library/HTMLPurifier/Injector/SafeObject.php

   1 <?php
   2
   3 /**
   4  * Adds important param elements to inside of object in order to make
   5  * things safe.
   6  */
   7 class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
   8 {
   9     /**
  10      * @type string
  11      */
  12     public $name = 'SafeObject';
  13
  14     /**
  15      * @type array
  16      */
  17     public $needed = array('object', 'param');
  18
  19     /**
  20      * @type array
  21      */
  22     protected $objectStack = array();
  23
  24     /**
  25      * @type array
  26      */
  27     protected $paramStack = array();
  28
  29     /**
  30      * Keep this synchronized with AttrTransform/SafeParam.php.
  31      * @type array
  32      */
  33     protected $addParam = array(
  34         'allowScriptAccess' => 'never',
  35         'allowNetworking' => 'internal',
  36     );
  37
  38     /**
  39      * These are all lower-case keys.
  40      * @type array
  41      */
  42     protected $allowedParam = array(
  43         'wmode' => true,
  44         'movie' => true,
  45         'flashvars' => true,
  46         'src' => true,
  47         'allowfullscreen' => true, // if omitted, assume to be 'false'
  48     );
  49
  50     /**
  51      * @param HTMLPurifier_Config $config
  52      * @param HTMLPurifier_Context $context
  53      * @return void
  54      */
  55     public function prepare($config, $context)
  56     {
  57         parent::prepare($config, $context);
  58     }
  59
  60     /**
  61      * @param HTMLPurifier_Token $token
  62      */
  63     public function handleElement(&$token)
  64     {
  65         if ($token->name == 'object') {
  66             $this->objectStack[] = $token;
  67             $this->paramStack[] = array();
  68             $new = array($token);
  69             foreach ($this->addParam as $name => $value) {
  70                 $new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value));
  71             }
  72             $token = $new;
  73         } elseif ($token->name == 'param') {
  74             $nest = count($this->currentNesting) - 1;
  75             if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
  76                 $i = count($this->objectStack) - 1;
  77                 if (!isset($token->attr['name'])) {
  78                     $token = false;
  79                     return;
  80                 }
  81                 $n = $token->attr['name'];
  82                 // We need this fix because YouTube doesn't supply a data
  83                 // attribute, which we need if a type is specified. This is
  84                 // *very* Flash specific.
  85                 if (!isset($this->objectStack[$i]->attr['data']) &&
  86                     ($token->attr['name'] == 'movie' || $token->attr['name'] == 'src')
  87                 ) {
  88                     $this->objectStack[$i]->attr['data'] = $token->attr['value'];
  89                 }
  90                 // Check if the parameter is the correct value but has not
  91                 // already been added
  92                 if (!isset($this->paramStack[$i][$n]) &&
  93                     isset($this->addParam[$n]) &&
  94                     $token->attr['name'] === $this->addParam[$n]) {
  95                     // keep token, and add to param stack
  96                     $this->paramStack[$i][$n] = true;
  97                 } elseif (isset($this->allowedParam[strtolower($n)])) {
  98                     // keep token, don't do anything to it
  99                     // (could possibly check for duplicates here)
 100                     // Note: In principle, parameters should be case sensitive.
 101                     // But it seems they are not really; so accept any case.
 102                 } else {
 103                     $token = false;
 104                 }
 105             } else {
 106                 // not directly inside an object, DENY!
 107                 $token = false;
 108             }
 109         }
 110     }
 111
 112     public function handleEnd(&$token)
 113     {
 114         // This is the WRONG way of handling the object and param stacks;
 115         // we should be inserting them directly on the relevant object tokens
 116         // so that the global stack handling handles it.
 117         if ($token->name == 'object') {
 118             array_pop($this->objectStack);
 119             array_pop($this->paramStack);
 120         }
 121     }
 122 }
 123
 124 // vim: et sw=4 sts=4