[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * Validates the HTML attribute style, otherwise known as CSS.
   5   * @note We don't implement the whole CSS specification, so it might be
   6   *       difficult to reuse this component in the context of validating
   7   *       actual stylesheet declarations.
   8   * @note If we were really serious about validating the CSS, we would
   9   *       tokenize the styles and then parse the tokens. Obviously, we
  10   *       are not doing that. Doing that could seriously harm performance,
  11   *       but would make these components a lot more viable for a CSS
  12   *       filtering solution.
  13   */
  14  class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
  15  {
  16  
  17      /**
  18       * @param string $css
  19       * @param HTMLPurifier_Config $config
  20       * @param HTMLPurifier_Context $context
  21       * @return bool|string
  22       */
  23      public function validate($css, $config, $context)
  24      {
  25          $css = $this->parseCDATA($css);
  26  
  27          $definition = $config->getCSSDefinition();
  28  
  29          // we're going to break the spec and explode by semicolons.
  30          // This is because semicolon rarely appears in escaped form
  31          // Doing this is generally flaky but fast
  32          // IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI
  33          // for details
  34  
  35          $declarations = explode(';', $css);
  36          $propvalues = array();
  37  
  38          /**
  39           * Name of the current CSS property being validated.
  40           */
  41          $property = false;
  42          $context->register('CurrentCSSProperty', $property);
  43  
  44          foreach ($declarations as $declaration) {
  45              if (!$declaration) {
  46                  continue;
  47              }
  48              if (!strpos($declaration, ':')) {
  49                  continue;
  50              }
  51              list($property, $value) = explode(':', $declaration, 2);
  52              $property = trim($property);
  53              $value = trim($value);
  54              $ok = false;
  55              do {
  56                  if (isset($definition->info[$property])) {
  57                      $ok = true;
  58                      break;
  59                  }
  60                  if (ctype_lower($property)) {
  61                      break;
  62                  }
  63                  $property = strtolower($property);
  64                  if (isset($definition->info[$property])) {
  65                      $ok = true;
  66                      break;
  67                  }
  68              } while (0);
  69              if (!$ok) {
  70                  continue;
  71              }
  72              // inefficient call, since the validator will do this again
  73              if (strtolower(trim($value)) !== 'inherit') {
  74                  // inherit works for everything (but only on the base property)
  75                  $result = $definition->info[$property]->validate(
  76                      $value,
  77                      $config,
  78                      $context
  79                  );
  80              } else {
  81                  $result = 'inherit';
  82              }
  83              if ($result === false) {
  84                  continue;
  85              }
  86              $propvalues[$property] = $result;
  87          }
  88  
  89          $context->destroy('CurrentCSSProperty');
  90  
  91          // procedure does not write the new CSS simultaneously, so it's
  92          // slightly inefficient, but it's the only way of getting rid of
  93          // duplicates. Perhaps config to optimize it, but not now.
  94  
  95          $new_declarations = '';
  96          foreach ($propvalues as $prop => $value) {
  97              $new_declarations .= "$prop:$value;";
  98          }
  99  
 100          return $new_declarations ? $new_declarations : false;
 101  
 102      }
 103  
 104  }
 105  
 106  // vim: et sw=4 sts=4