1: <?php
2: /*
3: You may not change or alter any portion of this comment or credits
4: of supporting developers from this source code or any supporting source code
5: which is considered copyrighted (c) material of the original comment or credit authors.
6:
7: This program is distributed in the hope that it will be useful,
8: but WITHOUT ANY WARRANTY; without even the implied warranty of
9: MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
10: */
11:
12: namespace Xoops\Core\Text\Sanitizer\Extensions;
13:
14: use Xoops\Core\Text\Sanitizer;
15: use Xoops\Core\Text\Sanitizer\FilterAbstract;
16:
17: /**
18: * TextSanitizer filter - clean XSS in HTML text
19: *
20: * @category Sanitizer
21: * @package Xoops\Core\Text
22: * @author Taiwen Jiang <phppp@users.sourceforge.net>
23: * @copyright 2000-2015 XOOPS Project (http://xoops.org)
24: * @license GNU GPL 2 (http://www.gnu.org/licenses/gpl-2.0.html)
25: * @link http://xoops.org
26: */
27: class Xss extends FilterAbstract
28: {
29: /**
30: * @var array default configuration values
31: */
32: protected static $defaultConfiguration = [
33: 'enabled' => true,
34: 'htmlawed_config' => ['safe' => 1],
35: 'htmlawed_spec' => [],
36: ];
37:
38: /**
39: * filter possible XSS
40: *
41: * @param string $text text string to filter
42: *
43: * @return mixed
44: */
45: public function applyFilter($text)
46: {
47: if (!$this->config['enabled']) {
48: return $text;
49: }
50:
51: /*
52: $patterns = array();
53: $replacements = array();
54: $text = str_replace("\x00", "", $text);
55: $c = "[\x01-\x1f]*";
56: $patterns[] = "/\bj{$c}a{$c}v{$c}a{$c}s{$c}c{$c}r{$c}i{$c}p{$c}t{$c}[\s]*:/si";
57: $replacements[] = "javascript;";
58: $patterns[] = "/\ba{$c}b{$c}o{$c}u{$c}t{$c}[\s]*:/si";
59: $replacements[] = "about;";
60: $patterns[] = "/\bx{$c}s{$c}s{$c}[\s]*:/si";
61: $replacements[] = "xss;";
62: $text = preg_replace($patterns, $replacements, $text);
63: */
64: $text = \htmLawed::hl($text, $this->config['htmlawed_config'], $this->config['htmlawed_spec']);
65:
66: return $text;
67: }
68:
69: /**
70: * truncate string in context of
71: *
72: * @param string $text string to be truncated
73: *
74: * @return string
75: */
76: protected function truncate($text)
77: {
78: $config = $this->config;
79: if (empty($text) || empty($config['truncate_length']) || mb_strlen($text) < $config['truncate_length']) {
80: return $text;
81: }
82: $len = (((mb_strlen($text) - $config['truncate_length']) - 5) / 2);
83: if ($len < 5) {
84: $ret = mb_substr($text, 0, $len) . ' ... ' . mb_substr($text, -$len);
85: } else {
86: $ret = mb_substr($text, 0, $config['truncate_length']);
87: }
88: return $ret;
89: }
90: }
91: