mirror of
https://github.com/EGroupware/egroupware.git
synced 2024-11-19 06:23:12 +01:00
8f797be836
- can be used via html class like:
$clean_html = html::purify($html);
- using it now in eTemplate to remove malicious code from html:
a) when displaying "formatted text"
b) when "formatted text" get's input by the user
127 lines
3.4 KiB
PHP
Executable File
127 lines
3.4 KiB
PHP
Executable File
<?php
|
|
|
|
/* W3C says:
|
|
[ // adjective and number must be in correct order, even if
|
|
// you could switch them without introducing ambiguity.
|
|
// some browsers support that syntax
|
|
[
|
|
<percentage> | <length> | left | center | right
|
|
]
|
|
[
|
|
<percentage> | <length> | top | center | bottom
|
|
]?
|
|
] |
|
|
[ // this signifies that the vertical and horizontal adjectives
|
|
// can be arbitrarily ordered, however, there can only be two,
|
|
// one of each, or none at all
|
|
[
|
|
left | center | right
|
|
] ||
|
|
[
|
|
top | center | bottom
|
|
]
|
|
]
|
|
top, left = 0%
|
|
center, (none) = 50%
|
|
bottom, right = 100%
|
|
*/
|
|
|
|
/* QuirksMode says:
|
|
keyword + length/percentage must be ordered correctly, as per W3C
|
|
|
|
Internet Explorer and Opera, however, support arbitrary ordering. We
|
|
should fix it up.
|
|
|
|
Minor issue though, not strictly necessary.
|
|
*/
|
|
|
|
// control freaks may appreciate the ability to convert these to
|
|
// percentages or something, but it's not necessary
|
|
|
|
/**
|
|
* Validates the value of background-position.
|
|
*/
|
|
class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
|
|
{
|
|
|
|
protected $length;
|
|
protected $percentage;
|
|
|
|
public function __construct() {
|
|
$this->length = new HTMLPurifier_AttrDef_CSS_Length();
|
|
$this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage();
|
|
}
|
|
|
|
public function validate($string, $config, $context) {
|
|
$string = $this->parseCDATA($string);
|
|
$bits = explode(' ', $string);
|
|
|
|
$keywords = array();
|
|
$keywords['h'] = false; // left, right
|
|
$keywords['v'] = false; // top, bottom
|
|
$keywords['c'] = false; // center
|
|
$measures = array();
|
|
|
|
$i = 0;
|
|
|
|
$lookup = array(
|
|
'top' => 'v',
|
|
'bottom' => 'v',
|
|
'left' => 'h',
|
|
'right' => 'h',
|
|
'center' => 'c'
|
|
);
|
|
|
|
foreach ($bits as $bit) {
|
|
if ($bit === '') continue;
|
|
|
|
// test for keyword
|
|
$lbit = ctype_lower($bit) ? $bit : strtolower($bit);
|
|
if (isset($lookup[$lbit])) {
|
|
$status = $lookup[$lbit];
|
|
$keywords[$status] = $lbit;
|
|
$i++;
|
|
}
|
|
|
|
// test for length
|
|
$r = $this->length->validate($bit, $config, $context);
|
|
if ($r !== false) {
|
|
$measures[] = $r;
|
|
$i++;
|
|
}
|
|
|
|
// test for percentage
|
|
$r = $this->percentage->validate($bit, $config, $context);
|
|
if ($r !== false) {
|
|
$measures[] = $r;
|
|
$i++;
|
|
}
|
|
|
|
}
|
|
|
|
if (!$i) return false; // no valid values were caught
|
|
|
|
|
|
$ret = array();
|
|
|
|
// first keyword
|
|
if ($keywords['h']) $ret[] = $keywords['h'];
|
|
elseif (count($measures)) $ret[] = array_shift($measures);
|
|
elseif ($keywords['c']) {
|
|
$ret[] = $keywords['c'];
|
|
$keywords['c'] = false; // prevent re-use: center = center center
|
|
}
|
|
|
|
if ($keywords['v']) $ret[] = $keywords['v'];
|
|
elseif (count($measures)) $ret[] = array_shift($measures);
|
|
elseif ($keywords['c']) $ret[] = $keywords['c'];
|
|
|
|
if (empty($ret)) return false;
|
|
return implode(' ', $ret);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|