_regexp = $config->get('HTML.AllowedCommentsRegexp');
|
||||
$check_comments = $comment_lookup !== array() || $comment_regexp !== null;
|
||||
|
||||
$remove_script_contents = $config->get('Core.RemoveScriptContents');
|
||||
$hidden_elements = $config->get('Core.HiddenElements');
|
||||
|
||||
// remove script contents compatibility
|
||||
if ($remove_script_contents === true) {
|
||||
$hidden_elements['script'] = true;
|
||||
} elseif ($remove_script_contents === false && isset($hidden_elements['script'])) {
|
||||
unset($hidden_elements['script']);
|
||||
}
|
||||
|
||||
$attr_validator = new HTMLPurifier_AttrValidator();
|
||||
|
||||
// removes tokens until it reaches a closing tag with its value
|
||||
$remove_until = false;
|
||||
|
||||
// converts comments into text tokens when this is equal to a tag name
|
||||
$textify_comments = false;
|
||||
|
||||
$token = false;
|
||||
$context->register('CurrentToken', $token);
|
||||
|
||||
$e = false;
|
||||
if ($config->get('Core.CollectErrors')) {
|
||||
$e =& $context->get('ErrorCollector');
|
||||
}
|
||||
|
||||
foreach ($tokens as $token) {
|
||||
if ($remove_until) {
|
||||
if (empty($token->is_tag) || $token->name !== $remove_until) {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
if (!empty($token->is_tag)) {
|
||||
// DEFINITION CALL
|
||||
|
||||
// before any processing, try to transform the element
|
||||
if (isset($definition->info_tag_transform[$token->name])) {
|
||||
$original_name = $token->name;
|
||||
// there is a transformation for this tag
|
||||
// DEFINITION CALL
|
||||
$token = $definition->
|
||||
info_tag_transform[$token->name]->transform($token, $config, $context);
|
||||
if ($e) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Tag transform', $original_name);
|
||||
}
|
||||
}
|
||||
|
||||
if (isset($definition->info[$token->name])) {
|
||||
// mostly everything's good, but
|
||||
// we need to make sure required attributes are in order
|
||||
if (($token instanceof HTMLPurifier_Token_Start || $token instanceof HTMLPurifier_Token_Empty) &&
|
||||
$definition->info[$token->name]->required_attr &&
|
||||
($token->name != 'img' || $remove_invalid_img) // ensure config option still works
|
||||
) {
|
||||
$attr_validator->validateToken($token, $config, $context);
|
||||
$ok = true;
|
||||
foreach ($definition->info[$token->name]->required_attr as $name) {
|
||||
if (!isset($token->attr[$name])) {
|
||||
$ok = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!$ok) {
|
||||
if ($e) {
|
||||
$e->send(
|
||||
E_ERROR,
|
||||
'Strategy_RemoveForeignElements: Missing required attribute',
|
||||
$name
|
||||
);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
$token->armor['ValidateAttributes'] = true;
|
||||
}
|
||||
|
||||
if (isset($hidden_elements[$token->name]) && $token instanceof HTMLPurifier_Token_Start) {
|
||||
$textify_comments = $token->name;
|
||||
} elseif ($token->name === $textify_comments && $token instanceof HTMLPurifier_Token_End) {
|
||||
$textify_comments = false;
|
||||
}
|
||||
|
||||
} elseif ($escape_invalid_tags) {
|
||||
// invalid tag, generate HTML representation and insert in
|
||||
if ($e) {
|
||||
$e->send(E_WARNING, 'Strategy_RemoveForeignElements: Foreign element to text');
|
||||
}
|
||||
$token = new HTMLPurifier_Token_Text(
|
||||
$generator->generateFromToken($token)
|
||||
);
|
||||
} else {
|
||||
// check if we need to destroy all of the tag's children
|
||||
// CAN BE GENERICIZED
|
||||
if (isset($hidden_elements[$token->name])) {
|
||||
if ($token instanceof HTMLPurifier_Token_Start) {
|
||||
$remove_until = $token->name;
|
||||
} elseif ($token instanceof HTMLPurifier_Token_Empty) {
|
||||
// do nothing: we're still looking
|
||||
} else {
|
||||
$remove_until = false;
|
||||
}
|
||||
if ($e) {
|
||||
$e->send(E_ERROR, 'Strategy_RemoveForeignElements: Foreign meta element removed');
|
||||
}
|
||||
} else {
|
||||
if ($e) {
|
||||
$e->send(E_ERROR, 'Strategy_RemoveForeignElements: Foreign element removed');
|
||||
}
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} elseif ($token instanceof HTMLPurifier_Token_Comment) {
|
||||
// textify comments in script tags when they are allowed
|
||||
if ($textify_comments !== false) {
|
||||
$data = $token->data;
|
||||
$token = new HTMLPurifier_Token_Text($data);
|
||||
} elseif ($trusted || $check_comments) {
|
||||
// always cleanup comments
|
||||
$trailing_hyphen = false;
|
||||
if ($e) {
|
||||
// perform check whether or not there's a trailing hyphen
|
||||
if (substr($token->data, -1) == '-') {
|
||||
$trailing_hyphen = true;
|
||||
}
|
||||
}
|
||||
$token->data = rtrim($token->data, '-');
|
||||
$found_double_hyphen = false;
|
||||
while (strpos($token->data, '--') !== false) {
|
||||
$found_double_hyphen = true;
|
||||
$token->data = str_replace('--', '-', $token->data);
|
||||
}
|
||||
if ($trusted || !empty($comment_lookup[trim($token->data)]) ||
|
||||
($comment_regexp !== null && preg_match($comment_regexp, trim($token->data)))) {
|
||||
// OK good
|
||||
if ($e) {
|
||||
if ($trailing_hyphen) {
|
||||
$e->send(
|
||||
E_NOTICE,
|
||||
'Strategy_RemoveForeignElements: Trailing hyphen in comment removed'
|
||||
);
|
||||
}
|
||||
if ($found_double_hyphen) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Hyphens in comment collapsed');
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if ($e) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Comment removed');
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} else {
|
||||
// strip comments
|
||||
if ($e) {
|
||||
$e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Comment removed');
|
||||
}
|
||||
continue;
|
||||
}
|
||||
} elseif ($token instanceof HTMLPurifier_Token_Text) {
|
||||
} else {
|
||||
continue;
|
||||
}
|
||||
$result[] = $token;
|
||||
}
|
||||
if ($remove_until && $e) {
|
||||
// we removed tokens until the end, throw error
|
||||
$e->send(E_ERROR, 'Strategy_RemoveForeignElements: Token removed to end', $remove_until);
|
||||
}
|
||||
$context->destroy('CurrentToken');
|
||||
return $result;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
@@ -1,45 +1,45 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Validate all attributes in the tokens.
|
||||
*/
|
||||
|
||||
class HTMLPurifier_Strategy_ValidateAttributes extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
// setup validator
|
||||
$validator = new HTMLPurifier_AttrValidator();
|
||||
|
||||
$token = false;
|
||||
$context->register('CurrentToken', $token);
|
||||
|
||||
foreach ($tokens as $key => $token) {
|
||||
|
||||
// only process tokens that have attributes,
|
||||
// namely start and empty tags
|
||||
if (!$token instanceof HTMLPurifier_Token_Start && !$token instanceof HTMLPurifier_Token_Empty) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// skip tokens that are armored
|
||||
if (!empty($token->armor['ValidateAttributes'])) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// note that we have no facilities here for removing tokens
|
||||
$validator->validateToken($token, $config, $context);
|
||||
}
|
||||
$context->destroy('CurrentToken');
|
||||
return $tokens;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Validate all attributes in the tokens.
|
||||
*/
|
||||
|
||||
class HTMLPurifier_Strategy_ValidateAttributes extends HTMLPurifier_Strategy
|
||||
{
|
||||
|
||||
/**
|
||||
* @param HTMLPurifier_Token[] $tokens
|
||||
* @param HTMLPurifier_Config $config
|
||||
* @param HTMLPurifier_Context $context
|
||||
* @return HTMLPurifier_Token[]
|
||||
*/
|
||||
public function execute($tokens, $config, $context)
|
||||
{
|
||||
// setup validator
|
||||
$validator = new HTMLPurifier_AttrValidator();
|
||||
|
||||
$token = false;
|
||||
$context->register('CurrentToken', $token);
|
||||
|
||||
foreach ($tokens as $key => $token) {
|
||||
|
||||
// only process tokens that have attributes,
|
||||
// namely start and empty tags
|
||||
if (!$token instanceof HTMLPurifier_Token_Start && !$token instanceof HTMLPurifier_Token_Empty) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// skip tokens that are armored
|
||||
if (!empty($token->armor['ValidateAttributes'])) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// note that we have no facilities here for removing tokens
|
||||
$validator->validateToken($token, $config, $context);
|
||||
}
|
||||
$context->destroy('CurrentToken');
|
||||
return $tokens;
|
||||
}
|
||||
}
|
||||
|
||||
// vim: et sw=4 sts=4
|
||||
|
||||
Reference in New Issue
Block a user