| 1: | <?php |
| 2: | |
| 3: | /** |
| 4: | * Validates a font family list according to CSS spec |
| 5: | */ |
| 6: | class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef |
| 7: | { |
| 8: | |
| 9: | protected $mask = null; |
| 10: | |
| 11: | public function __construct() |
| 12: | { |
| 13: | $this->mask = '_- '; |
| 14: | for ($c = 'a'; $c <= 'z'; $c++) { |
| 15: | $this->mask .= $c; |
| 16: | } |
| 17: | for ($c = 'A'; $c <= 'Z'; $c++) { |
| 18: | $this->mask .= $c; |
| 19: | } |
| 20: | for ($c = '0'; $c <= '9'; $c++) { |
| 21: | $this->mask .= $c; |
| 22: | } // cast-y, but should be fine |
| 23: | // special bytes used by UTF-8 |
| 24: | for ($i = 0x80; $i <= 0xFF; $i++) { |
| 25: | // We don't bother excluding invalid bytes in this range, |
| 26: | // because the our restriction of well-formed UTF-8 will |
| 27: | // prevent these from ever occurring. |
| 28: | $this->mask .= chr($i); |
| 29: | } |
| 30: | |
| 31: | /* |
| 32: | PHP's internal strcspn implementation is |
| 33: | O(length of string * length of mask), making it inefficient |
| 34: | for large masks. However, it's still faster than |
| 35: | preg_match 8) |
| 36: | for (p = s1;;) { |
| 37: | spanp = s2; |
| 38: | do { |
| 39: | if (*spanp == c || p == s1_end) { |
| 40: | return p - s1; |
| 41: | } |
| 42: | } while (spanp++ < (s2_end - 1)); |
| 43: | c = *++p; |
| 44: | } |
| 45: | */ |
| 46: | // possible optimization: invert the mask. |
| 47: | } |
| 48: | |
| 49: | /** |
| 50: | * @param string $string |
| 51: | * @param HTMLPurifier_Config $config |
| 52: | * @param HTMLPurifier_Context $context |
| 53: | * @return bool|string |
| 54: | */ |
| 55: | public function validate($string, $config, $context) |
| 56: | { |
| 57: | static $generic_names = array( |
| 58: | 'serif' => true, |
| 59: | 'sans-serif' => true, |
| 60: | 'monospace' => true, |
| 61: | 'fantasy' => true, |
| 62: | 'cursive' => true |
| 63: | ); |
| 64: | $allowed_fonts = $config->get('CSS.AllowedFonts'); |
| 65: | |
| 66: | // assume that no font names contain commas in them |
| 67: | $fonts = explode(',', $string); |
| 68: | $final = ''; |
| 69: | foreach ($fonts as $font) { |
| 70: | $font = trim($font); |
| 71: | if ($font === '') { |
| 72: | continue; |
| 73: | } |
| 74: | // match a generic name |
| 75: | if (isset($generic_names[$font])) { |
| 76: | if ($allowed_fonts === null || isset($allowed_fonts[$font])) { |
| 77: | $final .= $font . ', '; |
| 78: | } |
| 79: | continue; |
| 80: | } |
| 81: | // match a quoted name |
| 82: | if ($font[0] === '"' || $font[0] === "'") { |
| 83: | $length = strlen($font); |
| 84: | if ($length <= 2) { |
| 85: | continue; |
| 86: | } |
| 87: | $quote = $font[0]; |
| 88: | if ($font[$length - 1] !== $quote) { |
| 89: | continue; |
| 90: | } |
| 91: | $font = substr($font, 1, $length - 2); |
| 92: | } |
| 93: | |
| 94: | $font = $this->expandCSSEscape($font); |
| 95: | |
| 96: | // $font is a pure representation of the font name |
| 97: | |
| 98: | if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) { |
| 99: | continue; |
| 100: | } |
| 101: | |
| 102: | if (ctype_alnum($font) && $font !== '') { |
| 103: | // very simple font, allow it in unharmed |
| 104: | $final .= $font . ', '; |
| 105: | continue; |
| 106: | } |
| 107: | |
| 108: | // bugger out on whitespace. form feed (0C) really |
| 109: | // shouldn't show up regardless |
| 110: | $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font); |
| 111: | |
| 112: | // Here, there are various classes of characters which need |
| 113: | // to be treated differently: |
| 114: | // - Alphanumeric characters are essentially safe. We |
| 115: | // handled these above. |
| 116: | // - Spaces require quoting, though most parsers will do |
| 117: | // the right thing if there aren't any characters that |
| 118: | // can be misinterpreted |
| 119: | // - Dashes rarely occur, but they fairly unproblematic |
| 120: | // for parsing/rendering purposes. |
| 121: | // The above characters cover the majority of Western font |
| 122: | // names. |
| 123: | // - Arbitrary Unicode characters not in ASCII. Because |
| 124: | // most parsers give little thought to Unicode, treatment |
| 125: | // of these codepoints is basically uniform, even for |
| 126: | // punctuation-like codepoints. These characters can |
| 127: | // show up in non-Western pages and are supported by most |
| 128: | // major browsers, for example: "ＭＳ 明朝" is a |
| 129: | // legitimate font-name |
| 130: | // <http://ja.wikipedia.org/wiki/MS_明朝>. See |
| 131: | // the CSS3 spec for more examples: |
| 132: | // <http://www.w3.org/TR/2011/WD-css3-fonts-20110324/localizedfamilynames.png> |
| 133: | // You can see live samples of these on the Internet: |
| 134: | // <http://www.google.co.jp/search?q=font-family+ＭＳ+明朝|ゴシック> |
| 135: | // However, most of these fonts have ASCII equivalents: |
| 136: | // for example, 'MS Mincho', and it's considered |
| 137: | // professional to use ASCII font names instead of |
| 138: | // Unicode font names. Thanks Takeshi Terada for |
| 139: | // providing this information. |
| 140: | // The following characters, to my knowledge, have not been |
| 141: | // used to name font names. |
| 142: | // - Single quote. While theoretically you might find a |
| 143: | // font name that has a single quote in its name (serving |
| 144: | // as an apostrophe, e.g. Dave's Scribble), I haven't |
| 145: | // been able to find any actual examples of this. |
| 146: | // Internet Explorer's cssText translation (which I |
| 147: | // believe is invoked by innerHTML) normalizes any |
| 148: | // quoting to single quotes, and fails to escape single |
| 149: | // quotes. (Note that this is not IE's behavior for all |
| 150: | // CSS properties, just some sort of special casing for |
| 151: | // font-family). So a single quote *cannot* be used |
| 152: | // safely in the font-family context if there will be an |
| 153: | // innerHTML/cssText translation. Note that Firefox 3.x |
| 154: | // does this too. |
| 155: | // - Double quote. In IE, these get normalized to |
| 156: | // single-quotes, no matter what the encoding. (Fun |
| 157: | // fact, in IE8, the 'content' CSS property gained |
| 158: | // support, where they special cased to preserve encoded |
| 159: | // double quotes, but still translate unadorned double |
| 160: | // quotes into single quotes.) So, because their |
| 161: | // fixpoint behavior is identical to single quotes, they |
| 162: | // cannot be allowed either. Firefox 3.x displays |
| 163: | // single-quote style behavior. |
| 164: | // - Backslashes are reduced by one (so \\ -> \) every |
| 165: | // iteration, so they cannot be used safely. This shows |
| 166: | // up in IE7, IE8 and FF3 |
| 167: | // - Semicolons, commas and backticks are handled properly. |
| 168: | // - The rest of the ASCII punctuation is handled properly. |
| 169: | // We haven't checked what browsers do to unadorned |
| 170: | // versions, but this is not important as long as the |
| 171: | // browser doesn't /remove/ surrounding quotes (as IE does |
| 172: | // for HTML). |
| 173: | // |
| 174: | // With these results in hand, we conclude that there are |
| 175: | // various levels of safety: |
| 176: | // - Paranoid: alphanumeric, spaces and dashes(?) |
| 177: | // - International: Paranoid + non-ASCII Unicode |
| 178: | // - Edgy: Everything except quotes, backslashes |
| 179: | // - NoJS: Standards compliance, e.g. sod IE. Note that |
| 180: | // with some judicious character escaping (since certain |
| 181: | // types of escaping doesn't work) this is theoretically |
| 182: | // OK as long as innerHTML/cssText is not called. |
| 183: | // We believe that international is a reasonable default |
| 184: | // (that we will implement now), and once we do more |
| 185: | // extensive research, we may feel comfortable with dropping |
| 186: | // it down to edgy. |
| 187: | |
| 188: | // Edgy: alphanumeric, spaces, dashes, underscores and Unicode. Use of |
| 189: | // str(c)spn assumes that the string was already well formed |
| 190: | // Unicode (which of course it is). |
| 191: | if (strspn($font, $this->mask) !== strlen($font)) { |
| 192: | continue; |
| 193: | } |
| 194: | |
| 195: | // Historical: |
| 196: | // In the absence of innerHTML/cssText, these ugly |
| 197: | // transforms don't pose a security risk (as \\ and \" |
| 198: | // might--these escapes are not supported by most browsers). |
| 199: | // We could try to be clever and use single-quote wrapping |
| 200: | // when there is a double quote present, but I have choosen |
| 201: | // not to implement that. (NOTE: you can reduce the amount |
| 202: | // of escapes by one depending on what quoting style you use) |
| 203: | // $font = str_replace('\\', '\\5C ', $font); |
| 204: | // $font = str_replace('"', '\\22 ', $font); |
| 205: | // $font = str_replace("'", '\\27 ', $font); |
| 206: | |
| 207: | // font possibly with spaces, requires quoting |
| 208: | $final .= "'$font', "; |
| 209: | } |
| 210: | $final = rtrim($final, ', '); |
| 211: | if ($final === '') { |
| 212: | return false; |
| 213: | } |
| 214: | return $final; |
| 215: | } |
| 216: | |
| 217: | } |
| 218: | |
| 219: | // vim: et sw=4 sts=4 |
| 220: |