Rui Francisco
8 years ago
committed by
GitHub
15 changed files with 4808 additions and 4837 deletions
@ -1,444 +1,444 @@ |
|||||||
<?php // $Id$
|
<?php |
||||||
|
|
||||||
// vim: expandtab sw=4 ts=4 sts=4: |
/** |
||||||
|
* @file |
||||||
# ***** BEGIN LICENSE BLOCK ***** |
* $Id$. |
||||||
# This file is part of HTML Sanitizer. |
*/ |
||||||
# Copyright (c) 2005-2011 Frederic Minne <zefredz@gmail.com>. |
|
||||||
# All rights reserved. |
|
||||||
# |
|
||||||
# HTML Sanitizer is free software; you can redistribute it and/or modify |
|
||||||
# it under the terms of the GNU Lesser General Public License as published by |
|
||||||
# the Free Software Foundation; either version 3 of the License, or |
|
||||||
# (at your option) any later version. |
|
||||||
# |
|
||||||
# HTML Sanitizer is distributed in the hope that it will be useful, |
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
||||||
# GNU General Public License for more details. |
|
||||||
# |
|
||||||
# You should have received a copy of the GNU Lesser General Public License |
|
||||||
# along with HTML Sanitizer; if not, see <http://www.gnu.org/licenses/>. |
|
||||||
# |
|
||||||
# ***** END LICENSE BLOCK ***** |
|
||||||
|
|
||||||
|
// vim: expandtab sw=4 ts=4 sts=4: |
||||||
|
// ***** BEGIN LICENSE BLOCK ***** |
||||||
|
// This file is part of HTML Sanitizer. |
||||||
|
// Copyright (c) 2005-2011 Frederic Minne <zefredz@gmail.com>. |
||||||
|
// All rights reserved. |
||||||
|
// |
||||||
|
// HTML Sanitizer is free software; you can redistribute it and/or modify |
||||||
|
// it under the terms of the GNU Lesser General Public License as published by |
||||||
|
// the Free Software Foundation; either version 3 of the License, or |
||||||
|
// (at your option) any later version. |
||||||
|
// |
||||||
|
// HTML Sanitizer is distributed in the hope that it will be useful, |
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||||
|
// GNU General Public License for more details. |
||||||
|
// |
||||||
|
// You should have received a copy of the GNU Lesser General Public License |
||||||
|
// along with HTML Sanitizer; if not, see <http://www.gnu.org/licenses/>. |
||||||
|
// |
||||||
|
// ***** END LICENSE BLOCK *****. |
||||||
/** |
/** |
||||||
* Sanitize HTML contents : |
* Sanitize HTML contents : |
||||||
* Remove dangerous tags and attributes that can lead to security issues like |
* Remove dangerous tags and attributes that can lead to security issues like |
||||||
* XSS or HTTP response splitting |
* XSS or HTTP response splitting. |
||||||
* |
* |
||||||
* @author Frederic Minne <zefredz@gmail.com> |
* @author Frederic Minne <zefredz@gmail.com> |
||||||
* @copyright Copyright © 2005-2011, Frederic Minne |
* @copyright Copyright © 2005-2011, Frederic Minne |
||||||
* @license http://www.gnu.org/licenses/lgpl.txt GNU Lesser General Public License version 3 or later |
* @license http://www.gnu.org/licenses/lgpl.txt GNU Lesser General Public License version 3 or later |
||||||
* @version 1.1 |
* @version 1.1 |
||||||
*/ |
*/ |
||||||
class HTML_Sanitizer |
class HTML_Sanitizer { |
||||||
{ |
/** |
||||||
// Private fields |
* Private fields. |
||||||
private $_allowedTags; |
*/ |
||||||
private $_allowJavascriptEvents; |
private $_allowedTags; |
||||||
private $_allowJavascriptInUrls; |
private $_allowJavascriptEvents; |
||||||
private $_allowObjects; |
private $_allowJavascriptInUrls; |
||||||
private $_allowScript; |
private $_allowObjects; |
||||||
private $_allowStyle; |
private $_allowScript; |
||||||
private $_additionalTags; |
private $_allowStyle; |
||||||
|
private $_additionalTags; |
||||||
/** |
|
||||||
* Constructor |
/** |
||||||
*/ |
* Constructor. |
||||||
public function __construct() |
*/ |
||||||
{ |
public function __construct() { |
||||||
$this->resetAll(); |
$this->resetAll(); |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* (re)set all options to default value |
* (re)set all options to default value. |
||||||
*/ |
*/ |
||||||
public function resetAll() |
public function resetAll() { |
||||||
{ |
$this->_allowDOMEvents = FALSE; |
||||||
$this->_allowDOMEvents = false; |
$this->_allowJavascriptInUrls = FALSE; |
||||||
$this->_allowJavascriptInUrls = false; |
$this->_allowStyle = FALSE; |
||||||
$this->_allowStyle = false; |
$this->_allowScript = FALSE; |
||||||
$this->_allowScript = false; |
$this->_allowObjects = FALSE; |
||||||
$this->_allowObjects = false; |
$this->_allowStyle = FALSE; |
||||||
$this->_allowStyle = false; |
|
||||||
|
$this->_allowedTags = '<a><br><b><h1><h2><h3><h4><h5><h6>' |
||||||
$this->_allowedTags = '<a><br><b><h1><h2><h3><h4><h5><h6>' |
|
||||||
. '<img><li><ol><p><strong><table><tr><td><th><u><ul><thead>' |
. '<img><li><ol><p><strong><table><tr><td><th><u><ul><thead>' |
||||||
. '<tbody><tfoot><em><dd><dt><dl><span><div><del><add><i><hr>' |
. '<tbody><tfoot><em><dd><dt><dl><span><div><del><add><i><hr>' |
||||||
. '<pre><br><blockquote><address><code><caption><abbr><acronym>' |
. '<pre><br><blockquote><address><code><caption><abbr><acronym>' |
||||||
. '<cite><dfn><q><ins><sup><sub><kbd><samp><var><tt><small><big>' |
. '<cite><dfn><q><ins><sup><sub><kbd><samp><var><tt><small><big>'; |
||||||
; |
|
||||||
|
|
||||||
$this->_additionalTags = ''; |
|
||||||
} |
|
||||||
|
|
||||||
/** |
|
||||||
* Add additional tags to allowed tags |
|
||||||
* @param string |
|
||||||
* @access public |
|
||||||
*/ |
|
||||||
public function addAdditionalTags( $tags ) |
|
||||||
{ |
|
||||||
$this->_additionalTags .= $tags; |
|
||||||
} |
|
||||||
|
|
||||||
/** |
$this->_additionalTags = ''; |
||||||
* Allow iframes |
} |
||||||
* @access public |
|
||||||
*/ |
|
||||||
public function allowIframes() |
|
||||||
{ |
|
||||||
$this->addAdditionalTags( '<iframe>' ); |
|
||||||
} |
|
||||||
|
|
||||||
/** |
/** |
||||||
* Allow HTML5 media tags |
* Add additional tags to allowed tags. |
||||||
* @access public |
* |
||||||
*/ |
* @param string |
||||||
public function allowHtml5Media() |
* |
||||||
{ |
* @access public |
||||||
$this->addAdditionalTags( '<canvas><video><audio>' ); |
*/ |
||||||
} |
public function addAdditionalTags($tags) { |
||||||
|
$this->_additionalTags .= $tags; |
||||||
|
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Allow object, embed, applet and param tags in html |
* Allow iframes. |
||||||
* @access public |
* |
||||||
*/ |
* @access public |
||||||
public function allowObjects() |
*/ |
||||||
{ |
public function allowIframes() { |
||||||
$this->_allowObjects = true; |
$this->addAdditionalTags('<iframe>'); |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Allow DOM event on DOM elements |
* Allow HTML5 media tags. |
||||||
* @access public |
* |
||||||
*/ |
* @access public |
||||||
public function allowDOMEvents() |
*/ |
||||||
{ |
public function allowHtml5Media() { |
||||||
$this->_allowDOMEvents = true; |
$this->addAdditionalTags('<canvas><video><audio>'); |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Allow script tags |
* Allow object, embed, applet and param tags in html. |
||||||
* @access public |
* |
||||||
*/ |
* @access public |
||||||
public function allowScript() |
*/ |
||||||
{ |
public function allowObjects() { |
||||||
$this->_allowScript = true; |
$this->_allowObjects = TRUE; |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Allow the use of javascript: in urls |
* Allow DOM event on DOM elements. |
||||||
* @access public |
* |
||||||
*/ |
* @access public |
||||||
public function allowJavascriptInUrls() |
*/ |
||||||
{ |
public function allowDOMEvents() { |
||||||
$this->_allowJavascriptInUrls = true; |
$this->_allowDOMEvents = TRUE; |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Allow style tags and attributes |
* Allow script tags. |
||||||
* @access public |
* |
||||||
*/ |
* @access public |
||||||
public function allowStyle() |
*/ |
||||||
{ |
public function allowScript() { |
||||||
$this->_allowStyle = true; |
$this->_allowScript = TRUE; |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Helper to allow all javascript related tags and attributes |
* Allow the use of javascript: in urls. |
||||||
* @access public |
* |
||||||
*/ |
* @access public |
||||||
public function allowAllJavascript() |
*/ |
||||||
{ |
public function allowJavascriptInUrls() { |
||||||
$this->allowDOMEvents(); |
$this->_allowJavascriptInUrls = TRUE; |
||||||
$this->allowScript(); |
} |
||||||
$this->allowJavascriptInUrls(); |
|
||||||
} |
/** |
||||||
|
* Allow style tags and attributes. |
||||||
/** |
* |
||||||
* Allow all tags and attributes |
* @access public |
||||||
* @access public |
*/ |
||||||
*/ |
public function allowStyle() { |
||||||
public function allowAll() |
$this->_allowStyle = TRUE; |
||||||
{ |
} |
||||||
$this->allowAllJavascript(); |
|
||||||
$this->allowObjects(); |
/** |
||||||
$this->allowStyle(); |
* Helper to allow all javascript related tags and attributes. |
||||||
$this->allowIframes(); |
* |
||||||
$this->allowHtml5Media(); |
* @access public |
||||||
} |
*/ |
||||||
|
public function allowAllJavascript() { |
||||||
/** |
$this->allowDOMEvents(); |
||||||
* Filter URLs to avoid HTTP response splitting attacks |
$this->allowScript(); |
||||||
* @access public |
$this->allowJavascriptInUrls(); |
||||||
* @param string url |
} |
||||||
* @return string filtered url |
|
||||||
*/ |
/** |
||||||
public function filterHTTPResponseSplitting( $url ) |
* Allow all tags and attributes. |
||||||
{ |
* |
||||||
$dangerousCharactersPattern = '~(\r\n|\r|\n|%0a|%0d|%0D|%0A)~'; |
* @access public |
||||||
return preg_replace( $dangerousCharactersPattern, '', $url ); |
*/ |
||||||
} |
public function allowAll() { |
||||||
|
$this->allowAllJavascript(); |
||||||
/** |
$this->allowObjects(); |
||||||
* Remove potential javascript in urls |
$this->allowStyle(); |
||||||
* @access public |
$this->allowIframes(); |
||||||
* @param string url |
$this->allowHtml5Media(); |
||||||
* @return string filtered url |
} |
||||||
*/ |
|
||||||
public function removeJavascriptURL( $str ) |
/** |
||||||
{ |
* Filter URLs to avoid HTTP response splitting attacks. |
||||||
$HTML_Sanitizer_stripJavascriptURL = 'javascript:[^"]+'; |
* |
||||||
|
* @access public |
||||||
$str = preg_replace("/$HTML_Sanitizer_stripJavascriptURL/i" |
* @param string url |
||||||
, '__forbidden__' |
* |
||||||
, $str ); |
* @return string filtered url |
||||||
|
*/ |
||||||
return $str; |
public function filterHTTPResponseSplitting($url) { |
||||||
} |
$dangerousCharactersPattern = '~(\r\n|\r|\n|%0a|%0d|%0D|%0A)~'; |
||||||
|
return preg_replace($dangerousCharactersPattern, '', $url); |
||||||
/** |
} |
||||||
* Remove potential flaws in urls |
|
||||||
* @access private |
/** |
||||||
* @param string url |
* Remove potential javascript in urls. |
||||||
* @return string filtered url |
* |
||||||
*/ |
* @access public |
||||||
private function sanitizeURL( $url ) |
* @param string url |
||||||
{ |
* |
||||||
if ( ! $this->_allowJavascriptInUrls ) |
* @return string filtered url |
||||||
{ |
*/ |
||||||
$url = $this->removeJavascriptURL( $url ); |
public function removeJavascriptURL($str) { |
||||||
} |
$HTML_Sanitizer_stripJavascriptURL = 'javascript:[^"]+'; |
||||||
|
|
||||||
$url = $this->filterHTTPResponseSplitting( $url ); |
$str = preg_replace("/$HTML_Sanitizer_stripJavascriptURL/i", '__forbidden__', $str); |
||||||
|
|
||||||
return $url; |
return $str; |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Callback for PCRE |
* Remove potential flaws in urls. |
||||||
* @access private |
* |
||||||
* @param matches array |
* @access private |
||||||
* @return string |
* @param string url |
||||||
* @see sanitizeURL |
* |
||||||
*/ |
* @return string filtered url |
||||||
private function _sanitizeURLCallback( $matches ) |
*/ |
||||||
{ |
private function sanitizeURL($url) { |
||||||
return 'href="'.$this->sanitizeURL( $matches[1] ).'"'; |
if (!$this->_allowJavascriptInUrls) { |
||||||
} |
$url = $this->removeJavascriptURL($url); |
||||||
|
|
||||||
/** |
|
||||||
* Remove potential flaws in href attributes |
|
||||||
* @access private |
|
||||||
* @param string html tag |
|
||||||
* @return string filtered html tag |
|
||||||
*/ |
|
||||||
private function sanitizeHref( $str ) |
|
||||||
{ |
|
||||||
$HTML_Sanitizer_URL = 'href="([^"]+)"'; |
|
||||||
|
|
||||||
return preg_replace_callback("/$HTML_Sanitizer_URL/i" |
|
||||||
, array( &$this, '_sanitizeURLCallback' ) |
|
||||||
, $str ); |
|
||||||
} |
|
||||||
|
|
||||||
/** |
|
||||||
* Callback for PCRE |
|
||||||
* @access private |
|
||||||
* @param matches array |
|
||||||
* @return string |
|
||||||
* @see sanitizeURL |
|
||||||
*/ |
|
||||||
private function _sanitizeSrcCallback( $matches ) |
|
||||||
{ |
|
||||||
return 'src="'.$this->sanitizeURL( $matches[1] ).'"'; |
|
||||||
} |
} |
||||||
|
|
||||||
/** |
$url = $this->filterHTTPResponseSplitting($url); |
||||||
* Remove potential flaws in href attributes |
|
||||||
* @access private |
return $url; |
||||||
* @param string html tag |
} |
||||||
* @return string filtered html tag |
|
||||||
*/ |
/** |
||||||
private function sanitizeSrc( $str ) |
* Callback for PCRE. |
||||||
{ |
* |
||||||
$HTML_Sanitizer_URL = 'src="([^"]+)"'; |
* @access private |
||||||
|
* @param matches array |
||||||
return preg_replace_callback("/$HTML_Sanitizer_URL/i" |
* |
||||||
, array( &$this, '_sanitizeSrcCallback' ) |
* @return string |
||||||
, $str ); |
* |
||||||
|
* @see sanitizeURL |
||||||
|
*/ |
||||||
|
private function _sanitizeURLCallback($matches) { |
||||||
|
return 'href="' . $this->sanitizeURL($matches[1]) . '"'; |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* Remove potential flaws in href attributes. |
||||||
|
* |
||||||
|
* @access private |
||||||
|
* @param string html tag |
||||||
|
* |
||||||
|
* @return string filtered html tag |
||||||
|
*/ |
||||||
|
private function sanitizeHref($str) { |
||||||
|
$HTML_Sanitizer_URL = 'href="([^"]+)"'; |
||||||
|
|
||||||
|
return preg_replace_callback("/$HTML_Sanitizer_URL/i", array(&$this, '_sanitizeURLCallback'), $str); |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* Callback for PCRE. |
||||||
|
* |
||||||
|
* @access private |
||||||
|
* @param matches array |
||||||
|
* |
||||||
|
* @return string |
||||||
|
* |
||||||
|
* @see sanitizeURL |
||||||
|
*/ |
||||||
|
private function _sanitizeSrcCallback($matches) { |
||||||
|
return 'src="' . $this->sanitizeURL($matches[1]) . '"'; |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* Remove potential flaws in href attributes. |
||||||
|
* |
||||||
|
* @access private |
||||||
|
* @param string html tag |
||||||
|
* |
||||||
|
* @return string filtered html tag |
||||||
|
*/ |
||||||
|
private function sanitizeSrc($str) { |
||||||
|
$HTML_Sanitizer_URL = 'src="([^"]+)"'; |
||||||
|
|
||||||
|
return preg_replace_callback("/$HTML_Sanitizer_URL/i", array(&$this, '_sanitizeSrcCallback'), $str); |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* Remove dangerous attributes from html tags. |
||||||
|
* |
||||||
|
* @access private |
||||||
|
* @param string html tag |
||||||
|
* |
||||||
|
* @return string filtered html tag |
||||||
|
*/ |
||||||
|
private function removeEvilAttributes($str) { |
||||||
|
if (!$this->_allowDOMEvents) { |
||||||
|
$str = preg_replace_callback('/<(.*?)>/i', array(&$this, '_removeDOMEventsCallback'), $str); |
||||||
} |
} |
||||||
|
|
||||||
/** |
if (!$this->_allowStyle) { |
||||||
* Remove dangerous attributes from html tags |
$str = preg_replace_callback('/<(.*?)>/i', array(&$this, '_removeStyleCallback'), $str); |
||||||
* @access private |
|
||||||
* @param string html tag |
|
||||||
* @return string filtered html tag |
|
||||||
*/ |
|
||||||
private function removeEvilAttributes( $str ) |
|
||||||
{ |
|
||||||
if ( ! $this->_allowDOMEvents ) |
|
||||||
{ |
|
||||||
$str = preg_replace_callback('/<(.*?)>/i' |
|
||||||
, array( &$this, '_removeDOMEventsCallback' ) |
|
||||||
, $str ); |
|
||||||
} |
|
||||||
|
|
||||||
if ( ! $this->_allowStyle ) |
|
||||||
{ |
|
||||||
$str = preg_replace_callback('/<(.*?)>/i' |
|
||||||
, array( &$this, '_removeStyleCallback' ) |
|
||||||
, $str ); |
|
||||||
} |
|
||||||
|
|
||||||
return $str; |
|
||||||
} |
} |
||||||
|
|
||||||
/** |
return $str; |
||||||
* Remove DOM events attributes from html tags |
} |
||||||
* @access private |
|
||||||
* @param string html tag |
/** |
||||||
* @return string filtered html tag |
* Remove DOM events attributes from html tags. |
||||||
*/ |
* |
||||||
private function removeDOMEvents( $str ) |
* @access private |
||||||
{ |
* @param string html tag |
||||||
$str = preg_replace ( '/\s*=\s*/', '=', $str ); |
* |
||||||
|
* @return string filtered html tag |
||||||
$HTML_Sanitizer_stripAttrib = '(onclick|ondblclick|onmousedown|' |
*/ |
||||||
|
private function removeDOMEvents($str) { |
||||||
|
$str = preg_replace('/\s*=\s*/', '=', $str); |
||||||
|
|
||||||
|
$HTML_Sanitizer_stripAttrib = '(onclick|ondblclick|onmousedown|' |
||||||
. 'onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|' |
. 'onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|' |
||||||
. 'onkeyup|onfocus|onblur|onabort|onerror|onload)' |
. 'onkeyup|onfocus|onblur|onabort|onerror|onload)'; |
||||||
; |
|
||||||
|
|
||||||
$str = stripslashes( preg_replace("/$HTML_Sanitizer_stripAttrib/i" |
$str = stripslashes(preg_replace("/$HTML_Sanitizer_stripAttrib/i", 'forbidden', $str)); |
||||||
, 'forbidden' |
|
||||||
, $str ) ); |
|
||||||
|
|
||||||
return $str; |
return $str; |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Callback for PCRE |
* Callback for PCRE. |
||||||
* @access private |
* |
||||||
* @param matches array |
* @access private |
||||||
* @return string |
* @param matches array |
||||||
* @see removeDOMEvents |
* |
||||||
*/ |
* @return string |
||||||
private function _removeDOMEventsCallback( $matches ) |
* |
||||||
{ |
* @see removeDOMEvents |
||||||
return '<' . $this->removeDOMEvents( $matches[1] ) . '>'; |
*/ |
||||||
} |
private function _removeDOMEventsCallback($matches) { |
||||||
|
return '<' . $this->removeDOMEvents($matches[1]) . '>'; |
||||||
/** |
} |
||||||
* Remove style attributes from html tags |
|
||||||
* @access private |
/** |
||||||
* @param string html tag |
* Remove style attributes from html tags. |
||||||
* @return string filtered html tag |
* |
||||||
*/ |
* @access private |
||||||
private function removeStyle( $str ) |
* @param string html tag |
||||||
{ |
* |
||||||
$str = preg_replace ( '/\s*=\s*/', '=', $str ); |
* @return string filtered html tag |
||||||
|
*/ |
||||||
$HTML_Sanitizer_stripAttrib = '(style)' |
private function removeStyle($str) { |
||||||
; |
$str = preg_replace('/\s*=\s*/', '=', $str); |
||||||
|
|
||||||
$str = stripslashes( preg_replace("/$HTML_Sanitizer_stripAttrib/i" |
$HTML_Sanitizer_stripAttrib = '(style)'; |
||||||
, 'forbidden' |
|
||||||
, $str ) ); |
$str = stripslashes(preg_replace("/$HTML_Sanitizer_stripAttrib/i", 'forbidden', $str)); |
||||||
|
|
||||||
return $str; |
return $str; |
||||||
} |
} |
||||||
|
|
||||||
/** |
/** |
||||||
* Callback for PCRE |
* Callback for PCRE. |
||||||
* @access private |
* |
||||||
* @param matches array |
* @access private |
||||||
* @return string |
* @param matches array |
||||||
* @see removeStyle |
* |
||||||
*/ |
* @return string |
||||||
private function _removeStyleCallback( $matches ) |
* |
||||||
{ |
* @see removeStyle |
||||||
return '<' . $this->removeStyle( $matches[1] ) . '>'; |
*/ |
||||||
} |
private function _removeStyleCallback($matches) { |
||||||
|
return '<' . $this->removeStyle($matches[1]) . '>'; |
||||||
/** |
} |
||||||
* Remove dangerous HTML tags |
|
||||||
* @access private |
/** |
||||||
* @param string html code |
* Remove dangerous HTML tags. |
||||||
* @return string filtered url |
* |
||||||
*/ |
* @access private |
||||||
private function removeEvilTags( $str ) |
* @param string html code |
||||||
{ |
* |
||||||
$allowedTags = $this->_allowedTags; |
* @return string filtered url |
||||||
|
*/ |
||||||
if ( $this->_allowScript ) |
private function removeEvilTags($str) { |
||||||
{ |
$allowedTags = $this->_allowedTags; |
||||||
$allowedTags .= '<script>'; |
|
||||||
} |
if ($this->_allowScript) { |
||||||
|
$allowedTags .= '<script>'; |
||||||
if ( $this->_allowStyle ) |
|
||||||
{ |
|
||||||
$allowedTags .= '<style>'; |
|
||||||
} |
|
||||||
|
|
||||||
if ( $this->_allowObjects ) |
|
||||||
{ |
|
||||||
$allowedTags .= '<object><embed><applet><param>'; |
|
||||||
} |
|
||||||
|
|
||||||
$allowedTags .= $this->_additionalTags; |
|
||||||
|
|
||||||
$str = strip_tags($str, $allowedTags ); |
|
||||||
|
|
||||||
return $str; |
|
||||||
} |
} |
||||||
|
|
||||||
/** |
if ($this->_allowStyle) { |
||||||
* Sanitize HTML |
$allowedTags .= '<style>'; |
||||||
* remove dangerous tags and attributes |
|
||||||
* clean urls |
|
||||||
* @access public |
|
||||||
* @param string html code |
|
||||||
* @return string sanitized html code |
|
||||||
*/ |
|
||||||
public function sanitize( $html ) |
|
||||||
{ |
|
||||||
$html = $this->removeEvilTags( $html ); |
|
||||||
|
|
||||||
$html = $this->removeEvilAttributes( $html ); |
|
||||||
|
|
||||||
$html = $this->sanitizeHref( $html ); |
|
||||||
|
|
||||||
$html = $this->sanitizeSrc( $html ); |
|
||||||
|
|
||||||
return $html; |
|
||||||
} |
} |
||||||
} |
|
||||||
|
|
||||||
function html_sanitize( $str ) |
if ($this->_allowObjects) { |
||||||
{ |
$allowedTags .= '<object><embed><applet><param>'; |
||||||
static $san = null; |
|
||||||
|
|
||||||
if ( empty( $san ) ) |
|
||||||
{ |
|
||||||
$san = new HTML_Sanitizer; |
|
||||||
} |
} |
||||||
|
|
||||||
return $san->sanitize( $str ); |
$allowedTags .= $this->_additionalTags; |
||||||
|
|
||||||
|
$str = strip_tags($str, $allowedTags); |
||||||
|
|
||||||
|
return $str; |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* Sanitize HTML |
||||||
|
* remove dangerous tags and attributes |
||||||
|
* clean urls. |
||||||
|
* |
||||||
|
* @access public |
||||||
|
* @param string html code |
||||||
|
* |
||||||
|
* @return string sanitized html code |
||||||
|
*/ |
||||||
|
public function sanitize($html) { |
||||||
|
$html = $this->removeEvilTags($html); |
||||||
|
|
||||||
|
$html = $this->removeEvilAttributes($html); |
||||||
|
|
||||||
|
$html = $this->sanitizeHref($html); |
||||||
|
|
||||||
|
$html = $this->sanitizeSrc($html); |
||||||
|
|
||||||
|
return $html; |
||||||
|
} |
||||||
|
|
||||||
} |
} |
||||||
|
|
||||||
function html_loose_sanitize( $str ) |
/** |
||||||
{ |
* |
||||||
static $san = null; |
*/ |
||||||
|
function html_sanitize($str) { |
||||||
if ( empty( $san ) ) |
static $san = NULL; |
||||||
{ |
|
||||||
$san = new HTML_Sanitizer; |
if (empty($san)) { |
||||||
$san->allowAll(); |
$san = new HTML_Sanitizer(); |
||||||
} |
} |
||||||
|
|
||||||
return $san->sanitize( $str ); |
|
||||||
|
|
||||||
|
return $san->sanitize($str); |
||||||
} |
} |
||||||
|
|
||||||
|
/** |
||||||
|
* |
||||||
|
*/ |
||||||
|
function html_loose_sanitize($str) { |
||||||
|
static $san = NULL; |
||||||
|
|
||||||
|
if (empty($san)) { |
||||||
|
$san = new HTML_Sanitizer(); |
||||||
|
$san->allowAll(); |
||||||
|
} |
||||||
|
|
||||||
|
return $san->sanitize($str); |
||||||
|
|
||||||
|
} |
||||||
|
|||||||
Loading…
Reference in new issue