lib/htmlpurifier/HTMLPurifier/AttrDef/CSS.php

   1 <?php
   2
   3 require_once 'HTMLPurifier/AttrDef.php';
   4 require_once 'HTMLPurifier/CSSDefinition.php';
   5
   6 /**
   7  * Validates the HTML attribute style, otherwise known as CSS.
   8  * @note We don't implement the whole CSS specification, so it might be
   9  *       difficult to reuse this component in the context of validating
  10  *       actual stylesheet declarations.
  11  * @note If we were really serious about validating the CSS, we would
  12  *       tokenize the styles and then parse the tokens. Obviously, we
  13  *       are not doing that. Doing that could seriously harm performance,
  14  *       but would make these components a lot more viable for a CSS
  15  *       filtering solution.
  16  */
  17 class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
  18 {
  19
  20     function validate($css, $config, &$context) {
  21
  22         $css = $this->parseCDATA($css);
  23
  24         $definition = $config->getCSSDefinition();
  25
  26         // we're going to break the spec and explode by semicolons.
  27         // This is because semicolon rarely appears in escaped form
  28         // Doing this is generally flaky but fast
  29         // IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI
  30         // for details
  31
  32         $declarations = explode(';', $css);
  33         $propvalues = array();
  34
  35         foreach ($declarations as $declaration) {
  36             if (!$declaration) continue;
  37             if (!strpos($declaration, ':')) continue;
  38             list($property, $value) = explode(':', $declaration, 2);
  39             $property = trim($property);
  40             $value    = trim($value);
  41             $ok = false;
  42             do {
  43                 if (isset($definition->info[$property])) {
  44                     $ok = true;
  45                     break;
  46                 }
  47                 if (ctype_lower($property)) break;
  48                 $property = strtolower($property);
  49                 if (isset($definition->info[$property])) {
  50                     $ok = true;
  51                     break;
  52                 }
  53             } while(0);
  54             if (!$ok) continue;
  55             // inefficient call, since the validator will do this again
  56             if (strtolower(trim($value)) !== 'inherit') {
  57                 // inherit works for everything (but only on the base property)
  58                 $result = $definition->info[$property]->validate(
  59                     $value, $config, $context );
  60             } else {
  61                 $result = 'inherit';
  62             }
  63             if ($result === false) continue;
  64             $propvalues[$property] = $result;
  65         }
  66
  67         // procedure does not write the new CSS simultaneously, so it's
  68         // slightly inefficient, but it's the only way of getting rid of
  69         // duplicates. Perhaps config to optimize it, but not now.
  70
  71         $new_declarations = '';
  72         foreach ($propvalues as $prop => $value) {
  73             $new_declarations .= "$prop:$value;";
  74         }
  75
  76         return $new_declarations ? $new_declarations : false;
  77
  78     }
  79
  80 }
  81