| 1 |
efrain |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
/**
|
|
|
4 |
* Adds important param elements to inside of object in order to make
|
|
|
5 |
* things safe.
|
|
|
6 |
*/
|
|
|
7 |
class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
|
|
|
8 |
{
|
|
|
9 |
/**
|
|
|
10 |
* @type string
|
|
|
11 |
*/
|
|
|
12 |
public $name = 'SafeObject';
|
|
|
13 |
|
|
|
14 |
/**
|
|
|
15 |
* @type array
|
|
|
16 |
*/
|
|
|
17 |
public $needed = array('object', 'param');
|
|
|
18 |
|
|
|
19 |
/**
|
|
|
20 |
* @type array
|
|
|
21 |
*/
|
|
|
22 |
protected $objectStack = array();
|
|
|
23 |
|
|
|
24 |
/**
|
|
|
25 |
* @type array
|
|
|
26 |
*/
|
|
|
27 |
protected $paramStack = array();
|
|
|
28 |
|
|
|
29 |
/**
|
|
|
30 |
* Keep this synchronized with AttrTransform/SafeParam.php.
|
|
|
31 |
* @type array
|
|
|
32 |
*/
|
|
|
33 |
protected $addParam = array(
|
|
|
34 |
'allowScriptAccess' => 'never',
|
|
|
35 |
'allowNetworking' => 'internal',
|
|
|
36 |
);
|
|
|
37 |
|
|
|
38 |
/**
|
|
|
39 |
* These are all lower-case keys.
|
|
|
40 |
* @type array
|
|
|
41 |
*/
|
|
|
42 |
protected $allowedParam = array(
|
|
|
43 |
'wmode' => true,
|
|
|
44 |
'movie' => true,
|
|
|
45 |
'flashvars' => true,
|
|
|
46 |
'src' => true,
|
|
|
47 |
'allowfullscreen' => true, // if omitted, assume to be 'false'
|
|
|
48 |
);
|
|
|
49 |
|
|
|
50 |
/**
|
|
|
51 |
* @param HTMLPurifier_Config $config
|
|
|
52 |
* @param HTMLPurifier_Context $context
|
|
|
53 |
* @return void
|
|
|
54 |
*/
|
|
|
55 |
public function prepare($config, $context)
|
|
|
56 |
{
|
|
|
57 |
parent::prepare($config, $context);
|
|
|
58 |
}
|
|
|
59 |
|
|
|
60 |
/**
|
|
|
61 |
* @param HTMLPurifier_Token $token
|
|
|
62 |
*/
|
|
|
63 |
public function handleElement(&$token)
|
|
|
64 |
{
|
|
|
65 |
if ($token->name == 'object') {
|
|
|
66 |
$this->objectStack[] = $token;
|
|
|
67 |
$this->paramStack[] = array();
|
|
|
68 |
$new = array($token);
|
|
|
69 |
foreach ($this->addParam as $name => $value) {
|
|
|
70 |
$new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value));
|
|
|
71 |
}
|
|
|
72 |
$token = $new;
|
|
|
73 |
} elseif ($token->name == 'param') {
|
|
|
74 |
$nest = count($this->currentNesting) - 1;
|
|
|
75 |
if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
|
|
|
76 |
$i = count($this->objectStack) - 1;
|
|
|
77 |
if (!isset($token->attr['name'])) {
|
|
|
78 |
$token = false;
|
|
|
79 |
return;
|
|
|
80 |
}
|
|
|
81 |
$n = $token->attr['name'];
|
|
|
82 |
// We need this fix because YouTube doesn't supply a data
|
|
|
83 |
// attribute, which we need if a type is specified. This is
|
|
|
84 |
// *very* Flash specific.
|
|
|
85 |
if (!isset($this->objectStack[$i]->attr['data']) &&
|
|
|
86 |
($token->attr['name'] == 'movie' || $token->attr['name'] == 'src')
|
|
|
87 |
) {
|
|
|
88 |
$this->objectStack[$i]->attr['data'] = $token->attr['value'];
|
|
|
89 |
}
|
|
|
90 |
// Check if the parameter is the correct value but has not
|
|
|
91 |
// already been added
|
|
|
92 |
if (!isset($this->paramStack[$i][$n]) &&
|
|
|
93 |
isset($this->addParam[$n]) &&
|
|
|
94 |
$token->attr['name'] === $this->addParam[$n]) {
|
|
|
95 |
// keep token, and add to param stack
|
|
|
96 |
$this->paramStack[$i][$n] = true;
|
|
|
97 |
} elseif (isset($this->allowedParam[strtolower($n)])) {
|
|
|
98 |
// keep token, don't do anything to it
|
|
|
99 |
// (could possibly check for duplicates here)
|
|
|
100 |
// Note: In principle, parameters should be case sensitive.
|
|
|
101 |
// But it seems they are not really; so accept any case.
|
|
|
102 |
} else {
|
|
|
103 |
$token = false;
|
|
|
104 |
}
|
|
|
105 |
} else {
|
|
|
106 |
// not directly inside an object, DENY!
|
|
|
107 |
$token = false;
|
|
|
108 |
}
|
|
|
109 |
}
|
|
|
110 |
}
|
|
|
111 |
|
|
|
112 |
public function handleEnd(&$token)
|
|
|
113 |
{
|
|
|
114 |
// This is the WRONG way of handling the object and param stacks;
|
|
|
115 |
// we should be inserting them directly on the relevant object tokens
|
|
|
116 |
// so that the global stack handling handles it.
|
|
|
117 |
if ($token->name == 'object') {
|
|
|
118 |
array_pop($this->objectStack);
|
|
|
119 |
array_pop($this->paramStack);
|
|
|
120 |
}
|
|
|
121 |
}
|
|
|
122 |
}
|
|
|
123 |
|
|
|
124 |
// vim: et sw=4 sts=4
|