mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-12-24 09:11:52 +00:00
e76f4b45d0
Basically, browsers don't parse what should be valid URIs correctly, so
we have to go through some backbends to accomodate them. Specifically,
for browseable URIs, the following URIs have unintended behavior:
- ///example.com
- http:/example.com
- http:///example.com
Furthermore, if the path begins with //, modifying these URLs must
be done with care, as if you remove the host-name component, the
parse tree changes.
I've modified the engine to follow correct URI semantics as much
as possible while outputting browser compatible code, and invalidate
the URI in cases where we can't deal. There has been a refactoring
of URIScheme so that this important check is always performed,
introducing a new member variable allow_empty_host which is true
on data, file, mailto and news schemes.
This also fixes bypass bugs on URI.Munge.
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
97 lines
3.4 KiB
PHP
97 lines
3.4 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Implements data: URI for base64 encoded images supported by GD.
|
|
*/
|
|
class HTMLPurifier_URIScheme_data extends HTMLPurifier_URIScheme {
|
|
|
|
public $browsable = true;
|
|
public $allowed_types = array(
|
|
// you better write validation code for other types if you
|
|
// decide to allow them
|
|
'image/jpeg' => true,
|
|
'image/gif' => true,
|
|
'image/png' => true,
|
|
);
|
|
// this is actually irrelevant since we only write out the path
|
|
// component
|
|
public $may_omit_host = true;
|
|
|
|
public function doValidate(&$uri, $config, $context) {
|
|
$result = explode(',', $uri->path, 2);
|
|
$is_base64 = false;
|
|
$charset = null;
|
|
$content_type = null;
|
|
if (count($result) == 2) {
|
|
list($metadata, $data) = $result;
|
|
// do some legwork on the metadata
|
|
$metas = explode(';', $metadata);
|
|
while(!empty($metas)) {
|
|
$cur = array_shift($metas);
|
|
if ($cur == 'base64') {
|
|
$is_base64 = true;
|
|
break;
|
|
}
|
|
if (substr($cur, 0, 8) == 'charset=') {
|
|
// doesn't match if there are arbitrary spaces, but
|
|
// whatever dude
|
|
if ($charset !== null) continue; // garbage
|
|
$charset = substr($cur, 8); // not used
|
|
} else {
|
|
if ($content_type !== null) continue; // garbage
|
|
$content_type = $cur;
|
|
}
|
|
}
|
|
} else {
|
|
$data = $result[0];
|
|
}
|
|
if ($content_type !== null && empty($this->allowed_types[$content_type])) {
|
|
return false;
|
|
}
|
|
if ($charset !== null) {
|
|
// error; we don't allow plaintext stuff
|
|
$charset = null;
|
|
}
|
|
$data = rawurldecode($data);
|
|
if ($is_base64) {
|
|
$raw_data = base64_decode($data);
|
|
} else {
|
|
$raw_data = $data;
|
|
}
|
|
// XXX probably want to refactor this into a general mechanism
|
|
// for filtering arbitrary content types
|
|
$file = tempnam("/tmp", "");
|
|
file_put_contents($file, $raw_data);
|
|
if (function_exists('exif_imagetype')) {
|
|
$image_code = exif_imagetype($file);
|
|
} elseif (function_exists('getimagesize')) {
|
|
set_error_handler(array($this, 'muteErrorHandler'));
|
|
$info = getimagesize($file);
|
|
restore_error_handler();
|
|
if ($info == false) return false;
|
|
$image_code = $info[2];
|
|
} else {
|
|
trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
|
|
}
|
|
$real_content_type = image_type_to_mime_type($image_code);
|
|
if ($real_content_type != $content_type) {
|
|
// we're nice guys; if the content type is something else we
|
|
// support, change it over
|
|
if (empty($this->allowed_types[$real_content_type])) return false;
|
|
$content_type = $real_content_type;
|
|
}
|
|
// ok, it's kosher, rewrite what we need
|
|
$uri->userinfo = null;
|
|
$uri->host = null;
|
|
$uri->port = null;
|
|
$uri->fragment = null;
|
|
$uri->query = null;
|
|
$uri->path = "$content_type;base64," . base64_encode($raw_data);
|
|
return true;
|
|
}
|
|
|
|
public function muteErrorHandler($errno, $errstr) {}
|
|
|
|
}
|
|
|