-
Notifications
You must be signed in to change notification settings - Fork 821
/
HtmlEditorSanitiser.php
304 lines (259 loc) · 9.61 KB
/
HtmlEditorSanitiser.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
<?php
/**
* Sanitises an HTMLValue so it's contents are the elements and attributes that are whitelisted
* using the same configuration as TinyMCE
*
* See www.tinymce.com/wiki.php/configuration:valid_elements for details on the spec of TinyMCE's
* whitelist configuration
*
* Class HtmlEditorSanitiser
*/
class HtmlEditorSanitiser {
/** @var [stdClass] - $element => $rule hash for whitelist element rules where the element name isn't a pattern */
protected $elements = array();
/** @var [stdClass] - Sequential list of whitelist element rules where the element name is a pattern */
protected $elementPatterns = array();
/** @var [stdClass] - The list of attributes that apply to all further whitelisted elements added */
protected $globalAttributes = array();
/**
* Construct a sanitiser from a given HtmlEditorConfig
*
* Note that we build data structures from the current state of HtmlEditorConfig - later changes to
* the passed instance won't cause this instance to update it's whitelist
*
* @param HtmlEditorConfig $config
*/
public function __construct(HtmlEditorConfig $config) {
$valid = $config->getOption('valid_elements');
if ($valid) $this->addValidElements($valid);
$valid = $config->getOption('extended_valid_elements');
if ($valid) $this->addValidElements($valid);
}
/**
* Given a TinyMCE pattern (close to unix glob style), create a regex that does the match
*
* @param $str - The TinyMCE pattern
* @return string - The equivalent regex
*/
protected function patternToRegex($str) {
return '/^' . preg_replace('/([?+*])/', '.$1', $str) . '$/';
}
/**
* Given a valid_elements string, parse out the actual element and attribute rules and add to the
* internal whitelist
*
* Logic based heavily on javascript version from tiny_mce_src.js
*
* @param string $validElements - The valid_elements or extended_valid_elements string to add to the whitelist
*/
protected function addValidElements($validElements) {
$elementRuleRegExp = '/^([#+\-])?([^\[\/]+)(?:\/([^\[]+))?(?:\[([^\]]+)\])?$/';
$attrRuleRegExp = '/^([!\-])?(\w+::\w+|[^=:<]+)?(?:([=:<])(.*))?$/';
$hasPatternsRegExp = '/[*?+]/';
foreach(explode(',', $validElements) as $validElement) {
if(preg_match($elementRuleRegExp, $validElement, $matches)) {
$prefix = @$matches[1];
$elementName = @$matches[2];
$outputName = @$matches[3];
$attrData = @$matches[4];
// Create the new element
$element = new stdClass();
$element->attributes = array();
$element->attributePatterns = array();
$element->attributesRequired = array();
$element->attributesDefault = array();
$element->attributesForced = array();
foreach(array('#' => 'paddEmpty', '-' => 'removeEmpty') as $match => $means) {
$element->$means = ($prefix === $match);
}
// Copy attributes from global rule into current rule
if($this->globalAttributes) {
$element->attributes = array_merge($element->attributes, $this->globalAttributes);
}
// Attributes defined
if($attrData) {
foreach(explode('|', $attrData) as $attr) {
if(preg_match($attrRuleRegExp, $attr, $matches)) {
$attr = new stdClass();
$attrType = @$matches[1];
$attrName = str_replace('::', ':', @$matches[2]);
$prefix = @$matches[3];
$value = @$matches[4];
// Required
if($attrType === '!') {
$element->attributesRequired[] = $attrName;
$attr->required = true;
}
// Denied from global
else if($attrType === '-') {
unset($element->attributes[$attrName]);
continue;
}
// Default value
if($prefix) {
// Default value
if($prefix === '=') {
$element->attributesDefault[$attrName] = $value;
$attr->defaultValue = $value;
}
// Forced value
else if($prefix === ':') {
$element->attributesForced[$attrName] = $value;
$attr->forcedValue = $value;
}
// Required values
else if($prefix === '<') {
$attr->validValues = explode('?', $value);
}
}
// Check for attribute patterns
if(preg_match($hasPatternsRegExp, $attrName)) {
$attr->pattern = $this->patternToRegex($attrName);
$element->attributePatterns[] = $attr;
}
else {
$element->attributes[$attrName] = $attr;
}
}
}
}
// Global rule, store away these for later usage
if(!$this->globalAttributes && $elementName == '@') {
$this->globalAttributes = $element->attributes;
}
// Handle substitute elements such as b/strong
if($outputName) {
$element->outputName = $elementName;
$this->elements[$outputName] = $element;
}
// Add pattern or exact element
if(preg_match($hasPatternsRegExp, $elementName)) {
$element->pattern = $this->patternToRegex($elementName);
$this->elementPatterns[] = $element;
}
else {
$this->elements[$elementName] = $element;
}
}
}
}
/**
* Given an element tag, return the rule structure for that element
* @param string $tag - The element tag
* @return stdClass - The element rule
*/
protected function getRuleForElement($tag) {
if(isset($this->elements[$tag])) {
return $this->elements[$tag];
}
else foreach($this->elementPatterns as $element) {
if(preg_match($element->pattern, $tag)) return $element;
}
}
/**
* Given an attribute name, return the rule structure for that attribute
* @param string $name - The attribute name
* @return stdClass - The attribute rule
*/
protected function getRuleForAttribute($elementRule, $name) {
if(isset($elementRule->attributes[$name])) {
return $elementRule->attributes[$name];
}
else foreach($elementRule->attributePatterns as $attribute) {
if(preg_match($attribute->pattern, $name)) return $attribute;
}
}
/**
* Given a DOMElement and an element rule, check if that element passes the rule
* @param DOMElement $element - the element to check
* @param stdClass $rule - the rule to check against
* @return bool - true if the element passes (and so can be kept), false if it fails (and so needs stripping)
*/
protected function elementMatchesRule($element, $rule = null) {
// If the rule doesn't exist at all, the element isn't allowed
if(!$rule) return false;
// If the rule has attributes required, check them to see if this element has at least one
if($rule->attributesRequired) {
$hasMatch = false;
foreach($rule->attributesRequired as $attr) {
if($element->getAttribute($attr)) {
$hasMatch = true;
break;
}
}
if(!$hasMatch) return false;
}
// If the rule says to remove empty elements, and this element is empty, remove it
if($rule->removeEmpty && !$element->firstChild) return false;
// No further tests required, element passes
return true;
}
/**
* Given a DOMAttr and an attribute rule, check if that attribute passes the rule
* @param DOMAttr $attr - the attribute to check
* @param stdClass $rule - the rule to check against
* @return bool - true if the attribute passes (and so can be kept), false if it fails (and so needs stripping)
*/
protected function attributeMatchesRule($attr, $rule = null) {
// If the rule doesn't exist at all, the attribute isn't allowed
if(!$rule) return false;
// If the rule has a set of valid values, check them to see if this attribute is one
if(isset($rule->validValues) && !in_array($attr->value, $rule->validValues)) return false;
// No further tests required, attribute passes
return true;
}
/**
* Given an SS_HTMLValue instance, will remove and elements and attributes that are
* not explicitly included in the whitelist passed to __construct on instance creation
*
* @param SS_HTMLValue $html - The HTMLValue to remove any non-whitelisted elements & attributes from
*/
public function sanitise (SS_HTMLValue $html) {
if(!$this->elements && !$this->elementPatterns) return;
$doc = $html->getDocument();
foreach($html->query('//body//*') as $el) {
$elementRule = $this->getRuleForElement($el->tagName);
// If this element isn't allowed, strip it
if(!$this->elementMatchesRule($el, $elementRule)) {
// If it's a script or style, we don't keep contents
if($el->tagName === 'script' || $el->tagName === 'style') {
$el->parentNode->removeChild($el);
}
// Otherwise we replace this node with all it's children
else {
// First, create a new fragment with all of $el's children moved into it
$frag = $doc->createDocumentFragment();
while($el->firstChild) $frag->appendChild($el->firstChild);
// Then replace $el with the frags contents (which used to be it's children)
$el->parentNode->replaceChild($frag, $el);
}
}
// Otherwise tidy the element
else {
// First, if we're supposed to pad & this element is empty, fix that
if($elementRule->paddEmpty && !$el->firstChild) {
$el->nodeValue = ' ';
}
// Then filter out any non-whitelisted attributes
$children = $el->attributes;
$i = $children->length;
while($i--) {
$attr = $children->item($i);
$attributeRule = $this->getRuleForAttribute($elementRule, $attr->name);
// If this attribute isn't allowed, strip it
if(!$this->attributeMatchesRule($attr, $attributeRule)) {
$el->removeAttributeNode($attr);
}
}
// Then enforce any default attributes
foreach($elementRule->attributesDefault as $attr => $default) {
if(!$el->getAttribute($attr)) $el->setAttribute($attr, $default);
}
// And any forced attributes
foreach($elementRule->attributesForced as $attr => $forced) {
$el->setAttribute($attr, $forced);
}
}
}
}
}