Fix CSS URL innerHTML/cssText escaping bug.
[htmlpurifier.git] / library / HTMLPurifier / AttrDef / CSS / URI.php
blobc2f767e573cf20374e048501e967de6b4774b7a7
1 <?php
3 /**
4 * Validates a URI in CSS syntax, which uses url('http://example.com')
5 * @note While theoretically speaking a URI in a CSS document could
6 * be non-embedded, as of CSS2 there is no such usage so we're
7 * generalizing it. This may need to be changed in the future.
8 * @warning Since HTMLPurifier_AttrDef_CSS blindly uses semicolons as
9 * the separator, you cannot put a literal semicolon in
10 * in the URI. Try percent encoding it, in that case.
12 class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
15 public function __construct() {
16 parent::__construct(true); // always embedded
19 public function validate($uri_string, $config, $context) {
20 // parse the URI out of the string and then pass it onto
21 // the parent object
23 $uri_string = $this->parseCDATA($uri_string);
24 if (strpos($uri_string, 'url(') !== 0) return false;
25 $uri_string = substr($uri_string, 4);
26 $new_length = strlen($uri_string) - 1;
27 if ($uri_string[$new_length] != ')') return false;
28 $uri = trim(substr($uri_string, 0, $new_length));
30 if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) {
31 $quote = $uri[0];
32 $new_length = strlen($uri) - 1;
33 if ($uri[$new_length] !== $quote) return false;
34 $uri = substr($uri, 1, $new_length - 1);
37 $uri = $this->expandCSSEscape($uri);
39 $result = parent::validate($uri, $config, $context);
41 if ($result === false) return false;
43 // extra sanity check; should have been done by URI
44 $result = str_replace(array('"', "\\", "\n", "\x0c", "\r"), "", $result);
46 // suspicious characters are ()'; we're going to percent encode
47 // them for safety.
48 $result = str_replace(array('(', ')', "'"), array('%28', '%29', '%27'), $result);
50 // there's an extra bug where ampersands lose their escaping on
51 // an innerHTML cycle, so a very unlucky query parameter could
52 // then change the meaning of the URL. Unfortunately, there's
53 // not much we can do about that...
55 return "url(\"$result\")";
61 // vim: et sw=4 sts=4