2007-08-02 01:12:27 +00:00
|
|
|
<?php
|
|
|
|
|
|
|
|
class HTMLPurifier_URIDefinition extends HTMLPurifier_Definition
|
|
|
|
{
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2007-11-25 02:24:39 +00:00
|
|
|
public $type = 'URI';
|
|
|
|
protected $filters = array();
|
2008-05-26 16:26:47 +00:00
|
|
|
protected $postFilters = array();
|
2007-11-25 02:24:39 +00:00
|
|
|
protected $registeredFilters = array();
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2007-08-02 21:47:24 +00:00
|
|
|
/**
|
|
|
|
* HTMLPurifier_URI object of the base specified at %URI.Base
|
|
|
|
*/
|
2007-11-25 02:24:39 +00:00
|
|
|
public $base;
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2007-08-02 21:47:24 +00:00
|
|
|
/**
|
2007-11-25 02:24:39 +00:00
|
|
|
* String host to consider "home" base, derived off of $base
|
2007-08-02 21:47:24 +00:00
|
|
|
*/
|
2007-11-25 02:24:39 +00:00
|
|
|
public $host;
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2007-08-02 21:47:24 +00:00
|
|
|
/**
|
|
|
|
* Name of default scheme based on %URI.DefaultScheme and %URI.Base
|
|
|
|
*/
|
2007-11-25 02:24:39 +00:00
|
|
|
public $defaultScheme;
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
public function __construct()
|
|
|
|
{
|
2007-08-02 01:12:27 +00:00
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_DisableExternal());
|
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_DisableExternalResources());
|
2012-03-02 18:25:00 +00:00
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_DisableResources());
|
2007-08-02 01:41:37 +00:00
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_HostBlacklist());
|
Implement Iframe module, and provide %HTML.SafeIframe and %URI.SafeIframeRegexp for untrusted usage.
The purpose of this addition is twofold. In trusted mode, iframes are
now unconditionally allowed.
However, many online video providers (YouTube, Vimeo) and other web
applications (Google Maps, Google Calendar, etc) provide embed code in
iframe format, which is useful functionality in untrusted mode.
You can specify iframes as trusted elements with %HTML.SafeIframe;
however, you need to additionally specify a whitelist mechanism such as
%URI.SafeIframeRegexp to say what iframe embeds are OK (by default
everything is rejected).
Note: As iframes are invalid in strict doctypes, you will not be able to
use them there.
We also added an always_load parameter to URIFilters in order to support
the strange nature of the SafeIframe URIFilter (it always needs to be
loaded, due to the inability of accessing the %HTML.SafeIframe directive
to see if it's needed!) We expect this URIFilter can expand in the future
to offer more complex validation mechanisms.
Signed-off-by: Bradley M. Froehle <brad.froehle@gmail.com>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
2011-02-14 01:47:01 +00:00
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_SafeIframe());
|
2007-08-02 21:47:24 +00:00
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_MakeAbsolute());
|
2008-06-18 03:29:27 +00:00
|
|
|
$this->registerFilter(new HTMLPurifier_URIFilter_Munge());
|
2007-08-02 01:12:27 +00:00
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
public function registerFilter($filter)
|
|
|
|
{
|
2007-08-02 01:12:27 +00:00
|
|
|
$this->registeredFilters[$filter->name] = $filter;
|
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
public function addFilter($filter, $config)
|
|
|
|
{
|
2008-05-26 16:26:47 +00:00
|
|
|
$r = $filter->prepare($config);
|
|
|
|
if ($r === false) return; // null is ok, for backwards compat
|
|
|
|
if ($filter->post) {
|
|
|
|
$this->postFilters[$filter->name] = $filter;
|
|
|
|
} else {
|
|
|
|
$this->filters[$filter->name] = $filter;
|
|
|
|
}
|
2007-08-02 23:34:30 +00:00
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
protected function doSetup($config)
|
|
|
|
{
|
2007-08-02 21:47:24 +00:00
|
|
|
$this->setupMemberVariables($config);
|
2007-08-03 21:17:15 +00:00
|
|
|
$this->setupFilters($config);
|
2007-08-02 21:47:24 +00:00
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
protected function setupFilters($config)
|
|
|
|
{
|
2007-08-02 01:12:27 +00:00
|
|
|
foreach ($this->registeredFilters as $name => $filter) {
|
Implement Iframe module, and provide %HTML.SafeIframe and %URI.SafeIframeRegexp for untrusted usage.
The purpose of this addition is twofold. In trusted mode, iframes are
now unconditionally allowed.
However, many online video providers (YouTube, Vimeo) and other web
applications (Google Maps, Google Calendar, etc) provide embed code in
iframe format, which is useful functionality in untrusted mode.
You can specify iframes as trusted elements with %HTML.SafeIframe;
however, you need to additionally specify a whitelist mechanism such as
%URI.SafeIframeRegexp to say what iframe embeds are OK (by default
everything is rejected).
Note: As iframes are invalid in strict doctypes, you will not be able to
use them there.
We also added an always_load parameter to URIFilters in order to support
the strange nature of the SafeIframe URIFilter (it always needs to be
loaded, due to the inability of accessing the %HTML.SafeIframe directive
to see if it's needed!) We expect this URIFilter can expand in the future
to offer more complex validation mechanisms.
Signed-off-by: Bradley M. Froehle <brad.froehle@gmail.com>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
2011-02-14 01:47:01 +00:00
|
|
|
if ($filter->always_load) {
|
2007-08-03 21:17:15 +00:00
|
|
|
$this->addFilter($filter, $config);
|
Implement Iframe module, and provide %HTML.SafeIframe and %URI.SafeIframeRegexp for untrusted usage.
The purpose of this addition is twofold. In trusted mode, iframes are
now unconditionally allowed.
However, many online video providers (YouTube, Vimeo) and other web
applications (Google Maps, Google Calendar, etc) provide embed code in
iframe format, which is useful functionality in untrusted mode.
You can specify iframes as trusted elements with %HTML.SafeIframe;
however, you need to additionally specify a whitelist mechanism such as
%URI.SafeIframeRegexp to say what iframe embeds are OK (by default
everything is rejected).
Note: As iframes are invalid in strict doctypes, you will not be able to
use them there.
We also added an always_load parameter to URIFilters in order to support
the strange nature of the SafeIframe URIFilter (it always needs to be
loaded, due to the inability of accessing the %HTML.SafeIframe directive
to see if it's needed!) We expect this URIFilter can expand in the future
to offer more complex validation mechanisms.
Signed-off-by: Bradley M. Froehle <brad.froehle@gmail.com>
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
2011-02-14 01:47:01 +00:00
|
|
|
} else {
|
|
|
|
$conf = $config->get('URI.' . $name);
|
|
|
|
if ($conf !== false && $conf !== null) {
|
|
|
|
$this->addFilter($filter, $config);
|
|
|
|
}
|
2007-08-02 01:12:27 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
unset($this->registeredFilters);
|
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
protected function setupMemberVariables($config)
|
|
|
|
{
|
2009-02-20 00:17:49 +00:00
|
|
|
$this->host = $config->get('URI.Host');
|
|
|
|
$base_uri = $config->get('URI.Base');
|
2007-08-02 21:47:24 +00:00
|
|
|
if (!is_null($base_uri)) {
|
|
|
|
$parser = new HTMLPurifier_URIParser();
|
|
|
|
$this->base = $parser->parse($base_uri);
|
|
|
|
$this->defaultScheme = $this->base->scheme;
|
|
|
|
if (is_null($this->host)) $this->host = $this->base->host;
|
|
|
|
}
|
2009-02-20 00:17:49 +00:00
|
|
|
if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme');
|
2007-08-02 21:47:24 +00:00
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
public function getDefaultScheme($config, $context)
|
|
|
|
{
|
2011-12-25 09:17:19 +00:00
|
|
|
return HTMLPurifier_URISchemeRegistry::instance()->getScheme($this->defaultScheme, $config, $context);
|
|
|
|
}
|
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
public function filter(&$uri, $config, $context)
|
|
|
|
{
|
2008-05-26 16:26:47 +00:00
|
|
|
foreach ($this->filters as $name => $f) {
|
|
|
|
$result = $f->filter($uri, $config, $context);
|
|
|
|
if (!$result) return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2013-07-16 11:56:14 +00:00
|
|
|
public function postFilter(&$uri, $config, $context)
|
|
|
|
{
|
2008-05-26 16:26:47 +00:00
|
|
|
foreach ($this->postFilters as $name => $f) {
|
|
|
|
$result = $f->filter($uri, $config, $context);
|
2007-08-02 01:12:27 +00:00
|
|
|
if (!$result) return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
2008-12-06 07:28:20 +00:00
|
|
|
|
2007-08-02 01:12:27 +00:00
|
|
|
}
|
2008-12-06 09:24:59 +00:00
|
|
|
|
|
|
|
// vim: et sw=4 sts=4
|