File xoops_lib\modules\protector\library\HTMLPurifier\Injector\SafeObject.php

1:	<?php
2:
3:	/**
4:	* Adds important param elements to inside of object in order to make
5:	* things safe.
6:	*/
7:	class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
8:	{
9:	/**
10:	* @type string
11:	*/
12:	public $name = 'SafeObject';
13:
14:	/**
15:	* @type array
16:	*/
17:	public $needed = array('object', 'param');
18:
19:	/**
20:	* @type array
21:	*/
22:	protected $objectStack = array();
23:
24:	/**
25:	* @type array
26:	*/
27:	protected $paramStack = array();
28:
29:	/**
30:	* Keep this synchronized with AttrTransform/SafeParam.php.
31:	* @type array
32:	*/
33:	protected $addParam = array(
34:	'allowScriptAccess' => 'never',
35:	'allowNetworking' => 'internal',
36:	);
37:
38:	/**
39:	* These are all lower-case keys.
40:	* @type array
41:	*/
42:	protected $allowedParam = array(
43:	'wmode' => true,
44:	'movie' => true,
45:	'flashvars' => true,
46:	'src' => true,
47:	'allowfullscreen' => true, // if omitted, assume to be 'false'
48:	);
49:
50:	/**
51:	* @param HTMLPurifier_Config $config
52:	* @param HTMLPurifier_Context $context
53:	* @return void
54:	*/
55:	public function prepare($config, $context)
56:	{
57:	parent::prepare($config, $context);
58:	}
59:
60:	/**
61:	* @param HTMLPurifier_Token $token
62:	*/
63:	public function handleElement(&$token)
64:	{
65:	if ($token->name == 'object') {
66:	$this->objectStack[] = $token;
67:	$this->paramStack[] = array();
68:	$new = array($token);
69:	foreach ($this->addParam as $name => $value) {
70:	$new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value));
71:	}
72:	$token = $new;
73:	} elseif ($token->name == 'param') {
74:	$nest = count($this->currentNesting) - 1;
75:	if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
76:	$i = count($this->objectStack) - 1;
77:	if (!isset($token->attr['name'])) {
78:	$token = false;
79:	return;
80:	}
81:	$n = $token->attr['name'];
82:	// We need this fix because YouTube doesn't supply a data
83:	// attribute, which we need if a type is specified. This is
84:	// very Flash specific.
85:	if (!isset($this->objectStack[$i]->attr['data']) &&
86:	($token->attr['name'] == 'movie' \|\| $token->attr['name'] == 'src')
87:	) {
88:	$this->objectStack[$i]->attr['data'] = $token->attr['value'];
89:	}
90:	// Check if the parameter is the correct value but has not
91:	// already been added
92:	if (!isset($this->paramStack[$i][$n]) &&
93:	isset($this->addParam[$n]) &&
94:	$token->attr['name'] === $this->addParam[$n]) {
95:	// keep token, and add to param stack
96:	$this->paramStack[$i][$n] = true;
97:	} elseif (isset($this->allowedParam[strtolower($n)])) {
98:	// keep token, don't do anything to it
99:	// (could possibly check for duplicates here)
100:	// Note: In principle, parameters should be case sensitive.
101:	// But it seems they are not really; so accept any case.
102:	} else {
103:	$token = false;
104:	}
105:	} else {
106:	// not directly inside an object, DENY!
107:	$token = false;
108:	}
109:	}
110:	}
111:
112:	public function handleEnd(&$token)
113:	{
114:	// This is the WRONG way of handling the object and param stacks;
115:	// we should be inserting them directly on the relevant object tokens
116:	// so that the global stack handling handles it.
117:	if ($token->name == 'object') {
118:	array_pop($this->objectStack);
119:	array_pop($this->paramStack);
120:	}
121:	}
122:	}
123:
124:	// vim: et sw=4 sts=4
125:

Namespaces

Classes

Interfaces

Exceptions

Functions