Namespaces

Classes

Interfaces

Exceptions

Functions

1: <?php
2:
3: /**
4: * Generates HTML from tokens.
5: * @todo Refactor interface so that configuration/context is determined
6: * upon instantiation, no need for messy generateFromTokens() calls
7: * @todo Make some of the more internal functions protected, and have
8: * unit tests work around that
9: */
10: class HTMLPurifier_Generator
11: {
12:
13: /**
14: * Whether or not generator should produce XML output.
15: * @type bool
16: */
17: private $_xhtml = true;
18:
19: /**
20: * :HACK: Whether or not generator should comment the insides of <script> tags.
21: * @type bool
22: */
23: private $_scriptFix = false;
24:
25: /**
26: * Cache of HTMLDefinition during HTML output to determine whether or
27: * not attributes should be minimized.
28: * @type HTMLPurifier_HTMLDefinition
29: */
30: private $_def;
31:
32: /**
33: * Cache of %Output.SortAttr.
34: * @type bool
35: */
36: private $_sortAttr;
37:
38: /**
39: * Cache of %Output.FlashCompat.
40: * @type bool
41: */
42: private $_flashCompat;
43:
44: /**
45: * Cache of %Output.FixInnerHTML.
46: * @type bool
47: */
48: private $_innerHTMLFix;
49:
50: /**
51: * Stack for keeping track of object information when outputting IE
52: * compatibility code.
53: * @type array
54: */
55: private $_flashStack = array();
56:
57: /**
58: * Configuration for the generator
59: * @type HTMLPurifier_Config
60: */
61: protected $config;
62:
63: /**
64: * @param HTMLPurifier_Config $config
65: * @param HTMLPurifier_Context $context
66: */
67: public function __construct($config, $context)
68: {
69: $this->config = $config;
70: $this->_scriptFix = $config->get('Output.CommentScriptContents');
71: $this->_innerHTMLFix = $config->get('Output.FixInnerHTML');
72: $this->_sortAttr = $config->get('Output.SortAttr');
73: $this->_flashCompat = $config->get('Output.FlashCompat');
74: $this->_def = $config->getHTMLDefinition();
75: $this->_xhtml = $this->_def->doctype->xml;
76: }
77:
78: /**
79: * Generates HTML from an array of tokens.
80: * @param HTMLPurifier_Token[] $tokens Array of HTMLPurifier_Token
81: * @return string Generated HTML
82: */
83: public function generateFromTokens($tokens)
84: {
85: if (!$tokens) {
86: return '';
87: }
88:
89: // Basic algorithm
90: $html = '';
91: for ($i = 0, $size = count($tokens); $i < $size; $i++) {
92: if ($this->_scriptFix && $tokens[$i]->name === 'script'
93: && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) {
94: // script special case
95: // the contents of the script block must be ONE token
96: // for this to work.
97: $html .= $this->generateFromToken($tokens[$i++]);
98: $html .= $this->generateScriptFromToken($tokens[$i++]);
99: }
100: $html .= $this->generateFromToken($tokens[$i]);
101: }
102:
103: // Tidy cleanup
104: if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) {
105: $tidy = new Tidy;
106: $tidy->parseString(
107: $html,
108: array(
109: 'indent'=> true,
110: 'output-xhtml' => $this->_xhtml,
111: 'show-body-only' => true,
112: 'indent-spaces' => 2,
113: 'wrap' => 68,
114: ),
115: 'utf8'
116: );
117: $tidy->cleanRepair();
118: $html = (string) $tidy; // explicit cast necessary
119: }
120:
121: // Normalize newlines to system defined value
122: if ($this->config->get('Core.NormalizeNewlines')) {
123: $nl = $this->config->get('Output.Newline');
124: if ($nl === null) {
125: $nl = PHP_EOL;
126: }
127: if ($nl !== "\n") {
128: $html = str_replace("\n", $nl, $html);
129: }
130: }
131: return $html;
132: }
133:
134: /**
135: * Generates HTML from a single token.
136: * @param HTMLPurifier_Token $token HTMLPurifier_Token object.
137: * @return string Generated HTML
138: */
139: public function generateFromToken($token)
140: {
141: if (!$token instanceof HTMLPurifier_Token) {
142: trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING);
143: return '';
144:
145: } elseif ($token instanceof HTMLPurifier_Token_Start) {
146: $attr = $this->generateAttributes($token->attr, $token->name);
147: if ($this->_flashCompat) {
148: if ($token->name == "object") {
149: $flash = new stdClass();
150: $flash->attr = $token->attr;
151: $flash->param = array();
152: $this->_flashStack[] = $flash;
153: }
154: }
155: return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>';
156:
157: } elseif ($token instanceof HTMLPurifier_Token_End) {
158: $_extra = '';
159: if ($this->_flashCompat) {
160: if ($token->name == "object" && !empty($this->_flashStack)) {
161: // doesn't do anything for now
162: }
163: }
164: return $_extra . '</' . $token->name . '>';
165:
166: } elseif ($token instanceof HTMLPurifier_Token_Empty) {
167: if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) {
168: $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value'];
169: }
170: $attr = $this->generateAttributes($token->attr, $token->name);
171: return '<' . $token->name . ($attr ? ' ' : '') . $attr .
172: ( $this->_xhtml ? ' /': '' ) // <br /> v. <br>
173: . '>';
174:
175: } elseif ($token instanceof HTMLPurifier_Token_Text) {
176: return $this->escape($token->data, ENT_NOQUOTES);
177:
178: } elseif ($token instanceof HTMLPurifier_Token_Comment) {
179: return '<!--' . $token->data . '-->';
180: } else {
181: return '';
182:
183: }
184: }
185:
186: /**
187: * Special case processor for the contents of script tags
188: * @param HTMLPurifier_Token $token HTMLPurifier_Token object.
189: * @return string
190: * @warning This runs into problems if there's already a literal
191: * --> somewhere inside the script contents.
192: */
193: public function generateScriptFromToken($token)
194: {
195: if (!$token instanceof HTMLPurifier_Token_Text) {
196: return $this->generateFromToken($token);
197: }
198: // Thanks <http://lachy.id.au/log/2005/05/script-comments>
199: $data = preg_replace('#//\s*$#', '', $token->data);
200: return '<!--//--><![CDATA[//><!--' . "\n" . trim($data) . "\n" . '//--><!]]>';
201: }
202:
203: /**
204: * Generates attribute declarations from attribute array.
205: * @note This does not include the leading or trailing space.
206: * @param array $assoc_array_of_attributes Attribute array
207: * @param string $element Name of element attributes are for, used to check
208: * attribute minimization.
209: * @return string Generated HTML fragment for insertion.
210: */
211: public function generateAttributes($assoc_array_of_attributes, $element = '')
212: {
213: $html = '';
214: if ($this->_sortAttr) {
215: ksort($assoc_array_of_attributes);
216: }
217: foreach ($assoc_array_of_attributes as $key => $value) {
218: if (!$this->_xhtml) {
219: // Remove namespaced attributes
220: if (strpos($key, ':') !== false) {
221: continue;
222: }
223: // Check if we should minimize the attribute: val="val" -> val
224: if ($element && !empty($this->_def->info[$element]->attr[$key]->minimized)) {
225: $html .= $key . ' ';
226: continue;
227: }
228: }
229: // Workaround for Internet Explorer innerHTML bug.
230: // Essentially, Internet Explorer, when calculating
231: // innerHTML, omits quotes if there are no instances of
232: // angled brackets, quotes or spaces. However, when parsing
233: // HTML (for example, when you assign to innerHTML), it
234: // treats backticks as quotes. Thus,
235: // <img alt="``" />
236: // becomes
237: // <img alt=`` />
238: // becomes
239: // <img alt='' />
240: // Fortunately, all we need to do is trigger an appropriate
241: // quoting style, which we do by adding an extra space.
242: // This also is consistent with the W3C spec, which states
243: // that user agents may ignore leading or trailing
244: // whitespace (in fact, most don't, at least for attributes
245: // like alt, but an extra space at the end is barely
246: // noticeable). Still, we have a configuration knob for
247: // this, since this transformation is not necesary if you
248: // don't process user input with innerHTML or you don't plan
249: // on supporting Internet Explorer.
250: if ($this->_innerHTMLFix) {
251: if (strpos($value, '`') !== false) {
252: // check if correct quoting style would not already be
253: // triggered
254: if (strcspn($value, '"\' <>') === strlen($value)) {
255: // protect!
256: $value .= ' ';
257: }
258: }
259: }
260: $html .= $key.'="'.$this->escape($value).'" ';
261: }
262: return rtrim($html);
263: }
264:
265: /**
266: * Escapes raw text data.
267: * @todo This really ought to be protected, but until we have a facility
268: * for properly generating HTML here w/o using tokens, it stays
269: * public.
270: * @param string $string String data to escape for HTML.
271: * @param int $quote Quoting style, like htmlspecialchars. ENT_NOQUOTES is
272: * permissible for non-attribute output.
273: * @return string escaped data.
274: */
275: public function escape($string, $quote = null)
276: {
277: // Workaround for APC bug on Mac Leopard reported by sidepodcast
278: // http://htmlpurifier.org/phorum/read.php?3,4823,4846
279: if ($quote === null) {
280: $quote = ENT_COMPAT;
281: }
282: return htmlspecialchars($string, $quote, 'UTF-8');
283: }
284: }
285:
286: // vim: et sw=4 sts=4
287:
API documentation generated by ApiGen v7.0.0-alpha.6