PageRenderTime 50ms CodeModel.GetById 22ms RepoModel.GetById 1ms app.codeStats 0ms

/plugins/vjCommentPlugin/lib/tools/htmlpurifier/library/HTMLPurifier/HTMLDefinition.php

https://bitbucket.org/Kudlaty/360kdw
PHP | 425 lines | 239 code | 59 blank | 127 comment | 51 complexity | 15ac6baf303f0dd62e692b368571da6a MD5 | raw file
Possible License(s): LGPL-2.1
  1. <?php
  2. /**
  3. * Definition of the purified HTML that describes allowed children,
  4. * attributes, and many other things.
  5. *
  6. * Conventions:
  7. *
  8. * All member variables that are prefixed with info
  9. * (including the main $info array) are used by HTML Purifier internals
  10. * and should not be directly edited when customizing the HTMLDefinition.
  11. * They can usually be set via configuration directives or custom
  12. * modules.
  13. *
  14. * On the other hand, member variables without the info prefix are used
  15. * internally by the HTMLDefinition and MUST NOT be used by other HTML
  16. * Purifier internals. Many of them, however, are public, and may be
  17. * edited by userspace code to tweak the behavior of HTMLDefinition.
  18. *
  19. * @note This class is inspected by Printer_HTMLDefinition; please
  20. * update that class if things here change.
  21. *
  22. * @warning Directives that change this object's structure must be in
  23. * the HTML or Attr namespace!
  24. */
  25. class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition
  26. {
  27. // FULLY-PUBLIC VARIABLES ---------------------------------------------
  28. /**
  29. * Associative array of element names to HTMLPurifier_ElementDef
  30. */
  31. public $info = array();
  32. /**
  33. * Associative array of global attribute name to attribute definition.
  34. */
  35. public $info_global_attr = array();
  36. /**
  37. * String name of parent element HTML will be going into.
  38. */
  39. public $info_parent = 'div';
  40. /**
  41. * Definition for parent element, allows parent element to be a
  42. * tag that's not allowed inside the HTML fragment.
  43. */
  44. public $info_parent_def;
  45. /**
  46. * String name of element used to wrap inline elements in block context
  47. * @note This is rarely used except for BLOCKQUOTEs in strict mode
  48. */
  49. public $info_block_wrapper = 'p';
  50. /**
  51. * Associative array of deprecated tag name to HTMLPurifier_TagTransform
  52. */
  53. public $info_tag_transform = array();
  54. /**
  55. * Indexed list of HTMLPurifier_AttrTransform to be performed before validation.
  56. */
  57. public $info_attr_transform_pre = array();
  58. /**
  59. * Indexed list of HTMLPurifier_AttrTransform to be performed after validation.
  60. */
  61. public $info_attr_transform_post = array();
  62. /**
  63. * Nested lookup array of content set name (Block, Inline) to
  64. * element name to whether or not it belongs in that content set.
  65. */
  66. public $info_content_sets = array();
  67. /**
  68. * Indexed list of HTMLPurifier_Injector to be used.
  69. */
  70. public $info_injector = array();
  71. /**
  72. * Doctype object
  73. */
  74. public $doctype;
  75. // RAW CUSTOMIZATION STUFF --------------------------------------------
  76. /**
  77. * Adds a custom attribute to a pre-existing element
  78. * @note This is strictly convenience, and does not have a corresponding
  79. * method in HTMLPurifier_HTMLModule
  80. * @param $element_name String element name to add attribute to
  81. * @param $attr_name String name of attribute
  82. * @param $def Attribute definition, can be string or object, see
  83. * HTMLPurifier_AttrTypes for details
  84. */
  85. public function addAttribute($element_name, $attr_name, $def) {
  86. $module = $this->getAnonymousModule();
  87. if (!isset($module->info[$element_name])) {
  88. $element = $module->addBlankElement($element_name);
  89. } else {
  90. $element = $module->info[$element_name];
  91. }
  92. $element->attr[$attr_name] = $def;
  93. }
  94. /**
  95. * Adds a custom element to your HTML definition
  96. * @note See HTMLPurifier_HTMLModule::addElement for detailed
  97. * parameter and return value descriptions.
  98. */
  99. public function addElement($element_name, $type, $contents, $attr_collections, $attributes = array()) {
  100. $module = $this->getAnonymousModule();
  101. // assume that if the user is calling this, the element
  102. // is safe. This may not be a good idea
  103. $element = $module->addElement($element_name, $type, $contents, $attr_collections, $attributes);
  104. return $element;
  105. }
  106. /**
  107. * Adds a blank element to your HTML definition, for overriding
  108. * existing behavior
  109. * @note See HTMLPurifier_HTMLModule::addBlankElement for detailed
  110. * parameter and return value descriptions.
  111. */
  112. public function addBlankElement($element_name) {
  113. $module = $this->getAnonymousModule();
  114. $element = $module->addBlankElement($element_name);
  115. return $element;
  116. }
  117. /**
  118. * Retrieves a reference to the anonymous module, so you can
  119. * bust out advanced features without having to make your own
  120. * module.
  121. */
  122. public function getAnonymousModule() {
  123. if (!$this->_anonModule) {
  124. $this->_anonModule = new HTMLPurifier_HTMLModule();
  125. $this->_anonModule->name = 'Anonymous';
  126. }
  127. return $this->_anonModule;
  128. }
  129. private $_anonModule;
  130. // PUBLIC BUT INTERNAL VARIABLES --------------------------------------
  131. public $type = 'HTML';
  132. public $manager; /**< Instance of HTMLPurifier_HTMLModuleManager */
  133. /**
  134. * Performs low-cost, preliminary initialization.
  135. */
  136. public function __construct() {
  137. $this->manager = new HTMLPurifier_HTMLModuleManager();
  138. }
  139. protected function doSetup($config) {
  140. $this->processModules($config);
  141. $this->setupConfigStuff($config);
  142. unset($this->manager);
  143. // cleanup some of the element definitions
  144. foreach ($this->info as $k => $v) {
  145. unset($this->info[$k]->content_model);
  146. unset($this->info[$k]->content_model_type);
  147. }
  148. }
  149. /**
  150. * Extract out the information from the manager
  151. */
  152. protected function processModules($config) {
  153. if ($this->_anonModule) {
  154. // for user specific changes
  155. // this is late-loaded so we don't have to deal with PHP4
  156. // reference wonky-ness
  157. $this->manager->addModule($this->_anonModule);
  158. unset($this->_anonModule);
  159. }
  160. $this->manager->setup($config);
  161. $this->doctype = $this->manager->doctype;
  162. foreach ($this->manager->modules as $module) {
  163. foreach($module->info_tag_transform as $k => $v) {
  164. if ($v === false) unset($this->info_tag_transform[$k]);
  165. else $this->info_tag_transform[$k] = $v;
  166. }
  167. foreach($module->info_attr_transform_pre as $k => $v) {
  168. if ($v === false) unset($this->info_attr_transform_pre[$k]);
  169. else $this->info_attr_transform_pre[$k] = $v;
  170. }
  171. foreach($module->info_attr_transform_post as $k => $v) {
  172. if ($v === false) unset($this->info_attr_transform_post[$k]);
  173. else $this->info_attr_transform_post[$k] = $v;
  174. }
  175. foreach ($module->info_injector as $k => $v) {
  176. if ($v === false) unset($this->info_injector[$k]);
  177. else $this->info_injector[$k] = $v;
  178. }
  179. }
  180. $this->info = $this->manager->getElements();
  181. $this->info_content_sets = $this->manager->contentSets->lookup;
  182. }
  183. /**
  184. * Sets up stuff based on config. We need a better way of doing this.
  185. */
  186. protected function setupConfigStuff($config) {
  187. $block_wrapper = $config->get('HTML.BlockWrapper');
  188. if (isset($this->info_content_sets['Block'][$block_wrapper])) {
  189. $this->info_block_wrapper = $block_wrapper;
  190. } else {
  191. trigger_error('Cannot use non-block element as block wrapper',
  192. E_USER_ERROR);
  193. }
  194. $parent = $config->get('HTML.Parent');
  195. $def = $this->manager->getElement($parent, true);
  196. if ($def) {
  197. $this->info_parent = $parent;
  198. $this->info_parent_def = $def;
  199. } else {
  200. trigger_error('Cannot use unrecognized element as parent',
  201. E_USER_ERROR);
  202. $this->info_parent_def = $this->manager->getElement($this->info_parent, true);
  203. }
  204. // support template text
  205. $support = "(for information on implementing this, see the ".
  206. "support forums) ";
  207. // setup allowed elements -----------------------------------------
  208. $allowed_elements = $config->get('HTML.AllowedElements');
  209. $allowed_attributes = $config->get('HTML.AllowedAttributes'); // retrieve early
  210. if (!is_array($allowed_elements) && !is_array($allowed_attributes)) {
  211. $allowed = $config->get('HTML.Allowed');
  212. if (is_string($allowed)) {
  213. list($allowed_elements, $allowed_attributes) = $this->parseTinyMCEAllowedList($allowed);
  214. }
  215. }
  216. if (is_array($allowed_elements)) {
  217. foreach ($this->info as $name => $d) {
  218. if(!isset($allowed_elements[$name])) unset($this->info[$name]);
  219. unset($allowed_elements[$name]);
  220. }
  221. // emit errors
  222. foreach ($allowed_elements as $element => $d) {
  223. $element = htmlspecialchars($element); // PHP doesn't escape errors, be careful!
  224. trigger_error("Element '$element' is not supported $support", E_USER_WARNING);
  225. }
  226. }
  227. // setup allowed attributes ---------------------------------------
  228. $allowed_attributes_mutable = $allowed_attributes; // by copy!
  229. if (is_array($allowed_attributes)) {
  230. // This actually doesn't do anything, since we went away from
  231. // global attributes. It's possible that userland code uses
  232. // it, but HTMLModuleManager doesn't!
  233. foreach ($this->info_global_attr as $attr => $x) {
  234. $keys = array($attr, "*@$attr", "*.$attr");
  235. $delete = true;
  236. foreach ($keys as $key) {
  237. if ($delete && isset($allowed_attributes[$key])) {
  238. $delete = false;
  239. }
  240. if (isset($allowed_attributes_mutable[$key])) {
  241. unset($allowed_attributes_mutable[$key]);
  242. }
  243. }
  244. if ($delete) unset($this->info_global_attr[$attr]);
  245. }
  246. foreach ($this->info as $tag => $info) {
  247. foreach ($info->attr as $attr => $x) {
  248. $keys = array("$tag@$attr", $attr, "*@$attr", "$tag.$attr", "*.$attr");
  249. $delete = true;
  250. foreach ($keys as $key) {
  251. if ($delete && isset($allowed_attributes[$key])) {
  252. $delete = false;
  253. }
  254. if (isset($allowed_attributes_mutable[$key])) {
  255. unset($allowed_attributes_mutable[$key]);
  256. }
  257. }
  258. if ($delete) {
  259. if ($this->info[$tag]->attr[$attr]->required) {
  260. trigger_error("Required attribute '$attr' in element '$tag' was not allowed, which means '$tag' will not be allowed either", E_USER_WARNING);
  261. }
  262. unset($this->info[$tag]->attr[$attr]);
  263. }
  264. }
  265. }
  266. // emit errors
  267. foreach ($allowed_attributes_mutable as $elattr => $d) {
  268. $bits = preg_split('/[.@]/', $elattr, 2);
  269. $c = count($bits);
  270. switch ($c) {
  271. case 2:
  272. if ($bits[0] !== '*') {
  273. $element = htmlspecialchars($bits[0]);
  274. $attribute = htmlspecialchars($bits[1]);
  275. if (!isset($this->info[$element])) {
  276. trigger_error("Cannot allow attribute '$attribute' if element '$element' is not allowed/supported $support");
  277. } else {
  278. trigger_error("Attribute '$attribute' in element '$element' not supported $support",
  279. E_USER_WARNING);
  280. }
  281. break;
  282. }
  283. // otherwise fall through
  284. case 1:
  285. $attribute = htmlspecialchars($bits[0]);
  286. trigger_error("Global attribute '$attribute' is not ".
  287. "supported in any elements $support",
  288. E_USER_WARNING);
  289. break;
  290. }
  291. }
  292. }
  293. // setup forbidden elements ---------------------------------------
  294. $forbidden_elements = $config->get('HTML.ForbiddenElements');
  295. $forbidden_attributes = $config->get('HTML.ForbiddenAttributes');
  296. foreach ($this->info as $tag => $info) {
  297. if (isset($forbidden_elements[$tag])) {
  298. unset($this->info[$tag]);
  299. continue;
  300. }
  301. foreach ($info->attr as $attr => $x) {
  302. if (
  303. isset($forbidden_attributes["$tag@$attr"]) ||
  304. isset($forbidden_attributes["*@$attr"]) ||
  305. isset($forbidden_attributes[$attr])
  306. ) {
  307. unset($this->info[$tag]->attr[$attr]);
  308. continue;
  309. } // this segment might get removed eventually
  310. elseif (isset($forbidden_attributes["$tag.$attr"])) {
  311. // $tag.$attr are not user supplied, so no worries!
  312. trigger_error("Error with $tag.$attr: tag.attr syntax not supported for HTML.ForbiddenAttributes; use tag@attr instead", E_USER_WARNING);
  313. }
  314. }
  315. }
  316. foreach ($forbidden_attributes as $key => $v) {
  317. if (strlen($key) < 2) continue;
  318. if ($key[0] != '*') continue;
  319. if ($key[1] == '.') {
  320. trigger_error("Error with $key: *.attr syntax not supported for HTML.ForbiddenAttributes; use attr instead", E_USER_WARNING);
  321. }
  322. }
  323. // setup injectors -----------------------------------------------------
  324. foreach ($this->info_injector as $i => $injector) {
  325. if ($injector->checkNeeded($config) !== false) {
  326. // remove injector that does not have it's required
  327. // elements/attributes present, and is thus not needed.
  328. unset($this->info_injector[$i]);
  329. }
  330. }
  331. }
  332. /**
  333. * Parses a TinyMCE-flavored Allowed Elements and Attributes list into
  334. * separate lists for processing. Format is element[attr1|attr2],element2...
  335. * @warning Although it's largely drawn from TinyMCE's implementation,
  336. * it is different, and you'll probably have to modify your lists
  337. * @param $list String list to parse
  338. * @param array($allowed_elements, $allowed_attributes)
  339. * @todo Give this its own class, probably static interface
  340. */
  341. public function parseTinyMCEAllowedList($list) {
  342. $list = str_replace(array(' ', "\t"), '', $list);
  343. $elements = array();
  344. $attributes = array();
  345. $chunks = preg_split('/(,|[\n\r]+)/', $list);
  346. foreach ($chunks as $chunk) {
  347. if (empty($chunk)) continue;
  348. // remove TinyMCE element control characters
  349. if (!strpos($chunk, '[')) {
  350. $element = $chunk;
  351. $attr = false;
  352. } else {
  353. list($element, $attr) = explode('[', $chunk);
  354. }
  355. if ($element !== '*') $elements[$element] = true;
  356. if (!$attr) continue;
  357. $attr = substr($attr, 0, strlen($attr) - 1); // remove trailing ]
  358. $attr = explode('|', $attr);
  359. foreach ($attr as $key) {
  360. $attributes["$element.$key"] = true;
  361. }
  362. }
  363. return array($elements, $attributes);
  364. }
  365. }
  366. // vim: et sw=4 sts=4