| [21] | 1 | <?php |
|---|
| 2 | |
|---|
| 3 | /** |
|---|
| 4 | * Base class for all validating attribute definitions. |
|---|
| 5 | * |
|---|
| 6 | * This family of classes forms the core for not only HTML attribute validation, |
|---|
| 7 | * but also any sort of string that needs to be validated or cleaned (which |
|---|
| 8 | * means CSS properties and composite definitions are defined here too). |
|---|
| 9 | * Besides defining (through code) what precisely makes the string valid, |
|---|
| 10 | * subclasses are also responsible for cleaning the code if possible. |
|---|
| 11 | */ |
|---|
| 12 | |
|---|
| 13 | abstract class HTMLPurifier_AttrDef |
|---|
| 14 | { |
|---|
| 15 | |
|---|
| 16 | /** |
|---|
| 17 | * Tells us whether or not an HTML attribute is minimized. Has no |
|---|
| 18 | * meaning in other contexts. |
|---|
| 19 | */ |
|---|
| 20 | public $minimized = false; |
|---|
| 21 | |
|---|
| 22 | /** |
|---|
| 23 | * Tells us whether or not an HTML attribute is required. Has no |
|---|
| 24 | * meaning in other contexts |
|---|
| 25 | */ |
|---|
| 26 | public $required = false; |
|---|
| 27 | |
|---|
| 28 | /** |
|---|
| 29 | * Validates and cleans passed string according to a definition. |
|---|
| 30 | * |
|---|
| 31 | * @param $string String to be validated and cleaned. |
|---|
| 32 | * @param $config Mandatory HTMLPurifier_Config object. |
|---|
| 33 | * @param $context Mandatory HTMLPurifier_AttrContext object. |
|---|
| 34 | */ |
|---|
| 35 | abstract public function validate($string, $config, $context); |
|---|
| 36 | |
|---|
| 37 | /** |
|---|
| 38 | * Convenience method that parses a string as if it were CDATA. |
|---|
| 39 | * |
|---|
| 40 | * This method process a string in the manner specified at |
|---|
| 41 | * <http://www.w3.org/TR/html4/types.html#h-6.2> by removing |
|---|
| 42 | * leading and trailing whitespace, ignoring line feeds, and replacing |
|---|
| 43 | * carriage returns and tabs with spaces. While most useful for HTML |
|---|
| 44 | * attributes specified as CDATA, it can also be applied to most CSS |
|---|
| 45 | * values. |
|---|
| 46 | * |
|---|
| 47 | * @note This method is not entirely standards compliant, as trim() removes |
|---|
| 48 | * more types of whitespace than specified in the spec. In practice, |
|---|
| 49 | * this is rarely a problem, as those extra characters usually have |
|---|
| 50 | * already been removed by HTMLPurifier_Encoder. |
|---|
| 51 | * |
|---|
| 52 | * @warning This processing is inconsistent with XML's whitespace handling |
|---|
| 53 | * as specified by section 3.3.3 and referenced XHTML 1.0 section |
|---|
| 54 | * 4.7. Compliant processing requires all line breaks normalized |
|---|
| 55 | * to "\n", so the fix is not as simple as fixing it in this |
|---|
| 56 | * function. Trim and whitespace collapsing are supposed to only |
|---|
| 57 | * occur in NMTOKENs. However, note that we are NOT necessarily |
|---|
| 58 | * parsing XML, thus, this behavior may still be correct. |
|---|
| 59 | */ |
|---|
| 60 | public function parseCDATA($string) { |
|---|
| 61 | $string = trim($string); |
|---|
| 62 | $string = str_replace("\n", '', $string); |
|---|
| 63 | $string = str_replace(array("\r", "\t"), ' ', $string); |
|---|
| 64 | return $string; |
|---|
| 65 | } |
|---|
| 66 | |
|---|
| 67 | /** |
|---|
| 68 | * Factory method for creating this class from a string. |
|---|
| 69 | * @param $string String construction info |
|---|
| 70 | * @return Created AttrDef object corresponding to $string |
|---|
| 71 | */ |
|---|
| 72 | public function make($string) { |
|---|
| 73 | // default implementation, return a flyweight of this object. |
|---|
| 74 | // If $string has an effect on the returned object (i.e. you |
|---|
| 75 | // need to overload this method), it is best |
|---|
| 76 | // to clone or instantiate new copies. (Instantiation is safer.) |
|---|
| 77 | return $this; |
|---|
| 78 | } |
|---|
| 79 | |
|---|
| 80 | /** |
|---|
| 81 | * Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work |
|---|
| 82 | * properly. THIS IS A HACK! |
|---|
| 83 | */ |
|---|
| 84 | protected function mungeRgb($string) { |
|---|
| 85 | return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string); |
|---|
| 86 | } |
|---|
| 87 | |
|---|
| 88 | } |
|---|
| 89 | |
|---|