mirror of
https://github.com/EGroupware/egroupware.git
synced 2024-11-29 19:33:54 +01:00
8f797be836
- can be used via html class like:
$clean_html = html::purify($html);
- using it now in eTemplate to remove malicious code from html:
a) when displaying "formatted text"
b) when "formatted text" get's input by the user
70 lines
2.2 KiB
PHP
Executable File
70 lines
2.2 KiB
PHP
Executable File
<?php
|
|
|
|
/**
|
|
* Registry for retrieving specific URI scheme validator objects.
|
|
*/
|
|
class HTMLPurifier_URISchemeRegistry
|
|
{
|
|
|
|
/**
|
|
* Retrieve sole instance of the registry.
|
|
* @param $prototype Optional prototype to overload sole instance with,
|
|
* or bool true to reset to default registry.
|
|
* @note Pass a registry object $prototype with a compatible interface and
|
|
* the function will copy it and return it all further times.
|
|
*/
|
|
public static function instance($prototype = null) {
|
|
static $instance = null;
|
|
if ($prototype !== null) {
|
|
$instance = $prototype;
|
|
} elseif ($instance === null || $prototype == true) {
|
|
$instance = new HTMLPurifier_URISchemeRegistry();
|
|
}
|
|
return $instance;
|
|
}
|
|
|
|
/**
|
|
* Cache of retrieved schemes.
|
|
*/
|
|
protected $schemes = array();
|
|
|
|
/**
|
|
* Retrieves a scheme validator object
|
|
* @param $scheme String scheme name like http or mailto
|
|
* @param $config HTMLPurifier_Config object
|
|
* @param $config HTMLPurifier_Context object
|
|
*/
|
|
public function getScheme($scheme, $config, $context) {
|
|
if (!$config) $config = HTMLPurifier_Config::createDefault();
|
|
$null = null; // for the sake of passing by reference
|
|
|
|
// important, otherwise attacker could include arbitrary file
|
|
$allowed_schemes = $config->get('URI', 'AllowedSchemes');
|
|
if (!$config->get('URI', 'OverrideAllowedSchemes') &&
|
|
!isset($allowed_schemes[$scheme])
|
|
) {
|
|
return $null;
|
|
}
|
|
|
|
if (isset($this->schemes[$scheme])) return $this->schemes[$scheme];
|
|
if (!isset($allowed_schemes[$scheme])) return $null;
|
|
|
|
$class = 'HTMLPurifier_URIScheme_' . $scheme;
|
|
if (!class_exists($class)) return $null;
|
|
$this->schemes[$scheme] = new $class();
|
|
return $this->schemes[$scheme];
|
|
}
|
|
|
|
/**
|
|
* Registers a custom scheme to the cache, bypassing reflection.
|
|
* @param $scheme Scheme name
|
|
* @param $scheme_obj HTMLPurifier_URIScheme object
|
|
*/
|
|
public function register($scheme, $scheme_obj) {
|
|
$this->schemes[$scheme] = $scheme_obj;
|
|
}
|
|
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|