library/HTMLPurifier/AttrDef/CSS.php

   1 <?php
   2
   3 /**
   4  * Validates the HTML attribute style, otherwise known as CSS.
   5  * @note We don't implement the whole CSS specification, so it might be
   6  *       difficult to reuse this component in the context of validating
   7  *       actual stylesheet declarations.
   8  * @note If we were really serious about validating the CSS, we would
   9  *       tokenize the styles and then parse the tokens. Obviously, we
  10  *       are not doing that. Doing that could seriously harm performance,
  11  *       but would make these components a lot more viable for a CSS
  12  *       filtering solution.
  13  */
  14 class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
  15 {
  16
  17     /**
  18      * @param string $css
  19      * @param HTMLPurifier_Config $config
  20      * @param HTMLPurifier_Context $context
  21      * @return bool|string
  22      */
  23     public function validate($css, $config, $context)
  24     {
  25         $css = $this->parseCDATA($css);
  26
  27         $definition = $config->getCSSDefinition();
  28         $allow_duplicates = $config->get("CSS.AllowDuplicates");
  29
  30
  31         // According to the CSS2.1 spec, the places where a
  32         // non-delimiting semicolon can appear are in strings
  33         // escape sequences.   So here is some dumb hack to
  34         // handle quotes.
  35         $len = strlen($css);
  36         $accum = "";
  37         $declarations = array();
  38         $quoted = false;
  39         for ($i = 0; $i < $len; $i++) {
  40             $c = strcspn($css, ";'\"", $i);
  41             $accum .= substr($css, $i, $c);
  42             $i += $c;
  43             if ($i == $len) break;
  44             $d = $css[$i];
  45             if ($quoted) {
  46                 $accum .= $d;
  47                 if ($d == $quoted) {
  48                     $quoted = false;
  49                 }
  50             } else {
  51                 if ($d == ";") {
  52                     $declarations[] = $accum;
  53                     $accum = "";
  54                 } else {
  55                     $accum .= $d;
  56                     $quoted = $d;
  57                 }
  58             }
  59         }
  60         if ($accum != "") $declarations[] = $accum;
  61
  62         $propvalues = array();
  63         $new_declarations = '';
  64
  65         /**
  66          * Name of the current CSS property being validated.
  67          */
  68         $property = false;
  69         $context->register('CurrentCSSProperty', $property);
  70
  71         foreach ($declarations as $declaration) {
  72             if (!$declaration) {
  73                 continue;
  74             }
  75             if (!strpos($declaration, ':')) {
  76                 continue;
  77             }
  78             list($property, $value) = explode(':', $declaration, 2);
  79             $property = trim($property);
  80             $value = trim($value);
  81             $ok = false;
  82             do {
  83                 if (isset($definition->info[$property])) {
  84                     $ok = true;
  85                     break;
  86                 }
  87                 if (ctype_lower($property)) {
  88                     break;
  89                 }
  90                 $property = strtolower($property);
  91                 if (isset($definition->info[$property])) {
  92                     $ok = true;
  93                     break;
  94                 }
  95             } while (0);
  96             if (!$ok) {
  97                 continue;
  98             }
  99             // inefficient call, since the validator will do this again
 100             if (strtolower(trim($value)) !== 'inherit') {
 101                 // inherit works for everything (but only on the base property)
 102                 $result = $definition->info[$property]->validate(
 103                     $value,
 104                     $config,
 105                     $context
 106                 );
 107             } else {
 108                 $result = 'inherit';
 109             }
 110             if ($result === false) {
 111                 continue;
 112             }
 113             if ($allow_duplicates) {
 114                 $new_declarations .= "$property:$result;";
 115             } else {
 116                 $propvalues[$property] = $result;
 117             }
 118         }
 119
 120         $context->destroy('CurrentCSSProperty');
 121
 122         // procedure does not write the new CSS simultaneously, so it's
 123         // slightly inefficient, but it's the only way of getting rid of
 124         // duplicates. Perhaps config to optimize it, but not now.
 125
 126         foreach ($propvalues as $prop => $value) {
 127             $new_declarations .= "$prop:$value;";
 128         }
 129
 130         return $new_declarations ? $new_declarations : false;
 131
 132     }
 133
 134 }
 135
 136 // vim: et sw=4 sts=4