library/HTMLPurifier/Injector/SafeObject.php

   1 <?php
   2
   3 /**
   4  * Adds important param elements to inside of object in order to make
   5  * things safe.
   6  */
   7 class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
   8 {
   9     /**
  10      * @type string
  11      */
  12     public $name = 'SafeObject';
  13
  14     /**
  15      * @type array
  16      */
  17     public $needed = array('object', 'param');
  18
  19     /**
  20      * @type array
  21      */
  22     protected $objectStack = array();
  23
  24     /**
  25      * @type array
  26      */
  27     protected $paramStack = array();
  28
  29     /**
  30      * Keep this synchronized with AttrTransform/SafeParam.php.
  31      * @type array
  32      */
  33     protected $addParam = array(
  34         'allowScriptAccess' => 'never',
  35         'allowNetworking' => 'internal',
  36     );
  37
  38     /**
  39      * @type array
  40      */
  41     protected $allowedParam = array(
  42         'wmode' => true,
  43         'movie' => true,
  44         'flashvars' => true,
  45         'src' => true,
  46         'allowFullScreen' => true, // if omitted, assume to be 'false'
  47     );
  48
  49     /**
  50      * @param HTMLPurifier_Config $config
  51      * @param HTMLPurifier_Context $context
  52      * @return void
  53      */
  54     public function prepare($config, $context)
  55     {
  56         parent::prepare($config, $context);
  57     }
  58
  59     /**
  60      * @param HTMLPurifier_Token $token
  61      */
  62     public function handleElement(&$token)
  63     {
  64         if ($token->name == 'object') {
  65             $this->objectStack[] = $token;
  66             $this->paramStack[] = array();
  67             $new = array($token);
  68             foreach ($this->addParam as $name => $value) {
  69                 $new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value));
  70             }
  71             $token = $new;
  72         } elseif ($token->name == 'param') {
  73             $nest = count($this->currentNesting) - 1;
  74             if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
  75                 $i = count($this->objectStack) - 1;
  76                 if (!isset($token->attr['name'])) {
  77                     $token = false;
  78                     return;
  79                 }
  80                 $n = $token->attr['name'];
  81                 // We need this fix because YouTube doesn't supply a data
  82                 // attribute, which we need if a type is specified. This is
  83                 // *very* Flash specific.
  84                 if (!isset($this->objectStack[$i]->attr['data']) &&
  85                     ($token->attr['name'] == 'movie' || $token->attr['name'] == 'src')
  86                 ) {
  87                     $this->objectStack[$i]->attr['data'] = $token->attr['value'];
  88                 }
  89                 // Check if the parameter is the correct value but has not
  90                 // already been added
  91                 if (!isset($this->paramStack[$i][$n]) &&
  92                     isset($this->addParam[$n]) &&
  93                     $token->attr['name'] === $this->addParam[$n]) {
  94                     // keep token, and add to param stack
  95                     $this->paramStack[$i][$n] = true;
  96                 } elseif (isset($this->allowedParam[$n])) {
  97                     // keep token, don't do anything to it
  98                     // (could possibly check for duplicates here)
  99                 } else {
 100                     $token = false;
 101                 }
 102             } else {
 103                 // not directly inside an object, DENY!
 104                 $token = false;
 105             }
 106         }
 107     }
 108
 109     public function handleEnd(&$token)
 110     {
 111         // This is the WRONG way of handling the object and param stacks;
 112         // we should be inserting them directly on the relevant object tokens
 113         // so that the global stack handling handles it.
 114         if ($token->name == 'object') {
 115             array_pop($this->objectStack);
 116             array_pop($this->paramStack);
 117         }
 118     }
 119 }
 120
 121 // vim: et sw=4 sts=4