library/HTMLPurifier/Generator.php

   1 <?php
   2
   3 /**
   4  * Generates HTML from tokens.
   5  * @todo Refactor interface so that configuration/context is determined
   6  *       upon instantiation, no need for messy generateFromTokens() calls
   7  * @todo Make some of the more internal functions protected, and have
   8  *       unit tests work around that
   9  */
  10 class HTMLPurifier_Generator
  11 {
  12
  13     /**
  14      * Whether or not generator should produce XML output
  15      */
  16     private $_xhtml = true;
  17
  18     /**
  19      * :HACK: Whether or not generator should comment the insides of <script> tags
  20      */
  21     private $_scriptFix = false;
  22
  23     /**
  24      * Cache of HTMLDefinition during HTML output to determine whether or
  25      * not attributes should be minimized.
  26      */
  27     private $_def;
  28
  29     /**
  30      * Cache of %Output.SortAttr
  31      */
  32     private $_sortAttr;
  33
  34     /**
  35      * Cache of %Output.FlashCompat
  36      */
  37     private $_flashCompat;
  38
  39     /**
  40      * Cache of %Output.FixInnerHTML
  41      */
  42     private $_innerHTMLFix;
  43
  44     /**
  45      * Stack for keeping track of object information when outputting IE
  46      * compatibility code.
  47      */
  48     private $_flashStack = array();
  49
  50     /**
  51      * Configuration for the generator
  52      */
  53     protected $config;
  54
  55     /**
  56      * @param $config Instance of HTMLPurifier_Config
  57      * @param $context Instance of HTMLPurifier_Context
  58      */
  59     public function __construct($config, $context) {
  60         $this->config = $config;
  61         $this->_scriptFix = $config->get('Output.CommentScriptContents');
  62         $this->_innerHTMLFix = $config->get('Output.FixInnerHTML');
  63         $this->_sortAttr = $config->get('Output.SortAttr');
  64         $this->_flashCompat = $config->get('Output.FlashCompat');
  65         $this->_def = $config->getHTMLDefinition();
  66         $this->_xhtml = $this->_def->doctype->xml;
  67     }
  68
  69     /**
  70      * Generates HTML from an array of tokens.
  71      * @param $tokens Array of HTMLPurifier_Token
  72      * @param $config HTMLPurifier_Config object
  73      * @return Generated HTML
  74      */
  75     public function generateFromTokens($tokens) {
  76         if (!$tokens) return '';
  77
  78         // Basic algorithm
  79         $html = '';
  80         for ($i = 0, $size = count($tokens); $i < $size; $i++) {
  81             if ($this->_scriptFix && $tokens[$i]->name === 'script'
  82                 && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) {
  83                 // script special case
  84                 // the contents of the script block must be ONE token
  85                 // for this to work.
  86                 $html .= $this->generateFromToken($tokens[$i++]);
  87                 $html .= $this->generateScriptFromToken($tokens[$i++]);
  88             }
  89             $html .= $this->generateFromToken($tokens[$i]);
  90         }
  91
  92         // Tidy cleanup
  93         if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) {
  94             $tidy = new Tidy;
  95             $tidy->parseString($html, array(
  96                'indent'=> true,
  97                'output-xhtml' => $this->_xhtml,
  98                'show-body-only' => true,
  99                'indent-spaces' => 2,
 100                'wrap' => 68,
 101             ), 'utf8');
 102             $tidy->cleanRepair();
 103             $html = (string) $tidy; // explicit cast necessary
 104         }
 105
 106         // Normalize newlines to system defined value
 107         if ($this->config->get('Core.NormalizeNewlines')) {
 108             $nl = $this->config->get('Output.Newline');
 109             if ($nl === null) $nl = PHP_EOL;
 110             if ($nl !== "\n") $html = str_replace("\n", $nl, $html);
 111         }
 112         return $html;
 113     }
 114
 115     /**
 116      * Generates HTML from a single token.
 117      * @param $token HTMLPurifier_Token object.
 118      * @return Generated HTML
 119      */
 120     public function generateFromToken($token) {
 121         if (!$token instanceof HTMLPurifier_Token) {
 122             trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING);
 123             return '';
 124
 125         } elseif ($token instanceof HTMLPurifier_Token_Start) {
 126             $attr = $this->generateAttributes($token->attr, $token->name);
 127             if ($this->_flashCompat) {
 128                 if ($token->name == "object") {
 129                     $flash = new stdclass();
 130                     $flash->attr = $token->attr;
 131                     $flash->param = array();
 132                     $this->_flashStack[] = $flash;
 133                 }
 134             }
 135             return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>';
 136
 137         } elseif ($token instanceof HTMLPurifier_Token_End) {
 138             $_extra = '';
 139             if ($this->_flashCompat) {
 140                 if ($token->name == "object" && !empty($this->_flashStack)) {
 141                     // doesn't do anything for now
 142                 }
 143             }
 144             return $_extra . '</' . $token->name . '>';
 145
 146         } elseif ($token instanceof HTMLPurifier_Token_Empty) {
 147             if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) {
 148                 $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value'];
 149             }
 150             $attr = $this->generateAttributes($token->attr, $token->name);
 151              return '<' . $token->name . ($attr ? ' ' : '') . $attr .
 152                 ( $this->_xhtml ? ' /': '' ) // <br /> v. <br>
 153                 . '>';
 154
 155         } elseif ($token instanceof HTMLPurifier_Token_Text) {
 156             return $this->escape($token->data, ENT_NOQUOTES);
 157
 158         } elseif ($token instanceof HTMLPurifier_Token_Comment) {
 159             return '<!--' . $token->data . '-->';
 160         } else {
 161             return '';
 162
 163         }
 164     }
 165
 166     /**
 167      * Special case processor for the contents of script tags
 168      * @warning This runs into problems if there's already a literal
 169      *          --> somewhere inside the script contents.
 170      */
 171     public function generateScriptFromToken($token) {
 172         if (!$token instanceof HTMLPurifier_Token_Text) return $this->generateFromToken($token);
 173         // Thanks <http://lachy.id.au/log/2005/05/script-comments>
 174         $data = preg_replace('#//\s*$#', '', $token->data);
 175         return '<!--//--><![CDATA[//><!--' . "\n" . trim($data) . "\n" . '//--><!]]>';
 176     }
 177
 178     /**
 179      * Generates attribute declarations from attribute array.
 180      * @note This does not include the leading or trailing space.
 181      * @param $assoc_array_of_attributes Attribute array
 182      * @param $element Name of element attributes are for, used to check
 183      *        attribute minimization.
 184      * @return Generate HTML fragment for insertion.
 185      */
 186     public function generateAttributes($assoc_array_of_attributes, $element = false) {
 187         $html = '';
 188         if ($this->_sortAttr) ksort($assoc_array_of_attributes);
 189         foreach ($assoc_array_of_attributes as $key => $value) {
 190             if (!$this->_xhtml) {
 191                 // Remove namespaced attributes
 192                 if (strpos($key, ':') !== false) continue;
 193                 // Check if we should minimize the attribute: val="val" -> val
 194                 if ($element && !empty($this->_def->info[$element]->attr[$key]->minimized)) {
 195                     $html .= $key . ' ';
 196                     continue;
 197                 }
 198             }
 199             // Workaround for Internet Explorer innerHTML bug.
 200             // Essentially, Internet Explorer, when calculating
 201             // innerHTML, omits quotes if there are no instances of
 202             // angled brackets, quotes or spaces.  However, when parsing
 203             // HTML (for example, when you assign to innerHTML), it
 204             // treats backticks as quotes.  Thus,
 205             //      <img alt="``" />
 206             // becomes
 207             //      <img alt=`` />
 208             // becomes
 209             //      <img alt='' />
 210             // Fortunately, all we need to do is trigger an appropriate
 211             // quoting style, which we do by adding an extra space.
 212             // This also is consistent with the W3C spec, which states
 213             // that user agents may ignore leading or trailing
 214             // whitespace (in fact, most don't, at least for attributes
 215             // like alt, but an extra space at the end is barely
 216             // noticeable).  Still, we have a configuration knob for
 217             // this, since this transformation is not necesary if you
 218             // don't process user input with innerHTML or you don't plan
 219             // on supporting Internet Explorer.
 220             if ($this->_innerHTMLFix) {
 221                 if (strpos($value, '`') !== false) {
 222                     // check if correct quoting style would not already be
 223                     // triggered
 224                     if (strcspn($value, '"\' <>') === strlen($value)) {
 225                         // protect!
 226                         $value .= ' ';
 227                     }
 228                 }
 229             }
 230             $html .= $key.'="'.$this->escape($value).'" ';
 231         }
 232         return rtrim($html);
 233     }
 234
 235     /**
 236      * Escapes raw text data.
 237      * @todo This really ought to be protected, but until we have a facility
 238      *       for properly generating HTML here w/o using tokens, it stays
 239      *       public.
 240      * @param $string String data to escape for HTML.
 241      * @param $quote Quoting style, like htmlspecialchars. ENT_NOQUOTES is
 242      *               permissible for non-attribute output.
 243      * @return String escaped data.
 244      */
 245     public function escape($string, $quote = null) {
 246         // Workaround for APC bug on Mac Leopard reported by sidepodcast
 247         // http://htmlpurifier.org/phorum/read.php?3,4823,4846
 248         if ($quote === null) $quote = ENT_COMPAT;
 249         return htmlspecialchars($string, $quote, 'UTF-8');
 250     }
 251
 252 }
 253
 254 // vim: et sw=4 sts=4