[Summary view]

   1  <?php
   2  
   3  /**

   4   * Implements data: URI for base64 encoded images supported by GD.

   5   */
   6  class HTMLPurifier_URIScheme_data extends HTMLPurifier_URIScheme
   7  {
   8      /**

   9       * @type bool

  10       */
  11      public $browsable = true;
  12  
  13      /**

  14       * @type array

  15       */
  16      public $allowed_types = array(
  17          // you better write validation code for other types if you

  18          // decide to allow them

  19          'image/jpeg' => true,
  20          'image/gif' => true,
  21          'image/png' => true,
  22      );
  23      // this is actually irrelevant since we only write out the path

  24      // component

  25      /**

  26       * @type bool

  27       */
  28      public $may_omit_host = true;
  29  
  30      /**

  31       * @param HTMLPurifier_URI $uri

  32       * @param HTMLPurifier_Config $config

  33       * @param HTMLPurifier_Context $context

  34       * @return bool

  35       */
  36      public function doValidate(&$uri, $config, $context)
  37      {
  38          $result = explode(',', $uri->path, 2);
  39          $is_base64 = false;
  40          $charset = null;
  41          $content_type = null;
  42          if (count($result) == 2) {
  43              list($metadata, $data) = $result;
  44              // do some legwork on the metadata

  45              $metas = explode(';', $metadata);
  46              while (!empty($metas)) {
  47                  $cur = array_shift($metas);
  48                  if ($cur == 'base64') {
  49                      $is_base64 = true;
  50                      break;
  51                  }
  52                  if (substr($cur, 0, 8) == 'charset=') {
  53                      // doesn't match if there are arbitrary spaces, but

  54                      // whatever dude

  55                      if ($charset !== null) {
  56                          continue;
  57                      } // garbage

  58                      $charset = substr($cur, 8); // not used

  59                  } else {
  60                      if ($content_type !== null) {
  61                          continue;
  62                      } // garbage

  63                      $content_type = $cur;
  64                  }
  65              }
  66          } else {
  67              $data = $result[0];
  68          }
  69          if ($content_type !== null && empty($this->allowed_types[$content_type])) {
  70              return false;
  71          }
  72          if ($charset !== null) {
  73              // error; we don't allow plaintext stuff

  74              $charset = null;
  75          }
  76          $data = rawurldecode($data);
  77          if ($is_base64) {
  78              $raw_data = base64_decode($data);
  79          } else {
  80              $raw_data = $data;
  81          }
  82          if ( strlen($raw_data) < 12 ) {
  83              // error; exif_imagetype throws exception with small files,

  84              // and this likely indicates a corrupt URI/failed parse anyway

  85              return false;
  86          }
  87          // XXX probably want to refactor this into a general mechanism

  88          // for filtering arbitrary content types

  89          if (function_exists('sys_get_temp_dir')) {
  90              $file = tempnam(sys_get_temp_dir(), "");
  91          } else {
  92              $file = tempnam("/tmp", "");
  93          }
  94          file_put_contents($file, $raw_data);
  95          if (function_exists('exif_imagetype')) {
  96              $image_code = exif_imagetype($file);
  97              unlink($file);
  98          } elseif (function_exists('getimagesize')) {
  99              set_error_handler(array($this, 'muteErrorHandler'));
 100              $info = getimagesize($file);
 101              restore_error_handler();
 102              unlink($file);
 103              if ($info == false) {
 104                  return false;
 105              }
 106              $image_code = $info[2];
 107          } else {
 108              trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
 109          }
 110          $real_content_type = image_type_to_mime_type($image_code);
 111          if ($real_content_type != $content_type) {
 112              // we're nice guys; if the content type is something else we

 113              // support, change it over

 114              if (empty($this->allowed_types[$real_content_type])) {
 115                  return false;
 116              }
 117              $content_type = $real_content_type;
 118          }
 119          // ok, it's kosher, rewrite what we need

 120          $uri->userinfo = null;
 121          $uri->host = null;
 122          $uri->port = null;
 123          $uri->fragment = null;
 124          $uri->query = null;
 125          $uri->path = "$content_type;base64," . base64_encode($raw_data);
 126          return true;
 127      }
 128  
 129      /**

 130       * @param int $errno

 131       * @param string $errstr

 132       */
 133      public function muteErrorHandler($errno, $errstr)
 134      {
 135      }
 136  }