Proyectos de Subversion Moodle

<?php

/**

 * HTML Purifier's internal representation of a URI.

 * @note

 *      Internal data-structures are completely escaped. If the data needs

 *      to be used in a non-URI context (which is very unlikely), be sure

 *      to decode it first. The URI may not necessarily be well-formed until

 *      validate() is called.

 */

class HTMLPurifier_URI

{

    /**

     * @type string

     */

    public $scheme;

    /**

     * @type string

     */

    public $userinfo;

    /**

     * @type string

     */

    public $host;

    /**

     * @type int

     */

    public $port;

    /**

     * @type string

     */

    public $path;

    /**

     * @type string

     */

    public $query;

    /**

     * @type string

     */

    public $fragment;

    /**

     * @param string $scheme

     * @param string $userinfo

     * @param string $host

     * @param int $port

     * @param string $path

     * @param string $query

     * @param string $fragment

     * @note Automatically normalizes scheme and port

     */

    public function __construct($scheme, $userinfo, $host, $port, $path, $query, $fragment)

    {

        $this->scheme = is_null($scheme) || ctype_lower($scheme) ? $scheme : strtolower($scheme);

        $this->userinfo = $userinfo;

        $this->host = $host;

        $this->port = is_null($port) ? $port : (int)$port;

        $this->path = $path;

        $this->query = $query;

        $this->fragment = $fragment;

    }

    /**

     * Retrieves a scheme object corresponding to the URI's scheme/default

     * @param HTMLPurifier_Config $config

     * @param HTMLPurifier_Context $context

     * @return HTMLPurifier_URIScheme Scheme object appropriate for validating this URI

     */

    public function getSchemeObj($config, $context)

    {

        $registry = HTMLPurifier_URISchemeRegistry::instance();

        if ($this->scheme !== null) {

            $scheme_obj = $registry->getScheme($this->scheme, $config, $context);

            if (!$scheme_obj) {

                return false;

            } // invalid scheme, clean it out

        } else {

            // no scheme: retrieve the default one

            $def = $config->getDefinition('URI');

            $scheme_obj = $def->getDefaultScheme($config, $context);

            if (!$scheme_obj) {

                if ($def->defaultScheme !== null) {

                    // something funky happened to the default scheme object

                    trigger_error(

                        'Default scheme object "' . $def->defaultScheme . '" was not readable',

                        E_USER_WARNING

                    );

                } // suppress error if it's null

                return false;

            }

        }

        return $scheme_obj;

    }

    /**

     * Generic validation method applicable for all schemes. May modify

     * this URI in order to get it into a compliant form.

     * @param HTMLPurifier_Config $config

     * @param HTMLPurifier_Context $context

     * @return bool True if validation/filtering succeeds, false if failure

     */

    public function validate($config, $context)

    {

        // ABNF definitions from RFC 3986

        $chars_sub_delims = '!$&\'()*+,;=';

        $chars_gen_delims = ':/?#[]@';

        $chars_pchar = $chars_sub_delims . ':@';

        // validate host

        if (!is_null($this->host)) {

            $host_def = new HTMLPurifier_AttrDef_URI_Host();

            $this->host = $host_def->validate($this->host, $config, $context);

            if ($this->host === false) {

                $this->host = null;

            }

        }

        // validate scheme

        // NOTE: It's not appropriate to check whether or not this

        // scheme is in our registry, since a URIFilter may convert a

        // URI that we don't allow into one we do.  So instead, we just

        // check if the scheme can be dropped because there is no host

        // and it is our default scheme.

        if (!is_null($this->scheme) && is_null($this->host) || $this->host === '') {

            // support for relative paths is pretty abysmal when the

            // scheme is present, so axe it when possible

            $def = $config->getDefinition('URI');

            if ($def->defaultScheme === $this->scheme) {

                $this->scheme = null;

            }

        }

        // validate username

        if (!is_null($this->userinfo)) {

            $encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . ':');

            $this->userinfo = $encoder->encode($this->userinfo);

        }

        // validate port

        if (!is_null($this->port)) {

            if ($this->port < 1 || $this->port > 65535) {

                $this->port = null;

            }

        }

        // validate path

        $segments_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/');

        if (!is_null($this->host)) { // this catches $this->host === ''

            // path-abempty (hier and relative)

            // http://www.example.com/my/path

            // //www.example.com/my/path (looks odd, but works, and

            //                            recognized by most browsers)

            // (this set is valid or invalid on a scheme by scheme

            // basis, so we'll deal with it later)

            // file:///my/path

            // ///my/path

            $this->path = $segments_encoder->encode($this->path);

        } elseif ($this->path !== '') {

            if ($this->path[0] === '/') {

                // path-absolute (hier and relative)

                // http:/my/path

                // /my/path

                if (strlen($this->path) >= 2 && $this->path[1] === '/') {

                    // This could happen if both the host gets stripped

                    // out

                    // http://my/path

                    // //my/path

                    $this->path = '';

                } else {

                    $this->path = $segments_encoder->encode($this->path);

                }

            } elseif (!is_null($this->scheme)) {

                // path-rootless (hier)

                // http:my/path

                // Short circuit evaluation means we don't need to check nz

                $this->path = $segments_encoder->encode($this->path);

            } else {

                // path-noscheme (relative)

                // my/path

                // (once again, not checking nz)

                $segment_nc_encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . '@');

                $c = strpos($this->path, '/');

                if ($c !== false) {

                    $this->path =

                        $segment_nc_encoder->encode(substr($this->path, 0, $c)) .

                        $segments_encoder->encode(substr($this->path, $c));

                } else {

                    $this->path = $segment_nc_encoder->encode($this->path);

                }

            }

        } else {

            // path-empty (hier and relative)

            $this->path = ''; // just to be safe

        }

        // qf = query and fragment

        $qf_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/?');

        if (!is_null($this->query)) {

            $this->query = $qf_encoder->encode($this->query);

        }

        if (!is_null($this->fragment)) {

            $this->fragment = $qf_encoder->encode($this->fragment);

        }

        return true;

    }

    /**

     * Convert URI back to string

     * @return string URI appropriate for output

     */

    public function toString()

    {

        // reconstruct authority

        $authority = null;

        // there is a rendering difference between a null authority

        // (http:foo-bar) and an empty string authority

        // (http:///foo-bar).

        if (!is_null($this->host)) {

            $authority = '';

            if (!is_null($this->userinfo)) {

                $authority .= $this->userinfo . '@';

            }

            $authority .= $this->host;

            if (!is_null($this->port)) {

                $authority .= ':' . $this->port;

            }

        }

        // Reconstruct the result

        // One might wonder about parsing quirks from browsers after

        // this reconstruction.  Unfortunately, parsing behavior depends

        // on what *scheme* was employed (file:///foo is handled *very*

        // differently than http:///foo), so unfortunately we have to

        // defer to the schemes to do the right thing.

        $result = '';

        if (!is_null($this->scheme)) {

            $result .= $this->scheme . ':';

        }

        if (!is_null($authority)) {

            $result .= '//' . $authority;

        }

        $result .= $this->path;

        if (!is_null($this->query)) {

            $result .= '?' . $this->query;

        }

        if (!is_null($this->fragment)) {

            $result .= '#' . $this->fragment;

        }

        return $result;

    }

    /**

     * Returns true if this URL might be considered a 'local' URL given

     * the current context.  This is true when the host is null, or

     * when it matches the host supplied to the configuration.

     *

     * Note that this does not do any scheme checking, so it is mostly

     * only appropriate for metadata that doesn't care about protocol

     * security.  isBenign is probably what you actually want.

     * @param HTMLPurifier_Config $config

     * @param HTMLPurifier_Context $context

     * @return bool

     */

    public function isLocal($config, $context)

    {

        if ($this->host === null) {

            return true;

        }

        $uri_def = $config->getDefinition('URI');

        if ($uri_def->host === $this->host) {

            return true;

        }

        return false;

    }

    /**

     * Returns true if this URL should be considered a 'benign' URL,

     * that is:

     *

     *      - It is a local URL (isLocal), and

     *      - It has a equal or better level of security

     * @param HTMLPurifier_Config $config

     * @param HTMLPurifier_Context $context

     * @return bool

     */

    public function isBenign($config, $context)

    {

        if (!$this->isLocal($config, $context)) {

            return false;

        }

        $scheme_obj = $this->getSchemeObj($config, $context);

        if (!$scheme_obj) {

            return false;

        } // conservative approach

        $current_scheme_obj = $config->getDefinition('URI')->getDefaultScheme($config, $context);

        if ($current_scheme_obj->secure) {

            if (!$scheme_obj->secure) {

                return false;

            }

        }

        return true;

    }

}

// vim: et sw=4 sts=4