mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-09-20 11:15:18 +00:00
4164b2eb2b
The purpose of this addition is twofold. In trusted mode, iframes are now unconditionally allowed. However, many online video providers (YouTube, Vimeo) and other web applications (Google Maps, Google Calendar, etc) provide embed code in iframe format, which is useful functionality in untrusted mode. You can specify iframes as trusted elements with %HTML.SafeIframe; however, you need to additionally specify a whitelist mechanism such as %URI.SafeIframeRegexp to say what iframe embeds are OK (by default everything is rejected). Note: As iframes are invalid in strict doctypes, you will not be able to use them there. We also added an always_load parameter to URIFilters in order to support the strange nature of the SafeIframe URIFilter (it always needs to be loaded, due to the inability of accessing the %HTML.SafeIframe directive to see if it's needed!) We expect this URIFilter can expand in the future to offer more complex validation mechanisms. Signed-off-by: Bradley M. Froehle <brad.froehle@gmail.com> Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
78 lines
2.1 KiB
PHP
78 lines
2.1 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Validates a URI as defined by RFC 3986.
|
|
* @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme
|
|
*/
|
|
class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
|
|
{
|
|
|
|
protected $parser;
|
|
protected $embedsResource;
|
|
|
|
/**
|
|
* @param $embeds_resource_resource Does the URI here result in an extra HTTP request?
|
|
*/
|
|
public function __construct($embeds_resource = false) {
|
|
$this->parser = new HTMLPurifier_URIParser();
|
|
$this->embedsResource = (bool) $embeds_resource;
|
|
}
|
|
|
|
public function make($string) {
|
|
$embeds = ($string === 'embedded');
|
|
return new HTMLPurifier_AttrDef_URI($embeds);
|
|
}
|
|
|
|
public function validate($uri, $config, $context) {
|
|
|
|
if ($config->get('URI.Disable')) return false;
|
|
|
|
$uri = $this->parseCDATA($uri);
|
|
|
|
// parse the URI
|
|
$uri = $this->parser->parse($uri);
|
|
if ($uri === false) return false;
|
|
|
|
// add embedded flag to context for validators
|
|
$context->register('EmbeddedURI', $this->embedsResource);
|
|
|
|
$ok = false;
|
|
do {
|
|
|
|
// generic validation
|
|
$result = $uri->validate($config, $context);
|
|
if (!$result) break;
|
|
|
|
// chained filtering
|
|
$uri_def = $config->getDefinition('URI');
|
|
$result = $uri_def->filter($uri, $config, $context);
|
|
if (!$result) break;
|
|
|
|
// scheme-specific validation
|
|
$scheme_obj = $uri->getSchemeObj($config, $context);
|
|
if (!$scheme_obj) break;
|
|
if ($this->embedsResource && !$scheme_obj->browsable) break;
|
|
$result = $scheme_obj->validate($uri, $config, $context);
|
|
if (!$result) break;
|
|
|
|
// Post chained filtering
|
|
$result = $uri_def->postFilter($uri, $config, $context);
|
|
if (!$result) break;
|
|
|
|
// survived gauntlet
|
|
$ok = true;
|
|
|
|
} while (false);
|
|
|
|
$context->destroy('EmbeddedURI');
|
|
if (!$ok) return false;
|
|
|
|
// back to string
|
|
return $uri->toString();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|