mirror/php-htmlpurifier
1
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2025-10-15 06:04:23 +02:00
Code Issues Releases Wiki Activity

Remove trailing whitespace.

Browse Source 
Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
This commit is contained in:
Edward Z. Yang
2008-12-06 02:28:20 -05:00
parent 3a6b63dff1
commit 2c955af135
476 changed files with 5595 additions and 5547 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1056
Doxyfile
View File

File diff suppressed because it is too large Load Diff

60
INSTALL
View File

@@ -2,8 +2,8 @@
Install Install
How to install HTML Purifier How to install HTML Purifier
HTML Purifier is designed to run out of the box, so actually using the HTML Purifier is designed to run out of the box, so actually using the
library is extremely easy. (Although... if you were looking for a library is extremely easy. (Although... if you were looking for a
step-by-step installation GUI, you've downloaded the wrong software!) step-by-step installation GUI, you've downloaded the wrong software!)
While the impatient can get going immediately with some of the sample While the impatient can get going immediately with some of the sample
@@ -15,9 +15,9 @@ with these contents.
--------------------------------------------------------------------------- ---------------------------------------------------------------------------
1. Compatibility 1. Compatibility
HTML Purifier is PHP 5 only, and is actively tested from PHP 5.0.5 and HTML Purifier is PHP 5 only, and is actively tested from PHP 5.0.5 and
up. It has no core dependencies with other libraries. PHP up. It has no core dependencies with other libraries. PHP
4 support was deprecated on December 31, 2007 with HTML Purifier 3.0.0. 4 support was deprecated on December 31, 2007 with HTML Purifier 3.0.0.
These optional extensions can enhance the capabilities of HTML Purifier: These optional extensions can enhance the capabilities of HTML Purifier:
@@ -94,32 +94,32 @@ Autoload compatibility
HTML Purifier attempts to be as smart as possible when registering an HTML Purifier attempts to be as smart as possible when registering an
autoloader, but there are some cases where you will need to change autoloader, but there are some cases where you will need to change
your own code to accomodate HTML Purifier. These are those cases: your own code to accomodate HTML Purifier. These are those cases:
PHP VERSION IS LESS THAN 5.1.2, AND YOU'VE DEFINED __autoload PHP VERSION IS LESS THAN 5.1.2, AND YOU'VE DEFINED __autoload
Because spl_autoload_register() doesn't exist in early versions Because spl_autoload_register() doesn't exist in early versions
of PHP 5, HTML Purifier has no way of adding itself to the autoload of PHP 5, HTML Purifier has no way of adding itself to the autoload
stack. Modify your __autoload function to test stack. Modify your __autoload function to test
HTMLPurifier_Bootstrap::autoload($class) HTMLPurifier_Bootstrap::autoload($class)
For example, suppose your autoload function looks like this: For example, suppose your autoload function looks like this:
function __autoload($class) { function __autoload($class) {
require str_replace('_', '/', $class) . '.php'; require str_replace('_', '/', $class) . '.php';
return true; return true;
} }
A modified version with HTML Purifier would look like this: A modified version with HTML Purifier would look like this:
function __autoload($class) { function __autoload($class) {
if (HTMLPurifier_Bootstrap::autoload($class)) return true; if (HTMLPurifier_Bootstrap::autoload($class)) return true;
require str_replace('_', '/', $class) . '.php'; require str_replace('_', '/', $class) . '.php';
return true; return true;
} }
Note that there *is* some custom behavior in our autoloader; the Note that there *is* some custom behavior in our autoloader; the
original autoloader in our example would work for 99% of the time, original autoloader in our example would work for 99% of the time,
but would fail when including language files. but would fail when including language files.
AN __autoload FUNCTION IS DECLARED AFTER OUR AUTOLOADER IS REGISTERED AN __autoload FUNCTION IS DECLARED AFTER OUR AUTOLOADER IS REGISTERED
spl_autoload_register() has the curious behavior of disabling spl_autoload_register() has the curious behavior of disabling
the existing __autoload() handler. Users need to explicitly the existing __autoload() handler. Users need to explicitly
@@ -129,14 +129,14 @@ Autoload compatibility
HTML Purifier will register the function for you. But if it is HTML Purifier will register the function for you. But if it is
declared afterwards, it will mysteriously not work. This declared afterwards, it will mysteriously not work. This
snippet of code (after your autoloader is defined) will fix it: snippet of code (after your autoloader is defined) will fix it:
spl_autoload_register('__autoload') spl_autoload_register('__autoload')
Users should also be on guard if they use a version of PHP previous Users should also be on guard if they use a version of PHP previous
to 5.1.2 without an autoloader--HTML Purifier will define __autoload() to 5.1.2 without an autoloader--HTML Purifier will define __autoload()
for you, which can collide with an autoloader that was added by *you* for you, which can collide with an autoloader that was added by *you*
later. later.
For better performance For better performance
---------------------- ----------------------
@@ -145,18 +145,18 @@ For better performance
with large amounts of code (HTML Purifier included), don't like with large amounts of code (HTML Purifier included), don't like
autoloaders. We offer an include file that includes all of HTML Purifier's autoloaders. We offer an include file that includes all of HTML Purifier's
files in one go in an opcode cache friendly manner: files in one go in an opcode cache friendly manner:
// If /path/to/library isn't already in your include path, uncomment // If /path/to/library isn't already in your include path, uncomment
// the below line: // the below line:
// require '/path/to/library/HTMLPurifier.path.php'; // require '/path/to/library/HTMLPurifier.path.php';
require 'HTMLPurifier.includes.php'; require 'HTMLPurifier.includes.php';
Optional components still need to be included--you'll know if you try to Optional components still need to be included--you'll know if you try to
use a feature and you get a class doesn't exists error! The autoloader use a feature and you get a class doesn't exists error! The autoloader
can be used in conjunction with this approach to catch classes that are can be used in conjunction with this approach to catch classes that are
missing. Simply add this afterwards: missing. Simply add this afterwards:
require 'HTMLPurifier.autoload.php'; require 'HTMLPurifier.autoload.php';
Standalone version Standalone version
@@ -167,22 +167,22 @@ Standalone version
maintenance/generate-standalone.php . The standalone version has the maintenance/generate-standalone.php . The standalone version has the
benefit of having most of its code in one file, so parsing is much benefit of having most of its code in one file, so parsing is much
faster and the library is easier to manage. faster and the library is easier to manage.
If HTMLPurifier.standalone.php exists in the library directory, you If HTMLPurifier.standalone.php exists in the library directory, you
can use it like this: can use it like this:
require '/path/to/HTMLPurifier.standalone.php'; require '/path/to/HTMLPurifier.standalone.php';
This is equivalent to including HTMLPurifier.includes.php, except that This is equivalent to including HTMLPurifier.includes.php, except that
the contents of standalone/ will be added to your path. To override this the contents of standalone/ will be added to your path. To override this
behavior, specify a new HTMLPURIFIER_PREFIX where standalone files can behavior, specify a new HTMLPURIFIER_PREFIX where standalone files can
be found (usually, this will be one directory up, the "true" library be found (usually, this will be one directory up, the "true" library
directory in full distributions). Don't forget to set your path too! directory in full distributions). Don't forget to set your path too!
The autoloader can be added to the end to ensure the classes are The autoloader can be added to the end to ensure the classes are
loaded when necessary; otherwise you can manually include them. loaded when necessary; otherwise you can manually include them.
To use the autoloader, use this: To use the autoloader, use this:
require 'HTMLPurifier.autoload.php'; require 'HTMLPurifier.autoload.php';
For advanced users For advanced users
@@ -190,14 +190,14 @@ For advanced users
HTMLPurifier.auto.php performs a number of operations that can be done HTMLPurifier.auto.php performs a number of operations that can be done
individually. These are: individually. These are:
HTMLPurifier.path.php HTMLPurifier.path.php
Puts /path/to/library in the include path. For high performance, Puts /path/to/library in the include path. For high performance,
this should be done in php.ini. this should be done in php.ini.
HTMLPurifier.autoload.php HTMLPurifier.autoload.php
Registers our autoload handler HTMLPurifier_Bootstrap::autoload($class). Registers our autoload handler HTMLPurifier_Bootstrap::autoload($class).
You can do these operations by yourself--in fact, you must modify your own You can do these operations by yourself--in fact, you must modify your own
autoload handler if you are using a version of PHP earlier than PHP 5.1.2 autoload handler if you are using a version of PHP earlier than PHP 5.1.2
(See "Autoload compatibility" above). (See "Autoload compatibility" above).
@@ -352,7 +352,7 @@ If your website is in UTF-8 and XHTML Transitional, use this code:
<?php <?php
require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
$purifier = new HTMLPurifier(); $purifier = new HTMLPurifier();
$clean_html = $purifier->purify($dirty_html); $clean_html = $purifier->purify($dirty_html);
?> ?>
@@ -361,12 +361,12 @@ If your website is in a different encoding or doctype, use this code:
<?php <?php
require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault(); $config = HTMLPurifier_Config::createDefault();
$config->set('Core', 'Encoding', 'ISO-8859-1'); // replace with your encoding $config->set('Core', 'Encoding', 'ISO-8859-1'); // replace with your encoding
$config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); // replace with your doctype $config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); // replace with your doctype
$purifier = new HTMLPurifier($config); $purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html); $clean_html = $purifier->purify($dirty_html);
?> ?>

8
INSTALL.fr.utf8
View File

@@ -20,7 +20,7 @@ ce document pour quelques choses.
HTML Purifier fonctionne dans PHP 5. PHP 5.0.5 est le dernier HTML Purifier fonctionne dans PHP 5. PHP 5.0.5 est le dernier
version que je le testais. Il ne dépend de les autre librairies. version que je le testais. Il ne dépend de les autre librairies.
Les extensions optionnel est iconv (en général déjà installer) et Les extensions optionnel est iconv (en général déjà installer) et
tidy (répandu aussi). Si vous utilisez UTF-8 et ne voulez pas tidy (répandu aussi). Si vous utilisez UTF-8 et ne voulez pas
l'indentation, vous pouvez utiliser HTML Purifier sans ces extensions. l'indentation, vous pouvez utiliser HTML Purifier sans ces extensions.
@@ -48,7 +48,7 @@ Si votre site web est en UTF-8 et XHTML Transitional, utilisez:
<?php <?php
require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
$purificateur = new HTMLPurifier(); $purificateur = new HTMLPurifier();
$html_propre = $purificateur->purify($html_salle); $html_propre = $purificateur->purify($html_salle);
?> ?>
@@ -57,11 +57,11 @@ Sinon, utilisez:
<?php <?php
require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault(); $config = HTMLPurifier_Config::createDefault();
$config->set('Core', 'Encoding', 'ISO-8859-1'); //remplacez avec votre encoding $config->set('Core', 'Encoding', 'ISO-8859-1'); //remplacez avec votre encoding
$config->set('Core', 'XHTML', true); //remplacez avec false si HTML 4.01 $config->set('Core', 'XHTML', true); //remplacez avec false si HTML 4.01
$purificateur = new HTMLPurifier($config); $purificateur = new HTMLPurifier($config);
$html_propre = $purificateur->purify($html_salle); $html_propre = $purificateur->purify($html_salle);
?> ?>

2
LICENSE
View File

@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for on the Library (independent of the use of the Library in a tool for
writing it). Whether that is true depends on what the Library does writing it). Whether that is true depends on what the Library does
and what the program that uses the Library does. and what the program that uses the Library does.
1. You may copy and distribute verbatim copies of the Library's 1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an you conspicuously and appropriately publish on each copy an

28
NEWS
View File

@@ -34,7 +34,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
deal with a bug in FCKEditor. Requested by frank farmer. deal with a bug in FCKEditor. Requested by frank farmer.
! Enable HTML comments when %HTML.Trusted is on. Requested by Waldo Jaquith. ! Enable HTML comments when %HTML.Trusted is on. Requested by Waldo Jaquith.
! Proper support for name attribute. It is now allowed and equivalent to the id ! Proper support for name attribute. It is now allowed and equivalent to the id
attribute in a and img tags, and is only converted to id when %HTML.TidyLevel attribute in a and img tags, and is only converted to id when %HTML.TidyLevel
is heavy (for all doctypes). is heavy (for all doctypes).
! %AutoFormat.RemoveEmpty to remove some empty tags from documents. Please don't ! %AutoFormat.RemoveEmpty to remove some empty tags from documents. Please don't
use on hand-written HTML. use on hand-written HTML.
@@ -45,7 +45,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
! Test scripts now have a 'type' parameter, which lets you say 'htmlpurifier', ! Test scripts now have a 'type' parameter, which lets you say 'htmlpurifier',
'phpt', 'vtest', etc. in order to only execute those tests. This supercedes 'phpt', 'vtest', etc. in order to only execute those tests. This supercedes
the --only-phpt parameter, although for backwards-compatibility the flag the --only-phpt parameter, although for backwards-compatibility the flag
will still work. will still work.
! AutoParagraph auto-formatter will now preserve double-newlines upon output. ! AutoParagraph auto-formatter will now preserve double-newlines upon output.
Users who are not performing inbound filtering, this may seem a little Users who are not performing inbound filtering, this may seem a little
useless, but as a bonus, the test suite and handling of edge cases is also useless, but as a bonus, the test suite and handling of edge cases is also
@@ -89,7 +89,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
for more interesting filter-backtracking for more interesting filter-backtracking
. New HTMLPurifier_Injector->rewind() functionality, allows injectors to rewind . New HTMLPurifier_Injector->rewind() functionality, allows injectors to rewind
index to reprocess tokens. index to reprocess tokens.
. StringHashParser now allows for multiline sections with "empty" content; . StringHashParser now allows for multiline sections with "empty" content;
previously the section would remain undefined. previously the section would remain undefined.
. Added --quick option to multitest.php, which tests only the most recent . Added --quick option to multitest.php, which tests only the most recent
release for each series. release for each series.
@@ -98,7 +98,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
3.1.1, released 2008-06-19 3.1.1, released 2008-06-19
# %URI.Munge now, by default, does not munge resources (for example, <img src="">) # %URI.Munge now, by default, does not munge resources (for example, <img src="">)
In order to enable this again, please set %URI.MungeResources to true. In order to enable this again, please set %URI.MungeResources to true.
! More robust imagecrash protection with height/width CSS with %CSS.MaxImgLength, ! More robust imagecrash protection with height/width CSS with %CSS.MaxImgLength,
and height/width HTML with %HTML.MaxImgLength. and height/width HTML with %HTML.MaxImgLength.
! %URI.MungeSecretKey for secure URI munging. Thanks Chris ! %URI.MungeSecretKey for secure URI munging. Thanks Chris
@@ -108,7 +108,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
%URI.MungeSecretKey and and %URI.SecureMunge => %URI.Munge) %URI.MungeSecretKey and and %URI.SecureMunge => %URI.Munge)
! Implemented post URI filtering. Set member variable $post to true to set ! Implemented post URI filtering. Set member variable $post to true to set
a URIFilter as such. a URIFilter as such.
! Allow modules to define injectors via $info_injector. Injectors are ! Allow modules to define injectors via $info_injector. Injectors are
automatically disabled if injector's needed elements are not found. automatically disabled if injector's needed elements are not found.
! Support for "safe" objects added, use %HTML.SafeObject and %HTML.SafeEmbed. ! Support for "safe" objects added, use %HTML.SafeObject and %HTML.SafeEmbed.
Thanks Chris for sponsoring. If you've been using ad hoc code from the Thanks Chris for sponsoring. If you've been using ad hoc code from the
@@ -155,10 +155,10 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
consult changes to HTMLPurifier_Config for details. consult changes to HTMLPurifier_Config for details.
. Variable parsing types now are magic integers instead of strings . Variable parsing types now are magic integers instead of strings
. Added benchmark for ConfigSchema . Added benchmark for ConfigSchema
. HTMLPurifier_Generator requires $config and $context parameters. If you . HTMLPurifier_Generator requires $config and $context parameters. If you
don't know what they should be, use HTMLPurifier_Config::createDefault() don't know what they should be, use HTMLPurifier_Config::createDefault()
and new HTMLPurifier_Context(). and new HTMLPurifier_Context().
. Printers now properly distinguish between output configuration, and . Printers now properly distinguish between output configuration, and
target configuration. This is not applicable to scripts using target configuration. This is not applicable to scripts using
the Printers for HTML Purifier related tasks. the Printers for HTML Purifier related tasks.
. HTML/CSS Printers must be primed with prepareGenerator($gen_config), otherwise . HTML/CSS Printers must be primed with prepareGenerator($gen_config), otherwise
@@ -245,7 +245,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
enabled using %Filter.$filter_name or by setting your own filters using enabled using %Filter.$filter_name or by setting your own filters using
%Filter.Custom %Filter.Custom
# Directive-level safety properties superceded in favor of module-level # Directive-level safety properties superceded in favor of module-level
safety. Internal method HTMLModule->addElement() has changed, although safety. Internal method HTMLModule->addElement() has changed, although
the externally visible HTMLDefinition->addElement has *not* changed. the externally visible HTMLDefinition->addElement has *not* changed.
! Extra utility classes for testing and non-library operations can ! Extra utility classes for testing and non-library operations can
be found in extras/. Specifically, these are FSTools and ConfigDoc. be found in extras/. Specifically, these are FSTools and ConfigDoc.
@@ -285,7 +285,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
. Dry runs now supported in SimpleTest; testing facilities improved . Dry runs now supported in SimpleTest; testing facilities improved
. Bootstrap class added for handling autoloading functionality . Bootstrap class added for handling autoloading functionality
. Implemented recursive glob at FSTools->globr . Implemented recursive glob at FSTools->globr
. ConfigSchema now has instance methods for all corresponding define* . ConfigSchema now has instance methods for all corresponding define*
static methods. static methods.
. A couple of new historical maintenance scripts were added. . A couple of new historical maintenance scripts were added.
. HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php split into two files . HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php split into two files
@@ -306,7 +306,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
. HTMLPurifier_ConfigSchema->validate() deprecated in favor of . HTMLPurifier_ConfigSchema->validate() deprecated in favor of
HTMLPurifier_VarParser->parse() HTMLPurifier_VarParser->parse()
. Integers auto-cast into float type by VarParser. . Integers auto-cast into float type by VarParser.
. HTMLPURIFIER_STRICT removed; no validation is performed on runtime, only . HTMLPURIFIER_STRICT removed; no validation is performed on runtime, only
during cache generation during cache generation
. Reordered script calls in maintenance/flush.php . Reordered script calls in maintenance/flush.php
. Command line scripts now honor exit codes . Command line scripts now honor exit codes
@@ -348,7 +348,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
script (you must provide this script!) script (you must provide this script!)
- Fixed poor include ordering for Email URI AttrDefs, causes fatal errors - Fixed poor include ordering for Email URI AttrDefs, causes fatal errors
on some systems. on some systems.
- Injector algorithm further refined: off-by-one error regarding skip - Injector algorithm further refined: off-by-one error regarding skip
counts for dormant injectors fixed counts for dormant injectors fixed
- Corrective blockquote definition now enabled for HTML 4.01 Strict - Corrective blockquote definition now enabled for HTML 4.01 Strict
- Fatal error when <img> tag (or any other element with required attributes) - Fatal error when <img> tag (or any other element with required attributes)
@@ -373,7 +373,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
facilities in PHP 5 facilities in PHP 5
- Make ErrorCollectorEMock work in both PHP 4 and PHP 5 - Make ErrorCollectorEMock work in both PHP 4 and PHP 5
- Make PH5P work with PHP 5.0 by removing unnecessary array parameter typedef - Make PH5P work with PHP 5.0 by removing unnecessary array parameter typedef
. %Core.AcceptFullDocuments renamed to %Core.ConvertDocumentToFragment . %Core.AcceptFullDocuments renamed to %Core.ConvertDocumentToFragment
to better communicate its purpose to better communicate its purpose
. Error unit tests can now specify the expectation of no errors. Future . Error unit tests can now specify the expectation of no errors. Future
iterations of the harness will be extremely strict about what errors iterations of the harness will be extremely strict about what errors
@@ -532,7 +532,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
and better modularization and better modularization
# Configuration object now finalizes itself when a read operation is # Configuration object now finalizes itself when a read operation is
performed on it, ensuring that its internal state stays consistent. performed on it, ensuring that its internal state stays consistent.
To revert this behavior, you can set the $autoFinalize member variable To revert this behavior, you can set the $autoFinalize member variable
off, but it's not recommended. off, but it's not recommended.
# New compact syntax for AttrDef objects that can be used to instantiate # New compact syntax for AttrDef objects that can be used to instantiate
new objects via make() new objects via make()
@@ -616,7 +616,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
AttrTransform_EnumToCSS, refer to HTMLModule/TransformToStrict.php to AttrTransform_EnumToCSS, refer to HTMLModule/TransformToStrict.php to
see how the new equivalent is implemented see how the new equivalent is implemented
. Unit tests now use exclusively assertIdentical . Unit tests now use exclusively assertIdentical
1.6.0, released 2007-04-01 1.6.0, released 2007-04-01
! Support for most common deprecated attributes via transformations: ! Support for most common deprecated attributes via transformations:
+ bgcolor in td, th, tr and table + bgcolor in td, th, tr and table

16
README
View File

@@ -2,15 +2,15 @@
README README
All about HTML Purifier All about HTML Purifier
HTML Purifier is an HTML filtering solution that uses a unique combination HTML Purifier is an HTML filtering solution that uses a unique combination
of robust whitelists and agressive parsing to ensure that not only are of robust whitelists and agressive parsing to ensure that not only are
XSS attacks thwarted, but the resulting HTML is standards compliant. XSS attacks thwarted, but the resulting HTML is standards compliant.
HTML Purifier is oriented towards richly formatted documents from HTML Purifier is oriented towards richly formatted documents from
untrusted sources that require CSS and a full tag-set. This library can untrusted sources that require CSS and a full tag-set. This library can
be configured to accept a more restrictive set of tags, but it won't be be configured to accept a more restrictive set of tags, but it won't be
as efficient as more bare-bones parsers. It will, however, do the job as efficient as more bare-bones parsers. It will, however, do the job
right, which may be more important. right, which may be more important.
Places to go: Places to go:

2
TODO
View File

@@ -65,7 +65,7 @@ FUTURE VERSIONS
- Lots of documentation and samples - Lots of documentation and samples
Ongoing Ongoing
- More refactoring to take advantage of PHP5's facilities - More refactoring to take advantage of PHP5's facilities
- Refactor unit tests into lots of test methods - Refactor unit tests into lots of test methods
- Plugins for major CMSes (COMPLEX) - Plugins for major CMSes (COMPLEX)
- phpBB - phpBB

2
WHATSNEW
View File

@@ -1,6 +1,6 @@
HTML Purifier 3.2.0 is an amalgamation of new features and fixes that HTML Purifier 3.2.0 is an amalgamation of new features and fixes that
have accumulated over a four month period. Some notable features have accumulated over a four month period. Some notable features
include %AutoFormat.RemoveEmpty, column tracking for tokens, include %AutoFormat.RemoveEmpty, column tracking for tokens,
%AutoFormat.DisplayLinkURI and %Attr.DefaultImageAlt. There were also %AutoFormat.DisplayLinkURI and %Attr.DefaultImageAlt. There were also
major improvements to the test suite interface, error collection output major improvements to the test suite interface, error collection output
and the auto-formatter framework. and the auto-formatter framework.

44
benchmarks/Lexer.php
View File

@@ -9,7 +9,7 @@ require_once 'Text/Password.php'; // for generating random input
$LEXERS = array(); $LEXERS = array();
$RUNS = isset($GLOBALS['HTMLPurifierTest']['Runs']) $RUNS = isset($GLOBALS['HTMLPurifierTest']['Runs'])
? $GLOBALS['HTMLPurifierTest']['Runs'] : 2; ? $GLOBALS['HTMLPurifierTest']['Runs'] : 2;
require_once 'HTMLPurifier/Lexer/DirectLex.php'; require_once 'HTMLPurifier/Lexer/DirectLex.php';
$LEXERS['DirectLex'] = new HTMLPurifier_Lexer_DirectLex(); $LEXERS['DirectLex'] = new HTMLPurifier_Lexer_DirectLex();
@@ -22,48 +22,48 @@ if (version_compare(PHP_VERSION, '5', '>=')) {
// custom class to aid unit testing // custom class to aid unit testing
class RowTimer extends Benchmark_Timer class RowTimer extends Benchmark_Timer
{ {
var $name; var $name;
function RowTimer($name, $auto = false) { function RowTimer($name, $auto = false) {
$this->name = htmlentities($name); $this->name = htmlentities($name);
$this->Benchmark_Timer($auto); $this->Benchmark_Timer($auto);
} }
function getOutput() { function getOutput() {
$total = $this->TimeElapsed(); $total = $this->TimeElapsed();
$result = $this->getProfiling(); $result = $this->getProfiling();
$dashes = ''; $dashes = '';
$out = '<tr>'; $out = '<tr>';
$out .= "<td>{$this->name}</td>"; $out .= "<td>{$this->name}</td>";
$standard = false; $standard = false;
foreach ($result as $k => $v) { foreach ($result as $k => $v) {
if ($v['name'] == 'Start' || $v['name'] == 'Stop') continue; if ($v['name'] == 'Start' || $v['name'] == 'Stop') continue;
//$perc = (($v['diff'] * 100) / $total); //$perc = (($v['diff'] * 100) / $total);
//$tperc = (($v['total'] * 100) / $total); //$tperc = (($v['total'] * 100) / $total);
//$out .= '<td align="right">' . $v['diff'] . '</td>'; //$out .= '<td align="right">' . $v['diff'] . '</td>';
if ($standard == false) $standard = $v['diff']; if ($standard == false) $standard = $v['diff'];
$perc = $v['diff'] * 100 / $standard; $perc = $v['diff'] * 100 / $standard;
$bad_run = ($v['diff'] < 0); $bad_run = ($v['diff'] < 0);
$out .= '<td align="right"'. $out .= '<td align="right"'.
($bad_run ? ' style="color:#AAA;"' : ''). ($bad_run ? ' style="color:#AAA;"' : '').
'>' . number_format($perc, 2, '.', '') . '>' . number_format($perc, 2, '.', '') .
'%</td><td>'.number_format($v['diff'],4,'.','').'</td>'; '%</td><td>'.number_format($v['diff'],4,'.','').'</td>';
} }
$out .= '</tr>'; $out .= '</tr>';
return $out; return $out;
} }
} }
@@ -80,18 +80,18 @@ function print_lexers() {
function do_benchmark($name, $document) { function do_benchmark($name, $document) {
global $LEXERS, $RUNS; global $LEXERS, $RUNS;
$config = HTMLPurifier_Config::createDefault(); $config = HTMLPurifier_Config::createDefault();
$context = new HTMLPurifier_Context(); $context = new HTMLPurifier_Context();
$timer = new RowTimer($name); $timer = new RowTimer($name);
$timer->start(); $timer->start();
foreach($LEXERS as $key => $lexer) { foreach($LEXERS as $key => $lexer) {
for ($i=0; $i<$RUNS; $i++) $tokens = $lexer->tokenizeHTML($document, $config, $context); for ($i=0; $i<$RUNS; $i++) $tokens = $lexer->tokenizeHTML($document, $config, $context);
$timer->setMarker($key); $timer->setMarker($key);
} }
$timer->stop(); $timer->stop();
$timer->display(); $timer->display();
} }
@@ -118,11 +118,11 @@ foreach ($LEXERS as $key => $value) {
$dir = 'samples/Lexer'; $dir = 'samples/Lexer';
$dh = opendir($dir); $dh = opendir($dir);
while (false !== ($filename = readdir($dh))) { while (false !== ($filename = readdir($dh))) {
if (strpos($filename, '.html') !== strlen($filename) - 5) continue; if (strpos($filename, '.html') !== strlen($filename) - 5) continue;
$document = file_get_contents($dir . '/' . $filename); $document = file_get_contents($dir . '/' . $filename);
do_benchmark("File: $filename", $document); do_benchmark("File: $filename", $document);
} }
// crashers, caused infinite loops before // crashers, caused infinite loops before

4
benchmarks/samples/Lexer/1.html
View File

@@ -28,7 +28,7 @@
<li>HX Edison Taiji Club <a href="http://www.taijiclub.org/downloads/Taiji_club_regulation_.pdf">by-law</a> effective 3/28/2006</li> <li>HX Edison Taiji Club <a href="http://www.taijiclub.org/downloads/Taiji_club_regulation_.pdf">by-law</a> effective 3/28/2006</li>
<li>A new email account for our club: HXEdisontaijiclub@yahoo.com</li> <li>A new email account for our club: HXEdisontaijiclub@yahoo.com</li>
<li>Workshop conducted by <a href="http://www.taijiclub.org/ch/Digest/LiDeyin">?????</a> Li Deyin is set on June 4, 2006 at Clarion Hotel in Edison from 9:30am-12pm; <a href="http://www.taijiclub.org/en/Registration">Registration</a></li> <li>Workshop conducted by <a href="http://www.taijiclub.org/ch/Digest/LiDeyin">?????</a> Li Deyin is set on June 4, 2006 at Clarion Hotel in Edison from 9:30am-12pm; <a href="http://www.taijiclub.org/en/Registration">Registration</a></li>
</ul> </ul>
@@ -36,7 +36,7 @@
<p><i>Taiji</i> is an ancient Chinese tradition of movement systems that is associated with philosophy, physiology, psychology, geometry and dynamics. It is the slowest form of martial arts and is meant to improve the internal spirit. It is soothing to the soul and extremely invigorating. </p> <p><i>Taiji</i> is an ancient Chinese tradition of movement systems that is associated with philosophy, physiology, psychology, geometry and dynamics. It is the slowest form of martial arts and is meant to improve the internal spirit. It is soothing to the soul and extremely invigorating. </p>
<p>The founder of Taiji was Zhang Sanfeng (Chang San-feng), who was a monk of the Wu Dang (Wu Tang) Monastery and lived in the period from 1391 to 1459. His exercises stressed suppleness and elasticity as opposed to the hardness and force of other martial art styles. Several centuries old, Taiji was originally developed as a form of self-defense, emphasizing strength, balance, flexibility and speed. Tai Chi also differs from other martial arts in that it is based on the Taoist religion and aims to avoid aggressive forces. </p> <p>The founder of Taiji was Zhang Sanfeng (Chang San-feng), who was a monk of the Wu Dang (Wu Tang) Monastery and lived in the period from 1391 to 1459. His exercises stressed suppleness and elasticity as opposed to the hardness and force of other martial art styles. Several centuries old, Taiji was originally developed as a form of self-defense, emphasizing strength, balance, flexibility and speed. Tai Chi also differs from other martial arts in that it is based on the Taoist religion and aims to avoid aggressive forces. </p>

20
benchmarks/samples/Lexer/3.html
View File

@@ -67,21 +67,21 @@ if (objAdMgr.isSlotAvailable("leaderboard")) {
</table> </table>
<table width="86%" border="0" cellspacing="0" cellpadding="2"> <table width="86%" border="0" cellspacing="0" cellpadding="2">
<tr> <tr>
<td height="388" width="19%" bgcolor="#FFCCFF" valign="top"> <td height="388" width="19%" bgcolor="#FFCCFF" valign="top">
<p>May 1, 2000</p> <p>May 1, 2000</p>
<p><b>Pop Culture</b> </p> <p><b>Pop Culture</b> </p>
<p>by. H. Finkelstein</p> <p>by. H. Finkelstein</p>
</td> </td>
<td height="388" width="52%" valign="top"> <td height="388" width="52%" valign="top">
<p>Welcome to the <b>Anime Digi-Lib</b>, a virtual index to anime on the <p>Welcome to the <b>Anime Digi-Lib</b>, a virtual index to anime on the
internet. This site strives to house a comprehensive index to both personal internet. This site strives to house a comprehensive index to both personal
and commercial websites and provides reviews to these sites. We hope to and commercial websites and provides reviews to these sites. We hope to
be a gateway for people who've never imagined they'd ever be interested be a gateway for people who've never imagined they'd ever be interested
in Japanese Animation. </p> in Japanese Animation. </p>
<table width="99%" border="1" cellspacing="0" cellpadding="2" height="320" name="Searchnservices"> <table width="99%" border="1" cellspacing="0" cellpadding="2" height="320" name="Searchnservices">
<tr> <tr>
<td height="263" valign="top" width="58%"> <td height="263" valign="top" width="58%">
<p>&nbsp; </p> <p>&nbsp; </p>
<p>&nbsp;</p> <p>&nbsp;</p>
@@ -107,15 +107,15 @@ if (objAdMgr.isSlotAvailable("leaderboard")) {
</form> </form>
<td> <td>
<table border="0" cellpadding="0" cellspacing="0" width="100%"> <table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr><td><font face="verdana,geneva" color="#000011" size="1">What is better, subtitled or dubbed anime?</font></td></tr> <tr><td><font face="verdana,geneva" color="#000011" size="1">What is better, subtitled or dubbed anime?</font></td></tr>
<tr><td><input type="radio" name="rd" value="1"><font face="verdana" size="2" color="#000011">Subtitled</font></td></tr> <tr><td><input type="radio" name="rd" value="1"><font face="verdana" size="2" color="#000011">Subtitled</font></td></tr>
<tr><td align="middle"><font face="verdana" size="1"><a href="http://pub.alxnet.com/poll?id=2079873&q=view">Current results</a></font></td></tr> <tr><td align="middle"><font face="verdana" size="1"><a href="http://pub.alxnet.com/poll?id=2079873&q=view">Current results</a></font></td></tr>
</table></td></tr> </table></td></tr>
<tr> <tr>
<td><font face="verdana" size="1"><a href="http://www.alxnet.com/services/poll/">Free <td><font face="verdana" size="1"><a href="http://www.alxnet.com/services/poll/">Free
Web Polls</a></font></td> Web Polls</a></font></td>
</tr> </tr>
</table></form> </table></form>

28
benchmarks/samples/Lexer/4.html
View File

@@ -138,7 +138,7 @@
</table> </table>
<p><script type="text/javascript"> <p><script type="text/javascript">
//<![CDATA[ //<![CDATA[
if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); } if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); }
//]]> //]]>
</script></p> </script></p>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/w/index.php?title=Tai_Chi_Chuan&amp;action=edit&amp;section=1" title="Edit section: Overview">edit</a>]</div> <div class="editsection" style="float:right;margin-left:5px;">[<a href="/w/index.php?title=Tai_Chi_Chuan&amp;action=edit&amp;section=1" title="Edit section: Overview">edit</a>]</div>
@@ -279,19 +279,19 @@ Yang Small Frame | <a href="/wik
| | | |
<a href="/w/index.php?title=Wu_Ta-kuei&amp;action=edit" class="new" title="Wu Ta-kuei">Wu Ta-kuei</a> <a href="/w/index.php?title=Sun_Hsing-i&amp;action=edit" class="new" title="Sun Hsing-i">Sun Hsing-i</a> <a href="/w/index.php?title=Wu_Ta-kuei&amp;action=edit" class="new" title="Wu Ta-kuei">Wu Ta-kuei</a> <a href="/w/index.php?title=Sun_Hsing-i&amp;action=edit" class="new" title="Sun Hsing-i">Sun Hsing-i</a>
1923-1970 1891-1929 1923-1970 1891-1929
<b>MODERN FORMS</b> <b>MODERN FORMS</b>
from Yang Ch`eng-fu from Yang Ch`eng-fu
| |
| |
| |
+--------------+ +--------------+
| | | |
<a href="/wiki/Cheng_Man-ch%27ing" title="Cheng Man-ch'ing">Cheng Man-ch'ing</a> | <a href="/wiki/Cheng_Man-ch%27ing" title="Cheng Man-ch'ing">Cheng Man-ch'ing</a> |
1901-1975 | 1901-1975 |
Short (37) Form | Short (37) Form |
| |
Chinese Sports Commission Chinese Sports Commission
1956 1956

22
configdoc/styles/plain.xsl
View File

@@ -14,13 +14,13 @@
/> />
<xsl:param name="css" select="'styles/plain.css'"/> <xsl:param name="css" select="'styles/plain.css'"/>
<xsl:param name="title" select="'Configuration Documentation'"/> <xsl:param name="title" select="'Configuration Documentation'"/>
<xsl:variable name="typeLookup" select="document('../types.xml')/types" /> <xsl:variable name="typeLookup" select="document('../types.xml')/types" />
<xsl:variable name="usageLookup" select="document('../usage.xml')/usage" /> <xsl:variable name="usageLookup" select="document('../usage.xml')/usage" />
<!-- Twiddle this variable to get the columns as even as possible --> <!-- Twiddle this variable to get the columns as even as possible -->
<xsl:variable name="maxNumberAdjust" select="2" /> <xsl:variable name="maxNumberAdjust" select="2" />
<xsl:template match="/"> <xsl:template match="/">
<html lang="en" xml:lang="en"> <html lang="en" xml:lang="en">
<head> <head>
@@ -45,7 +45,7 @@
</body> </body>
</html> </html>
</xsl:template> </xsl:template>
<xsl:template match="title" mode="toc" /> <xsl:template match="title" mode="toc" />
<xsl:template match="namespace" mode="toc"> <xsl:template match="namespace" mode="toc">
<xsl:param name="overflowNumber" /> <xsl:param name="overflowNumber" />
@@ -83,9 +83,9 @@
</li> </li>
</xsl:if> </xsl:if>
</xsl:template> </xsl:template>
<xsl:template match="title" /> <xsl:template match="title" />
<xsl:template match="namespace"> <xsl:template match="namespace">
<div class="namespace"> <div class="namespace">
<xsl:apply-templates /> <xsl:apply-templates />
@@ -102,7 +102,7 @@
<xsl:copy-of xmlns:xhtml="http://www.w3.org/1999/xhtml" select="xhtml:div/node()" /> <xsl:copy-of xmlns:xhtml="http://www.w3.org/1999/xhtml" select="xhtml:div/node()" />
</div> </div>
</xsl:template> </xsl:template>
<xsl:template match="directive"> <xsl:template match="directive">
<div> <div>
<xsl:attribute name="class"><!-- <xsl:attribute name="class"><!--
@@ -122,10 +122,10 @@
<xsl:template match="alias" mode="anchor"> <xsl:template match="alias" mode="anchor">
<a id="{.}"></a> <a id="{.}"></a>
</xsl:template> </xsl:template>
<!-- Do not pass through --> <!-- Do not pass through -->
<xsl:template match="alias"></xsl:template> <xsl:template match="alias"></xsl:template>
<xsl:template match="directive/constraints"> <xsl:template match="directive/constraints">
<xsl:param name="id" /> <xsl:param name="id" />
<table class="constraints"> <table class="constraints">
@@ -179,7 +179,7 @@
</xsl:for-each> </xsl:for-each>
</li> </li>
</xsl:template> </xsl:template>
<xsl:template match="constraints/version"> <xsl:template match="constraints/version">
<tr> <tr>
<th>Version added</th> <th>Version added</th>
@@ -229,5 +229,5 @@
<xsl:template match="constraints/external/project"> <xsl:template match="constraints/external/project">
<li><xsl:value-of select="." /></li> <li><xsl:value-of select="." /></li>
</xsl:template> </xsl:template>
</xsl:stylesheet> </xsl:stylesheet>

2
configdoc/usage.xml
View File

@@ -302,7 +302,7 @@
</directive> </directive>
<directive id="Core.EscapeInvalidChildren"> <directive id="Core.EscapeInvalidChildren">
<file name="HTMLPurifier/ChildDef/Required.php"> <file name="HTMLPurifier/ChildDef/Required.php">
<line>55</line> <line>62</line>
</file> </file>
</directive> </directive>
<directive id="Cache.SerializerPath"> <directive id="Cache.SerializerPath">

2
docs/dev-advanced-api.html
View File

@@ -164,7 +164,7 @@ to make things simpler. It can be a literal object or:</p>
class with that function registered as a callback.</li>--> class with that function registered as a callback.</li>-->
<li>String attribute type: We'll use <code>HTMLPurifier_AttrTypes</code> <li>String attribute type: We'll use <code>HTMLPurifier_AttrTypes</code>
to resolve it for you. Any data that follows a hash mark (#) will to resolve it for you. Any data that follows a hash mark (#) will
be used to customize the attribute type: in the example above, be used to customize the attribute type: in the example above,
we specify which values for Enum to allow.</li> we specify which values for Enum to allow.</li>
</ul> </ul>

68
docs/dev-config-schema.html
View File

@@ -9,29 +9,29 @@
<title>Config Schema - HTML Purifier</title> <title>Config Schema - HTML Purifier</title>
</head> </head>
<body> <body>
<h1>Config Schema</h1> <h1>Config Schema</h1>
<div id="filing">Filed under Development</div> <div id="filing">Filed under Development</div>
<div id="index">Return to the <a href="index.html">index</a>.</div> <div id="index">Return to the <a href="index.html">index</a>.</div>
<div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div> <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
<p> <p>
HTML Purifier has a fairly complex system for configuration. Users HTML Purifier has a fairly complex system for configuration. Users
interact with a <code>HTMLPurifier_Config</code> object to interact with a <code>HTMLPurifier_Config</code> object to
set configuration directives. The values they set are validated according set configuration directives. The values they set are validated according
to a configuration schema, <code>HTMLPurifier_ConfigSchema</code>. to a configuration schema, <code>HTMLPurifier_ConfigSchema</code>.
</p> </p>
<p> <p>
The schema is mostly transparent to end-users, but if you're doing development The schema is mostly transparent to end-users, but if you're doing development
work for HTML Purifier and need to define a new configuration directive, work for HTML Purifier and need to define a new configuration directive,
you'll need to interact with it. We'll also talk about how to define you'll need to interact with it. We'll also talk about how to define
userspace configuration directives at the very end. userspace configuration directives at the very end.
</p> </p>
<h2>Write a directive file</h2> <h2>Write a directive file</h2>
<p> <p>
Directive files define configuration directives to be used by Directive files define configuration directives to be used by
HTML Purifier. They are placed in <code>library/HTMLPurifier/ConfigSchema/schema/</code> HTML Purifier. They are placed in <code>library/HTMLPurifier/ConfigSchema/schema/</code>
@@ -42,7 +42,7 @@
<a href="http://qa.php.net/write-test.php">PHPT</a> tests. Here's a <a href="http://qa.php.net/write-test.php">PHPT</a> tests. Here's a
sample directive file, <code>Test.Sample.txt</code>: sample directive file, <code>Test.Sample.txt</code>:
</p> </p>
<pre>Test.Sample <pre>Test.Sample
TYPE: string/null TYPE: string/null
DEFAULT: NULL DEFAULT: NULL
@@ -54,11 +54,11 @@ This is a sample configuration directive for the purposes of the
&lt;code&gt;dev-config-schema.html&lt;code&gt; documentation. &lt;code&gt;dev-config-schema.html&lt;code&gt; documentation.
--ALIASES-- --ALIASES--
Test.Example</pre> Test.Example</pre>
<p> <p>
Each of these segments has a specific meaning: Each of these segments has a specific meaning:
</p> </p>
<table class="table"> <table class="table">
<thead> <thead>
<tr> <tr>
@@ -143,11 +143,11 @@ Test.Example</pre>
</tr> </tr>
</tbody> </tbody>
</table> </table>
<p> <p>
Some notes on format and style: Some notes on format and style:
</p> </p>
<ul> <ul>
<li> <li>
Each of these keys can be expressed in the short format Each of these keys can be expressed in the short format
@@ -162,11 +162,11 @@ Test.Example</pre>
not rely on editor word-wrapping. not rely on editor word-wrapping.
</li> </li>
</ul> </ul>
<p> <p>
Also, as promised, here is the set of possible types: Also, as promised, here is the set of possible types:
</p> </p>
<table class="table"> <table class="table">
<thead> <thead>
<tr> <tr>
@@ -233,7 +233,7 @@ Test.Example</pre>
</tr> </tr>
</tbody> </tbody>
</table> </table>
<p> <p>
The examples represent what will be returned out of the configuration The examples represent what will be returned out of the configuration
object; users have a little bit of leeway when setting configuration object; users have a little bit of leeway when setting configuration
@@ -242,7 +242,7 @@ Test.Example</pre>
in <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/VarParser.php"> in <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/VarParser.php">
library/HTMLPurifier/VarParser.php</a>. library/HTMLPurifier/VarParser.php</a>.
</p> </p>
<p> <p>
For more information on what values are allowed, and how they are parsed, For more information on what values are allowed, and how they are parsed,
consult <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php"> consult <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
@@ -251,9 +251,9 @@ Test.Example</pre>
library/HTMLPurifier/ConfigSchema/Interchange/Directive.php</a> for library/HTMLPurifier/ConfigSchema/Interchange/Directive.php</a> for
the semantics of the parsed values. the semantics of the parsed values.
</p> </p>
<h2>Refreshing the cache</h2> <h2>Refreshing the cache</h2>
<p> <p>
You may have noticed that your directive file isn't doing anything You may have noticed that your directive file isn't doing anything
yet. That's because it hasn't been added to the runtime yet. That's because it hasn't been added to the runtime
@@ -262,14 +262,14 @@ Test.Example</pre>
If there were no errors, you're good to go! Don't forget to add If there were no errors, you're good to go! Don't forget to add
some unit tests for your functionality! some unit tests for your functionality!
</p> </p>
<p> <p>
If you ever make changes to your configuration directives, you If you ever make changes to your configuration directives, you
will need to run this script again. will need to run this script again.
</p> </p>
<h2>Errors</h2> <h2>Errors</h2>
<p> <p>
All directive files go through a rigorous validation process All directive files go through a rigorous validation process
through <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/Validator.php"> through <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/Validator.php">
@@ -279,16 +279,16 @@ Test.Example</pre>
can give some general tips for interpreting error messages. can give some general tips for interpreting error messages.
There are two types of errors: builder errors and validation errors. There are two types of errors: builder errors and validation errors.
</p> </p>
<h3>Builder errors</h3> <h3>Builder errors</h3>
<blockquote> <blockquote>
<p> <p>
<strong>Exception:</strong> Expected type string, got <strong>Exception:</strong> Expected type string, got
integer in DEFAULT in directive hash 'Ns.Dir' integer in DEFAULT in directive hash 'Ns.Dir'
</p> </p>
</blockquote> </blockquote>
<p> <p>
You can identify a builder error by the keyword "directive hash." You can identify a builder error by the keyword "directive hash."
These are the easiest to deal with, because they directly correspond These are the easiest to deal with, because they directly correspond
@@ -298,28 +298,28 @@ Test.Example</pre>
This particular error would occur if your default value is not the same This particular error would occur if your default value is not the same
type as TYPE. type as TYPE.
</p> </p>
<h3>Validation errors</h3> <h3>Validation errors</h3>
<blockquote> <blockquote>
<p> <p>
<strong>Exception:</strong> Alias 3 in valueAliases in directive <strong>Exception:</strong> Alias 3 in valueAliases in directive
'Ns.Dir' must be a string 'Ns.Dir' must be a string
</p> </p>
</blockquote> </blockquote>
<p> <p>
These are a little trickier, because we're not actually validating These are a little trickier, because we're not actually validating
your directive file, or even the direct string hash representation. your directive file, or even the direct string hash representation.
We're validating an Interchange object, and the error messages do We're validating an Interchange object, and the error messages do
not mention any string hash keys. not mention any string hash keys.
</p> </p>
<p> <p>
Nevertheless, it's not difficult to figure out what went wrong. Nevertheless, it's not difficult to figure out what went wrong.
Read the "context" statements in reverse: Read the "context" statements in reverse:
</p> </p>
<dl> <dl>
<dt>in directive 'Ns.Dir'</dt> <dt>in directive 'Ns.Dir'</dt>
<dd>This means we need to look at the directive file <code>Ns.Dir.txt</code></dd> <dd>This means we need to look at the directive file <code>Ns.Dir.txt</code></dd>
@@ -329,12 +329,12 @@ Test.Example</pre>
<dt>Alias 3</dt> <dt>Alias 3</dt>
<dd>The value alias that is equal to 3 is the culprit.</dd> <dd>The value alias that is equal to 3 is the culprit.</dd>
</dl> </dl>
<p> <p>
In this particular case, you're not allowed to alias integers values to In this particular case, you're not allowed to alias integers values to
strings values. strings values.
</p> </p>
<p> <p>
The most difficult part is translating the Interchange member variable (valueAliases) The most difficult part is translating the Interchange member variable (valueAliases)
into a directive file key (VALUE-ALIASES), but there's a one-to-one into a directive file key (VALUE-ALIASES), but there's a one-to-one
@@ -342,9 +342,9 @@ Test.Example</pre>
will be described in <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php"> will be described in <a href="http://repo.or.cz/w/htmlpurifier.git?a=blob;hb=HEAD;f=library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php</a>. library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php</a>.
</p> </p>
<h2>Internals</h2> <h2>Internals</h2>
<p> <p>
Much of the configuration schema framework's codebase deals with Much of the configuration schema framework's codebase deals with
shuffling data from one format to another, and doing validation on this shuffling data from one format to another, and doing validation on this
@@ -352,7 +352,7 @@ Test.Example</pre>
The keystone of all of this is the <code>HTMLPurifier_ConfigSchema_Interchange</code> The keystone of all of this is the <code>HTMLPurifier_ConfigSchema_Interchange</code>
class, which represents the purest, parsed representation of the schema. class, which represents the purest, parsed representation of the schema.
</p> </p>
<p> <p>
Hand-writing this data is unwieldy, however, so we write directive files. Hand-writing this data is unwieldy, however, so we write directive files.
These directive files are parsed by <code>HTMLPurifier_StringHashParser</code> These directive files are parsed by <code>HTMLPurifier_StringHashParser</code>
@@ -360,7 +360,7 @@ Test.Example</pre>
are run through <code>HTMLPurifier_ConfigSchema_InterchangeBuilder</code> are run through <code>HTMLPurifier_ConfigSchema_InterchangeBuilder</code>
to construct the interchange object. to construct the interchange object.
</p> </p>
<p> <p>
From the interchange object, the data can be siphoned into other forms From the interchange object, the data can be siphoned into other forms
using <code>HTMLPurifier_ConfigSchema_Builder</code> subclasses. using <code>HTMLPurifier_ConfigSchema_Builder</code> subclasses.

6
docs/dev-includes.txt
View File

@@ -91,14 +91,14 @@ use the stub for all cases (which might not be a bad idea).
Deprecated Deprecated
---------- ----------
One of the things I'd like to do is have the code search for any classes One of the things I'd like to do is have the code search for any classes
that are explicitly mentioned in the code. If a class isn't mentioned, I that are explicitly mentioned in the code. If a class isn't mentioned, I
get to assume that it is "optional," i.e. included via introspection. get to assume that it is "optional," i.e. included via introspection.
The choice is either to use PHP's tokenizer or use regexps; regexps would The choice is either to use PHP's tokenizer or use regexps; regexps would
be faster but a tokenizer would be more correct. If this ends up being be faster but a tokenizer would be more correct. If this ends up being
unfeasible, adding dependency comments isn't a bad idea. (This could unfeasible, adding dependency comments isn't a bad idea. (This could
even be done automatically by search/replacing require_once, although even be done automatically by search/replacing require_once, although
we'd have to manually inspect the results for the optional requires.) we'd have to manually inspect the results for the optional requires.)
NOTE: This ends up not being necessary, as we're going to make the user NOTE: This ends up not being necessary, as we're going to make the user
figure out all the extra classes they need, and only include the core figure out all the extra classes they need, and only include the core
which is predetermined. which is predetermined.
@@ -193,7 +193,7 @@ configuration directives would be used to generate our key (meta-directives!)
mechanism works better. However, we can uniquely identify the mechanism works better. However, we can uniquely identify the
schema based on the directories they loaded, so there's no need schema based on the directories they loaded, so there's no need
for a DefinitionId until we give them full programmatic control. for a DefinitionId until we give them full programmatic control.
These variables should be directly incorporated into ConfigSchema, These variables should be directly incorporated into ConfigSchema,
and ConfigSchema should handle serialization. Some refactoring will be and ConfigSchema should handle serialization. Some refactoring will be
necessary for the DefinitionCache classes, as they are built with necessary for the DefinitionCache classes, as they are built with

4
docs/dev-naming.html
View File

@@ -35,7 +35,7 @@ help you find the correct functionality more quickly. Here they are:</p>
<dt>Harness and Test are reserved class names for unit tests</dt> <dt>Harness and Test are reserved class names for unit tests</dt>
<dd>The suffix <code>Test</code> indicates that the class is a subclass of UnitTestCase <dd>The suffix <code>Test</code> indicates that the class is a subclass of UnitTestCase
(of the Simpletest library) and is testable. "Harness" indicates a subclass (of the Simpletest library) and is testable. "Harness" indicates a subclass
of UnitTestCase that is not meant to be run but to be extended into of UnitTestCase that is not meant to be run but to be extended into
concrete test cases and contains custom test methods (i.e. assert*())</dd> concrete test cases and contains custom test methods (i.e. assert*())</dd>
<dt>Class names do not necessarily represent inheritance hierarchies</dt> <dt>Class names do not necessarily represent inheritance hierarchies</dt>
@@ -51,7 +51,7 @@ help you find the correct functionality more quickly. Here they are:</p>
all must be present in order for proper functioning.</dd> all must be present in order for proper functioning.</dd>
<dt>Abbreviations are avoided</dt> <dt>Abbreviations are avoided</dt>
<dd>We try to avoid abbreviations as much as possible, but in some cases, <dd>We try to avoid abbreviations as much as possible, but in some cases,
abbreviated version is more readable than the full version. Here, we abbreviated version is more readable than the full version. Here, we
list common abbreviations: list common abbreviations:
<ul> <ul>

16
docs/enduser-customize.html
View File

@@ -206,7 +206,7 @@ $def = $config->getHTMLDefinition(true);</pre>
<h2>Turn off caching</h2> <h2>Turn off caching</h2>
<p> <p>
To make development easier, we're going to temporarily turn off To make development easier, we're going to temporarily turn off
definition caching: definition caching:
</p> </p>
@@ -401,8 +401,8 @@ $def = $config->getHTMLDefinition(true);
<p> <p>
Adding attributes is really small-fry stuff, though, and it was possible Adding attributes is really small-fry stuff, though, and it was possible
to add them (albeit a bit more wordy) prior to 2.0. The real gem of to add them (albeit a bit more wordy) prior to 2.0. The real gem of
the Advanced API is adding elements. There are five questions to the Advanced API is adding elements. There are five questions to
ask when adding a new element: ask when adding a new element:
</p> </p>
@@ -493,9 +493,9 @@ $def = $config->getHTMLDefinition(true);
<p> <p>
The <code>(%flow;)*</code> indicates the allowed children of the The <code>(%flow;)*</code> indicates the allowed children of the
<code>li</code> tag: <code>li</code> allows any number of flow <code>li</code> tag: <code>li</code> allows any number of flow
elements as its children. (The <code>- O</code> allows the closing tag to be elements as its children. (The <code>- O</code> allows the closing tag to be
omitted, though in XML this is not allowed.) In HTML Purifier, omitted, though in XML this is not allowed.) In HTML Purifier,
we'd write it like <code>Flow</code> (here's where the content sets we'd write it like <code>Flow</code> (here's where the content sets
we were discussing earlier come into play). There are three shorthand we were discussing earlier come into play). There are three shorthand
content models you can specify: content models you can specify:
</p> </p>
@@ -596,7 +596,7 @@ $def = $config->getHTMLDefinition(true);
be nuked. This is why there is are specific content model types like be nuked. This is why there is are specific content model types like
Optional and Required: while they could be implemented as <code>Custom: Optional and Required: while they could be implemented as <code>Custom:
(valid | elements)*</code>, the custom classes contain special recovery (valid | elements)*</code>, the custom classes contain special recovery
measures that make sure as much of the user's original content gets measures that make sure as much of the user's original content gets
through. HTML Purifier's core, as a rule, does not use Custom. through. HTML Purifier's core, as a rule, does not use Custom.
</p> </p>
@@ -676,7 +676,7 @@ $def = $config->getHTMLDefinition(true);
href="http://www.w3.org/TR/xhtml-modularization/abstract_modules.html#s_commonatts">abstract href="http://www.w3.org/TR/xhtml-modularization/abstract_modules.html#s_commonatts">abstract
modules of the XHTML Modularization 1.1</a>. We believe this section modules of the XHTML Modularization 1.1</a>. We believe this section
to be in error, as <code>br</code> permits the use of the <code>style</code> to be in error, as <code>br</code> permits the use of the <code>style</code>
attribute even though it uses the <code>Core</code> collection, and attribute even though it uses the <code>Core</code> collection, and
the DTD and XML Schemas supplied by W3C support our interpretation. the DTD and XML Schemas supplied by W3C support our interpretation.
</p> </p>

48
docs/enduser-slow.html
View File

@@ -17,25 +17,25 @@
<div id="index">Return to the <a href="index.html">index</a>.</div> <div id="index">Return to the <a href="index.html">index</a>.</div>
<div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div> <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
<p>HTML Purifier is a very powerful library. But with power comes great <p>HTML Purifier is a very powerful library. But with power comes great
responsibility, in the form of longer execution times. Remember, this responsibility, in the form of longer execution times. Remember, this
library isn't lightly grazing over submitted HTML: it's deconstructing library isn't lightly grazing over submitted HTML: it's deconstructing
the whole thing, rigorously checking the parts, and then putting it back the whole thing, rigorously checking the parts, and then putting it back
together. </p> together. </p>
<p>So, if it so turns out that HTML Purifier is kinda too slow for outbound <p>So, if it so turns out that HTML Purifier is kinda too slow for outbound
filtering, you've got a few options: </p> filtering, you've got a few options: </p>
<h2>Inbound filtering</h2> <h2>Inbound filtering</h2>
<p>Perform filtering of HTML when it's submitted by the user. Since the <p>Perform filtering of HTML when it's submitted by the user. Since the
user is already submitting something, an extra half a second tacked on user is already submitting something, an extra half a second tacked on
to the load time probably isn't going to be that huge of a problem. to the load time probably isn't going to be that huge of a problem.
Then, displaying the content is a simple a manner of outputting it Then, displaying the content is a simple a manner of outputting it
directly from your database/filesystem. The trouble with this method is directly from your database/filesystem. The trouble with this method is
that your user loses the original text, and when doing edits, will be that your user loses the original text, and when doing edits, will be
handling the filtered text. While this may be a good thing, especially handling the filtered text. While this may be a good thing, especially
if you're using a WYSIWYG editor, it can also result in data-loss if a if you're using a WYSIWYG editor, it can also result in data-loss if a
user makes a typo. </p> user makes a typo. </p>
<p>Example (non-functional):</p> <p>Example (non-functional):</p>
@@ -66,14 +66,14 @@ user makes a typo. </p>
<h2>Caching the filtered output</h2> <h2>Caching the filtered output</h2>
<p>Accept the submitted text and put it unaltered into the database, but <p>Accept the submitted text and put it unaltered into the database, but
then also generate a filtered version and stash that in the database. then also generate a filtered version and stash that in the database.
Serve the filtered version to readers, and the unaltered version to Serve the filtered version to readers, and the unaltered version to
editors. If need be, you can invalidate the cache and have the cached editors. If need be, you can invalidate the cache and have the cached
filtered version be regenerated on the first page view. Pros? Full data filtered version be regenerated on the first page view. Pros? Full data
retention. Cons? It's more complicated, and opens other editors up to retention. Cons? It's more complicated, and opens other editors up to
XSS if they are using a WYSIWYG editor (to fix that, they'd have to be XSS if they are using a WYSIWYG editor (to fix that, they'd have to be
able to get their hands on the *really* original text served in able to get their hands on the *really* original text served in
plaintext mode). </p> plaintext mode). </p>
<p>Example (non-functional):</p> <p>Example (non-functional):</p>
@@ -108,9 +108,9 @@ plaintext mode). </p>
<p>In short, inbound filtering is the simple option and caching is the <p>In short, inbound filtering is the simple option and caching is the
robust option (albeit with bigger storage requirements). </p> robust option (albeit with bigger storage requirements). </p>
<p>There is a third option, independent of the two we've discussed: profile <p>There is a third option, independent of the two we've discussed: profile
and optimize HTMLPurifier yourself. Be sure to report back your results and optimize HTMLPurifier yourself. Be sure to report back your results
if you decide to do that! Especially if you port HTML Purifier to C++. if you decide to do that! Especially if you port HTML Purifier to C++.
<tt>;-)</tt></p> <tt>;-)</tt></p>
</body> </body>

2
docs/enduser-tidy.html
View File

@@ -50,7 +50,7 @@ not need Tidy installed on your PHP to use these features!</strong></p>
<h2>What are levels?</h2> <h2>What are levels?</h2>
<p>Levels describe how aggressive the Tidy module should be when <p>Levels describe how aggressive the Tidy module should be when
cleaning up HTML. There are four levels to pick: none, light, medium cleaning up HTML. There are four levels to pick: none, light, medium
and heavy. Each of these levels has a well-defined set of behavior and heavy. Each of these levels has a well-defined set of behavior
associated with it, although it may change depending on your doctype.</p> associated with it, although it may change depending on your doctype.</p>

2
docs/enduser-uri-filter.html
View File

@@ -92,7 +92,7 @@
</tbody></table> </tbody></table>
<p> <p>
Because the URI is presented to us in this form, and not Because the URI is presented to us in this form, and not
<code>http://bob@example.com:8080/foo.php?q=string#hash</code>, it saves us <code>http://bob@example.com:8080/foo.php?q=string#hash</code>, it saves us
a lot of trouble in having to parse the URI every time we want to filter a lot of trouble in having to parse the URI every time we want to filter
it. For the record, the above URI has the following components: it. For the record, the above URI has the following components:

24
docs/enduser-utf8.html
View File

@@ -106,7 +106,7 @@ there are now many character encodings floating around.</p>
interpret raw zeroes and ones into real characters. It interpret raw zeroes and ones into real characters. It
usually does this by pairing numbers with characters.</p> usually does this by pairing numbers with characters.</p>
<p>There are many different types of character encodings floating <p>There are many different types of character encodings floating
around, but the ones we deal most frequently with are ASCII, around, but the ones we deal most frequently with are ASCII,
8-bit encodings, and Unicode-based encodings.</p> 8-bit encodings, and Unicode-based encodings.</p>
<ul> <ul>
<li><strong>ASCII</strong> is a 7-bit encoding based on the <li><strong>ASCII</strong> is a 7-bit encoding based on the
@@ -306,7 +306,7 @@ languages</a>. The appropriate code is:</p>
<p>...replacing UTF-8 with whatever your embedded encoding is. <p>...replacing UTF-8 with whatever your embedded encoding is.
This code must come before any output, so be careful about This code must come before any output, so be careful about
stray whitespace in your application (i.e., any whitespace before stray whitespace in your application (i.e., any whitespace before
output excluding whitespace within &lt;?php ?&gt; tags).</p> output excluding whitespace within &lt;?php ?&gt; tags).</p>
<h4 id="fixcharset-server-phpini">PHP ini directive</h4> <h4 id="fixcharset-server-phpini">PHP ini directive</h4>
@@ -366,9 +366,9 @@ to send anything at all:</p>
<pre><a href="http://httpd.apache.org/docs/1.3/mod/core.html#adddefaultcharset">AddDefaultCharset</a> Off</pre> <pre><a href="http://httpd.apache.org/docs/1.3/mod/core.html#adddefaultcharset">AddDefaultCharset</a> Off</pre>
<p>...making your internal charset declaration (usually the <code>META</code> tags) <p>...making your internal charset declaration (usually the <code>META</code> tags)
the sole source of character encoding the sole source of character encoding
information. In these cases, it is <em>especially</em> important to make information. In these cases, it is <em>especially</em> important to make
sure you have valid <code>META</code> tags on your pages and all the sure you have valid <code>META</code> tags on your pages and all the
text before them is ASCII.</p> text before them is ASCII.</p>
<blockquote class="aside"><p>These directives can also be <blockquote class="aside"><p>These directives can also be
@@ -443,9 +443,9 @@ Declarations. They look like:</p>
<p>For XHTML, this XML Declaration theoretically <p>For XHTML, this XML Declaration theoretically
overrides the <code>META</code> tag. In reality, this happens only when the overrides the <code>META</code> tag. In reality, this happens only when the
XHTML is actually served as legit XML and not HTML, which is almost always XHTML is actually served as legit XML and not HTML, which is almost always
never due to Internet Explorer's lack of support for never due to Internet Explorer's lack of support for
<code>application/xhtml+xml</code> (even though doing so is often <code>application/xhtml+xml</code> (even though doing so is often
argued to be <a href="http://www.hixie.ch/advocacy/xhtml">good argued to be <a href="http://www.hixie.ch/advocacy/xhtml">good
practice</a> and is required by the XHTML 1.1 specification).</p> practice</a> and is required by the XHTML 1.1 specification).</p>
<p>For XML, however, this XML Declaration is extremely important. <p>For XML, however, this XML Declaration is extremely important.
@@ -456,7 +456,7 @@ ISO-8859-1 encoding (you see this in garbled RSS feeds).</p>
<p>In short, if you use XHTML and have gone through the <p>In short, if you use XHTML and have gone through the
trouble of adding the XML Declaration, make sure it jives trouble of adding the XML Declaration, make sure it jives
with your <code>META</code> tags (which should only be present with your <code>META</code> tags (which should only be present
if served in text/html) and HTTP headers.</p> if served in text/html) and HTTP headers.</p>
<h3 id="fixcharset-internals">Inside the process</h3> <h3 id="fixcharset-internals">Inside the process</h3>
@@ -489,7 +489,7 @@ it gets to the Content-Type tag, extract the character encoding
tag, then re-parse the document according to this new information.</p> tag, then re-parse the document according to this new information.</p>
<p>Obviously this is complicated, so browsers prefer the simpler <p>Obviously this is complicated, so browsers prefer the simpler
and more efficient solution: get the character encoding from a and more efficient solution: get the character encoding from a
somewhere other than the document itself, i.e. the HTTP headers, somewhere other than the document itself, i.e. the HTTP headers,
much to the chagrin of HTML authors who can't set these headers.</p> much to the chagrin of HTML authors who can't set these headers.</p>
@@ -578,7 +578,7 @@ files.</p>
<a href="http://web.archive.org/web/20060427015200/ppewww.ph.gla.ac.uk/~flavell/charset/form-i18n.html"> <a href="http://web.archive.org/web/20060427015200/ppewww.ph.gla.ac.uk/~flavell/charset/form-i18n.html">
<code>FORM</code> submission and i18n</a>. That document contains lots <code>FORM</code> submission and i18n</a>. That document contains lots
of useful information, but is written in a rambly manner, so of useful information, but is written in a rambly manner, so
here I try to get right to the point. (Note: the original has here I try to get right to the point. (Note: the original has
disappeared off the web, so I am linking to the Web Archive copy.)</p> disappeared off the web, so I am linking to the Web Archive copy.)</p>
<h4 id="whyutf8-forms-urlencoded"><code>application/x-www-form-urlencoded</code></h4> <h4 id="whyutf8-forms-urlencoded"><code>application/x-www-form-urlencoded</code></h4>
@@ -886,7 +886,7 @@ sure the page is saved WITHOUT the BOM.</p>
</blockquote> </blockquote>
<p>If you are reading in text files to insert into the middle of another <p>If you are reading in text files to insert into the middle of another
page, it is strongly advised (but not strictly necessary) that you replace out the UTF-8 byte page, it is strongly advised (but not strictly necessary) that you replace out the UTF-8 byte
sequence for BOM <code>&quot;\xEF\xBB\xBF&quot;</code> before inserting it in, sequence for BOM <code>&quot;\xEF\xBB\xBF&quot;</code> before inserting it in,
via:</p> via:</p>
@@ -949,7 +949,7 @@ to known good Unicode fonts.</p>
heavy lifting for you. Get the CSS from the horses mouth here: heavy lifting for you. Get the CSS from the horses mouth here:
<a href="http://en.wikipedia.org/wiki/MediaWiki:Common.css">Common.css</a>, <a href="http://en.wikipedia.org/wiki/MediaWiki:Common.css">Common.css</a>,
and search for &quot;.IPA&quot; There are also a smattering of and search for &quot;.IPA&quot; There are also a smattering of
other classes you can use for other purposes, check out other classes you can use for other purposes, check out
<a href="http://meta.wikimedia.org/wiki/Help:Special_characters#Displaying_Special_Characters">this page</a> <a href="http://meta.wikimedia.org/wiki/Help:Special_characters#Displaying_Special_Characters">this page</a>
for more details. For you lazy ones, this should work:</p> for more details. For you lazy ones, this should work:</p>

38
docs/proposal-errors.txt
View File

@@ -2,7 +2,7 @@ Considerations for ErrorCollection
Presently, HTML Purifier takes a code-execution centric approach to handling Presently, HTML Purifier takes a code-execution centric approach to handling
errors. Errors are organized and grouped according to which segment of the errors. Errors are organized and grouped according to which segment of the
code triggers them, not necessarily the portion of the input document that code triggers them, not necessarily the portion of the input document that
triggered the error. This means that errors are pseudo-sorted by category, triggered the error. This means that errors are pseudo-sorted by category,
rather than location in the document. rather than location in the document.
@@ -13,7 +13,7 @@ can report errors still process the document mostly linearly. Furthermore,
not only do they process linearly, but the way they pass off operations to not only do they process linearly, but the way they pass off operations to
sub-systems mirrors that of the document. For example, AttrValidator will sub-systems mirrors that of the document. For example, AttrValidator will
linearly proceed through elements, and on each element will use AttrDef to linearly proceed through elements, and on each element will use AttrDef to
validate those contents. From there, the attribute might have more validate those contents. From there, the attribute might have more
sub-components, which have execution passed off accordingly. sub-components, which have execution passed off accordingly.
In fact, each strategy handles a very specific class of "error." In fact, each strategy handles a very specific class of "error."
@@ -56,7 +56,7 @@ set it as a document-wide error. And actually, nothing needs to be done here.
Something interesting to consider is whether or not we care about the locations Something interesting to consider is whether or not we care about the locations
of attributes and CSS properties, i.e. the sub-objects that compose these things. of attributes and CSS properties, i.e. the sub-objects that compose these things.
In terms of consistency, at the very least attributes should have column/line In terms of consistency, at the very least attributes should have column/line
numbers attached to them. However, this may be overkill, as attributes are numbers attached to them. However, this may be overkill, as attributes are
uniquely identifiable. You could go even further, with CSS, but they are also uniquely identifiable. You could go even further, with CSS, but they are also
uniquely identifiable. uniquely identifiable.
@@ -80,12 +80,12 @@ cases).
4. Setup ErrorCollector to use context information to setup hierarchies. 4. Setup ErrorCollector to use context information to setup hierarchies.
This may require a different internal format. Use objects if it gets This may require a different internal format. Use objects if it gets
complex. [DONE] complex. [DONE]
ASIDE ASIDE
More on this topic: since we are now binding errors to lines More on this topic: since we are now binding errors to lines
and columns, a particular error can have three relationships to that and columns, a particular error can have three relationships to that
specific location: specific location:
1. The token at that location directly 1. The token at that location directly
RemoveForeignElements RemoveForeignElements
AttrValidator (transforms) AttrValidator (transforms)
@@ -95,50 +95,50 @@ cases).
3. A modification to that node (i.e. contents from start to end 3. A modification to that node (i.e. contents from start to end
token) as a whole token) as a whole
FixNesting FixNesting
This needs to be marked accordingly. In the presentation, it might This needs to be marked accordingly. In the presentation, it might
make sense keep (3) separate, have (2) a sublist of (1). (1) can make sense keep (3) separate, have (2) a sublist of (1). (1) can
be a closing tag, in which case (3) makes no sense at all, OR it be a closing tag, in which case (3) makes no sense at all, OR it
should be related with its opening tag (this may not necessarily should be related with its opening tag (this may not necessarily
be possible before MakeWellFormed is run). be possible before MakeWellFormed is run).
So, the line and column counts as our identifier, so: So, the line and column counts as our identifier, so:
$errors[$line][$col] = ... $errors[$line][$col] = ...
Then, we need to identify case 1, 2 or 3. They are identified as Then, we need to identify case 1, 2 or 3. They are identified as
such: such:
1. Need some sort of semaphore in RemoveForeignElements, etc. 1. Need some sort of semaphore in RemoveForeignElements, etc.
2. If CurrentAttr/CurrentCssProperty is non-null 2. If CurrentAttr/CurrentCssProperty is non-null
3. Default (FixNesting, MakeWellFormed) 3. Default (FixNesting, MakeWellFormed)
One consideration about (1) is that it usually is actually a One consideration about (1) is that it usually is actually a
(3) modification, but we have no way of knowing about that because (3) modification, but we have no way of knowing about that because
of various optimizations. However, they can probably be treated of various optimizations. However, they can probably be treated
the same. The other difficulty is that (3) is never a line and the same. The other difficulty is that (3) is never a line and
column; rather, it is a range (i.e. a duple) and telling the user column; rather, it is a range (i.e. a duple) and telling the user
the very start of the range may confuse them. For example, the very start of the range may confuse them. For example,
<b>Foo<div>bar</div></b> <b>Foo<div>bar</div></b>
^ ^ ^ ^
The node being operated on is <b>, so the error would be assigned The node being operated on is <b>, so the error would be assigned
to the first caret, with a "node reorganized" error. Then, the to the first caret, with a "node reorganized" error. Then, the
ChildDef would have submitted its own suggestions and errors with ChildDef would have submitted its own suggestions and errors with
regard to what's going in the internals. So I suppose this is regard to what's going in the internals. So I suppose this is
ok. :-) ok. :-)
Now, the structure of the earlier mentioned ... would be something Now, the structure of the earlier mentioned ... would be something
like this: like this:
object { object {
type = (token|attr|property), type = (token|attr|property),
value, // appropriate for type value, // appropriate for type
errors => array(), errors => array(),
sub-errors = [recursive], sub-errors = [recursive],
} }
This helps us keep things agnostic. It is also sufficiently complex This helps us keep things agnostic. It is also sufficiently complex
enough to warrant an object. enough to warrant an object.
@@ -173,7 +173,7 @@ Then we setup suggestions.
5. Setup a separate error class which tells the user any modifications 5. Setup a separate error class which tells the user any modifications
HTML Purifier made. HTML Purifier made.
Some information about this: Some information about this:
Our current paradigm is to tell the user what HTML Purifier did to the HTML. Our current paradigm is to tell the user what HTML Purifier did to the HTML.
@@ -187,7 +187,7 @@ the correct version isn't a bad idea, but problems arise when:
- The user has such bad HTML we do something odd, when we should have just - The user has such bad HTML we do something odd, when we should have just
flagged the HTML as an error. Such examples are when we do things like flagged the HTML as an error. Such examples are when we do things like
remove text from directly inside a <table> tag. It was probably meant to remove text from directly inside a <table> tag. It was probably meant to
be in a <td> tag or be outside the table, but we're not smart enough to be in a <td> tag or be outside the table, but we're not smart enough to
realize this so we just remove it. In such a case, we should tell the user realize this so we just remove it. In such a case, we should tell the user
that there was foreign data in the table, but then we shouldn't "demand" that there was foreign data in the table, but then we shouldn't "demand"
the user remove the data; it's more of a "here's a possible way of the user remove the data; it's more of a "here's a possible way of
@@ -204,6 +204,6 @@ Don't forget to spruce up output.
6. Output needs to automatically give line and column numbers, basically 6. Output needs to automatically give line and column numbers, basically
"at line" on steroids. Look at W3C's output; it's ok. [PARTIALLY DONE] "at line" on steroids. Look at W3C's output; it's ok. [PARTIALLY DONE]
- We need a standard CSS to apply (check demo.css for some starting - We need a standard CSS to apply (check demo.css for some starting
styling; some buttons would also be hip) styling; some buttons would also be hip)

2
docs/proposal-new-directives.txt
View File

@@ -16,7 +16,7 @@ implemented, give us a ring, and we'll move it up the priority chain.
%Attr.ClassBlacklist. When it's Whitelist, only allow those in %Attr.ClassBlacklist. When it's Whitelist, only allow those in
%Attr.ClassWhitelist. %Attr.ClassWhitelist.
%Attr.MaxWidth, %Attr.MaxWidth,
%Attr.MaxHeight - caps for width and height related checks. %Attr.MaxHeight - caps for width and height related checks.
(the hack in Pixels for an image crashing attack could be replaced by this) (the hack in Pixels for an image crashing attack could be replaced by this)

2
docs/ref-css-length.txt
View File

@@ -22,7 +22,7 @@ Relative:
1 ex ~= 0.5 em, though Mozilla Firefox says 1 ex = 6px 1 ex ~= 0.5 em, though Mozilla Firefox says 1 ex = 6px
1 px ~= 1 pt 1 px ~= 1 pt
Watch out: font-sizes can also be nested to get successively larger Watch out: font-sizes can also be nested to get successively larger
(although I do not relish having to keep track of context font-sizes, (although I do not relish having to keep track of context font-sizes,
this may be necessary, especially for some of the more advanced features this may be necessary, especially for some of the more advanced features
for preventing things like white on white). for preventing things like white on white).

2
docs/ref-html-modularization.txt
View File

@@ -121,7 +121,7 @@ a proprietary system called ChildDef for performance and flexibility
reasons, but this does not line up very well with W3C's notion of reasons, but this does not line up very well with W3C's notion of
regexps for defining the allowed children of an element. regexps for defining the allowed children of an element.
HTMLPurifier->elements[$element]->content_model and HTMLPurifier->elements[$element]->content_model and
HTMLPurifier->elements[$element]->content_model_type store information HTMLPurifier->elements[$element]->content_model_type store information
about the final ChildDef that will be stored in about the final ChildDef that will be stored in
HTMLPurifier->elements[$element]->child (we use a different variable HTMLPurifier->elements[$element]->child (we use a different variable

2
docs/ref-whatwg.txt
View File

@@ -18,7 +18,7 @@ committing ourselves till the spec stabilizes, though.
More immediately speaking though, however, is the well-defined parsing More immediately speaking though, however, is the well-defined parsing
behavior that HTML 5 adds. While I have little interest in writing behavior that HTML 5 adds. While I have little interest in writing
another DirectLex parser, other parsers like ph5p another DirectLex parser, other parsers like ph5p
<http://jero.net/lab/ph5p/> can be adapted to DOMLex to support much more <http://jero.net/lab/ph5p/> can be adapted to DOMLex to support much more
flexible HTML parsing (a cool feature I've seen is how they resolve flexible HTML parsing (a cool feature I've seen is how they resolve
<b>bold<i>both</b>italic</i>). <b>bold<i>both</b>italic</i>).

88
docs/specimens/windows-live-mail-desktop-beta.html
View File

@@ -4,71 +4,71 @@
<STYLE></STYLE> <STYLE></STYLE>
<META content="MSHTML 6.00.6000.16414" name=GENERATOR></HEAD> <META content="MSHTML 6.00.6000.16414" name=GENERATOR></HEAD>
<BODY id=MailContainerBody <BODY id=MailContainerBody
style="PADDING-RIGHT: 10px; PADDING-LEFT: 10px; FONT-SIZE: 10pt; COLOR: #000000; PADDING-TOP: 15px; FONT-FAMILY: Arial" style="PADDING-RIGHT: 10px; PADDING-LEFT: 10px; FONT-SIZE: 10pt; COLOR: #000000; PADDING-TOP: 15px; FONT-FAMILY: Arial"
bgColor=#ff6600 leftMargin=0 background="" topMargin=0 bgColor=#ff6600 leftMargin=0 background="" topMargin=0
name="Compose message area" acc_role="text" CanvasTabStop="false"> name="Compose message area" acc_role="text" CanvasTabStop="false">
<DIV <DIV
style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; WIDTH: 100%; MARGIN-RIGHT: 10px; PADDING-TOP: 5px; BORDER-BOTTOM: #dddddd 1px solid; FONT-FAMILY: Verdana; HEIGHT: 25px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; WIDTH: 100%; MARGIN-RIGHT: 10px; PADDING-TOP: 5px; BORDER-BOTTOM: #dddddd 1px solid; FONT-FAMILY: Verdana; HEIGHT: 25px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN
title="View a slideshow of the pictures in this e-mail message." title="View a slideshow of the pictures in this e-mail message."
style="PADDING-RIGHT: 20px"><A style="COLOR: #0088e4" style="PADDING-RIGHT: 20px"><A style="COLOR: #0088e4"
href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216">Play href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216">Play
slideshow </A></SPAN><SPAN style="COLOR: #909090"><SPAN>|</SPAN><SPAN slideshow </A></SPAN><SPAN style="COLOR: #909090"><SPAN>|</SPAN><SPAN
style="PADDING-LEFT: 20px"> Download the highest quality version of a picture by style="PADDING-LEFT: 20px"> Download the highest quality version of a picture by
clicking the + above it </SPAN></SPAN></NOBR></DIV> clicking the + above it </SPAN></SPAN></NOBR></DIV>
<DIV <DIV
style="PADDING-RIGHT: 5px; PADDING-LEFT: 7px; PADDING-BOTTOM: 2px; WIDTH: 100%; PADDING-TOP: 2px"> style="PADDING-RIGHT: 5px; PADDING-LEFT: 7px; PADDING-BOTTOM: 2px; WIDTH: 100%; PADDING-TOP: 2px">
<OL> <OL>
<LI><IMG title="Angry smile emoticon" <LI><IMG title="Angry smile emoticon"
style="FLOAT: none; MARGIN: 0px; POSITION: static" tabIndex=-1 style="FLOAT: none; MARGIN: 0px; POSITION: static" tabIndex=-1
alt="Angry smile emoticon" src="cid:49F0C856199E4D688D2D740680733D74@wc" alt="Angry smile emoticon" src="cid:49F0C856199E4D688D2D740680733D74@wc"
MSNNonUserImageOrEmoticon="true">Un ka <FONT style="BACKGROUND-COLOR: #800000" MSNNonUserImageOrEmoticon="true">Un ka <FONT style="BACKGROUND-COLOR: #800000"
color=#cc99ff><STRONG>Tev</STRONG></FONT> iet, un ko tu dari? color=#cc99ff><STRONG>Tev</STRONG></FONT> iet, un ko tu dari?
<LI>Aha!</LI></OL> <LI>Aha!</LI></OL>
<UL> <UL>
<LI>Buletets <LI>Buletets
<LI> <LI>
<DIV align=justify><A title=http://laacz.lv/blog/ <DIV align=justify><A title=http://laacz.lv/blog/
href="http://laacz.lv/blog/">http://laacz.lv/blog/</A> un <A href="http://laacz.lv/blog/">http://laacz.lv/blog/</A> un <A
title=http://google.com/ href="http://google.com/">gugle</A></DIV> title=http://google.com/ href="http://google.com/">gugle</A></DIV>
<LI>Sarakstucitis</LI></UL></DIV><SPAN><SPAN xmlns:canvas="canvas-namespace-id" <LI>Sarakstucitis</LI></UL></DIV><SPAN><SPAN xmlns:canvas="canvas-namespace-id"
layoutEmptyTextWellFont="Tahoma"><SPAN layoutEmptyTextWellFont="Tahoma"><SPAN
style="MARGIN-BOTTOM: 15px; OVERFLOW: visible; HEIGHT: 16px"></SPAN><SPAN style="MARGIN-BOTTOM: 15px; OVERFLOW: visible; HEIGHT: 16px"></SPAN><SPAN
style="MARGIN-BOTTOM: 25px; VERTICAL-ALIGN: top; OVERFLOW: visible; MARGIN-RIGHT: 25px; HEIGHT: 234px"> style="MARGIN-BOTTOM: 25px; VERTICAL-ALIGN: top; OVERFLOW: visible; MARGIN-RIGHT: 25px; HEIGHT: 234px">
<TABLE style="DISPLAY: inline"> <TABLE style="DISPLAY: inline">
<TBODY> <TBODY>
<TR> <TR>
<TD> <TD>
<DIV <DIV
style="FONT-WEIGHT: bold; FONT-SIZE: 12pt; FONT-FAMILY: arial; TEXT-ALIGN: center"><A style="FONT-WEIGHT: bold; FONT-SIZE: 12pt; FONT-FAMILY: arial; TEXT-ALIGN: center"><A
id=HiresARef id=HiresARef
title="Click here to view or download a high resolution version of this picture" title="Click here to view or download a high resolution version of this picture"
style="COLOR: #0088e4; TEXT-DECORATION: none" style="COLOR: #0088e4; TEXT-DECORATION: none"
href="http://byfiles.storage.msn.com/x1pMvt0I80jTgT6DuaCpEMbprX3nk3jNv_vjigxV_EYVSMyM_PKgEvDEUtuNhQC-F-23mTTcKyqx6eGaeK2e_wMJ0ikwpDdFntk4SY7pfJUv2g2Ck6R2S2vAA?download">+</A></DIV> href="http://byfiles.storage.msn.com/x1pMvt0I80jTgT6DuaCpEMbprX3nk3jNv_vjigxV_EYVSMyM_PKgEvDEUtuNhQC-F-23mTTcKyqx6eGaeK2e_wMJ0ikwpDdFntk4SY7pfJUv2g2Ck6R2S2vAA?download">+</A></DIV>
<DIV <DIV
title="Click here to view the full image using the online photo viewer." title="Click here to view the full image using the online photo viewer."
style="DISPLAY: inline; OVERFLOW: hidden; WIDTH: 140px; HEIGHT: 140px"><A style="DISPLAY: inline; OVERFLOW: hidden; WIDTH: 140px; HEIGHT: 140px"><A
href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216" href="http://g.msn.com/5meen_us/171?path=/photomail/{6fc0065f-ffdd-4ca6-9a4c-cc5a93dc122f}&amp;image=47D7B182CFEFB10!127&amp;imagehi=47D7B182CFEFB10!125&amp;CID=323550092004883216"
border="0"><IMG border="0"><IMG
style="MARGIN-TOP: 15px; DISPLAY: inline-block; MARGIN-LEFT: 0px" style="MARGIN-TOP: 15px; DISPLAY: inline-block; MARGIN-LEFT: 0px"
height=109 src="cid:006A71303B80404E9FB6184E55D6A446@wc" width=140 height=109 src="cid:006A71303B80404E9FB6184E55D6A446@wc" width=140
border=0></A></DIV></TD></TR> border=0></A></DIV></TD></TR>
<TR> <TR>
<TD> <TD>
<DIV <DIV
style="FONT-SIZE: 10pt; WIDTH: 140px; FONT-FAMILY: verdana; TEXT-ALIGN: center"><EM><STRONG>This style="FONT-SIZE: 10pt; WIDTH: 140px; FONT-FAMILY: verdana; TEXT-ALIGN: center"><EM><STRONG>This
<U>is </U></STRONG><U>tit</U>le</EM> fo<STRONG>r <FONT <U>is </U></STRONG><U>tit</U>le</EM> fo<STRONG>r <FONT
face="Arial Black">t<FONT color=#800000 size=7>h<U>i</U></FONT>s face="Arial Black">t<FONT color=#800000 size=7>h<U>i</U></FONT>s
</FONT>picture</STRONG></DIV></TD></TR></TBODY></TABLE></SPAN></SPAN></SPAN> </FONT>picture</STRONG></DIV></TD></TR></TBODY></TABLE></SPAN></SPAN></SPAN>
<DIV <DIV
style="PADDING-RIGHT: 5px; PADDING-LEFT: 7px; PADDING-BOTTOM: 2px; WIDTH: 100%; PADDING-TOP: 2px; HEIGHT: 50px"> style="PADDING-RIGHT: 5px; PADDING-LEFT: 7px; PADDING-BOTTOM: 2px; WIDTH: 100%; PADDING-TOP: 2px; HEIGHT: 50px">
<DIV>&nbsp;</DIV></DIV> <DIV>&nbsp;</DIV></DIV>
<DIV <DIV
style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; MARGIN-BOTTOM: 10px; WIDTH: 100%; COLOR: #909090; MARGIN-RIGHT: 10px; PADDING-TOP: 9px; FONT-FAMILY: Verdana; HEIGHT: 42px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN style="BORDER-TOP: #dddddd 1px solid; FONT-SIZE: 10pt; MARGIN-BOTTOM: 10px; WIDTH: 100%; COLOR: #909090; MARGIN-RIGHT: 10px; PADDING-TOP: 9px; FONT-FAMILY: Verdana; HEIGHT: 42px; BACKGROUND-COLOR: #ffffff"><NOBR><SPAN
title="Join Windows Live to share photos using Windows Live Photo E-mail.">Online title="Join Windows Live to share photos using Windows Live Photo E-mail.">Online
pictures are available for 30 days. <A style="COLOR: #0088e4" pictures are available for 30 days. <A style="COLOR: #0088e4"
href="http://g.msn.com/5meen_us/175">Get Windows Live Mail desktop to create href="http://g.msn.com/5meen_us/175">Get Windows Live Mail desktop to create
your own photo e-mails. </A></SPAN></NOBR></DIV></BODY></HTML> your own photo e-mails. </A></SPAN></NOBR></DIV></BODY></HTML>

20
extras/ConfigDoc/HTMLXSLTProcessor.php
View File

@@ -5,17 +5,17 @@
*/ */
class ConfigDoc_HTMLXSLTProcessor class ConfigDoc_HTMLXSLTProcessor
{ {
/** /**
* Instance of XSLTProcessor * Instance of XSLTProcessor
*/ */
protected $xsltProcessor; protected $xsltProcessor;
public function __construct($proc = false) { public function __construct($proc = false) {
if ($proc === false) $proc = new XSLTProcessor(); if ($proc === false) $proc = new XSLTProcessor();
$this->xsltProcessor = $proc; $this->xsltProcessor = $proc;
} }
/** /**
* @note Allows a string $xsl filename to be passed * @note Allows a string $xsl filename to be passed
*/ */
@@ -27,7 +27,7 @@ class ConfigDoc_HTMLXSLTProcessor
} }
return $this->xsltProcessor->importStylesheet($xsl); return $this->xsltProcessor->importStylesheet($xsl);
} }
/** /**
* Transforms an XML file into compatible XHTML based on the stylesheet * Transforms an XML file into compatible XHTML based on the stylesheet
* @param $xml XML DOM tree, or string filename * @param $xml XML DOM tree, or string filename
@@ -42,12 +42,12 @@ class ConfigDoc_HTMLXSLTProcessor
$dom = $xml; $dom = $xml;
} }
$out = $this->xsltProcessor->transformToXML($dom); $out = $this->xsltProcessor->transformToXML($dom);
// fudges for HTML backwards compatibility // fudges for HTML backwards compatibility
// assumes that document is XHTML // assumes that document is XHTML
$out = str_replace('/>', ' />', $out); // <br /> not <br/> $out = str_replace('/>', ' />', $out); // <br /> not <br/>
$out = str_replace(' xmlns=""', '', $out); // rm unnecessary xmlns $out = str_replace(' xmlns=""', '', $out); // rm unnecessary xmlns
if (class_exists('Tidy')) { if (class_exists('Tidy')) {
// cleanup output // cleanup output
$config = array( $config = array(
@@ -60,10 +60,10 @@ class ConfigDoc_HTMLXSLTProcessor
$tidy->cleanRepair(); $tidy->cleanRepair();
$out = (string) $tidy; $out = (string) $tidy;
} }
return $out; return $out;
} }
/** /**
* Bulk sets parameters for the XSL stylesheet * Bulk sets parameters for the XSL stylesheet
* @param array $options Associative array of options to set * @param array $options Associative array of options to set
@@ -73,13 +73,13 @@ class ConfigDoc_HTMLXSLTProcessor
$this->xsltProcessor->setParameter('', $name, $value); $this->xsltProcessor->setParameter('', $name, $value);
} }
} }
/** /**
* Forward any other calls to the XSLT processor * Forward any other calls to the XSLT processor
*/ */
public function __call($name, $arguments) { public function __call($name, $arguments) {
call_user_func_array(array($this->xsltProcessor, $name), $arguments); call_user_func_array(array($this->xsltProcessor, $name), $arguments);
} }
} }

32
extras/FSTools.php
View File

@@ -3,15 +3,15 @@
/** /**
* Filesystem tools not provided by default; can recursively create, copy * Filesystem tools not provided by default; can recursively create, copy
* and delete folders. Some template methods are provided for extensibility. * and delete folders. Some template methods are provided for extensibility.
* *
* @note This class must be instantiated to be used, although it does * @note This class must be instantiated to be used, although it does
* not maintain state. * not maintain state.
*/ */
class FSTools class FSTools
{ {
private static $singleton; private static $singleton;
/** /**
* Returns a global instance of FSTools * Returns a global instance of FSTools
*/ */
@@ -19,7 +19,7 @@ class FSTools
if (empty(FSTools::$singleton)) FSTools::$singleton = new FSTools(); if (empty(FSTools::$singleton)) FSTools::$singleton = new FSTools();
return FSTools::$singleton; return FSTools::$singleton;
} }
/** /**
* Sets our global singleton to something else; useful for overloading * Sets our global singleton to something else; useful for overloading
* functions. * functions.
@@ -27,7 +27,7 @@ class FSTools
static public function setSingleton($singleton) { static public function setSingleton($singleton) {
FSTools::$singleton = $singleton; FSTools::$singleton = $singleton;
} }
/** /**
* Recursively creates a directory * Recursively creates a directory
* @param string $folder Name of folder to create * @param string $folder Name of folder to create
@@ -51,7 +51,7 @@ class FSTools
$base .= DIRECTORY_SEPARATOR; $base .= DIRECTORY_SEPARATOR;
} }
} }
/** /**
* Copy a file, or recursively copy a folder and its contents; modified * Copy a file, or recursively copy a folder and its contents; modified
* so that copied files, if PHP, have includes removed * so that copied files, if PHP, have includes removed
@@ -85,17 +85,17 @@ class FSTools
$dir->close(); $dir->close();
return true; return true;
} }
/** /**
* Overloadable function that tests a filename for copyability. By * Overloadable function that tests a filename for copyability. By
* default, everything should be copied; you can restrict things to * default, everything should be copied; you can restrict things to
* ignore hidden files, unreadable files, etc. This function * ignore hidden files, unreadable files, etc. This function
* applies to copyr(). * applies to copyr().
*/ */
public function copyable($file) { public function copyable($file) {
return true; return true;
} }
/** /**
* Delete a file, or a folder and its contents * Delete a file, or a folder and its contents
* @note Adapted from http://aidanlister.com/repos/v/function.rmdirr.php * @note Adapted from http://aidanlister.com/repos/v/function.rmdirr.php
@@ -106,12 +106,12 @@ class FSTools
if (!$this->file_exists($dirname)) { if (!$this->file_exists($dirname)) {
return false; return false;
} }
// Simple delete for a file // Simple delete for a file
if ($this->is_file($dirname) || $this->is_link($dirname)) { if ($this->is_file($dirname) || $this->is_link($dirname)) {
return $this->unlink($dirname); return $this->unlink($dirname);
} }
// Loop through the folder // Loop through the folder
$dir = $this->dir($dirname); $dir = $this->dir($dirname);
while (false !== $entry = $dir->read()) { while (false !== $entry = $dir->read()) {
@@ -122,12 +122,12 @@ class FSTools
// Recurse // Recurse
$this->rmdirr($dirname . DIRECTORY_SEPARATOR . $entry); $this->rmdirr($dirname . DIRECTORY_SEPARATOR . $entry);
} }
// Clean up // Clean up
$dir->close(); $dir->close();
return $this->rmdir($dirname); return $this->rmdir($dirname);
} }
/** /**
* Recursively globs a directory. * Recursively globs a directory.
*/ */
@@ -140,9 +140,9 @@ class FSTools
$sub_files = $this->globr($sub_dir, $pattern, $flags); $sub_files = $this->globr($sub_dir, $pattern, $flags);
$files = array_merge($files, $sub_files); $files = array_merge($files, $sub_files);
} }
return $files; return $files;
} }
/** /**
* Allows for PHP functions to be called and be stubbed. * Allows for PHP functions to be called and be stubbed.
* @warning This function will not work for functions that need * @warning This function will not work for functions that need
@@ -151,5 +151,5 @@ class FSTools
public function __call($name, $args) { public function __call($name, $args) {
return call_user_func_array($name, $args); return call_user_func_array($name, $args);
} }
} }

42
extras/FSTools/File.php
View File

@@ -9,16 +9,16 @@
*/ */
class FSTools_File class FSTools_File
{ {
/** Filename of file this object represents */ /** Filename of file this object represents */
protected $name; protected $name;
/** Handle for the file */ /** Handle for the file */
protected $handle = false; protected $handle = false;
/** Instance of FSTools for interfacing with filesystem */ /** Instance of FSTools for interfacing with filesystem */
protected $fs; protected $fs;
/** /**
* Filename of file you wish to instantiate. * Filename of file you wish to instantiate.
* @note This file need not exist * @note This file need not exist
@@ -27,13 +27,13 @@ class FSTools_File
$this->name = $name; $this->name = $name;
$this->fs = $fs ? $fs : FSTools::singleton(); $this->fs = $fs ? $fs : FSTools::singleton();
} }
/** Returns the filename of the file. */ /** Returns the filename of the file. */
public function getName() {return $this->name;} public function getName() {return $this->name;}
/** Returns directory of the file without trailing slash */ /** Returns directory of the file without trailing slash */
public function getDirectory() {return $this->fs->dirname($this->name);} public function getDirectory() {return $this->fs->dirname($this->name);}
/** /**
* Retrieves the contents of a file * Retrieves the contents of a file
* @todo Throw an exception if file doesn't exist * @todo Throw an exception if file doesn't exist
@@ -41,27 +41,27 @@ class FSTools_File
public function get() { public function get() {
return $this->fs->file_get_contents($this->name); return $this->fs->file_get_contents($this->name);
} }
/** Writes contents to a file, creates new file if necessary */ /** Writes contents to a file, creates new file if necessary */
public function write($contents) { public function write($contents) {
return $this->fs->file_put_contents($this->name, $contents); return $this->fs->file_put_contents($this->name, $contents);
} }
/** Deletes the file */ /** Deletes the file */
public function delete() { public function delete() {
return $this->fs->unlink($this->name); return $this->fs->unlink($this->name);
} }
/** Returns true if file exists and is a file. */ /** Returns true if file exists and is a file. */
public function exists() { public function exists() {
return $this->fs->is_file($this->name); return $this->fs->is_file($this->name);
} }
/** Returns last file modification time */ /** Returns last file modification time */
public function getMTime() { public function getMTime() {
return $this->fs->filemtime($this->name); return $this->fs->filemtime($this->name);
} }
/** /**
* Chmod a file * Chmod a file
* @note We ignore errors because of some weird owner trickery due * @note We ignore errors because of some weird owner trickery due
@@ -70,14 +70,14 @@ class FSTools_File
public function chmod($octal_code) { public function chmod($octal_code) {
return @$this->fs->chmod($this->name, $octal_code); return @$this->fs->chmod($this->name, $octal_code);
} }
/** Opens file's handle */ /** Opens file's handle */
public function open($mode) { public function open($mode) {
if ($this->handle) $this->close(); if ($this->handle) $this->close();
$this->handle = $this->fs->fopen($this->name, $mode); $this->handle = $this->fs->fopen($this->name, $mode);
return true; return true;
} }
/** Closes file's handle */ /** Closes file's handle */
public function close() { public function close() {
if (!$this->handle) return false; if (!$this->handle) return false;
@@ -85,40 +85,40 @@ class FSTools_File
$this->handle = false; $this->handle = false;
return $status; return $status;
} }
/** Retrieves a line from an open file, with optional max length $length */ /** Retrieves a line from an open file, with optional max length $length */
public function getLine($length = null) { public function getLine($length = null) {
if (!$this->handle) $this->open('r'); if (!$this->handle) $this->open('r');
if ($length === null) return $this->fs->fgets($this->handle); if ($length === null) return $this->fs->fgets($this->handle);
else return $this->fs->fgets($this->handle, $length); else return $this->fs->fgets($this->handle, $length);
} }
/** Retrieves a character from an open file */ /** Retrieves a character from an open file */
public function getChar() { public function getChar() {
if (!$this->handle) $this->open('r'); if (!$this->handle) $this->open('r');
return $this->fs->fgetc($this->handle); return $this->fs->fgetc($this->handle);
} }
/** Retrieves an $length bytes of data from an open data */ /** Retrieves an $length bytes of data from an open data */
public function read($length) { public function read($length) {
if (!$this->handle) $this->open('r'); if (!$this->handle) $this->open('r');
return $this->fs->fread($this->handle, $length); return $this->fs->fread($this->handle, $length);
} }
/** Writes to an open file */ /** Writes to an open file */
public function put($string) { public function put($string) {
if (!$this->handle) $this->open('a'); if (!$this->handle) $this->open('a');
return $this->fs->fwrite($this->handle, $string); return $this->fs->fwrite($this->handle, $string);
} }
/** Returns TRUE if the end of the file has been reached */ /** Returns TRUE if the end of the file has been reached */
public function eof() { public function eof() {
if (!$this->handle) return true; if (!$this->handle) return true;
return $this->fs->feof($this->handle); return $this->fs->feof($this->handle);
} }
public function __destruct() { public function __destruct() {
if ($this->handle) $this->close(); if ($this->handle) $this->close();
} }
} }

2
extras/HTMLPurifierExtras.autoload.php
View File

@@ -3,7 +3,7 @@
/** /**
* @file * @file
* Convenience file that registers autoload handler for HTML Purifier. * Convenience file that registers autoload handler for HTML Purifier.
* *
* @warning * @warning
* This autoloader does not contain the compatibility code seen in * This autoloader does not contain the compatibility code seen in
* HTMLPurifier_Bootstrap; the user is expected to make any necessary * HTMLPurifier_Bootstrap; the user is expected to make any necessary

6
extras/HTMLPurifierExtras.php
View File

@@ -6,14 +6,14 @@
*/ */
class HTMLPurifierExtras class HTMLPurifierExtras
{ {
public static function autoload($class) { public static function autoload($class) {
$path = HTMLPurifierExtras::getPath($class); $path = HTMLPurifierExtras::getPath($class);
if (!$path) return false; if (!$path) return false;
require $path; require $path;
return true; return true;
} }
public static function getPath($class) { public static function getPath($class) {
if ( if (
strncmp('FSTools', $class, 7) !== 0 && strncmp('FSTools', $class, 7) !== 0 &&
@@ -23,5 +23,5 @@ class HTMLPurifierExtras
// Standard implementation: // Standard implementation:
return str_replace('_', '/', $class) . '.php'; return str_replace('_', '/', $class) . '.php';
} }
} }

2
extras/README
View File

@@ -24,7 +24,7 @@ the filesystem. It currently consists of two classes:
to call arbitrary native PHP functions through it like $FS->fopen(...). to call arbitrary native PHP functions through it like $FS->fopen(...).
This makes it a lot simpler to mock these filesystem calls for unit testing. This makes it a lot simpler to mock these filesystem calls for unit testing.
- FSTools_File: This object represents a single file, and has almost any - FSTools_File: This object represents a single file, and has almost any
method imaginable one would need. method imaginable one would need.
Check the files themselves for more information. Check the files themselves for more information.

8
library/HTMLPurifier.includes.php
View File

@@ -6,13 +6,13 @@
* the core files required by HTML Purifier. Use this if performance is a * the core files required by HTML Purifier. Use this if performance is a
* primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
* FILE, changes will be overwritten the next time the script is run. * FILE, changes will be overwritten the next time the script is run.
* *
* @version 3.2.0 * @version 3.2.0
* *
* @warning * @warning
* You must *not* include any other HTML Purifier files before this file, * You must *not* include any other HTML Purifier files before this file,
* because 'require' not 'require_once' is used. * because 'require' not 'require_once' is used.
* *
* @warning * @warning
* This file requires that the include path contains the HTML Purifier * This file requires that the include path contains the HTML Purifier
* library directory; this is not auto-set. * library directory; this is not auto-set.
@@ -55,6 +55,8 @@ require 'HTMLPurifier/LanguageFactory.php';
require 'HTMLPurifier/Length.php'; require 'HTMLPurifier/Length.php';
require 'HTMLPurifier/Lexer.php'; require 'HTMLPurifier/Lexer.php';
require 'HTMLPurifier/PercentEncoder.php'; require 'HTMLPurifier/PercentEncoder.php';
require 'HTMLPurifier/PropertyList.php';
require 'HTMLPurifier/PropertyListIterator.php';
require 'HTMLPurifier/Strategy.php'; require 'HTMLPurifier/Strategy.php';
require 'HTMLPurifier/StringHash.php'; require 'HTMLPurifier/StringHash.php';
require 'HTMLPurifier/StringHashParser.php'; require 'HTMLPurifier/StringHashParser.php';

76
library/HTMLPurifier.php
View File

@@ -1,11 +1,11 @@
<?php <?php
/*! @mainpage /*! @mainpage
* *
* HTML Purifier is an HTML filter that will take an arbitrary snippet of * HTML Purifier is an HTML filter that will take an arbitrary snippet of
* HTML and rigorously test, validate and filter it into a version that * HTML and rigorously test, validate and filter it into a version that
* is safe for output onto webpages. It achieves this by: * is safe for output onto webpages. It achieves this by:
* *
* -# Lexing (parsing into tokens) the document, * -# Lexing (parsing into tokens) the document,
* -# Executing various strategies on the tokens: * -# Executing various strategies on the tokens:
* -# Removing all elements not in the whitelist, * -# Removing all elements not in the whitelist,
@@ -13,7 +13,7 @@
* -# Fixing the nesting of the nodes, and * -# Fixing the nesting of the nodes, and
* -# Validating attributes of the nodes; and * -# Validating attributes of the nodes; and
* -# Generating HTML from the purified tokens. * -# Generating HTML from the purified tokens.
* *
* However, most users will only need to interface with the HTMLPurifier * However, most users will only need to interface with the HTMLPurifier
* and HTMLPurifier_Config. * and HTMLPurifier_Config.
*/ */
@@ -39,44 +39,44 @@
/** /**
* Facade that coordinates HTML Purifier's subsystems in order to purify HTML. * Facade that coordinates HTML Purifier's subsystems in order to purify HTML.
* *
* @note There are several points in which configuration can be specified * @note There are several points in which configuration can be specified
* for HTML Purifier. The precedence of these (from lowest to * for HTML Purifier. The precedence of these (from lowest to
* highest) is as follows: * highest) is as follows:
* -# Instance: new HTMLPurifier($config) * -# Instance: new HTMLPurifier($config)
* -# Invocation: purify($html, $config) * -# Invocation: purify($html, $config)
* These configurations are entirely independent of each other and * These configurations are entirely independent of each other and
* are *not* merged (this behavior may change in the future). * are *not* merged (this behavior may change in the future).
* *
* @todo We need an easier way to inject strategies using the configuration * @todo We need an easier way to inject strategies using the configuration
* object. * object.
*/ */
class HTMLPurifier class HTMLPurifier
{ {
/** Version of HTML Purifier */ /** Version of HTML Purifier */
public $version = '3.2.0'; public $version = '3.2.0';
/** Constant with version of HTML Purifier */ /** Constant with version of HTML Purifier */
const VERSION = '3.2.0'; const VERSION = '3.2.0';
/** Global configuration object */ /** Global configuration object */
public $config; public $config;
/** Array of extra HTMLPurifier_Filter objects to run on HTML, for backwards compatibility */ /** Array of extra HTMLPurifier_Filter objects to run on HTML, for backwards compatibility */
private $filters = array(); private $filters = array();
/** Single instance of HTML Purifier */ /** Single instance of HTML Purifier */
private static $instance; private static $instance;
protected $strategy, $generator; protected $strategy, $generator;
/** /**
* Resultant HTMLPurifier_Context of last run purification. Is an array * Resultant HTMLPurifier_Context of last run purification. Is an array
* of contexts if the last called method was purifyArray(). * of contexts if the last called method was purifyArray().
*/ */
public $context; public $context;
/** /**
* Initializes the purifier. * Initializes the purifier.
* @param $config Optional HTMLPurifier_Config object for all instances of * @param $config Optional HTMLPurifier_Config object for all instances of
@@ -86,13 +86,13 @@ class HTMLPurifier
* HTMLPurifier_Config::create() supports. * HTMLPurifier_Config::create() supports.
*/ */
public function __construct($config = null) { public function __construct($config = null) {
$this->config = HTMLPurifier_Config::create($config); $this->config = HTMLPurifier_Config::create($config);
$this->strategy = new HTMLPurifier_Strategy_Core(); $this->strategy = new HTMLPurifier_Strategy_Core();
} }
/** /**
* Adds a filter to process the output. First come first serve * Adds a filter to process the output. First come first serve
* @param $filter HTMLPurifier_Filter object * @param $filter HTMLPurifier_Filter object
@@ -101,10 +101,10 @@ class HTMLPurifier
trigger_error('HTMLPurifier->addFilter() is deprecated, use configuration directives in the Filter namespace or Filter.Custom', E_USER_WARNING); trigger_error('HTMLPurifier->addFilter() is deprecated, use configuration directives in the Filter namespace or Filter.Custom', E_USER_WARNING);
$this->filters[] = $filter; $this->filters[] = $filter;
} }
/** /**
* Filters an HTML snippet/document to be XSS-free and standards-compliant. * Filters an HTML snippet/document to be XSS-free and standards-compliant.
* *
* @param $html String of HTML to purify * @param $html String of HTML to purify
* @param $config HTMLPurifier_Config object for this operation, if omitted, * @param $config HTMLPurifier_Config object for this operation, if omitted,
* defaults to the config object specified during this * defaults to the config object specified during this
@@ -113,38 +113,38 @@ class HTMLPurifier
* @return Purified HTML * @return Purified HTML
*/ */
public function purify($html, $config = null) { public function purify($html, $config = null) {
// :TODO: make the config merge in, instead of replace // :TODO: make the config merge in, instead of replace
$config = $config ? HTMLPurifier_Config::create($config) : $this->config; $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
// implementation is partially environment dependant, partially // implementation is partially environment dependant, partially
// configuration dependant // configuration dependant
$lexer = HTMLPurifier_Lexer::create($config); $lexer = HTMLPurifier_Lexer::create($config);
$context = new HTMLPurifier_Context(); $context = new HTMLPurifier_Context();
// setup HTML generator // setup HTML generator
$this->generator = new HTMLPurifier_Generator($config, $context); $this->generator = new HTMLPurifier_Generator($config, $context);
$context->register('Generator', $this->generator); $context->register('Generator', $this->generator);
// set up global context variables // set up global context variables
if ($config->get('Core', 'CollectErrors')) { if ($config->get('Core', 'CollectErrors')) {
// may get moved out if other facilities use it // may get moved out if other facilities use it
$language_factory = HTMLPurifier_LanguageFactory::instance(); $language_factory = HTMLPurifier_LanguageFactory::instance();
$language = $language_factory->create($config, $context); $language = $language_factory->create($config, $context);
$context->register('Locale', $language); $context->register('Locale', $language);
$error_collector = new HTMLPurifier_ErrorCollector($context); $error_collector = new HTMLPurifier_ErrorCollector($context);
$context->register('ErrorCollector', $error_collector); $context->register('ErrorCollector', $error_collector);
} }
// setup id_accumulator context, necessary due to the fact that // setup id_accumulator context, necessary due to the fact that
// AttrValidator can be called from many places // AttrValidator can be called from many places
$id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context); $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
$context->register('IDAccumulator', $id_accumulator); $context->register('IDAccumulator', $id_accumulator);
$html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context); $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
// setup filters // setup filters
$filter_flags = $config->getBatch('Filter'); $filter_flags = $config->getBatch('Filter');
$custom_filters = $filter_flags['Custom']; $custom_filters = $filter_flags['Custom'];
@@ -161,13 +161,13 @@ class HTMLPurifier
} }
$filters = array_merge($filters, $this->filters); $filters = array_merge($filters, $this->filters);
// maybe prepare(), but later // maybe prepare(), but later
for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) { for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
$html = $filters[$i]->preFilter($html, $config, $context); $html = $filters[$i]->preFilter($html, $config, $context);
} }
// purified HTML // purified HTML
$html = $html =
$this->generator->generateFromTokens( $this->generator->generateFromTokens(
// list of tokens // list of tokens
$this->strategy->execute( $this->strategy->execute(
@@ -179,16 +179,16 @@ class HTMLPurifier
$config, $context $config, $context
) )
); );
for ($i = $filter_size - 1; $i >= 0; $i--) { for ($i = $filter_size - 1; $i >= 0; $i--) {
$html = $filters[$i]->postFilter($html, $config, $context); $html = $filters[$i]->postFilter($html, $config, $context);
} }
$html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context); $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
$this->context =& $context; $this->context =& $context;
return $html; return $html;
} }
/** /**
* Filters an array of HTML snippets * Filters an array of HTML snippets
* @param $config Optional HTMLPurifier_Config object for this operation. * @param $config Optional HTMLPurifier_Config object for this operation.
@@ -204,7 +204,7 @@ class HTMLPurifier
$this->context = $context_array; $this->context = $context_array;
return $array_of_html; return $array_of_html;
} }
/** /**
* Singleton for enforcing just one HTML Purifier in your system * Singleton for enforcing just one HTML Purifier in your system
* @param $prototype Optional prototype HTMLPurifier instance to * @param $prototype Optional prototype HTMLPurifier instance to
@@ -223,12 +223,12 @@ class HTMLPurifier
} }
return self::$instance; return self::$instance;
} }
/** /**
* @note Backwards compatibility, see instance() * @note Backwards compatibility, see instance()
*/ */
public static function getInstance($prototype = null) { public static function getInstance($prototype = null) {
return HTMLPurifier::instance($prototype); return HTMLPurifier::instance($prototype);
} }
} }

4
library/HTMLPurifier.safe-includes.php
View File

@@ -6,7 +6,7 @@
* the core files required by HTML Purifier. This is a convenience stub that * the core files required by HTML Purifier. This is a convenience stub that
* includes all files using dirname(__FILE__) and require_once. PLEASE DO NOT * includes all files using dirname(__FILE__) and require_once. PLEASE DO NOT
* EDIT THIS FILE, changes will be overwritten the next time the script is run. * EDIT THIS FILE, changes will be overwritten the next time the script is run.
* *
* Changes to include_path are not necessary. * Changes to include_path are not necessary.
*/ */
@@ -49,6 +49,8 @@ require_once $__dir . '/HTMLPurifier/LanguageFactory.php';
require_once $__dir . '/HTMLPurifier/Length.php'; require_once $__dir . '/HTMLPurifier/Length.php';
require_once $__dir . '/HTMLPurifier/Lexer.php'; require_once $__dir . '/HTMLPurifier/Lexer.php';
require_once $__dir . '/HTMLPurifier/PercentEncoder.php'; require_once $__dir . '/HTMLPurifier/PercentEncoder.php';
require_once $__dir . '/HTMLPurifier/PropertyList.php';
require_once $__dir . '/HTMLPurifier/PropertyListIterator.php';
require_once $__dir . '/HTMLPurifier/Strategy.php'; require_once $__dir . '/HTMLPurifier/Strategy.php';
require_once $__dir . '/HTMLPurifier/StringHash.php'; require_once $__dir . '/HTMLPurifier/StringHash.php';
require_once $__dir . '/HTMLPurifier/StringHashParser.php'; require_once $__dir . '/HTMLPurifier/StringHashParser.php';

28
library/HTMLPurifier/AttrCollections.php
View File

@@ -6,12 +6,12 @@
class HTMLPurifier_AttrCollections class HTMLPurifier_AttrCollections
{ {
/** /**
* Associative array of attribute collections, indexed by name * Associative array of attribute collections, indexed by name
*/ */
public $info = array(); public $info = array();
/** /**
* Performs all expansions on internal data for use by other inclusions * Performs all expansions on internal data for use by other inclusions
* It also collects all attribute collection extensions from * It also collects all attribute collection extensions from
@@ -45,7 +45,7 @@ class HTMLPurifier_AttrCollections
$this->expandIdentifiers($this->info[$name], $attr_types); $this->expandIdentifiers($this->info[$name], $attr_types);
} }
} }
/** /**
* Takes a reference to an attribute associative array and performs * Takes a reference to an attribute associative array and performs
* all inclusions specified by the zero index. * all inclusions specified by the zero index.
@@ -72,7 +72,7 @@ class HTMLPurifier_AttrCollections
} }
unset($attr[0]); unset($attr[0]);
} }
/** /**
* Expands all string identifiers in an attribute array by replacing * Expands all string identifiers in an attribute array by replacing
* them with the appropriate values inside HTMLPurifier_AttrTypes * them with the appropriate values inside HTMLPurifier_AttrTypes
@@ -80,17 +80,17 @@ class HTMLPurifier_AttrCollections
* @param $attr_types HTMLPurifier_AttrTypes instance * @param $attr_types HTMLPurifier_AttrTypes instance
*/ */
public function expandIdentifiers(&$attr, $attr_types) { public function expandIdentifiers(&$attr, $attr_types) {
// because foreach will process new elements we add, make sure we // because foreach will process new elements we add, make sure we
// skip duplicates // skip duplicates
$processed = array(); $processed = array();
foreach ($attr as $def_i => $def) { foreach ($attr as $def_i => $def) {
// skip inclusions // skip inclusions
if ($def_i === 0) continue; if ($def_i === 0) continue;
if (isset($processed[$def_i])) continue; if (isset($processed[$def_i])) continue;
// determine whether or not attribute is required // determine whether or not attribute is required
if ($required = (strpos($def_i, '*') !== false)) { if ($required = (strpos($def_i, '*') !== false)) {
// rename the definition // rename the definition
@@ -98,21 +98,21 @@ class HTMLPurifier_AttrCollections
$def_i = trim($def_i, '*'); $def_i = trim($def_i, '*');
$attr[$def_i] = $def; $attr[$def_i] = $def;
} }
$processed[$def_i] = true; $processed[$def_i] = true;
// if we've already got a literal object, move on // if we've already got a literal object, move on
if (is_object($def)) { if (is_object($def)) {
// preserve previous required // preserve previous required
$attr[$def_i]->required = ($required || $attr[$def_i]->required); $attr[$def_i]->required = ($required || $attr[$def_i]->required);
continue; continue;
} }
if ($def === false) { if ($def === false) {
unset($attr[$def_i]); unset($attr[$def_i]);
continue; continue;
} }
if ($t = $attr_types->get($def)) { if ($t = $attr_types->get($def)) {
$attr[$def_i] = $t; $attr[$def_i] = $t;
$attr[$def_i]->required = $required; $attr[$def_i]->required = $required;
@@ -120,8 +120,8 @@ class HTMLPurifier_AttrCollections
unset($attr[$def_i]); unset($attr[$def_i]);
} }
} }
} }
} }

26
library/HTMLPurifier/AttrDef.php
View File

@@ -2,53 +2,53 @@
/** /**
* Base class for all validating attribute definitions. * Base class for all validating attribute definitions.
* *
* This family of classes forms the core for not only HTML attribute validation, * This family of classes forms the core for not only HTML attribute validation,
* but also any sort of string that needs to be validated or cleaned (which * but also any sort of string that needs to be validated or cleaned (which
* means CSS properties and composite definitions are defined here too). * means CSS properties and composite definitions are defined here too).
* Besides defining (through code) what precisely makes the string valid, * Besides defining (through code) what precisely makes the string valid,
* subclasses are also responsible for cleaning the code if possible. * subclasses are also responsible for cleaning the code if possible.
*/ */
abstract class HTMLPurifier_AttrDef abstract class HTMLPurifier_AttrDef
{ {
/** /**
* Tells us whether or not an HTML attribute is minimized. Has no * Tells us whether or not an HTML attribute is minimized. Has no
* meaning in other contexts. * meaning in other contexts.
*/ */
public $minimized = false; public $minimized = false;
/** /**
* Tells us whether or not an HTML attribute is required. Has no * Tells us whether or not an HTML attribute is required. Has no
* meaning in other contexts * meaning in other contexts
*/ */
public $required = false; public $required = false;
/** /**
* Validates and cleans passed string according to a definition. * Validates and cleans passed string according to a definition.
* *
* @param $string String to be validated and cleaned. * @param $string String to be validated and cleaned.
* @param $config Mandatory HTMLPurifier_Config object. * @param $config Mandatory HTMLPurifier_Config object.
* @param $context Mandatory HTMLPurifier_AttrContext object. * @param $context Mandatory HTMLPurifier_AttrContext object.
*/ */
abstract public function validate($string, $config, $context); abstract public function validate($string, $config, $context);
/** /**
* Convenience method that parses a string as if it were CDATA. * Convenience method that parses a string as if it were CDATA.
* *
* This method process a string in the manner specified at * This method process a string in the manner specified at
* <http://www.w3.org/TR/html4/types.html#h-6.2> by removing * <http://www.w3.org/TR/html4/types.html#h-6.2> by removing
* leading and trailing whitespace, ignoring line feeds, and replacing * leading and trailing whitespace, ignoring line feeds, and replacing
* carriage returns and tabs with spaces. While most useful for HTML * carriage returns and tabs with spaces. While most useful for HTML
* attributes specified as CDATA, it can also be applied to most CSS * attributes specified as CDATA, it can also be applied to most CSS
* values. * values.
* *
* @note This method is not entirely standards compliant, as trim() removes * @note This method is not entirely standards compliant, as trim() removes
* more types of whitespace than specified in the spec. In practice, * more types of whitespace than specified in the spec. In practice,
* this is rarely a problem, as those extra characters usually have * this is rarely a problem, as those extra characters usually have
* already been removed by HTMLPurifier_Encoder. * already been removed by HTMLPurifier_Encoder.
* *
* @warning This processing is inconsistent with XML's whitespace handling * @warning This processing is inconsistent with XML's whitespace handling
* as specified by section 3.3.3 and referenced XHTML 1.0 section * as specified by section 3.3.3 and referenced XHTML 1.0 section
* 4.7. However, note that we are NOT necessarily * 4.7. However, note that we are NOT necessarily
@@ -60,7 +60,7 @@ abstract class HTMLPurifier_AttrDef
$string = str_replace(array("\n", "\t", "\r"), ' ', $string); $string = str_replace(array("\n", "\t", "\r"), ' ', $string);
return $string; return $string;
} }
/** /**
* Factory method for creating this class from a string. * Factory method for creating this class from a string.
* @param $string String construction info * @param $string String construction info
@@ -73,7 +73,7 @@ abstract class HTMLPurifier_AttrDef
// to clone or instantiate new copies. (Instantiation is safer.) // to clone or instantiate new copies. (Instantiation is safer.)
return $this; return $this;
} }
/** /**
* Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work * Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work
* properly. THIS IS A HACK! * properly. THIS IS A HACK!
@@ -81,6 +81,6 @@ abstract class HTMLPurifier_AttrDef
protected function mungeRgb($string) { protected function mungeRgb($string) {
return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string); return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string);
} }
} }

26
library/HTMLPurifier/AttrDef/CSS.php
View File

@@ -13,28 +13,28 @@
*/ */
class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
{ {
public function validate($css, $config, $context) { public function validate($css, $config, $context) {
$css = $this->parseCDATA($css); $css = $this->parseCDATA($css);
$definition = $config->getCSSDefinition(); $definition = $config->getCSSDefinition();
// we're going to break the spec and explode by semicolons. // we're going to break the spec and explode by semicolons.
// This is because semicolon rarely appears in escaped form // This is because semicolon rarely appears in escaped form
// Doing this is generally flaky but fast // Doing this is generally flaky but fast
// IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI // IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI
// for details // for details
$declarations = explode(';', $css); $declarations = explode(';', $css);
$propvalues = array(); $propvalues = array();
/** /**
* Name of the current CSS property being validated. * Name of the current CSS property being validated.
*/ */
$property = false; $property = false;
$context->register('CurrentCSSProperty', $property); $context->register('CurrentCSSProperty', $property);
foreach ($declarations as $declaration) { foreach ($declarations as $declaration) {
if (!$declaration) continue; if (!$declaration) continue;
if (!strpos($declaration, ':')) continue; if (!strpos($declaration, ':')) continue;
@@ -66,21 +66,21 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
if ($result === false) continue; if ($result === false) continue;
$propvalues[$property] = $result; $propvalues[$property] = $result;
} }
$context->destroy('CurrentCSSProperty'); $context->destroy('CurrentCSSProperty');
// procedure does not write the new CSS simultaneously, so it's // procedure does not write the new CSS simultaneously, so it's
// slightly inefficient, but it's the only way of getting rid of // slightly inefficient, but it's the only way of getting rid of
// duplicates. Perhaps config to optimize it, but not now. // duplicates. Perhaps config to optimize it, but not now.
$new_declarations = ''; $new_declarations = '';
foreach ($propvalues as $prop => $value) { foreach ($propvalues as $prop => $value) {
$new_declarations .= "$prop:$value;"; $new_declarations .= "$prop:$value;";
} }
return $new_declarations ? $new_declarations : false; return $new_declarations ? $new_declarations : false;
} }
} }

6
library/HTMLPurifier/AttrDef/CSS/AlphaValue.php
View File

@@ -2,11 +2,11 @@
class HTMLPurifier_AttrDef_CSS_AlphaValue extends HTMLPurifier_AttrDef_CSS_Number class HTMLPurifier_AttrDef_CSS_AlphaValue extends HTMLPurifier_AttrDef_CSS_Number
{ {
public function __construct() { public function __construct() {
parent::__construct(false); // opacity is non-negative, but we will clamp it parent::__construct(false); // opacity is non-negative, but we will clamp it
} }
public function validate($number, $config, $context) { public function validate($number, $config, $context) {
$result = parent::validate($number, $config, $context); $result = parent::validate($number, $config, $context);
if ($result === false) return $result; if ($result === false) return $result;
@@ -15,5 +15,5 @@ class HTMLPurifier_AttrDef_CSS_AlphaValue extends HTMLPurifier_AttrDef_CSS_Numbe
if ($float > 1.0) $result = '1'; if ($float > 1.0) $result = '1';
return $result; return $result;
} }
} }

28
library/HTMLPurifier/AttrDef/CSS/Background.php
View File

@@ -6,13 +6,13 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
{ {
/** /**
* Local copy of component validators. * Local copy of component validators.
* @note See HTMLPurifier_AttrDef_Font::$info for a similar impl. * @note See HTMLPurifier_AttrDef_Font::$info for a similar impl.
*/ */
protected $info; protected $info;
public function __construct($config) { public function __construct($config) {
$def = $config->getCSSDefinition(); $def = $config->getCSSDefinition();
$this->info['background-color'] = $def->info['background-color']; $this->info['background-color'] = $def->info['background-color'];
@@ -21,29 +21,29 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
$this->info['background-attachment'] = $def->info['background-attachment']; $this->info['background-attachment'] = $def->info['background-attachment'];
$this->info['background-position'] = $def->info['background-position']; $this->info['background-position'] = $def->info['background-position'];
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
// regular pre-processing // regular pre-processing
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
if ($string === '') return false; if ($string === '') return false;
// munge rgb() decl if necessary // munge rgb() decl if necessary
$string = $this->mungeRgb($string); $string = $this->mungeRgb($string);
// assumes URI doesn't have spaces in it // assumes URI doesn't have spaces in it
$bits = explode(' ', strtolower($string)); // bits to process $bits = explode(' ', strtolower($string)); // bits to process
$caught = array(); $caught = array();
$caught['color'] = false; $caught['color'] = false;
$caught['image'] = false; $caught['image'] = false;
$caught['repeat'] = false; $caught['repeat'] = false;
$caught['attachment'] = false; $caught['attachment'] = false;
$caught['position'] = false; $caught['position'] = false;
$i = 0; // number of catches $i = 0; // number of catches
$none = false; $none = false;
foreach ($bits as $bit) { foreach ($bits as $bit) {
if ($bit === '') continue; if ($bit === '') continue;
foreach ($caught as $key => $status) { foreach ($caught as $key => $status) {
@@ -64,23 +64,23 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
break; break;
} }
} }
if (!$i) return false; if (!$i) return false;
if ($caught['position'] !== false) { if ($caught['position'] !== false) {
$caught['position'] = $this->info['background-position']-> $caught['position'] = $this->info['background-position']->
validate($caught['position'], $config, $context); validate($caught['position'], $config, $context);
} }
$ret = array(); $ret = array();
foreach ($caught as $value) { foreach ($caught as $value) {
if ($value === false) continue; if ($value === false) continue;
$ret[] = $value; $ret[] = $value;
} }
if (empty($ret)) return false; if (empty($ret)) return false;
return implode(' ', $ret); return implode(' ', $ret);
} }
} }

44
library/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php
View File

@@ -7,7 +7,7 @@
[ [
<percentage> | <length> | left | center | right <percentage> | <length> | left | center | right
] ]
[ [
<percentage> | <length> | top | center | bottom <percentage> | <length> | top | center | bottom
]? ]?
] | ] |
@@ -28,10 +28,10 @@
/* QuirksMode says: /* QuirksMode says:
keyword + length/percentage must be ordered correctly, as per W3C keyword + length/percentage must be ordered correctly, as per W3C
Internet Explorer and Opera, however, support arbitrary ordering. We Internet Explorer and Opera, however, support arbitrary ordering. We
should fix it up. should fix it up.
Minor issue though, not strictly necessary. Minor issue though, not strictly necessary.
*/ */
@@ -43,27 +43,27 @@
*/ */
class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
{ {
protected $length; protected $length;
protected $percentage; protected $percentage;
public function __construct() { public function __construct() {
$this->length = new HTMLPurifier_AttrDef_CSS_Length(); $this->length = new HTMLPurifier_AttrDef_CSS_Length();
$this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage(); $this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage();
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
$bits = explode(' ', $string); $bits = explode(' ', $string);
$keywords = array(); $keywords = array();
$keywords['h'] = false; // left, right $keywords['h'] = false; // left, right
$keywords['v'] = false; // top, bottom $keywords['v'] = false; // top, bottom
$keywords['c'] = false; // center $keywords['c'] = false; // center
$measures = array(); $measures = array();
$i = 0; $i = 0;
$lookup = array( $lookup = array(
'top' => 'v', 'top' => 'v',
'bottom' => 'v', 'bottom' => 'v',
@@ -71,10 +71,10 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
'right' => 'h', 'right' => 'h',
'center' => 'c' 'center' => 'c'
); );
foreach ($bits as $bit) { foreach ($bits as $bit) {
if ($bit === '') continue; if ($bit === '') continue;
// test for keyword // test for keyword
$lbit = ctype_lower($bit) ? $bit : strtolower($bit); $lbit = ctype_lower($bit) ? $bit : strtolower($bit);
if (isset($lookup[$lbit])) { if (isset($lookup[$lbit])) {
@@ -82,28 +82,28 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
$keywords[$status] = $lbit; $keywords[$status] = $lbit;
$i++; $i++;
} }
// test for length // test for length
$r = $this->length->validate($bit, $config, $context); $r = $this->length->validate($bit, $config, $context);
if ($r !== false) { if ($r !== false) {
$measures[] = $r; $measures[] = $r;
$i++; $i++;
} }
// test for percentage // test for percentage
$r = $this->percentage->validate($bit, $config, $context); $r = $this->percentage->validate($bit, $config, $context);
if ($r !== false) { if ($r !== false) {
$measures[] = $r; $measures[] = $r;
$i++; $i++;
} }
} }
if (!$i) return false; // no valid values were caught if (!$i) return false; // no valid values were caught
$ret = array(); $ret = array();
// first keyword // first keyword
if ($keywords['h']) $ret[] = $keywords['h']; if ($keywords['h']) $ret[] = $keywords['h'];
elseif (count($measures)) $ret[] = array_shift($measures); elseif (count($measures)) $ret[] = array_shift($measures);
@@ -111,15 +111,15 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
$ret[] = $keywords['c']; $ret[] = $keywords['c'];
$keywords['c'] = false; // prevent re-use: center = center center $keywords['c'] = false; // prevent re-use: center = center center
} }
if ($keywords['v']) $ret[] = $keywords['v']; if ($keywords['v']) $ret[] = $keywords['v'];
elseif (count($measures)) $ret[] = array_shift($measures); elseif (count($measures)) $ret[] = array_shift($measures);
elseif ($keywords['c']) $ret[] = $keywords['c']; elseif ($keywords['c']) $ret[] = $keywords['c'];
if (empty($ret)) return false; if (empty($ret)) return false;
return implode(' ', $ret); return implode(' ', $ret);
} }
} }

8
library/HTMLPurifier/AttrDef/CSS/Border.php
View File

@@ -5,19 +5,19 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef
{ {
/** /**
* Local copy of properties this property is shorthand for. * Local copy of properties this property is shorthand for.
*/ */
protected $info = array(); protected $info = array();
public function __construct($config) { public function __construct($config) {
$def = $config->getCSSDefinition(); $def = $config->getCSSDefinition();
$this->info['border-width'] = $def->info['border-width']; $this->info['border-width'] = $def->info['border-width'];
$this->info['border-style'] = $def->info['border-style']; $this->info['border-style'] = $def->info['border-style'];
$this->info['border-top-color'] = $def->info['border-top-color']; $this->info['border-top-color'] = $def->info['border-top-color'];
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
$string = $this->mungeRgb($string); $string = $this->mungeRgb($string);
@@ -37,6 +37,6 @@ class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef
} }
return rtrim($ret); return rtrim($ret);
} }
} }

16
library/HTMLPurifier/AttrDef/CSS/Color.php
View File

@@ -5,18 +5,18 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
{ {
public function validate($color, $config, $context) { public function validate($color, $config, $context) {
static $colors = null; static $colors = null;
if ($colors === null) $colors = $config->get('Core', 'ColorKeywords'); if ($colors === null) $colors = $config->get('Core', 'ColorKeywords');
$color = trim($color); $color = trim($color);
if ($color === '') return false; if ($color === '') return false;
$lower = strtolower($color); $lower = strtolower($color);
if (isset($colors[$lower])) return $colors[$lower]; if (isset($colors[$lower])) return $colors[$lower];
if (strpos($color, 'rgb(') !== false) { if (strpos($color, 'rgb(') !== false) {
// rgb literal handling // rgb literal handling
$length = strlen($color); $length = strlen($color);
@@ -68,10 +68,10 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
if ($length !== 3 && $length !== 6) return false; if ($length !== 3 && $length !== 6) return false;
if (!ctype_xdigit($hex)) return false; if (!ctype_xdigit($hex)) return false;
} }
return $color; return $color;
} }
} }

10
library/HTMLPurifier/AttrDef/CSS/Composite.php
View File

@@ -2,7 +2,7 @@
/** /**
* Allows multiple validators to attempt to validate attribute. * Allows multiple validators to attempt to validate attribute.
* *
* Composite is just what it sounds like: a composite of many validators. * Composite is just what it sounds like: a composite of many validators.
* This means that multiple HTMLPurifier_AttrDef objects will have a whack * This means that multiple HTMLPurifier_AttrDef objects will have a whack
* at the string. If one of them passes, that's what is returned. This is * at the string. If one of them passes, that's what is returned. This is
@@ -11,20 +11,20 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
{ {
/** /**
* List of HTMLPurifier_AttrDef objects that may process strings * List of HTMLPurifier_AttrDef objects that may process strings
* @todo Make protected * @todo Make protected
*/ */
public $defs; public $defs;
/** /**
* @param $defs List of HTMLPurifier_AttrDef objects * @param $defs List of HTMLPurifier_AttrDef objects
*/ */
public function __construct($defs) { public function __construct($defs) {
$this->defs = $defs; $this->defs = $defs;
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
foreach ($this->defs as $i => $def) { foreach ($this->defs as $i => $def) {
$result = $this->defs[$i]->validate($string, $config, $context); $result = $this->defs[$i]->validate($string, $config, $context);
@@ -32,6 +32,6 @@ class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
} }
return false; return false;
} }
} }

2
library/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php
View File

@@ -6,7 +6,7 @@
class HTMLPurifier_AttrDef_CSS_DenyElementDecorator extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_DenyElementDecorator extends HTMLPurifier_AttrDef
{ {
protected $def, $element; protected $def, $element;
/** /**
* @param $def Definition to wrap * @param $def Definition to wrap
* @param $element Element to deny * @param $element Element to deny

8
library/HTMLPurifier/AttrDef/CSS/Filter.php
View File

@@ -7,13 +7,13 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef
{ {
protected $intValidator; protected $intValidator;
public function __construct() { public function __construct() {
$this->intValidator = new HTMLPurifier_AttrDef_Integer(); $this->intValidator = new HTMLPurifier_AttrDef_Integer();
} }
public function validate($value, $config, $context) { public function validate($value, $config, $context) {
$value = $this->parseCDATA($value); $value = $this->parseCDATA($value);
if ($value === 'none') return $value; if ($value === 'none') return $value;
@@ -48,5 +48,5 @@ class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef
$ret_function = "$function($ret_parameters)"; $ret_function = "$function($ret_parameters)";
return $ret_function; return $ret_function;
} }
} }

26
library/HTMLPurifier/AttrDef/CSS/Font.php
View File

@@ -5,17 +5,17 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
{ {
/** /**
* Local copy of component validators. * Local copy of component validators.
* *
* @note If we moved specific CSS property definitions to their own * @note If we moved specific CSS property definitions to their own
* classes instead of having them be assembled at run time by * classes instead of having them be assembled at run time by
* CSSDefinition, this wouldn't be necessary. We'd instantiate * CSSDefinition, this wouldn't be necessary. We'd instantiate
* our own copies. * our own copies.
*/ */
protected $info = array(); protected $info = array();
public function __construct($config) { public function __construct($config) {
$def = $config->getCSSDefinition(); $def = $config->getCSSDefinition();
$this->info['font-style'] = $def->info['font-style']; $this->info['font-style'] = $def->info['font-style'];
@@ -25,9 +25,9 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
$this->info['line-height'] = $def->info['line-height']; $this->info['line-height'] = $def->info['line-height'];
$this->info['font-family'] = $def->info['font-family']; $this->info['font-family'] = $def->info['font-family'];
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
static $system_fonts = array( static $system_fonts = array(
'caption' => true, 'caption' => true,
'icon' => true, 'icon' => true,
@@ -36,27 +36,27 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
'small-caption' => true, 'small-caption' => true,
'status-bar' => true 'status-bar' => true
); );
// regular pre-processing // regular pre-processing
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
if ($string === '') return false; if ($string === '') return false;
// check if it's one of the keywords // check if it's one of the keywords
$lowercase_string = strtolower($string); $lowercase_string = strtolower($string);
if (isset($system_fonts[$lowercase_string])) { if (isset($system_fonts[$lowercase_string])) {
return $lowercase_string; return $lowercase_string;
} }
$bits = explode(' ', $string); // bits to process $bits = explode(' ', $string); // bits to process
$stage = 0; // this indicates what we're looking for $stage = 0; // this indicates what we're looking for
$caught = array(); // which stage 0 properties have we caught? $caught = array(); // which stage 0 properties have we caught?
$stage_1 = array('font-style', 'font-variant', 'font-weight'); $stage_1 = array('font-style', 'font-variant', 'font-weight');
$final = ''; // output $final = ''; // output
for ($i = 0, $size = count($bits); $i < $size; $i++) { for ($i = 0, $size = count($bits); $i < $size; $i++) {
if ($bits[$i] === '') continue; if ($bits[$i] === '') continue;
switch ($stage) { switch ($stage) {
// attempting to catch font-style, font-variant or font-weight // attempting to catch font-style, font-variant or font-weight
case 0: case 0:
foreach ($stage_1 as $validator_name) { foreach ($stage_1 as $validator_name) {
@@ -72,7 +72,7 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
// all three caught, continue on // all three caught, continue on
if (count($caught) >= 3) $stage = 1; if (count($caught) >= 3) $stage = 1;
if ($r !== false) break; if ($r !== false) break;
// attempting to catch font-size and perhaps line-height // attempting to catch font-size and perhaps line-height
case 1: case 1:
$found_slash = false; $found_slash = false;
@@ -126,7 +126,7 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
break; break;
} }
return false; return false;
// attempting to catch font-family // attempting to catch font-family
case 2: case 2:
$font_family = $font_family =
@@ -143,6 +143,6 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
} }
return false; return false;
} }
} }

16
library/HTMLPurifier/AttrDef/CSS/FontFamily.php
View File

@@ -6,7 +6,7 @@
*/ */
class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
static $generic_names = array( static $generic_names = array(
'serif' => true, 'serif' => true,
@@ -15,7 +15,7 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
'fantasy' => true, 'fantasy' => true,
'cursive' => true 'cursive' => true
); );
// assume that no font names contain commas in them // assume that no font names contain commas in them
$fonts = explode(',', $string); $fonts = explode(',', $string);
$final = ''; $final = '';
@@ -34,7 +34,7 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
$quote = $font[0]; $quote = $font[0];
if ($font[$length - 1] !== $quote) continue; if ($font[$length - 1] !== $quote) continue;
$font = substr($font, 1, $length - 2); $font = substr($font, 1, $length - 2);
$new_font = ''; $new_font = '';
for ($i = 0, $c = strlen($font); $i < $c; $i++) { for ($i = 0, $c = strlen($font); $i < $c; $i++) {
if ($font[$i] === '\\') { if ($font[$i] === '\\') {
@@ -62,19 +62,19 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
} }
$new_font .= $font[$i]; $new_font .= $font[$i];
} }
$font = $new_font; $font = $new_font;
} }
// $font is a pure representation of the font name // $font is a pure representation of the font name
if (ctype_alnum($font) && $font !== '') { if (ctype_alnum($font) && $font !== '') {
// very simple font, allow it in unharmed // very simple font, allow it in unharmed
$final .= $font . ', '; $final .= $font . ', ';
continue; continue;
} }
// complicated font, requires quoting // complicated font, requires quoting
// armor single quotes and new lines // armor single quotes and new lines
$font = str_replace("\\", "\\\\", $font); $font = str_replace("\\", "\\\\", $font);
$font = str_replace("'", "\\'", $font); $font = str_replace("'", "\\'", $font);
@@ -84,6 +84,6 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
if ($final === '') return false; if ($final === '') return false;
return $final; return $final;
} }
} }

2
library/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php
View File

@@ -6,7 +6,7 @@
class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef
{ {
protected $def, $allow; protected $def, $allow;
/** /**
* @param $def Definition to wrap * @param $def Definition to wrap
* @param $allow Whether or not to allow !important * @param $allow Whether or not to allow !important

16
library/HTMLPurifier/AttrDef/CSS/Length.php
View File

@@ -5,9 +5,9 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
{ {
protected $min, $max; protected $min, $max;
/** /**
* @param HTMLPurifier_Length $max Minimum length, or null for no bound. String is also acceptable. * @param HTMLPurifier_Length $max Minimum length, or null for no bound. String is also acceptable.
* @param HTMLPurifier_Length $max Maximum length, or null for no bound. String is also acceptable. * @param HTMLPurifier_Length $max Maximum length, or null for no bound. String is also acceptable.
@@ -16,18 +16,18 @@ class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
$this->min = $min !== null ? HTMLPurifier_Length::make($min) : null; $this->min = $min !== null ? HTMLPurifier_Length::make($min) : null;
$this->max = $max !== null ? HTMLPurifier_Length::make($max) : null; $this->max = $max !== null ? HTMLPurifier_Length::make($max) : null;
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
// Optimizations // Optimizations
if ($string === '') return false; if ($string === '') return false;
if ($string === '0') return '0'; if ($string === '0') return '0';
if (strlen($string) === 1) return false; if (strlen($string) === 1) return false;
$length = HTMLPurifier_Length::make($string); $length = HTMLPurifier_Length::make($string);
if (!$length->isValid()) return false; if (!$length->isValid()) return false;
if ($this->min) { if ($this->min) {
$c = $length->compareTo($this->min); $c = $length->compareTo($this->min);
if ($c === false) return false; if ($c === false) return false;
@@ -38,9 +38,9 @@ class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
if ($c === false) return false; if ($c === false) return false;
if ($c > 0) return false; if ($c > 0) return false;
} }
return $length->toString(); return $length->toString();
} }
} }

32
library/HTMLPurifier/AttrDef/CSS/ListStyle.php
View File

@@ -6,37 +6,37 @@
*/ */
class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
{ {
/** /**
* Local copy of component validators. * Local copy of component validators.
* @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl. * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
*/ */
protected $info; protected $info;
public function __construct($config) { public function __construct($config) {
$def = $config->getCSSDefinition(); $def = $config->getCSSDefinition();
$this->info['list-style-type'] = $def->info['list-style-type']; $this->info['list-style-type'] = $def->info['list-style-type'];
$this->info['list-style-position'] = $def->info['list-style-position']; $this->info['list-style-position'] = $def->info['list-style-position'];
$this->info['list-style-image'] = $def->info['list-style-image']; $this->info['list-style-image'] = $def->info['list-style-image'];
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
// regular pre-processing // regular pre-processing
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
if ($string === '') return false; if ($string === '') return false;
// assumes URI doesn't have spaces in it // assumes URI doesn't have spaces in it
$bits = explode(' ', strtolower($string)); // bits to process $bits = explode(' ', strtolower($string)); // bits to process
$caught = array(); $caught = array();
$caught['type'] = false; $caught['type'] = false;
$caught['position'] = false; $caught['position'] = false;
$caught['image'] = false; $caught['image'] = false;
$i = 0; // number of catches $i = 0; // number of catches
$none = false; $none = false;
foreach ($bits as $bit) { foreach ($bits as $bit) {
if ($i >= 3) return; // optimization bit if ($i >= 3) return; // optimization bit
if ($bit === '') continue; if ($bit === '') continue;
@@ -54,24 +54,24 @@ class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
break; break;
} }
} }
if (!$i) return false; if (!$i) return false;
$ret = array(); $ret = array();
// construct type // construct type
if ($caught['type']) $ret[] = $caught['type']; if ($caught['type']) $ret[] = $caught['type'];
// construct image // construct image
if ($caught['image']) $ret[] = $caught['image']; if ($caught['image']) $ret[] = $caught['image'];
// construct position // construct position
if ($caught['position']) $ret[] = $caught['position']; if ($caught['position']) $ret[] = $caught['position'];
if (empty($ret)) return false; if (empty($ret)) return false;
return implode(' ', $ret); return implode(' ', $ret);
} }
} }

14
library/HTMLPurifier/AttrDef/CSS/Multiple.php
View File

@@ -2,30 +2,30 @@
/** /**
* Framework class for strings that involve multiple values. * Framework class for strings that involve multiple values.
* *
* Certain CSS properties such as border-width and margin allow multiple * Certain CSS properties such as border-width and margin allow multiple
* lengths to be specified. This class can take a vanilla border-width * lengths to be specified. This class can take a vanilla border-width
* definition and multiply it, usually into a max of four. * definition and multiply it, usually into a max of four.
* *
* @note Even though the CSS specification isn't clear about it, inherit * @note Even though the CSS specification isn't clear about it, inherit
* can only be used alone: it will never manifest as part of a multi * can only be used alone: it will never manifest as part of a multi
* shorthand declaration. Thus, this class does not allow inherit. * shorthand declaration. Thus, this class does not allow inherit.
*/ */
class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
{ {
/** /**
* Instance of component definition to defer validation to. * Instance of component definition to defer validation to.
* @todo Make protected * @todo Make protected
*/ */
public $single; public $single;
/** /**
* Max number of values allowed. * Max number of values allowed.
* @todo Make protected * @todo Make protected
*/ */
public $max; public $max;
/** /**
* @param $single HTMLPurifier_AttrDef to multiply * @param $single HTMLPurifier_AttrDef to multiply
* @param $max Max number of values allowed (usually four) * @param $max Max number of values allowed (usually four)
@@ -34,7 +34,7 @@ class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
$this->single = $single; $this->single = $single;
$this->max = $max; $this->max = $max;
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
if ($string === '') return false; if ($string === '') return false;
@@ -52,6 +52,6 @@ class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
if ($final === '') return false; if ($final === '') return false;
return rtrim($final); return rtrim($final);
} }
} }

30
library/HTMLPurifier/AttrDef/CSS/Number.php
View File

@@ -5,30 +5,30 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
{ {
/** /**
* Bool indicating whether or not only positive values allowed. * Bool indicating whether or not only positive values allowed.
*/ */
protected $non_negative = false; protected $non_negative = false;
/** /**
* @param $non_negative Bool indicating whether negatives are forbidden * @param $non_negative Bool indicating whether negatives are forbidden
*/ */
public function __construct($non_negative = false) { public function __construct($non_negative = false) {
$this->non_negative = $non_negative; $this->non_negative = $non_negative;
} }
/** /**
* @warning Some contexts do not pass $config, $context. These * @warning Some contexts do not pass $config, $context. These
* variables should not be used without checking HTMLPurifier_Length * variables should not be used without checking HTMLPurifier_Length
*/ */
public function validate($number, $config, $context) { public function validate($number, $config, $context) {
$number = $this->parseCDATA($number); $number = $this->parseCDATA($number);
if ($number === '') return false; if ($number === '') return false;
if ($number === '0') return '0'; if ($number === '0') return '0';
$sign = ''; $sign = '';
switch ($number[0]) { switch ($number[0]) {
case '-': case '-':
@@ -37,32 +37,32 @@ class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
case '+': case '+':
$number = substr($number, 1); $number = substr($number, 1);
} }
if (ctype_digit($number)) { if (ctype_digit($number)) {
$number = ltrim($number, '0'); $number = ltrim($number, '0');
return $number ? $sign . $number : '0'; return $number ? $sign . $number : '0';
} }
// Period is the only non-numeric character allowed // Period is the only non-numeric character allowed
if (strpos($number, '.') === false) return false; if (strpos($number, '.') === false) return false;
list($left, $right) = explode('.', $number, 2); list($left, $right) = explode('.', $number, 2);
if ($left === '' && $right === '') return false; if ($left === '' && $right === '') return false;
if ($left !== '' && !ctype_digit($left)) return false; if ($left !== '' && !ctype_digit($left)) return false;
$left = ltrim($left, '0'); $left = ltrim($left, '0');
$right = rtrim($right, '0'); $right = rtrim($right, '0');
if ($right === '') { if ($right === '') {
return $left ? $sign . $left : '0'; return $left ? $sign . $left : '0';
} elseif (!ctype_digit($right)) { } elseif (!ctype_digit($right)) {
return false; return false;
} }
return $sign . $left . '.' . $right; return $sign . $left . '.' . $right;
} }
} }

18
library/HTMLPurifier/AttrDef/CSS/Percentage.php
View File

@@ -5,35 +5,35 @@
*/ */
class HTMLPurifier_AttrDef_CSS_Percentage extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_Percentage extends HTMLPurifier_AttrDef
{ {
/** /**
* Instance of HTMLPurifier_AttrDef_CSS_Number to defer number validation * Instance of HTMLPurifier_AttrDef_CSS_Number to defer number validation
*/ */
protected $number_def; protected $number_def;
/** /**
* @param Bool indicating whether to forbid negative values * @param Bool indicating whether to forbid negative values
*/ */
public function __construct($non_negative = false) { public function __construct($non_negative = false) {
$this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative); $this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
if ($string === '') return false; if ($string === '') return false;
$length = strlen($string); $length = strlen($string);
if ($length === 1) return false; if ($length === 1) return false;
if ($string[$length - 1] !== '%') return false; if ($string[$length - 1] !== '%') return false;
$number = substr($string, 0, $length - 1); $number = substr($string, 0, $length - 1);
$number = $this->number_def->validate($number, $config, $context); $number = $this->number_def->validate($number, $config, $context);
if ($number === false) return false; if ($number === false) return false;
return "$number%"; return "$number%";
} }
} }

14
library/HTMLPurifier/AttrDef/CSS/TextDecoration.php
View File

@@ -7,19 +7,19 @@
*/ */
class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
static $allowed_values = array( static $allowed_values = array(
'line-through' => true, 'line-through' => true,
'overline' => true, 'overline' => true,
'underline' => true, 'underline' => true,
); );
$string = strtolower($this->parseCDATA($string)); $string = strtolower($this->parseCDATA($string));
if ($string === 'none') return $string; if ($string === 'none') return $string;
$parts = explode(' ', $string); $parts = explode(' ', $string);
$final = ''; $final = '';
foreach ($parts as $part) { foreach ($parts as $part) {
@@ -30,8 +30,8 @@ class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
$final = rtrim($final); $final = rtrim($final);
if ($final === '') return false; if ($final === '') return false;
return $final; return $final;
} }
} }

22
library/HTMLPurifier/AttrDef/CSS/URI.php
View File

@@ -11,45 +11,45 @@
*/ */
class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
{ {
public function __construct() { public function __construct() {
parent::__construct(true); // always embedded parent::__construct(true); // always embedded
} }
public function validate($uri_string, $config, $context) { public function validate($uri_string, $config, $context) {
// parse the URI out of the string and then pass it onto // parse the URI out of the string and then pass it onto
// the parent object // the parent object
$uri_string = $this->parseCDATA($uri_string); $uri_string = $this->parseCDATA($uri_string);
if (strpos($uri_string, 'url(') !== 0) return false; if (strpos($uri_string, 'url(') !== 0) return false;
$uri_string = substr($uri_string, 4); $uri_string = substr($uri_string, 4);
$new_length = strlen($uri_string) - 1; $new_length = strlen($uri_string) - 1;
if ($uri_string[$new_length] != ')') return false; if ($uri_string[$new_length] != ')') return false;
$uri = trim(substr($uri_string, 0, $new_length)); $uri = trim(substr($uri_string, 0, $new_length));
if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) { if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) {
$quote = $uri[0]; $quote = $uri[0];
$new_length = strlen($uri) - 1; $new_length = strlen($uri) - 1;
if ($uri[$new_length] !== $quote) return false; if ($uri[$new_length] !== $quote) return false;
$uri = substr($uri, 1, $new_length - 1); $uri = substr($uri, 1, $new_length - 1);
} }
$keys = array( '(', ')', ',', ' ', '"', "'"); $keys = array( '(', ')', ',', ' ', '"', "'");
$values = array('\\(', '\\)', '\\,', '\\ ', '\\"', "\\'"); $values = array('\\(', '\\)', '\\,', '\\ ', '\\"', "\\'");
$uri = str_replace($values, $keys, $uri); $uri = str_replace($values, $keys, $uri);
$result = parent::validate($uri, $config, $context); $result = parent::validate($uri, $config, $context);
if ($result === false) return false; if ($result === false) return false;
// escape necessary characters according to CSS spec // escape necessary characters according to CSS spec
// except for the comma, none of these should appear in the // except for the comma, none of these should appear in the
// URI at all // URI at all
$result = str_replace($keys, $values, $result); $result = str_replace($keys, $values, $result);
return "url($result)"; return "url($result)";
} }
} }

14
library/HTMLPurifier/AttrDef/Enum.php
View File

@@ -9,19 +9,19 @@
*/ */
class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
{ {
/** /**
* Lookup table of valid values. * Lookup table of valid values.
* @todo Make protected * @todo Make protected
*/ */
public $valid_values = array(); public $valid_values = array();
/** /**
* Bool indicating whether or not enumeration is case sensitive. * Bool indicating whether or not enumeration is case sensitive.
* @note In general this is always case insensitive. * @note In general this is always case insensitive.
*/ */
protected $case_sensitive = false; // values according to W3C spec protected $case_sensitive = false; // values according to W3C spec
/** /**
* @param $valid_values List of valid values * @param $valid_values List of valid values
* @param $case_sensitive Bool indicating whether or not case sensitive * @param $case_sensitive Bool indicating whether or not case sensitive
@@ -32,7 +32,7 @@ class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
$this->valid_values = array_flip($valid_values); $this->valid_values = array_flip($valid_values);
$this->case_sensitive = $case_sensitive; $this->case_sensitive = $case_sensitive;
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = trim($string); $string = trim($string);
if (!$this->case_sensitive) { if (!$this->case_sensitive) {
@@ -40,10 +40,10 @@ class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
$string = ctype_lower($string) ? $string : strtolower($string); $string = ctype_lower($string) ? $string : strtolower($string);
} }
$result = isset($this->valid_values[$string]); $result = isset($this->valid_values[$string]);
return $result ? $string : false; return $result ? $string : false;
} }
/** /**
* @param $string In form of comma-delimited list of case-insensitive * @param $string In form of comma-delimited list of case-insensitive
* valid values. Example: "foo,bar,baz". Prepend "s:" to make * valid values. Example: "foo,bar,baz". Prepend "s:" to make
@@ -59,6 +59,6 @@ class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
$values = explode(',', $string); $values = explode(',', $string);
return new HTMLPurifier_AttrDef_Enum($values, $sensitive); return new HTMLPurifier_AttrDef_Enum($values, $sensitive);
} }
} }

10
library/HTMLPurifier/AttrDef/HTML/Bool.php
View File

@@ -5,23 +5,23 @@
*/ */
class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef
{ {
protected $name; protected $name;
public $minimized = true; public $minimized = true;
public function __construct($name = false) {$this->name = $name;} public function __construct($name = false) {$this->name = $name;}
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
if (empty($string)) return false; if (empty($string)) return false;
return $this->name; return $this->name;
} }
/** /**
* @param $string Name of attribute * @param $string Name of attribute
*/ */
public function make($string) { public function make($string) {
return new HTMLPurifier_AttrDef_HTML_Bool($string); return new HTMLPurifier_AttrDef_HTML_Bool($string);
} }
} }

16
library/HTMLPurifier/AttrDef/HTML/Color.php
View File

@@ -5,27 +5,27 @@
*/ */
class HTMLPurifier_AttrDef_HTML_Color extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_HTML_Color extends HTMLPurifier_AttrDef
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
static $colors = null; static $colors = null;
if ($colors === null) $colors = $config->get('Core', 'ColorKeywords'); if ($colors === null) $colors = $config->get('Core', 'ColorKeywords');
$string = trim($string); $string = trim($string);
if (empty($string)) return false; if (empty($string)) return false;
if (isset($colors[$string])) return $colors[$string]; if (isset($colors[$string])) return $colors[$string];
if ($string[0] === '#') $hex = substr($string, 1); if ($string[0] === '#') $hex = substr($string, 1);
else $hex = $string; else $hex = $string;
$length = strlen($hex); $length = strlen($hex);
if ($length !== 3 && $length !== 6) return false; if ($length !== 3 && $length !== 6) return false;
if (!ctype_xdigit($hex)) return false; if (!ctype_xdigit($hex)) return false;
if ($length === 3) $hex = $hex[0].$hex[0].$hex[1].$hex[1].$hex[2].$hex[2]; if ($length === 3) $hex = $hex[0].$hex[0].$hex[1].$hex[1].$hex[2].$hex[2];
return "#$hex"; return "#$hex";
} }
} }

8
library/HTMLPurifier/AttrDef/HTML/FrameTarget.php
View File

@@ -5,16 +5,16 @@
*/ */
class HTMLPurifier_AttrDef_HTML_FrameTarget extends HTMLPurifier_AttrDef_Enum class HTMLPurifier_AttrDef_HTML_FrameTarget extends HTMLPurifier_AttrDef_Enum
{ {
public $valid_values = false; // uninitialized value public $valid_values = false; // uninitialized value
protected $case_sensitive = false; protected $case_sensitive = false;
public function __construct() {} public function __construct() {}
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
if ($this->valid_values === false) $this->valid_values = $config->get('Attr', 'AllowedFrameTargets'); if ($this->valid_values === false) $this->valid_values = $config->get('Attr', 'AllowedFrameTargets');
return parent::validate($string, $config, $context); return parent::validate($string, $config, $context);
} }
} }

28
library/HTMLPurifier/AttrDef/HTML/ID.php
View File

@@ -11,18 +11,18 @@
class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
{ {
// ref functionality disabled, since we also have to verify // ref functionality disabled, since we also have to verify
// whether or not the ID it refers to exists // whether or not the ID it refers to exists
public function validate($id, $config, $context) { public function validate($id, $config, $context) {
if (!$config->get('Attr', 'EnableID')) return false; if (!$config->get('Attr', 'EnableID')) return false;
$id = trim($id); // trim it first $id = trim($id); // trim it first
if ($id === '') return false; if ($id === '') return false;
$prefix = $config->get('Attr', 'IDPrefix'); $prefix = $config->get('Attr', 'IDPrefix');
if ($prefix !== '') { if ($prefix !== '') {
$prefix .= $config->get('Attr', 'IDPrefixLocal'); $prefix .= $config->get('Attr', 'IDPrefixLocal');
@@ -32,14 +32,14 @@ class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
trigger_error('%Attr.IDPrefixLocal cannot be used unless '. trigger_error('%Attr.IDPrefixLocal cannot be used unless '.
'%Attr.IDPrefix is set', E_USER_WARNING); '%Attr.IDPrefix is set', E_USER_WARNING);
} }
//if (!$this->ref) { //if (!$this->ref) {
$id_accumulator =& $context->get('IDAccumulator'); $id_accumulator =& $context->get('IDAccumulator');
if (isset($id_accumulator->ids[$id])) return false; if (isset($id_accumulator->ids[$id])) return false;
//} //}
// we purposely avoid using regex, hopefully this is faster // we purposely avoid using regex, hopefully this is faster
if (ctype_alpha($id)) { if (ctype_alpha($id)) {
$result = true; $result = true;
} else { } else {
@@ -50,20 +50,20 @@ class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
); );
$result = ($trim === ''); $result = ($trim === '');
} }
$regexp = $config->get('Attr', 'IDBlacklistRegexp'); $regexp = $config->get('Attr', 'IDBlacklistRegexp');
if ($regexp && preg_match($regexp, $id)) { if ($regexp && preg_match($regexp, $id)) {
return false; return false;
} }
if (/*!$this->ref && */$result) $id_accumulator->add($id); if (/*!$this->ref && */$result) $id_accumulator->add($id);
// if no change was made to the ID, return the result // if no change was made to the ID, return the result
// else, return the new id if stripping whitespace made it // else, return the new id if stripping whitespace made it
// valid, or return false. // valid, or return false.
return $result ? $id : false; return $result ? $id : false;
} }
} }

26
library/HTMLPurifier/AttrDef/HTML/Length.php
View File

@@ -2,39 +2,39 @@
/** /**
* Validates the HTML type length (not to be confused with CSS's length). * Validates the HTML type length (not to be confused with CSS's length).
* *
* This accepts integer pixels or percentages as lengths for certain * This accepts integer pixels or percentages as lengths for certain
* HTML attributes. * HTML attributes.
*/ */
class HTMLPurifier_AttrDef_HTML_Length extends HTMLPurifier_AttrDef_HTML_Pixels class HTMLPurifier_AttrDef_HTML_Length extends HTMLPurifier_AttrDef_HTML_Pixels
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = trim($string); $string = trim($string);
if ($string === '') return false; if ($string === '') return false;
$parent_result = parent::validate($string, $config, $context); $parent_result = parent::validate($string, $config, $context);
if ($parent_result !== false) return $parent_result; if ($parent_result !== false) return $parent_result;
$length = strlen($string); $length = strlen($string);
$last_char = $string[$length - 1]; $last_char = $string[$length - 1];
if ($last_char !== '%') return false; if ($last_char !== '%') return false;
$points = substr($string, 0, $length - 1); $points = substr($string, 0, $length - 1);
if (!is_numeric($points)) return false; if (!is_numeric($points)) return false;
$points = (int) $points; $points = (int) $points;
if ($points < 0) return '0%'; if ($points < 0) return '0%';
if ($points > 100) return '100%'; if ($points > 100) return '100%';
return ((string) $points) . '%'; return ((string) $points) . '%';
} }
} }

20
library/HTMLPurifier/AttrDef/HTML/LinkTypes.php
View File

@@ -8,10 +8,10 @@
*/ */
class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
{ {
/** Name config attribute to pull. */ /** Name config attribute to pull. */
protected $name; protected $name;
public function __construct($name) { public function __construct($name) {
$configLookup = array( $configLookup = array(
'rel' => 'AllowedRel', 'rel' => 'AllowedRel',
@@ -24,15 +24,15 @@ class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
} }
$this->name = $configLookup[$name]; $this->name = $configLookup[$name];
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$allowed = $config->get('Attr', $this->name); $allowed = $config->get('Attr', $this->name);
if (empty($allowed)) return false; if (empty($allowed)) return false;
$string = $this->parseCDATA($string); $string = $this->parseCDATA($string);
$parts = explode(' ', $string); $parts = explode(' ', $string);
// lookup to prevent duplicates // lookup to prevent duplicates
$ret_lookup = array(); $ret_lookup = array();
foreach ($parts as $part) { foreach ($parts as $part) {
@@ -40,13 +40,13 @@ class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
if (!isset($allowed[$part])) continue; if (!isset($allowed[$part])) continue;
$ret_lookup[$part] = true; $ret_lookup[$part] = true;
} }
if (empty($ret_lookup)) return false; if (empty($ret_lookup)) return false;
$string = implode(' ', array_keys($ret_lookup)); $string = implode(' ', array_keys($ret_lookup));
return $string; return $string;
} }
} }

24
library/HTMLPurifier/AttrDef/HTML/MultiLength.php
View File

@@ -2,39 +2,39 @@
/** /**
* Validates a MultiLength as defined by the HTML spec. * Validates a MultiLength as defined by the HTML spec.
* *
* A multilength is either a integer (pixel count), a percentage, or * A multilength is either a integer (pixel count), a percentage, or
* a relative number. * a relative number.
*/ */
class HTMLPurifier_AttrDef_HTML_MultiLength extends HTMLPurifier_AttrDef_HTML_Length class HTMLPurifier_AttrDef_HTML_MultiLength extends HTMLPurifier_AttrDef_HTML_Length
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = trim($string); $string = trim($string);
if ($string === '') return false; if ($string === '') return false;
$parent_result = parent::validate($string, $config, $context); $parent_result = parent::validate($string, $config, $context);
if ($parent_result !== false) return $parent_result; if ($parent_result !== false) return $parent_result;
$length = strlen($string); $length = strlen($string);
$last_char = $string[$length - 1]; $last_char = $string[$length - 1];
if ($last_char !== '*') return false; if ($last_char !== '*') return false;
$int = substr($string, 0, $length - 1); $int = substr($string, 0, $length - 1);
if ($int == '') return '*'; if ($int == '') return '*';
if (!is_numeric($int)) return false; if (!is_numeric($int)) return false;
$int = (int) $int; $int = (int) $int;
if ($int < 0) return false; if ($int < 0) return false;
if ($int == 0) return '0'; if ($int == 0) return '0';
if ($int == 1) return '*'; if ($int == 1) return '*';
return ((string) $int) . '*'; return ((string) $int) . '*';
} }
} }

20
library/HTMLPurifier/AttrDef/HTML/Nmtokens.php
View File

@@ -9,17 +9,17 @@
*/ */
class HTMLPurifier_AttrDef_HTML_Nmtokens extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_HTML_Nmtokens extends HTMLPurifier_AttrDef
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = trim($string); $string = trim($string);
// early abort: '' and '0' (strings that convert to false) are invalid // early abort: '' and '0' (strings that convert to false) are invalid
if (!$string) return false; if (!$string) return false;
// OPTIMIZABLE! // OPTIMIZABLE!
// do the preg_match, capture all subpatterns for reformulation // do the preg_match, capture all subpatterns for reformulation
// we don't support U+00A1 and up codepoints or // we don't support U+00A1 and up codepoints or
// escaping because I don't know how to do that with regexps // escaping because I don't know how to do that with regexps
// and plus it would complicate optimization efforts (you never // and plus it would complicate optimization efforts (you never
@@ -29,19 +29,19 @@ class HTMLPurifier_AttrDef_HTML_Nmtokens extends HTMLPurifier_AttrDef
'((?:--|-?[A-Za-z_])[A-Za-z_\-0-9]*)'. '((?:--|-?[A-Za-z_])[A-Za-z_\-0-9]*)'.
'(?:(?=\s)|\z)/'; // look ahead for space or string end '(?:(?=\s)|\z)/'; // look ahead for space or string end
preg_match_all($pattern, $string, $matches); preg_match_all($pattern, $string, $matches);
if (empty($matches[1])) return false; if (empty($matches[1])) return false;
// reconstruct string // reconstruct string
$new_string = ''; $new_string = '';
foreach ($matches[1] as $token) { foreach ($matches[1] as $token) {
$new_string .= $token . ' '; $new_string .= $token . ' ';
} }
$new_string = rtrim($new_string); $new_string = rtrim($new_string);
return $new_string; return $new_string;
} }
} }

22
library/HTMLPurifier/AttrDef/HTML/Pixels.php
View File

@@ -5,15 +5,15 @@
*/ */
class HTMLPurifier_AttrDef_HTML_Pixels extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_HTML_Pixels extends HTMLPurifier_AttrDef
{ {
protected $max; protected $max;
public function __construct($max = null) { public function __construct($max = null) {
$this->max = $max; $this->max = $max;
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = trim($string); $string = trim($string);
if ($string === '0') return $string; if ($string === '0') return $string;
if ($string === '') return false; if ($string === '') return false;
@@ -23,25 +23,25 @@ class HTMLPurifier_AttrDef_HTML_Pixels extends HTMLPurifier_AttrDef
} }
if (!is_numeric($string)) return false; if (!is_numeric($string)) return false;
$int = (int) $string; $int = (int) $string;
if ($int < 0) return '0'; if ($int < 0) return '0';
// upper-bound value, extremely high values can // upper-bound value, extremely high values can
// crash operating systems, see <http://ha.ckers.org/imagecrash.html> // crash operating systems, see <http://ha.ckers.org/imagecrash.html>
// WARNING, above link WILL crash you if you're using Windows // WARNING, above link WILL crash you if you're using Windows
if ($this->max !== null && $int > $this->max) return (string) $this->max; if ($this->max !== null && $int > $this->max) return (string) $this->max;
return (string) $int; return (string) $int;
} }
public function make($string) { public function make($string) {
if ($string === '') $max = null; if ($string === '') $max = null;
else $max = (int) $string; else $max = (int) $string;
$class = get_class($this); $class = get_class($this);
return new $class($max); return new $class($max);
} }
} }

26
library/HTMLPurifier/AttrDef/Integer.php
View File

@@ -9,22 +9,22 @@
*/ */
class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef
{ {
/** /**
* Bool indicating whether or not negative values are allowed * Bool indicating whether or not negative values are allowed
*/ */
protected $negative = true; protected $negative = true;
/** /**
* Bool indicating whether or not zero is allowed * Bool indicating whether or not zero is allowed
*/ */
protected $zero = true; protected $zero = true;
/** /**
* Bool indicating whether or not positive values are allowed * Bool indicating whether or not positive values are allowed
*/ */
protected $positive = true; protected $positive = true;
/** /**
* @param $negative Bool indicating whether or not negative values are allowed * @param $negative Bool indicating whether or not negative values are allowed
* @param $zero Bool indicating whether or not zero is allowed * @param $zero Bool indicating whether or not zero is allowed
@@ -37,15 +37,15 @@ class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef
$this->zero = $zero; $this->zero = $zero;
$this->positive = $positive; $this->positive = $positive;
} }
public function validate($integer, $config, $context) { public function validate($integer, $config, $context) {
$integer = $this->parseCDATA($integer); $integer = $this->parseCDATA($integer);
if ($integer === '') return false; if ($integer === '') return false;
// we could possibly simply typecast it to integer, but there are // we could possibly simply typecast it to integer, but there are
// certain fringe cases that must not return an integer. // certain fringe cases that must not return an integer.
// clip leading sign // clip leading sign
if ( $this->negative && $integer[0] === '-' ) { if ( $this->negative && $integer[0] === '-' ) {
$digits = substr($integer, 1); $digits = substr($integer, 1);
@@ -55,18 +55,18 @@ class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef
} else { } else {
$digits = $integer; $digits = $integer;
} }
// test if it's numeric // test if it's numeric
if (!ctype_digit($digits)) return false; if (!ctype_digit($digits)) return false;
// perform scope tests // perform scope tests
if (!$this->zero && $integer == 0) return false; if (!$this->zero && $integer == 0) return false;
if (!$this->positive && $integer > 0) return false; if (!$this->positive && $integer > 0) return false;
if (!$this->negative && $integer < 0) return false; if (!$this->negative && $integer < 0) return false;
return $integer; return $integer;
} }
} }

24
library/HTMLPurifier/AttrDef/Lang.php
View File

@@ -6,17 +6,17 @@
*/ */
class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$string = trim($string); $string = trim($string);
if (!$string) return false; if (!$string) return false;
$subtags = explode('-', $string); $subtags = explode('-', $string);
$num_subtags = count($subtags); $num_subtags = count($subtags);
if ($num_subtags == 0) return false; // sanity check if ($num_subtags == 0) return false; // sanity check
// process primary subtag : $subtags[0] // process primary subtag : $subtags[0]
$length = strlen($subtags[0]); $length = strlen($subtags[0]);
switch ($length) { switch ($length) {
@@ -38,20 +38,20 @@ class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef
default: default:
return false; return false;
} }
$new_string = $subtags[0]; $new_string = $subtags[0];
if ($num_subtags == 1) return $new_string; if ($num_subtags == 1) return $new_string;
// process second subtag : $subtags[1] // process second subtag : $subtags[1]
$length = strlen($subtags[1]); $length = strlen($subtags[1]);
if ($length == 0 || ($length == 1 && $subtags[1] != 'x') || $length > 8 || !ctype_alnum($subtags[1])) { if ($length == 0 || ($length == 1 && $subtags[1] != 'x') || $length > 8 || !ctype_alnum($subtags[1])) {
return $new_string; return $new_string;
} }
if (!ctype_lower($subtags[1])) $subtags[1] = strtolower($subtags[1]); if (!ctype_lower($subtags[1])) $subtags[1] = strtolower($subtags[1]);
$new_string .= '-' . $subtags[1]; $new_string .= '-' . $subtags[1];
if ($num_subtags == 2) return $new_string; if ($num_subtags == 2) return $new_string;
// process all other subtags, index 2 and up // process all other subtags, index 2 and up
for ($i = 2; $i < $num_subtags; $i++) { for ($i = 2; $i < $num_subtags; $i++) {
$length = strlen($subtags[$i]); $length = strlen($subtags[$i]);
@@ -63,10 +63,10 @@ class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef
} }
$new_string .= '-' . $subtags[$i]; $new_string .= '-' . $subtags[$i];
} }
return $new_string; return $new_string;
} }
} }

8
library/HTMLPurifier/AttrDef/Switch.php
View File

@@ -5,10 +5,10 @@
*/ */
class HTMLPurifier_AttrDef_Switch class HTMLPurifier_AttrDef_Switch
{ {
protected $tag; protected $tag;
protected $withTag, $withoutTag; protected $withTag, $withoutTag;
/** /**
* @param string $tag Tag name to switch upon * @param string $tag Tag name to switch upon
* @param HTMLPurifier_AttrDef $with_tag Call if token matches tag * @param HTMLPurifier_AttrDef $with_tag Call if token matches tag
@@ -19,7 +19,7 @@ class HTMLPurifier_AttrDef_Switch
$this->withTag = $with_tag; $this->withTag = $with_tag;
$this->withoutTag = $without_tag; $this->withoutTag = $without_tag;
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$token = $context->get('CurrentToken', true); $token = $context->get('CurrentToken', true);
if (!$token || $token->name !== $this->tag) { if (!$token || $token->name !== $this->tag) {
@@ -28,5 +28,5 @@ class HTMLPurifier_AttrDef_Switch
return $this->withTag->validate($string, $config, $context); return $this->withTag->validate($string, $config, $context);
} }
} }
} }

4
library/HTMLPurifier/AttrDef/Text.php
View File

@@ -5,10 +5,10 @@
*/ */
class HTMLPurifier_AttrDef_Text extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_Text extends HTMLPurifier_AttrDef
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
return $this->parseCDATA($string); return $this->parseCDATA($string);
} }
} }

42
library/HTMLPurifier/AttrDef/URI.php
View File

@@ -6,10 +6,10 @@
*/ */
class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
{ {
protected $parser; protected $parser;
protected $embedsResource; protected $embedsResource;
/** /**
* @param $embeds_resource_resource Does the URI here result in an extra HTTP request? * @param $embeds_resource_resource Does the URI here result in an extra HTTP request?
*/ */
@@ -17,61 +17,61 @@ class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
$this->parser = new HTMLPurifier_URIParser(); $this->parser = new HTMLPurifier_URIParser();
$this->embedsResource = (bool) $embeds_resource; $this->embedsResource = (bool) $embeds_resource;
} }
public function make($string) { public function make($string) {
$embeds = (bool) $string; $embeds = (bool) $string;
return new HTMLPurifier_AttrDef_URI($embeds); return new HTMLPurifier_AttrDef_URI($embeds);
} }
public function validate($uri, $config, $context) { public function validate($uri, $config, $context) {
if ($config->get('URI', 'Disable')) return false; if ($config->get('URI', 'Disable')) return false;
$uri = $this->parseCDATA($uri); $uri = $this->parseCDATA($uri);
// parse the URI // parse the URI
$uri = $this->parser->parse($uri); $uri = $this->parser->parse($uri);
if ($uri === false) return false; if ($uri === false) return false;
// add embedded flag to context for validators // add embedded flag to context for validators
$context->register('EmbeddedURI', $this->embedsResource); $context->register('EmbeddedURI', $this->embedsResource);
$ok = false; $ok = false;
do { do {
// generic validation // generic validation
$result = $uri->validate($config, $context); $result = $uri->validate($config, $context);
if (!$result) break; if (!$result) break;
// chained filtering // chained filtering
$uri_def = $config->getDefinition('URI'); $uri_def = $config->getDefinition('URI');
$result = $uri_def->filter($uri, $config, $context); $result = $uri_def->filter($uri, $config, $context);
if (!$result) break; if (!$result) break;
// scheme-specific validation // scheme-specific validation
$scheme_obj = $uri->getSchemeObj($config, $context); $scheme_obj = $uri->getSchemeObj($config, $context);
if (!$scheme_obj) break; if (!$scheme_obj) break;
if ($this->embedsResource && !$scheme_obj->browsable) break; if ($this->embedsResource && !$scheme_obj->browsable) break;
$result = $scheme_obj->validate($uri, $config, $context); $result = $scheme_obj->validate($uri, $config, $context);
if (!$result) break; if (!$result) break;
// Post chained filtering // Post chained filtering
$result = $uri_def->postFilter($uri, $config, $context); $result = $uri_def->postFilter($uri, $config, $context);
if (!$result) break; if (!$result) break;
// survived gauntlet // survived gauntlet
$ok = true; $ok = true;
} while (false); } while (false);
$context->destroy('EmbeddedURI'); $context->destroy('EmbeddedURI');
if (!$ok) return false; if (!$ok) return false;
// back to string // back to string
return $uri->toString(); return $uri->toString();
} }
} }

4
library/HTMLPurifier/AttrDef/URI/Email.php
View File

@@ -2,14 +2,14 @@
abstract class HTMLPurifier_AttrDef_URI_Email extends HTMLPurifier_AttrDef abstract class HTMLPurifier_AttrDef_URI_Email extends HTMLPurifier_AttrDef
{ {
/** /**
* Unpacks a mailbox into its display-name and address * Unpacks a mailbox into its display-name and address
*/ */
function unpack($string) { function unpack($string) {
// needs to be implemented // needs to be implemented
} }
} }
// sub-implementations // sub-implementations

6
library/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php
View File

@@ -1,12 +1,12 @@
<?php <?php
/** /**
* Primitive email validation class based on the regexp found at * Primitive email validation class based on the regexp found at
* http://www.regular-expressions.info/email.html * http://www.regular-expressions.info/email.html
*/ */
class HTMLPurifier_AttrDef_URI_Email_SimpleCheck extends HTMLPurifier_AttrDef_URI_Email class HTMLPurifier_AttrDef_URI_Email_SimpleCheck extends HTMLPurifier_AttrDef_URI_Email
{ {
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
// no support for named mailboxes i.e. "Bob <bob@example.com>" // no support for named mailboxes i.e. "Bob <bob@example.com>"
// that needs more percent encoding to be done // that needs more percent encoding to be done
@@ -15,6 +15,6 @@ class HTMLPurifier_AttrDef_URI_Email_SimpleCheck extends HTMLPurifier_AttrDef_UR
$result = preg_match('/^[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i', $string); $result = preg_match('/^[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i', $string);
return $result ? $string : false; return $result ? $string : false;
} }
} }

22
library/HTMLPurifier/AttrDef/URI/Host.php
View File

@@ -5,22 +5,22 @@
*/ */
class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
{ {
/** /**
* Instance of HTMLPurifier_AttrDef_URI_IPv4 sub-validator * Instance of HTMLPurifier_AttrDef_URI_IPv4 sub-validator
*/ */
protected $ipv4; protected $ipv4;
/** /**
* Instance of HTMLPurifier_AttrDef_URI_IPv6 sub-validator * Instance of HTMLPurifier_AttrDef_URI_IPv6 sub-validator
*/ */
protected $ipv6; protected $ipv6;
public function __construct() { public function __construct() {
$this->ipv4 = new HTMLPurifier_AttrDef_URI_IPv4(); $this->ipv4 = new HTMLPurifier_AttrDef_URI_IPv4();
$this->ipv6 = new HTMLPurifier_AttrDef_URI_IPv6(); $this->ipv6 = new HTMLPurifier_AttrDef_URI_IPv6();
} }
public function validate($string, $config, $context) { public function validate($string, $config, $context) {
$length = strlen($string); $length = strlen($string);
if ($string === '') return ''; if ($string === '') return '';
@@ -31,17 +31,17 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
if ($valid === false) return false; if ($valid === false) return false;
return '['. $valid . ']'; return '['. $valid . ']';
} }
// need to do checks on unusual encodings too // need to do checks on unusual encodings too
$ipv4 = $this->ipv4->validate($string, $config, $context); $ipv4 = $this->ipv4->validate($string, $config, $context);
if ($ipv4 !== false) return $ipv4; if ($ipv4 !== false) return $ipv4;
// A regular domain name. // A regular domain name.
// This breaks I18N domain names, but we don't have proper IRI support, // This breaks I18N domain names, but we don't have proper IRI support,
// so force users to insert Punycode. If there's complaining we'll // so force users to insert Punycode. If there's complaining we'll
// try to fix things into an international friendly form. // try to fix things into an international friendly form.
// The productions describing this are: // The productions describing this are:
$a = '[a-z]'; // alpha $a = '[a-z]'; // alpha
$an = '[a-z0-9]'; // alphanum $an = '[a-z0-9]'; // alphanum
@@ -53,9 +53,9 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
// hostname = *( domainlabel "." ) toplabel [ "." ] // hostname = *( domainlabel "." ) toplabel [ "." ]
$match = preg_match("/^($domainlabel\.)*$toplabel\.?$/i", $string); $match = preg_match("/^($domainlabel\.)*$toplabel\.?$/i", $string);
if (!$match) return false; if (!$match) return false;
return $string; return $string;
} }
} }

16
library/HTMLPurifier/AttrDef/URI/IPv4.php
View File

@@ -6,25 +6,25 @@
*/ */
class HTMLPurifier_AttrDef_URI_IPv4 extends HTMLPurifier_AttrDef class HTMLPurifier_AttrDef_URI_IPv4 extends HTMLPurifier_AttrDef
{ {
/** /**
* IPv4 regex, protected so that IPv6 can reuse it * IPv4 regex, protected so that IPv6 can reuse it
*/ */
protected $ip4; protected $ip4;
public function validate($aIP, $config, $context) { public function validate($aIP, $config, $context) {
if (!$this->ip4) $this->_loadRegex(); if (!$this->ip4) $this->_loadRegex();
if (preg_match('#^' . $this->ip4 . '$#s', $aIP)) if (preg_match('#^' . $this->ip4 . '$#s', $aIP))
{ {
return $aIP; return $aIP;
} }
return false; return false;
} }
/** /**
* Lazy load function to prevent regex from being stuffed in * Lazy load function to prevent regex from being stuffed in
* cache. * cache.
@@ -33,6 +33,6 @@ class HTMLPurifier_AttrDef_URI_IPv4 extends HTMLPurifier_AttrDef
$oct = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])'; // 0-255 $oct = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])'; // 0-255
$this->ip4 = "(?:{$oct}\\.{$oct}\\.{$oct}\\.{$oct})"; $this->ip4 = "(?:{$oct}\\.{$oct}\\.{$oct}\\.{$oct})";
} }
} }

30
library/HTMLPurifier/AttrDef/URI/IPv6.php
View File

@@ -8,17 +8,17 @@
*/ */
class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4 class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
{ {
public function validate($aIP, $config, $context) { public function validate($aIP, $config, $context) {
if (!$this->ip4) $this->_loadRegex(); if (!$this->ip4) $this->_loadRegex();
$original = $aIP; $original = $aIP;
$hex = '[0-9a-fA-F]'; $hex = '[0-9a-fA-F]';
$blk = '(?:' . $hex . '{1,4})'; $blk = '(?:' . $hex . '{1,4})';
$pre = '(?:/(?:12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))'; // /0 - /128 $pre = '(?:/(?:12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))'; // /0 - /128
// prefix check // prefix check
if (strpos($aIP, '/') !== false) if (strpos($aIP, '/') !== false)
{ {
@@ -32,8 +32,8 @@ class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
return false; return false;
} }
} }
// IPv4-compatiblity check // IPv4-compatiblity check
if (preg_match('#(?<=:'.')' . $this->ip4 . '$#s', $aIP, $find)) if (preg_match('#(?<=:'.')' . $this->ip4 . '$#s', $aIP, $find))
{ {
$aIP = substr($aIP, 0, 0-strlen($find[0])); $aIP = substr($aIP, 0, 0-strlen($find[0]));
@@ -42,7 +42,7 @@ class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
$aIP .= $ip[0] . $ip[1] . ':' . $ip[2] . $ip[3]; $aIP .= $ip[0] . $ip[1] . ':' . $ip[2] . $ip[3];
unset($find, $ip); unset($find, $ip);
} }
// compression check // compression check
$aIP = explode('::', $aIP); $aIP = explode('::', $aIP);
$c = count($aIP); $c = count($aIP);
@@ -55,12 +55,12 @@ class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
list($first, $second) = $aIP; list($first, $second) = $aIP;
$first = explode(':', $first); $first = explode(':', $first);
$second = explode(':', $second); $second = explode(':', $second);
if (count($first) + count($second) > 8) if (count($first) + count($second) > 8)
{ {
return false; return false;
} }
while(count($first) < 8) while(count($first) < 8)
{ {
array_push($first, '0'); array_push($first, '0');
@@ -75,12 +75,12 @@ class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
$aIP = explode(':', $aIP[0]); $aIP = explode(':', $aIP[0]);
} }
$c = count($aIP); $c = count($aIP);
if ($c != 8) if ($c != 8)
{ {
return false; return false;
} }
// All the pieces should be 16-bit hex strings. Are they? // All the pieces should be 16-bit hex strings. Are they?
foreach ($aIP as $piece) foreach ($aIP as $piece)
{ {
@@ -89,10 +89,10 @@ class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
return false; return false;
} }
} }
return $original; return $original;
} }
} }

14
library/HTMLPurifier/AttrTransform.php
View File

@@ -2,13 +2,13 @@
/** /**
* Processes an entire attribute array for corrections needing multiple values. * Processes an entire attribute array for corrections needing multiple values.
* *
* Occasionally, a certain attribute will need to be removed and popped onto * Occasionally, a certain attribute will need to be removed and popped onto
* another value. Instead of creating a complex return syntax for * another value. Instead of creating a complex return syntax for
* HTMLPurifier_AttrDef, we just pass the whole attribute array to a * HTMLPurifier_AttrDef, we just pass the whole attribute array to a
* specialized object and have that do the special work. That is the * specialized object and have that do the special work. That is the
* family of HTMLPurifier_AttrTransform. * family of HTMLPurifier_AttrTransform.
* *
* An attribute transformation can be assigned to run before or after * An attribute transformation can be assigned to run before or after
* HTMLPurifier_AttrDef validation. See HTMLPurifier_HTMLDefinition for * HTMLPurifier_AttrDef validation. See HTMLPurifier_HTMLDefinition for
* more details. * more details.
@@ -16,10 +16,10 @@
abstract class HTMLPurifier_AttrTransform abstract class HTMLPurifier_AttrTransform
{ {
/** /**
* Abstract: makes changes to the attributes dependent on multiple values. * Abstract: makes changes to the attributes dependent on multiple values.
* *
* @param $attr Assoc array of attributes, usually from * @param $attr Assoc array of attributes, usually from
* HTMLPurifier_Token_Tag::$attr * HTMLPurifier_Token_Tag::$attr
* @param $config Mandatory HTMLPurifier_Config object. * @param $config Mandatory HTMLPurifier_Config object.
@@ -27,7 +27,7 @@ abstract class HTMLPurifier_AttrTransform
* @returns Processed attribute array. * @returns Processed attribute array.
*/ */
abstract public function transform($attr, $config, $context); abstract public function transform($attr, $config, $context);
/** /**
* Prepends CSS properties to the style attribute, creating the * Prepends CSS properties to the style attribute, creating the
* attribute if it doesn't exist. * attribute if it doesn't exist.
@@ -38,7 +38,7 @@ abstract class HTMLPurifier_AttrTransform
$attr['style'] = isset($attr['style']) ? $attr['style'] : ''; $attr['style'] = isset($attr['style']) ? $attr['style'] : '';
$attr['style'] = $css . $attr['style']; $attr['style'] = $css . $attr['style'];
} }
/** /**
* Retrieves and removes an attribute * Retrieves and removes an attribute
* @param $attr Attribute array to process (passed by reference) * @param $attr Attribute array to process (passed by reference)
@@ -50,6 +50,6 @@ abstract class HTMLPurifier_AttrTransform
unset($attr[$key]); unset($attr[$key]);
return $value; return $value;
} }
} }

12
library/HTMLPurifier/AttrTransform/Background.php
View File

@@ -6,17 +6,17 @@
class HTMLPurifier_AttrTransform_Background extends HTMLPurifier_AttrTransform { class HTMLPurifier_AttrTransform_Background extends HTMLPurifier_AttrTransform {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr['background'])) return $attr; if (!isset($attr['background'])) return $attr;
$background = $this->confiscateAttr($attr, 'background'); $background = $this->confiscateAttr($attr, 'background');
// some validation should happen here // some validation should happen here
$this->prependCSS($attr, "background-image:url($background);"); $this->prependCSS($attr, "background-image:url($background);");
return $attr; return $attr;
} }
} }

4
library/HTMLPurifier/AttrTransform/BdoDir.php
View File

@@ -7,12 +7,12 @@
*/ */
class HTMLPurifier_AttrTransform_BdoDir extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_BdoDir extends HTMLPurifier_AttrTransform
{ {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (isset($attr['dir'])) return $attr; if (isset($attr['dir'])) return $attr;
$attr['dir'] = $config->get('Attr', 'DefaultTextDir'); $attr['dir'] = $config->get('Attr', 'DefaultTextDir');
return $attr; return $attr;
} }
} }

12
library/HTMLPurifier/AttrTransform/BgColor.php
View File

@@ -6,17 +6,17 @@
class HTMLPurifier_AttrTransform_BgColor extends HTMLPurifier_AttrTransform { class HTMLPurifier_AttrTransform_BgColor extends HTMLPurifier_AttrTransform {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr['bgcolor'])) return $attr; if (!isset($attr['bgcolor'])) return $attr;
$bgcolor = $this->confiscateAttr($attr, 'bgcolor'); $bgcolor = $this->confiscateAttr($attr, 'bgcolor');
// some validation should happen here // some validation should happen here
$this->prependCSS($attr, "background-color:$bgcolor;"); $this->prependCSS($attr, "background-color:$bgcolor;");
return $attr; return $attr;
} }
} }

10
library/HTMLPurifier/AttrTransform/BoolToCSS.php
View File

@@ -4,17 +4,17 @@
* Pre-transform that changes converts a boolean attribute to fixed CSS * Pre-transform that changes converts a boolean attribute to fixed CSS
*/ */
class HTMLPurifier_AttrTransform_BoolToCSS extends HTMLPurifier_AttrTransform { class HTMLPurifier_AttrTransform_BoolToCSS extends HTMLPurifier_AttrTransform {
/** /**
* Name of boolean attribute that is trigger * Name of boolean attribute that is trigger
*/ */
protected $attr; protected $attr;
/** /**
* CSS declarations to add to style, needs trailing semicolon * CSS declarations to add to style, needs trailing semicolon
*/ */
protected $css; protected $css;
/** /**
* @param $attr string attribute name to convert from * @param $attr string attribute name to convert from
* @param $css string CSS declarations to add to style (needs semicolon) * @param $css string CSS declarations to add to style (needs semicolon)
@@ -23,13 +23,13 @@ class HTMLPurifier_AttrTransform_BoolToCSS extends HTMLPurifier_AttrTransform {
$this->attr = $attr; $this->attr = $attr;
$this->css = $css; $this->css = $css;
} }
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr[$this->attr])) return $attr; if (!isset($attr[$this->attr])) return $attr;
unset($attr[$this->attr]); unset($attr[$this->attr]);
$this->prependCSS($attr, $this->css); $this->prependCSS($attr, $this->css);
return $attr; return $attr;
} }
} }

2
library/HTMLPurifier/AttrTransform/Border.php
View File

@@ -12,6 +12,6 @@ class HTMLPurifier_AttrTransform_Border extends HTMLPurifier_AttrTransform {
$this->prependCSS($attr, "border:{$border_width}px solid;"); $this->prependCSS($attr, "border:{$border_width}px solid;");
return $attr; return $attr;
} }
} }

26
library/HTMLPurifier/AttrTransform/EnumToCSS.php
View File

@@ -5,24 +5,24 @@
* values (enumerated) to CSS. * values (enumerated) to CSS.
*/ */
class HTMLPurifier_AttrTransform_EnumToCSS extends HTMLPurifier_AttrTransform { class HTMLPurifier_AttrTransform_EnumToCSS extends HTMLPurifier_AttrTransform {
/** /**
* Name of attribute to transform from * Name of attribute to transform from
*/ */
protected $attr; protected $attr;
/** /**
* Lookup array of attribute values to CSS * Lookup array of attribute values to CSS
*/ */
protected $enumToCSS = array(); protected $enumToCSS = array();
/** /**
* Case sensitivity of the matching * Case sensitivity of the matching
* @warning Currently can only be guaranteed to work with ASCII * @warning Currently can only be guaranteed to work with ASCII
* values. * values.
*/ */
protected $caseSensitive = false; protected $caseSensitive = false;
/** /**
* @param $attr String attribute name to transform from * @param $attr String attribute name to transform from
* @param $enumToCSS Lookup array of attribute values to CSS * @param $enumToCSS Lookup array of attribute values to CSS
@@ -33,25 +33,25 @@ class HTMLPurifier_AttrTransform_EnumToCSS extends HTMLPurifier_AttrTransform {
$this->enumToCSS = $enum_to_css; $this->enumToCSS = $enum_to_css;
$this->caseSensitive = (bool) $case_sensitive; $this->caseSensitive = (bool) $case_sensitive;
} }
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr[$this->attr])) return $attr; if (!isset($attr[$this->attr])) return $attr;
$value = trim($attr[$this->attr]); $value = trim($attr[$this->attr]);
unset($attr[$this->attr]); unset($attr[$this->attr]);
if (!$this->caseSensitive) $value = strtolower($value); if (!$this->caseSensitive) $value = strtolower($value);
if (!isset($this->enumToCSS[$value])) { if (!isset($this->enumToCSS[$value])) {
return $attr; return $attr;
} }
$this->prependCSS($attr, $this->enumToCSS[$value]); $this->prependCSS($attr, $this->enumToCSS[$value]);
return $attr; return $attr;
} }
} }

12
library/HTMLPurifier/AttrTransform/ImgRequired.php
View File

@@ -10,16 +10,16 @@
*/ */
class HTMLPurifier_AttrTransform_ImgRequired extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_ImgRequired extends HTMLPurifier_AttrTransform
{ {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
$src = true; $src = true;
if (!isset($attr['src'])) { if (!isset($attr['src'])) {
if ($config->get('Core', 'RemoveInvalidImg')) return $attr; if ($config->get('Core', 'RemoveInvalidImg')) return $attr;
$attr['src'] = $config->get('Attr', 'DefaultInvalidImage'); $attr['src'] = $config->get('Attr', 'DefaultInvalidImage');
$src = false; $src = false;
} }
if (!isset($attr['alt'])) { if (!isset($attr['alt'])) {
if ($src) { if ($src) {
$alt = $config->get('Attr', 'DefaultImageAlt'); $alt = $config->get('Attr', 'DefaultImageAlt');
@@ -32,10 +32,10 @@ class HTMLPurifier_AttrTransform_ImgRequired extends HTMLPurifier_AttrTransform
$attr['alt'] = $config->get('Attr', 'DefaultInvalidImageAlt'); $attr['alt'] = $config->get('Attr', 'DefaultInvalidImageAlt');
} }
} }
return $attr; return $attr;
} }
} }

22
library/HTMLPurifier/AttrTransform/ImgSpace.php
View File

@@ -4,40 +4,40 @@
* Pre-transform that changes deprecated hspace and vspace attributes to CSS * Pre-transform that changes deprecated hspace and vspace attributes to CSS
*/ */
class HTMLPurifier_AttrTransform_ImgSpace extends HTMLPurifier_AttrTransform { class HTMLPurifier_AttrTransform_ImgSpace extends HTMLPurifier_AttrTransform {
protected $attr; protected $attr;
protected $css = array( protected $css = array(
'hspace' => array('left', 'right'), 'hspace' => array('left', 'right'),
'vspace' => array('top', 'bottom') 'vspace' => array('top', 'bottom')
); );
public function __construct($attr) { public function __construct($attr) {
$this->attr = $attr; $this->attr = $attr;
if (!isset($this->css[$attr])) { if (!isset($this->css[$attr])) {
trigger_error(htmlspecialchars($attr) . ' is not valid space attribute'); trigger_error(htmlspecialchars($attr) . ' is not valid space attribute');
} }
} }
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr[$this->attr])) return $attr; if (!isset($attr[$this->attr])) return $attr;
$width = $this->confiscateAttr($attr, $this->attr); $width = $this->confiscateAttr($attr, $this->attr);
// some validation could happen here // some validation could happen here
if (!isset($this->css[$this->attr])) return $attr; if (!isset($this->css[$this->attr])) return $attr;
$style = ''; $style = '';
foreach ($this->css[$this->attr] as $suffix) { foreach ($this->css[$this->attr] as $suffix) {
$property = "margin-$suffix"; $property = "margin-$suffix";
$style .= "$property:{$width}px;"; $style .= "$property:{$width}px;";
} }
$this->prependCSS($attr, $style); $this->prependCSS($attr, $style);
return $attr; return $attr;
} }
} }

8
library/HTMLPurifier/AttrTransform/Input.php
View File

@@ -5,13 +5,13 @@
* input elements. This is meant to be a post-transform. * input elements. This is meant to be a post-transform.
*/ */
class HTMLPurifier_AttrTransform_Input extends HTMLPurifier_AttrTransform { class HTMLPurifier_AttrTransform_Input extends HTMLPurifier_AttrTransform {
protected $pixels; protected $pixels;
public function __construct() { public function __construct() {
$this->pixels = new HTMLPurifier_AttrDef_HTML_Pixels(); $this->pixels = new HTMLPurifier_AttrDef_HTML_Pixels();
} }
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr['type'])) $t = 'text'; if (!isset($attr['type'])) $t = 'text';
else $t = strtolower($attr['type']); else $t = strtolower($attr['type']);
@@ -34,6 +34,6 @@ class HTMLPurifier_AttrTransform_Input extends HTMLPurifier_AttrTransform {
} }
return $attr; return $attr;
} }
} }

12
library/HTMLPurifier/AttrTransform/Lang.php
View File

@@ -7,21 +7,21 @@
*/ */
class HTMLPurifier_AttrTransform_Lang extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_Lang extends HTMLPurifier_AttrTransform
{ {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
$lang = isset($attr['lang']) ? $attr['lang'] : false; $lang = isset($attr['lang']) ? $attr['lang'] : false;
$xml_lang = isset($attr['xml:lang']) ? $attr['xml:lang'] : false; $xml_lang = isset($attr['xml:lang']) ? $attr['xml:lang'] : false;
if ($lang !== false && $xml_lang === false) { if ($lang !== false && $xml_lang === false) {
$attr['xml:lang'] = $lang; $attr['xml:lang'] = $lang;
} elseif ($xml_lang !== false) { } elseif ($xml_lang !== false) {
$attr['lang'] = $xml_lang; $attr['lang'] = $xml_lang;
} }
return $attr; return $attr;
} }
} }

8
library/HTMLPurifier/AttrTransform/Length.php
View File

@@ -5,15 +5,15 @@
*/ */
class HTMLPurifier_AttrTransform_Length extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_Length extends HTMLPurifier_AttrTransform
{ {
protected $name; protected $name;
protected $cssName; protected $cssName;
public function __construct($name, $css_name = null) { public function __construct($name, $css_name = null) {
$this->name = $name; $this->name = $name;
$this->cssName = $css_name ? $css_name : $name; $this->cssName = $css_name ? $css_name : $name;
} }
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr[$this->name])) return $attr; if (!isset($attr[$this->name])) return $attr;
$length = $this->confiscateAttr($attr, $this->name); $length = $this->confiscateAttr($attr, $this->name);
@@ -21,6 +21,6 @@ class HTMLPurifier_AttrTransform_Length extends HTMLPurifier_AttrTransform
$this->prependCSS($attr, $this->cssName . ":$length;"); $this->prependCSS($attr, $this->cssName . ":$length;");
return $attr; return $attr;
} }
} }

4
library/HTMLPurifier/AttrTransform/Name.php
View File

@@ -5,7 +5,7 @@
*/ */
class HTMLPurifier_AttrTransform_Name extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_Name extends HTMLPurifier_AttrTransform
{ {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
if (!isset($attr['name'])) return $attr; if (!isset($attr['name'])) return $attr;
$id = $this->confiscateAttr($attr, 'name'); $id = $this->confiscateAttr($attr, 'name');
@@ -13,6 +13,6 @@ class HTMLPurifier_AttrTransform_Name extends HTMLPurifier_AttrTransform
$attr['id'] = $id; $attr['id'] = $id;
return $attr; return $attr;
} }
} }

2
library/HTMLPurifier/AttrTransform/SafeEmbed.php
View File

@@ -1,6 +1,6 @@
<?php <?php
class HTMLPurifier_AttrTransform_SafeEmbed extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_SafeEmbed extends HTMLPurifier_AttrTransform
{ {
public $name = "SafeEmbed"; public $name = "SafeEmbed";

10
library/HTMLPurifier/AttrTransform/SafeParam.php
View File

@@ -4,23 +4,23 @@
* Validates name/value pairs in param tags to be used in safe objects. This * Validates name/value pairs in param tags to be used in safe objects. This
* will only allow name values it recognizes, and pre-fill certain attributes * will only allow name values it recognizes, and pre-fill certain attributes
* with required values. * with required values.
* *
* @note * @note
* This class only supports Flash. In the future, Quicktime support * This class only supports Flash. In the future, Quicktime support
* may be added. * may be added.
* *
* @warning * @warning
* This class expects an injector to add the necessary parameters tags. * This class expects an injector to add the necessary parameters tags.
*/ */
class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
{ {
public $name = "SafeParam"; public $name = "SafeParam";
private $uri; private $uri;
public function __construct() { public function __construct() {
$this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded $this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded
} }
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
// If we add support for other objects, we'll need to alter the // If we add support for other objects, we'll need to alter the
// transforms. // transforms.

4
library/HTMLPurifier/AttrTransform/Textarea.php
View File

@@ -5,12 +5,12 @@
*/ */
class HTMLPurifier_AttrTransform_Textarea extends HTMLPurifier_AttrTransform class HTMLPurifier_AttrTransform_Textarea extends HTMLPurifier_AttrTransform
{ {
public function transform($attr, $config, $context) { public function transform($attr, $config, $context) {
// Calculated from Firefox // Calculated from Firefox
if (!isset($attr['cols'])) $attr['cols'] = '22'; if (!isset($attr['cols'])) $attr['cols'] = '22';
if (!isset($attr['rows'])) $attr['rows'] = '3'; if (!isset($attr['rows'])) $attr['rows'] = '3';
return $attr; return $attr;
} }
} }

20
library/HTMLPurifier/AttrTypes.php
View File

@@ -9,7 +9,7 @@ class HTMLPurifier_AttrTypes
* Lookup array of attribute string identifiers to concrete implementations * Lookup array of attribute string identifiers to concrete implementations
*/ */
protected $info = array(); protected $info = array();
/** /**
* Constructs the info array, supplying default implementations for attribute * Constructs the info array, supplying default implementations for attribute
* types. * types.
@@ -18,7 +18,7 @@ class HTMLPurifier_AttrTypes
// pseudo-types, must be instantiated via shorthand // pseudo-types, must be instantiated via shorthand
$this->info['Enum'] = new HTMLPurifier_AttrDef_Enum(); $this->info['Enum'] = new HTMLPurifier_AttrDef_Enum();
$this->info['Bool'] = new HTMLPurifier_AttrDef_HTML_Bool(); $this->info['Bool'] = new HTMLPurifier_AttrDef_HTML_Bool();
$this->info['CDATA'] = new HTMLPurifier_AttrDef_Text(); $this->info['CDATA'] = new HTMLPurifier_AttrDef_Text();
$this->info['ID'] = new HTMLPurifier_AttrDef_HTML_ID(); $this->info['ID'] = new HTMLPurifier_AttrDef_HTML_ID();
$this->info['Length'] = new HTMLPurifier_AttrDef_HTML_Length(); $this->info['Length'] = new HTMLPurifier_AttrDef_HTML_Length();
@@ -29,38 +29,38 @@ class HTMLPurifier_AttrTypes
$this->info['URI'] = new HTMLPurifier_AttrDef_URI(); $this->info['URI'] = new HTMLPurifier_AttrDef_URI();
$this->info['LanguageCode'] = new HTMLPurifier_AttrDef_Lang(); $this->info['LanguageCode'] = new HTMLPurifier_AttrDef_Lang();
$this->info['Color'] = new HTMLPurifier_AttrDef_HTML_Color(); $this->info['Color'] = new HTMLPurifier_AttrDef_HTML_Color();
// unimplemented aliases // unimplemented aliases
$this->info['ContentType'] = new HTMLPurifier_AttrDef_Text(); $this->info['ContentType'] = new HTMLPurifier_AttrDef_Text();
$this->info['ContentTypes'] = new HTMLPurifier_AttrDef_Text(); $this->info['ContentTypes'] = new HTMLPurifier_AttrDef_Text();
$this->info['Charsets'] = new HTMLPurifier_AttrDef_Text(); $this->info['Charsets'] = new HTMLPurifier_AttrDef_Text();
$this->info['Character'] = new HTMLPurifier_AttrDef_Text(); $this->info['Character'] = new HTMLPurifier_AttrDef_Text();
// number is really a positive integer (one or more digits) // number is really a positive integer (one or more digits)
// FIXME: ^^ not always, see start and value of list items // FIXME: ^^ not always, see start and value of list items
$this->info['Number'] = new HTMLPurifier_AttrDef_Integer(false, false, true); $this->info['Number'] = new HTMLPurifier_AttrDef_Integer(false, false, true);
} }
/** /**
* Retrieves a type * Retrieves a type
* @param $type String type name * @param $type String type name
* @return Object AttrDef for type * @return Object AttrDef for type
*/ */
public function get($type) { public function get($type) {
// determine if there is any extra info tacked on // determine if there is any extra info tacked on
if (strpos($type, '#') !== false) list($type, $string) = explode('#', $type, 2); if (strpos($type, '#') !== false) list($type, $string) = explode('#', $type, 2);
else $string = ''; else $string = '';
if (!isset($this->info[$type])) { if (!isset($this->info[$type])) {
trigger_error('Cannot retrieve undefined attribute type ' . $type, E_USER_ERROR); trigger_error('Cannot retrieve undefined attribute type ' . $type, E_USER_ERROR);
return; return;
} }
return $this->info[$type]->make($string); return $this->info[$type]->make($string);
} }
/** /**
* Sets a new implementation for a type * Sets a new implementation for a type
* @param $type String type name * @param $type String type name

52
library/HTMLPurifier/AttrValidator.php
View File

@@ -7,7 +7,7 @@
*/ */
class HTMLPurifier_AttrValidator class HTMLPurifier_AttrValidator
{ {
/** /**
* Validates the attributes of a token, returning a modified token * Validates the attributes of a token, returning a modified token
* that has valid tokens * that has valid tokens
@@ -19,33 +19,33 @@ class HTMLPurifier_AttrValidator
* @param $context Instance of HTMLPurifier_Context * @param $context Instance of HTMLPurifier_Context
*/ */
public function validateToken(&$token, &$config, $context) { public function validateToken(&$token, &$config, $context) {
$definition = $config->getHTMLDefinition(); $definition = $config->getHTMLDefinition();
$e =& $context->get('ErrorCollector', true); $e =& $context->get('ErrorCollector', true);
// initialize IDAccumulator if necessary // initialize IDAccumulator if necessary
$ok =& $context->get('IDAccumulator', true); $ok =& $context->get('IDAccumulator', true);
if (!$ok) { if (!$ok) {
$id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context); $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
$context->register('IDAccumulator', $id_accumulator); $context->register('IDAccumulator', $id_accumulator);
} }
// initialize CurrentToken if necessary // initialize CurrentToken if necessary
$current_token =& $context->get('CurrentToken', true); $current_token =& $context->get('CurrentToken', true);
if (!$current_token) $context->register('CurrentToken', $token); if (!$current_token) $context->register('CurrentToken', $token);
if ( if (
!$token instanceof HTMLPurifier_Token_Start && !$token instanceof HTMLPurifier_Token_Start &&
!$token instanceof HTMLPurifier_Token_Empty !$token instanceof HTMLPurifier_Token_Empty
) return $token; ) return $token;
// create alias to global definition array, see also $defs // create alias to global definition array, see also $defs
// DEFINITION CALL // DEFINITION CALL
$d_defs = $definition->info_global_attr; $d_defs = $definition->info_global_attr;
// don't update token until the very end, to ensure an atomic update // don't update token until the very end, to ensure an atomic update
$attr = $token->attr; $attr = $token->attr;
// do global transformations (pre) // do global transformations (pre)
// nothing currently utilizes this // nothing currently utilizes this
foreach ($definition->info_attr_transform_pre as $transform) { foreach ($definition->info_attr_transform_pre as $transform) {
@@ -54,7 +54,7 @@ class HTMLPurifier_AttrValidator
if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
} }
} }
// do local transformations only applicable to this element (pre) // do local transformations only applicable to this element (pre)
// ex. <p align="right"> to <p style="text-align:right;"> // ex. <p align="right"> to <p style="text-align:right;">
foreach ($definition->info[$token->name]->attr_transform_pre as $transform) { foreach ($definition->info[$token->name]->attr_transform_pre as $transform) {
@@ -63,19 +63,19 @@ class HTMLPurifier_AttrValidator
if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
} }
} }
// create alias to this element's attribute definition array, see // create alias to this element's attribute definition array, see
// also $d_defs (global attribute definition array) // also $d_defs (global attribute definition array)
// DEFINITION CALL // DEFINITION CALL
$defs = $definition->info[$token->name]->attr; $defs = $definition->info[$token->name]->attr;
$attr_key = false; $attr_key = false;
$context->register('CurrentAttr', $attr_key); $context->register('CurrentAttr', $attr_key);
// iterate through all the attribute keypairs // iterate through all the attribute keypairs
// Watch out for name collisions: $key has previously been used // Watch out for name collisions: $key has previously been used
foreach ($attr as $attr_key => $value) { foreach ($attr as $attr_key => $value) {
// call the definition // call the definition
if ( isset($defs[$attr_key]) ) { if ( isset($defs[$attr_key]) ) {
// there is a local definition defined // there is a local definition defined
@@ -102,37 +102,37 @@ class HTMLPurifier_AttrValidator
// system never heard of the attribute? DELETE! // system never heard of the attribute? DELETE!
$result = false; $result = false;
} }
// put the results into effect // put the results into effect
if ($result === false || $result === null) { if ($result === false || $result === null) {
// this is a generic error message that should replaced // this is a generic error message that should replaced
// with more specific ones when possible // with more specific ones when possible
if ($e) $e->send(E_ERROR, 'AttrValidator: Attribute removed'); if ($e) $e->send(E_ERROR, 'AttrValidator: Attribute removed');
// remove the attribute // remove the attribute
unset($attr[$attr_key]); unset($attr[$attr_key]);
} elseif (is_string($result)) { } elseif (is_string($result)) {
// generally, if a substitution is happening, there // generally, if a substitution is happening, there
// was some sort of implicit correction going on. We'll // was some sort of implicit correction going on. We'll
// delegate it to the attribute classes to say exactly what. // delegate it to the attribute classes to say exactly what.
// simple substitution // simple substitution
$attr[$attr_key] = $result; $attr[$attr_key] = $result;
} else { } else {
// nothing happens // nothing happens
} }
// we'd also want slightly more complicated substitution // we'd also want slightly more complicated substitution
// involving an array as the return value, // involving an array as the return value,
// although we're not sure how colliding attributes would // although we're not sure how colliding attributes would
// resolve (certain ones would be completely overriden, // resolve (certain ones would be completely overriden,
// others would prepend themselves). // others would prepend themselves).
} }
$context->destroy('CurrentAttr'); $context->destroy('CurrentAttr');
// post transforms // post transforms
// global (error reporting untested) // global (error reporting untested)
foreach ($definition->info_attr_transform_post as $transform) { foreach ($definition->info_attr_transform_post as $transform) {
$attr = $transform->transform($o = $attr, $config, $context); $attr = $transform->transform($o = $attr, $config, $context);
@@ -140,7 +140,7 @@ class HTMLPurifier_AttrValidator
if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
} }
} }
// local (error reporting untested) // local (error reporting untested)
foreach ($definition->info[$token->name]->attr_transform_post as $transform) { foreach ($definition->info[$token->name]->attr_transform_post as $transform) {
$attr = $transform->transform($o = $attr, $config, $context); $attr = $transform->transform($o = $attr, $config, $context);
@@ -148,14 +148,14 @@ class HTMLPurifier_AttrValidator
if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
} }
} }
$token->attr = $attr; $token->attr = $attr;
// destroy CurrentToken if we made it ourselves // destroy CurrentToken if we made it ourselves
if (!$current_token) $context->destroy('CurrentToken'); if (!$current_token) $context->destroy('CurrentToken');
} }
} }

8
library/HTMLPurifier/Bootstrap.php
View File

@@ -29,7 +29,7 @@ if (!defined('PHP_EOL')) {
*/ */
class HTMLPurifier_Bootstrap class HTMLPurifier_Bootstrap
{ {
/** /**
* Autoload function for HTML Purifier * Autoload function for HTML Purifier
* @param $class Class to load * @param $class Class to load
@@ -40,7 +40,7 @@ class HTMLPurifier_Bootstrap
require HTMLPURIFIER_PREFIX . '/' . $file; require HTMLPURIFIER_PREFIX . '/' . $file;
return true; return true;
} }
/** /**
* Returns the path for a specific class. * Returns the path for a specific class.
*/ */
@@ -56,7 +56,7 @@ class HTMLPurifier_Bootstrap
if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) return false; if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) return false;
return $file; return $file;
} }
/** /**
* "Pre-registers" our autoloader on the SPL stack. * "Pre-registers" our autoloader on the SPL stack.
*/ */
@@ -92,5 +92,5 @@ class HTMLPurifier_Bootstrap
foreach ($funcs as $func) spl_autoload_register($func); foreach ($funcs as $func) spl_autoload_register($func);
} }
} }
} }

148
library/HTMLPurifier/CSSDefinition.php
View File

@@ -6,32 +6,32 @@
*/ */
class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
{ {
public $type = 'CSS'; public $type = 'CSS';
/** /**
* Assoc array of attribute name to definition object. * Assoc array of attribute name to definition object.
*/ */
public $info = array(); public $info = array();
/** /**
* Constructs the info array. The meat of this class. * Constructs the info array. The meat of this class.
*/ */
protected function doSetup($config) { protected function doSetup($config) {
$this->info['text-align'] = new HTMLPurifier_AttrDef_Enum( $this->info['text-align'] = new HTMLPurifier_AttrDef_Enum(
array('left', 'right', 'center', 'justify'), false); array('left', 'right', 'center', 'justify'), false);
$border_style = $border_style =
$this->info['border-bottom-style'] = $this->info['border-bottom-style'] =
$this->info['border-right-style'] = $this->info['border-right-style'] =
$this->info['border-left-style'] = $this->info['border-left-style'] =
$this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum( $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum(
array('none', 'hidden', 'dotted', 'dashed', 'solid', 'double', array('none', 'hidden', 'dotted', 'dashed', 'solid', 'double',
'groove', 'ridge', 'inset', 'outset'), false); 'groove', 'ridge', 'inset', 'outset'), false);
$this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style); $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style);
$this->info['clear'] = new HTMLPurifier_AttrDef_Enum( $this->info['clear'] = new HTMLPurifier_AttrDef_Enum(
array('none', 'left', 'right', 'both'), false); array('none', 'left', 'right', 'both'), false);
$this->info['float'] = new HTMLPurifier_AttrDef_Enum( $this->info['float'] = new HTMLPurifier_AttrDef_Enum(
@@ -40,27 +40,27 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
array('normal', 'italic', 'oblique'), false); array('normal', 'italic', 'oblique'), false);
$this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum( $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum(
array('normal', 'small-caps'), false); array('normal', 'small-caps'), false);
$uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite( $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite(
array( array(
new HTMLPurifier_AttrDef_Enum(array('none')), new HTMLPurifier_AttrDef_Enum(array('none')),
new HTMLPurifier_AttrDef_CSS_URI() new HTMLPurifier_AttrDef_CSS_URI()
) )
); );
$this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum( $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum(
array('inside', 'outside'), false); array('inside', 'outside'), false);
$this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum( $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum(
array('disc', 'circle', 'square', 'decimal', 'lower-roman', array('disc', 'circle', 'square', 'decimal', 'lower-roman',
'upper-roman', 'lower-alpha', 'upper-alpha', 'none'), false); 'upper-roman', 'lower-alpha', 'upper-alpha', 'none'), false);
$this->info['list-style-image'] = $uri_or_none; $this->info['list-style-image'] = $uri_or_none;
$this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config); $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config);
$this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum( $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum(
array('capitalize', 'uppercase', 'lowercase', 'none'), false); array('capitalize', 'uppercase', 'lowercase', 'none'), false);
$this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color(); $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color();
$this->info['background-image'] = $uri_or_none; $this->info['background-image'] = $uri_or_none;
$this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum( $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum(
array('repeat', 'repeat-x', 'repeat-y', 'no-repeat') array('repeat', 'repeat-x', 'repeat-y', 'no-repeat')
@@ -69,42 +69,42 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
array('scroll', 'fixed') array('scroll', 'fixed')
); );
$this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition(); $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition();
$border_color = $border_color =
$this->info['border-top-color'] = $this->info['border-top-color'] =
$this->info['border-bottom-color'] = $this->info['border-bottom-color'] =
$this->info['border-left-color'] = $this->info['border-left-color'] =
$this->info['border-right-color'] = $this->info['border-right-color'] =
$this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('transparent')), new HTMLPurifier_AttrDef_Enum(array('transparent')),
new HTMLPurifier_AttrDef_CSS_Color() new HTMLPurifier_AttrDef_CSS_Color()
)); ));
$this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config); $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config);
$this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color); $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color);
$border_width = $border_width =
$this->info['border-top-width'] = $this->info['border-top-width'] =
$this->info['border-bottom-width'] = $this->info['border-bottom-width'] =
$this->info['border-left-width'] = $this->info['border-left-width'] =
$this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')), new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')),
new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative
)); ));
$this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width); $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width);
$this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('normal')), new HTMLPurifier_AttrDef_Enum(array('normal')),
new HTMLPurifier_AttrDef_CSS_Length() new HTMLPurifier_AttrDef_CSS_Length()
)); ));
$this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('normal')), new HTMLPurifier_AttrDef_Enum(array('normal')),
new HTMLPurifier_AttrDef_CSS_Length() new HTMLPurifier_AttrDef_CSS_Length()
)); ));
$this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('xx-small', 'x-small', new HTMLPurifier_AttrDef_Enum(array('xx-small', 'x-small',
'small', 'medium', 'large', 'x-large', 'xx-large', 'small', 'medium', 'large', 'x-large', 'xx-large',
@@ -112,54 +112,54 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
new HTMLPurifier_AttrDef_CSS_Percentage(), new HTMLPurifier_AttrDef_CSS_Percentage(),
new HTMLPurifier_AttrDef_CSS_Length() new HTMLPurifier_AttrDef_CSS_Length()
)); ));
$this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('normal')), new HTMLPurifier_AttrDef_Enum(array('normal')),
new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives
new HTMLPurifier_AttrDef_CSS_Length('0'), new HTMLPurifier_AttrDef_CSS_Length('0'),
new HTMLPurifier_AttrDef_CSS_Percentage(true) new HTMLPurifier_AttrDef_CSS_Percentage(true)
)); ));
$margin = $margin =
$this->info['margin-top'] = $this->info['margin-top'] =
$this->info['margin-bottom'] = $this->info['margin-bottom'] =
$this->info['margin-left'] = $this->info['margin-left'] =
$this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_CSS_Length(), new HTMLPurifier_AttrDef_CSS_Length(),
new HTMLPurifier_AttrDef_CSS_Percentage(), new HTMLPurifier_AttrDef_CSS_Percentage(),
new HTMLPurifier_AttrDef_Enum(array('auto')) new HTMLPurifier_AttrDef_Enum(array('auto'))
)); ));
$this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin); $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin);
// non-negative // non-negative
$padding = $padding =
$this->info['padding-top'] = $this->info['padding-top'] =
$this->info['padding-bottom'] = $this->info['padding-bottom'] =
$this->info['padding-left'] = $this->info['padding-left'] =
$this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_CSS_Length('0'), new HTMLPurifier_AttrDef_CSS_Length('0'),
new HTMLPurifier_AttrDef_CSS_Percentage(true) new HTMLPurifier_AttrDef_CSS_Percentage(true)
)); ));
$this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding); $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding);
$this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_CSS_Length(), new HTMLPurifier_AttrDef_CSS_Length(),
new HTMLPurifier_AttrDef_CSS_Percentage() new HTMLPurifier_AttrDef_CSS_Percentage()
)); ));
$trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(array( $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_CSS_Length('0'), new HTMLPurifier_AttrDef_CSS_Length('0'),
new HTMLPurifier_AttrDef_CSS_Percentage(true), new HTMLPurifier_AttrDef_CSS_Percentage(true),
new HTMLPurifier_AttrDef_Enum(array('auto')) new HTMLPurifier_AttrDef_Enum(array('auto'))
)); ));
$max = $config->get('CSS', 'MaxImgLength'); $max = $config->get('CSS', 'MaxImgLength');
$this->info['width'] = $this->info['width'] =
$this->info['height'] = $this->info['height'] =
$max === null ? $max === null ?
$trusted_wh : $trusted_wh :
new HTMLPurifier_AttrDef_Switch('img', new HTMLPurifier_AttrDef_Switch('img',
// For img tags: // For img tags:
new HTMLPurifier_AttrDef_CSS_Composite(array( new HTMLPurifier_AttrDef_CSS_Composite(array(
@@ -169,65 +169,65 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
// For everyone else: // For everyone else:
$trusted_wh $trusted_wh
); );
$this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration(); $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();
$this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily(); $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
// this could use specialized code // this could use specialized code
$this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum( $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum(
array('normal', 'bold', 'bolder', 'lighter', '100', '200', '300', array('normal', 'bold', 'bolder', 'lighter', '100', '200', '300',
'400', '500', '600', '700', '800', '900'), false); '400', '500', '600', '700', '800', '900'), false);
// MUST be called after other font properties, as it references // MUST be called after other font properties, as it references
// a CSSDefinition object // a CSSDefinition object
$this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config); $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config);
// same here // same here
$this->info['border'] = $this->info['border'] =
$this->info['border-bottom'] = $this->info['border-bottom'] =
$this->info['border-top'] = $this->info['border-top'] =
$this->info['border-left'] = $this->info['border-left'] =
$this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config); $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config);
$this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(array( $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(array(
'collapse', 'separate')); 'collapse', 'separate'));
$this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(array( $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(array(
'top', 'bottom')); 'top', 'bottom'));
$this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(array( $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(array(
'auto', 'fixed')); 'auto', 'fixed'));
$this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(array( $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
new HTMLPurifier_AttrDef_Enum(array('baseline', 'sub', 'super', new HTMLPurifier_AttrDef_Enum(array('baseline', 'sub', 'super',
'top', 'text-top', 'middle', 'bottom', 'text-bottom')), 'top', 'text-top', 'middle', 'bottom', 'text-bottom')),
new HTMLPurifier_AttrDef_CSS_Length(), new HTMLPurifier_AttrDef_CSS_Length(),
new HTMLPurifier_AttrDef_CSS_Percentage() new HTMLPurifier_AttrDef_CSS_Percentage()
)); ));
$this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2); $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2);
// partial support // partial support
$this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(array('nowrap')); $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(array('nowrap'));
if ($config->get('CSS', 'Proprietary')) { if ($config->get('CSS', 'Proprietary')) {
$this->doSetupProprietary($config); $this->doSetupProprietary($config);
} }
if ($config->get('CSS', 'AllowTricky')) { if ($config->get('CSS', 'AllowTricky')) {
$this->doSetupTricky($config); $this->doSetupTricky($config);
} }
$allow_important = $config->get('CSS', 'AllowImportant'); $allow_important = $config->get('CSS', 'AllowImportant');
// wrap all attr-defs with decorator that handles !important // wrap all attr-defs with decorator that handles !important
foreach ($this->info as $k => $v) { foreach ($this->info as $k => $v) {
$this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important); $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important);
} }
$this->setupConfigStuff($config); $this->setupConfigStuff($config);
} }
protected function doSetupProprietary($config) { protected function doSetupProprietary($config) {
// Internet Explorer only scrollbar colors // Internet Explorer only scrollbar colors
$this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
@@ -236,17 +236,17 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
$this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color(); $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color();
$this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color(); $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color();
$this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
// technically not proprietary, but CSS3, and no one supports it // technically not proprietary, but CSS3, and no one supports it
$this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
$this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
$this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
// only opacity, for now // only opacity, for now
$this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter(); $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter();
} }
protected function doSetupTricky($config) { protected function doSetupTricky($config) {
$this->info['display'] = new HTMLPurifier_AttrDef_Enum(array( $this->info['display'] = new HTMLPurifier_AttrDef_Enum(array(
'inline', 'block', 'list-item', 'run-in', 'compact', 'inline', 'block', 'list-item', 'run-in', 'compact',
@@ -259,8 +259,8 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
)); ));
$this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(array('visible', 'hidden', 'auto', 'scroll')); $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(array('visible', 'hidden', 'auto', 'scroll'));
} }
/** /**
* Performs extra config-based processing. Based off of * Performs extra config-based processing. Based off of
* HTMLPurifier_HTMLDefinition. * HTMLPurifier_HTMLDefinition.
@@ -268,7 +268,7 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
* composition, not inheritance). * composition, not inheritance).
*/ */
protected function setupConfigStuff($config) { protected function setupConfigStuff($config) {
// setup allowed elements // setup allowed elements
$support = "(for information on implementing this, see the ". $support = "(for information on implementing this, see the ".
"support forums) "; "support forums) ";
@@ -285,7 +285,7 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING); trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING);
} }
} }
} }
} }

12
library/HTMLPurifier/ChildDef.php
View File

@@ -10,20 +10,20 @@ abstract class HTMLPurifier_ChildDef
* Used occasionally in terms of context. * Used occasionally in terms of context.
*/ */
public $type; public $type;
/** /**
* Bool that indicates whether or not an empty array of children is okay * Bool that indicates whether or not an empty array of children is okay
* *
* This is necessary for redundant checking when changes affecting * This is necessary for redundant checking when changes affecting
* a child node may cause a parent node to now be disallowed. * a child node may cause a parent node to now be disallowed.
*/ */
public $allow_empty; public $allow_empty;
/** /**
* Lookup array of all elements that this definition could possibly allow * Lookup array of all elements that this definition could possibly allow
*/ */
public $elements = array(); public $elements = array();
/** /**
* Get lookup of tag names that should not close this element automatically. * Get lookup of tag names that should not close this element automatically.
* All other elements will do so. * All other elements will do so.
@@ -31,10 +31,10 @@ abstract class HTMLPurifier_ChildDef
public function getNonAutoCloseElements($config) { public function getNonAutoCloseElements($config) {
return $this->elements; return $this->elements;
} }
/** /**
* Validates nodes according to definition and returns modification. * Validates nodes according to definition and returns modification.
* *
* @param $tokens_of_children Array of HTMLPurifier_Token * @param $tokens_of_children Array of HTMLPurifier_Token
* @param $config HTMLPurifier_Config object * @param $config HTMLPurifier_Config object
* @param $context HTMLPurifier_Context object * @param $context HTMLPurifier_Context object

Some files were not shown because too many files have changed in this diff Show More