lib/htmlpurifier/HTMLPurifier/URISchemeRegistry.php

   1 <?php
   2
   3 HTMLPurifier_ConfigSchema::define(
   4     'URI', 'AllowedSchemes', array(
   5         'http'  => true, // "Hypertext Transfer Protocol", nuf' said
   6         'https' => true, // HTTP over SSL (Secure Socket Layer)
   7         // quite useful, but not necessary
   8         'mailto' => true,// Email
   9         'ftp'   => true, // "File Transfer Protocol"
  10         'irc'   => true, // "Internet Relay Chat", usually needs another app
  11         // for Usenet, these two are similar, but distinct
  12         'nntp'  => true, // individual Netnews articles
  13         'news'  => true  // newsgroup or individual Netnews articles
  14     ), 'lookup',
  15     'Whitelist that defines the schemes that a URI is allowed to have.  This '.
  16     'prevents XSS attacks from using pseudo-schemes like javascript or mocha.'
  17 );
  18
  19 HTMLPurifier_ConfigSchema::define(
  20     'URI', 'OverrideAllowedSchemes', true, 'bool',
  21     'If this is set to true (which it is by default), you can override '.
  22     '%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme '.
  23     'to the registry.  If false, you will also have to update that directive '.
  24     'in order to add more schemes.'
  25 );
  26
  27 /**
  28  * Registry for retrieving specific URI scheme validator objects.
  29  */
  30 class HTMLPurifier_URISchemeRegistry
  31 {
  32
  33     /**
  34      * Retrieve sole instance of the registry.
  35      * @static
  36      * @param $prototype Optional prototype to overload sole instance with,
  37      *                   or bool true to reset to default registry.
  38      * @note Pass a registry object $prototype with a compatible interface and
  39      *       the function will copy it and return it all further times.
  40      */
  41     function &instance($prototype = null) {
  42         static $instance = null;
  43         if ($prototype !== null) {
  44             $instance = $prototype;
  45         } elseif ($instance === null || $prototype == true) {
  46             $instance = new HTMLPurifier_URISchemeRegistry();
  47         }
  48         return $instance;
  49     }
  50
  51     /**
  52      * Cache of retrieved schemes.
  53      * @protected
  54      */
  55     var $schemes = array();
  56
  57     /**
  58      * Directory where scheme objects can be found
  59      * @private
  60      */
  61     var $_scheme_dir = null;
  62
  63     /**
  64      * Retrieves a scheme validator object
  65      * @param $scheme String scheme name like http or mailto
  66      * @param $config HTMLPurifier_Config object
  67      * @param $config HTMLPurifier_Context object
  68      */
  69     function &getScheme($scheme, $config, &$context) {
  70         if (!$config) $config = HTMLPurifier_Config::createDefault();
  71         $null = null; // for the sake of passing by reference
  72
  73         // important, otherwise attacker could include arbitrary file
  74         $allowed_schemes = $config->get('URI', 'AllowedSchemes');
  75         if (!$config->get('URI', 'OverrideAllowedSchemes') &&
  76             !isset($allowed_schemes[$scheme])
  77         ) {
  78             return $null;
  79         }
  80
  81         if (isset($this->schemes[$scheme])) return $this->schemes[$scheme];
  82         if (empty($this->_dir)) $this->_dir = dirname(__FILE__) . '/URIScheme/';
  83
  84         if (!isset($allowed_schemes[$scheme])) return $null;
  85
  86         @include_once $this->_dir . $scheme . '.php';
  87         $class = 'HTMLPurifier_URIScheme_' . $scheme;
  88         if (!class_exists($class)) return $null;
  89         $this->schemes[$scheme] = new $class();
  90         return $this->schemes[$scheme];
  91     }
  92
  93     /**
  94      * Registers a custom scheme to the cache.
  95      * @param $scheme Scheme name
  96      * @param $scheme_obj HTMLPurifier_URIScheme object
  97      */
  98     function register($scheme, &$scheme_obj) {
  99         $this->schemes[$scheme] =& $scheme_obj;
 100     }
 101
 102 }
 103
 104 ?>