library/htmlspecialchars.inc.php

   1 <?php
   2
   3 /**
   4  * Escaping Functions
   5  *
   6  * @package   OpenEMR
   7  * @link      https://www.open-emr.org
   8  * @author    Boyd Stephen Smith Jr.
   9  * @author    Brady Miller <brady.g.miller@gmail.com>
  10  * @copyright Copyright (c) 2011 Boyd Stephen Smith Jr.
  11  * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
  12  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  13  */
  14
  15 /**
  16  * Escape a javascript literal.
  17  */
  18 function js_escape($text)
  19 {
  20     return json_encode($text);
  21 }
  22
  23 /**
  24  * Escape a javascript literal within html onclick attribute.
  25  */
  26 function attr_js($text)
  27 {
  28     return attr(json_encode($text));
  29 }
  30
  31 /**
  32  * Escape html and url encode a url item.
  33  */
  34 function attr_url($text)
  35 {
  36     return attr(urlencode($text ?? ''));
  37 }
  38
  39 /**
  40  * Escape js and url encode a url item.
  41  */
  42 function js_url($text)
  43 {
  44     return js_escape(urlencode($text));
  45 }
  46
  47 /**
  48  * Escape variables that are outputted into the php error log.
  49  */
  50 function errorLogEscape($text)
  51 {
  52     return attr($text);
  53 }
  54
  55 /**
  56  * Escape variables that are outputted into csv and spreadsheet files.
  57  * See here: https://www.owasp.org/index.php/CSV_Injection
  58  * Based mitigation strategy on this report: https://asecurityz.blogspot.com/2017/12/csv-injection-mitigations.html
  59  *  1. Remove all the following characters:  = + " |
  60  *  2. Only remove leading - characters (since need in dates)
  61  *  3. Only remove leading @ characters (since need in email addresses)
  62  *  4. Surround with double quotes (no reference link, but seems very reasonable, which will prevent commas from breaking things).
  63  * If needed in future, will add a second parameter called 'options' which will be an array of option tokens that will allow
  64  * less stringent (or more stringent) mechanisms to escape for csv.
  65  */
  66 function csvEscape($text)
  67 {
  68     // 1. Remove all the following characters:  = + " |
  69     $text = preg_replace('/[=+"|]/', '', $text);
  70
  71     // 2. Only remove leading - characters (since need in dates)
  72     // 3. Only remove leading @ characters (since need in email addresses)
  73     $text = preg_replace('/^[\-@]+/', '', $text);
  74
  75     // 4. Surround with double quotes (no reference link, but seems very reasonable, which will prevent commas from breaking things).
  76     return '"' . $text . '"';
  77 }
  78
  79 /**
  80  *
  81  * references: https://stackoverflow.com/questions/3426090/how-do-you-make-strings-xml-safe
  82  *             https://www.php.net/htmlspecialchars
  83  *             https://www.php.net/XMLWriter
  84  *
  85  *
  86  * Escapes & < > ' "
  87  * TODO: not sure if need to escape ' and ", which are escaping for now (via the ENT_QUOTES flag)
  88  */
  89 function xmlEscape($text)
  90 {
  91     return htmlspecialchars(($text ?? ''), ENT_XML1 | ENT_QUOTES);
  92 }
  93
  94 /**
  95  * Special function to remove the 'javascript' string (case insensitive) for when including a variable within a html link
  96  */
  97 function javascriptStringRemove($text)
  98 {
  99     return str_ireplace('javascript', '', $text ?? '');
 100 }
 101
 102 /**
 103  * Escape a PHP string for use as (part of) an HTML / XML text node.
 104  *
 105  * It only escapes a few special chars: the ampersand (&) and both the left-
 106  * pointing angle bracket (<) and the right-pointing angle bracket (>), since
 107  * these are the only characters that are special in a text node.  Minimal
 108  * quoting is preferred because it produces smaller and more easily human-
 109  * readable output.
 110  *
 111  * Some characters simply cannot appear in valid XML documents, even
 112  * as entities but, this function does not attempt to handle them.
 113  *
 114  * NOTE: Attribute values are NOT text nodes, and require additional escaping.
 115  *
 116  * @param string $text The string to escape, possibly including "&", "<",
 117  *                     or ">".
 118  * @return string The string, with "&", "<", and ">" escaped.
 119  */
 120 function text($text)
 121 {
 122     return htmlspecialchars(($text ?? ''), ENT_NOQUOTES);
 123 }
 124
 125 /**
 126  * Given an array of properties run through both the keys and values of the array and
 127  * escape each PHP string for use as (part of) an HTML / XML text node.
 128  *
 129  * It only escapes a few special chars: the ampersand (&) and both the left-
 130  * pointing angle bracket (<) and the right-pointing angle bracket (>), since
 131  * these are the only characters that are special in a text node.  Minimal
 132  * quoting is preferred because it produces smaller and more easily human-
 133  * readable output.
 134  *
 135  * Some characters simply cannot appear in valid XML documents, even
 136  * as entities but, this function does not attempt to handle them.
 137  *
 138  * NOTE: Attribute values are NOT text nodes, and require additional escaping.
 139  *
 140  * @param string $arr The array of strings to escape, possibly including "&", "<",
 141  *                     or ">".
 142  * @param int $depth The current recursive depth of the escaping function.  Defaults to 0 for initial call
 143  * @return array The array that has each key and property escaped.
 144  */
 145 function textArray(array $arr, $depth = 0)
 146 {
 147     if ($depth > 50) {
 148         throw new \InvalidArgumentException("array was nested too deep for escaping.  Max limit reached");
 149     }
 150
 151     $newArray = [];
 152     foreach ($arr as $key => $value) {
 153         if (is_array($value)) {
 154             $newArray[text($key)] = textArray($value, $depth + 1);
 155         } else {
 156             $newArray[text($key)] = text($value);
 157         }
 158     }
 159     return $newArray;
 160 }
 161
 162 /**
 163  * Escape a PHP string for use as (part of) an HTML / XML attribute value.
 164  *
 165  * It escapes several special chars: the ampersand (&), the double quote
 166  * ("), the singlequote ('), and both the left-pointing angle bracket (<)
 167  * and the right-pointing angle bracket (>), since these are the characters
 168  * that are special in an attribute value.
 169  *
 170  * Some characters simply cannot appear in valid XML documents, even
 171  * as entities but, this function does not attempt to handle them.
 172  *
 173  * NOTE: This can be used as a "generic" HTML escape since it does maximal
 174  * quoting.  However, some HTML and XML contexts (CDATA) don't provide
 175  * escape mechanisms.  Also, further pre- or post-escaping might need to
 176  * be done when embdedded other languages (like JavaScript) inside HTML /
 177  * XML documents.
 178  *
 179  * @param string $text The string to escape, possibly including (&), (<),
 180  *                     (>), ('), and (").
 181  * @return string The string, with (&), (<), (>), ("), and (') escaped.
 182  */
 183 function attr($text)
 184 {
 185     return htmlspecialchars(($text ?? ''), ENT_QUOTES);
 186 }
 187
 188 /**
 189  * Don't call this function.  You don't see this function.  This function
 190  * doesn't exist.
 191  *
 192  * TODO: Hide this function so it can be called from this file but not from
 193  * PHP that includes / requires this file.  Either that, or write reasonable
 194  * documentation and clean up the name.
 195  */
 196 function hsc_private_xl_or_warn($key)
 197 {
 198     if (function_exists('xl')) {
 199         return xl($key);
 200     } else {
 201         trigger_error(
 202             'Translation via xl() was requested, but the xl()'
 203             . ' function is not defined, yet.',
 204             E_USER_WARNING
 205         );
 206         return $key;
 207     }
 208 }
 209
 210 /**
 211  * Translate via xl() and then escape via text().
 212  *
 213  * @param string $key The string to escape, possibly including "&", "<",
 214  *                    or ">".
 215  * @return string The string, with "&", "<", and ">" escaped.
 216  */
 217 function xlt($key)
 218 {
 219     return text(hsc_private_xl_or_warn($key));
 220 }
 221
 222 /**
 223  * Translate via xl() and then escape via attr().
 224  *
 225  * @param string $key The string to escape, possibly including (&), (<),
 226  *                    (>), ('), and (").
 227  * @return string The string, with (&), (<), (>), ("), and (') escaped.
 228  */
 229 function xla($key)
 230 {
 231     return attr(hsc_private_xl_or_warn($key));
 232 }
 233
 234 /*
 235  * Translate via xl() and then escape via js_escape for use with javascript literals
 236  */
 237 function xlj($key)
 238 {
 239     return js_escape(hsc_private_xl_or_warn($key));
 240 }
 241
 242 /*
 243  * Deprecated
 244  *Translate via xl() and then escape via addslashes for use with javascript literals
 245  */
 246 function xls($key)
 247 {
 248     return addslashes(hsc_private_xl_or_warn($key));
 249 }