mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-11-08 23:08:42 +00:00
29716bf8f4
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@492 48356398-32a2-884e-a903-53898d9a118a
115 lines
4.1 KiB
PHP
115 lines
4.1 KiB
PHP
<?php
|
|
|
|
/*!
|
|
* @mainpage
|
|
*
|
|
* HTML Purifier is an HTML filter that will take an arbitrary snippet of
|
|
* HTML and rigorously test, validate and filter it into a version that
|
|
* is safe for output onto webpages. It achieves this by:
|
|
*
|
|
* -# Lexing (parsing into tokens) the document,
|
|
* -# Executing various strategies on the tokens:
|
|
* -# Removing all elements not in the whitelist,
|
|
* -# Making the tokens well-formed,
|
|
* -# Fixing the nesting of the nodes, and
|
|
* -# Validating attributes of the nodes; and
|
|
* -# Generating HTML from the purified tokens.
|
|
*
|
|
* However, most users will only need to interface with the HTMLPurifier
|
|
* class, so this massive amount of infrastructure is usually concealed.
|
|
* If you plan on working with the internals, be sure to include
|
|
* HTMLPurifier_ConfigSchema and HTMLPurifier_Config.
|
|
*/
|
|
|
|
/*
|
|
HTML Purifier 1.1.2 - Standards Compliant HTML Filtering
|
|
Copyright (C) 2006 Edward Z. Yang
|
|
|
|
This library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
This library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with this library; if not, write to the Free Software
|
|
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
// almost every class has an undocumented dependency to these, so make sure
|
|
// they get included
|
|
require_once 'HTMLPurifier/ConfigSchema.php';
|
|
require_once 'HTMLPurifier/Config.php';
|
|
require_once 'HTMLPurifier/Context.php';
|
|
|
|
require_once 'HTMLPurifier/Lexer.php';
|
|
require_once 'HTMLPurifier/Generator.php';
|
|
require_once 'HTMLPurifier/Strategy/Core.php';
|
|
require_once 'HTMLPurifier/Encoder.php';
|
|
|
|
/**
|
|
* Main library execution class.
|
|
*
|
|
* Facade that performs calls to the HTMLPurifier_Lexer,
|
|
* HTMLPurifier_Strategy and HTMLPurifier_Generator subsystems in order to
|
|
* purify HTML.
|
|
*
|
|
* @todo We need an easier way to inject strategies, it'll probably end
|
|
* up getting done through config though.
|
|
*/
|
|
class HTMLPurifier
|
|
{
|
|
|
|
var $config;
|
|
|
|
var $lexer, $strategy, $generator;
|
|
|
|
/**
|
|
* Initializes the purifier.
|
|
* @param $config Optional HTMLPurifier_Config object for all instances of
|
|
* the purifier, if omitted, a default configuration is
|
|
* supplied (which can be overridden on a per-use basis).
|
|
*/
|
|
function HTMLPurifier($config = null) {
|
|
|
|
$this->config = $config ? $config : HTMLPurifier_Config::createDefault();
|
|
|
|
$this->lexer = HTMLPurifier_Lexer::create();
|
|
$this->strategy = new HTMLPurifier_Strategy_Core();
|
|
$this->generator = new HTMLPurifier_Generator();
|
|
$this->encoder = new HTMLPurifier_Encoder();
|
|
|
|
}
|
|
|
|
/**
|
|
* Filters an HTML snippet/document to be XSS-free and standards-compliant.
|
|
*
|
|
* @param $html String of HTML to purify
|
|
* @param $config HTMLPurifier_Config object for this operation, if omitted,
|
|
* defaults to the config object specified during this
|
|
* object's construction.
|
|
* @return Purified HTML
|
|
*/
|
|
function purify($html, $config = null) {
|
|
$config = $config ? $config : $this->config;
|
|
$context =& new HTMLPurifier_Context();
|
|
$html = $this->encoder->convertToUTF8($html, $config, $context);
|
|
$html =
|
|
$this->generator->generateFromTokens(
|
|
$this->strategy->execute(
|
|
$this->lexer->tokenizeHTML($html, $config, $context),
|
|
$config, $context
|
|
),
|
|
$config, $context
|
|
);
|
|
$html = $this->encoder->convertFromUTF8($html, $config, $context);
|
|
return $html;
|
|
}
|
|
|
|
}
|
|
|
|
?>
|