lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php

   1 <?php
   2
   3 require_once 'HTMLPurifier/AttrDef.php';
   4
   5 // whitelisting allowed fonts would be nice
   6
   7 /**
   8  * Validates a font family list according to CSS spec
   9  */
  10 class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
  11 {
  12
  13     /**
  14      * Generic font family keywords.
  15      * @protected
  16      */
  17     var $generic_names = array(
  18         'serif' => true,
  19         'sans-serif' => true,
  20         'monospace' => true,
  21         'fantasy' => true,
  22         'cursive' => true
  23     );
  24
  25     function validate($string, $config, &$context) {
  26         $string = $this->parseCDATA($string);
  27         // assume that no font names contain commas in them
  28         $fonts = explode(',', $string);
  29         $final = '';
  30         foreach($fonts as $font) {
  31             $font = trim($font);
  32             if ($font === '') continue;
  33             // match a generic name
  34             if (isset($this->generic_names[$font])) {
  35                 $final .= $font . ', ';
  36                 continue;
  37             }
  38             // match a quoted name
  39             if ($font[0] === '"' || $font[0] === "'") {
  40                 $length = strlen($font);
  41                 if ($length <= 2) continue;
  42                 $quote = $font[0];
  43                 if ($font[$length - 1] !== $quote) continue;
  44                 $font = substr($font, 1, $length - 2);
  45             }
  46             // process font
  47             if (ctype_alnum($font)) {
  48                 // very simple font, allow it in unharmed
  49                 $final .= $font . ', ';
  50                 continue;
  51             }
  52             $nospace = str_replace(array(' ', '.', '!'), '', $font);
  53             if (ctype_alnum($nospace)) {
  54                 // font with spaces in it
  55                 $final .= "'$font', ";
  56                 continue;
  57             }
  58         }
  59         $final = rtrim($final, ', ');
  60         if ($final === '') return false;
  61         return $final;
  62     }
  63
  64 }
  65
  66 ?>