-
Notifications
You must be signed in to change notification settings - Fork 259
/
SafeString.php
169 lines (155 loc) · 4.65 KB
/
SafeString.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
<?php defined("SYSPATH") or die("No direct script access.");
/**
* Gallery - a web based photo album viewer and editor
* Copyright (C) 2000-2009 Bharat Mediratta
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at
* your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.
*/
/**
* Safe string representation (regarding security - cross site scripting).
*/
class SafeString_Core {
private $_raw_string;
protected $_is_safe_html = false;
protected $_is_purified_html = false;
private static $_purifier = null;
/** Constructor */
function __construct($string) {
if ($string instanceof SafeString) {
$this->_is_safe_html = $string->_is_safe_html;
$this->_is_purified_html = $string->_is_purified_html;
$string = $string->unescaped();
}
$this->_raw_string = (string) $string;
}
/**
* Factory method returning a new SafeString instance for the given string.
*/
static function of($string) {
return new SafeString($string);
}
/**
* Factory method returning a new SafeString instance after HTML purifying
* the given string.
*/
static function purify($string) {
if ($string instanceof SafeString) {
$string = $string->unescaped();
}
$safe_string = self::of_safe_html(self::_purify_for_html($string));
$safe_string->_is_purified_html = true;
return $safe_string;
}
/**
* Factory method returning a new SafeString instance which won't HTML escape.
*/
static function of_safe_html($string) {
$safe_string = new SafeString($string);
$safe_string->_is_safe_html = true;
return $safe_string;
}
/**
* Safe for use in HTML.
* @see #for_html()
*/
function __toString() {
if ($this->_is_safe_html) {
return $this->_raw_string;
} else {
return self::_escape_for_html($this->_raw_string);
}
}
/**
* Safe for use in HTML.
*
* Example:<pre>
* <div><?= $php_var ?>
* </pre>
* @return the string escaped for use in HTML.
*/
function for_html() {
return $this;
}
/**
* Safe for use as JavaScript string.
*
* Example:<pre>
* <script type="text/javascript>"
* var some_js_var = <?= $php_var->for_js() ?>;
* </script>
* </pre>
* @return the string escaped for use in JavaScript.
*/
function for_js() {
return json_encode((string) $this->_raw_string);
}
/**
* Safe for use in HTML element attributes.
*
* Assumes that the HTML element attribute is already
* delimited by single or double quotes
*
* Example:<pre>
* <a title="<?= $php_var->for_html_attr() ?>">;
* </script>
* </pre>
* @return the string escaped for use in HTML attributes.
*/
function for_html_attr() {
$string = (string) $this->for_html();
return strtr($string,
array("'"=>"'",
'"'=>'"'));
}
/**
* Safe for use HTML (purified HTML)
*
* Example:<pre>
* <div><?= $php_var->purified_html() ?>
* </pre>
* @return the string escaped for use in HTML.
*/
function purified_html() {
if ($this->_is_purified_html) {
return $this;
} else {
return self::purify($this);
}
}
/**
* Returns the raw, unsafe string. Do not use lightly.
*/
function unescaped() {
return $this->_raw_string;
}
// Escapes special HTML chars ("<", ">", "&", etc.) to HTML entities.
private static function _escape_for_html($dirty_html) {
return html::specialchars($dirty_html);
}
// Purifies the string, removing any potentially malicious or unsafe HTML / JavaScript.
private static function _purify_for_html($dirty_html) {
if (empty(self::$_purifier)) {
require_once(dirname(__file__) . "/../lib/HTMLPurifier/HTMLPurifier.auto.php");
$config = HTMLPurifier_Config::createDefault();
foreach (Kohana::config('purifier') as $category => $key_value) {
foreach ($key_value as $key => $value) {
$config->set("$category.$key", $value);
}
}
self::$_purifier = new HTMLPurifier($config);
}
return self::$_purifier->purify($dirty_html);
}
}