[Summary view]

   1  <?php
   2  
   3  // if want to implement error collecting here, we'll need to use some sort

   4  // of global data (probably trigger_error) because it's impossible to pass

   5  // $config or $context to the callback functions.

   6  
   7  /**

   8   * Handles referencing and derefencing character entities

   9   */
  10  class HTMLPurifier_EntityParser
  11  {
  12  
  13      /**

  14       * Reference to entity lookup table.

  15       * @type HTMLPurifier_EntityLookup

  16       */
  17      protected $_entity_lookup;
  18  
  19      /**

  20       * Callback regex string for entities in text.

  21       * @type string

  22       */
  23      protected $_textEntitiesRegex;
  24  
  25      /**

  26       * Callback regex string for entities in attributes.

  27       * @type string

  28       */
  29      protected $_attrEntitiesRegex;
  30  
  31      /**

  32       * Tests if the beginning of a string is a semi-optional regex

  33       */
  34      protected $_semiOptionalPrefixRegex;
  35  
  36      public function __construct() {
  37          // From

  38          // http://stackoverflow.com/questions/15532252/why-is-reg-being-rendered-as-without-the-bounding-semicolon

  39          $semi_optional = "quot|QUOT|lt|LT|gt|GT|amp|AMP|AElig|Aacute|Acirc|Agrave|Aring|Atilde|Auml|COPY|Ccedil|ETH|Eacute|Ecirc|Egrave|Euml|Iacute|Icirc|Igrave|Iuml|Ntilde|Oacute|Ocirc|Ograve|Oslash|Otilde|Ouml|REG|THORN|Uacute|Ucirc|Ugrave|Uuml|Yacute|aacute|acirc|acute|aelig|agrave|aring|atilde|auml|brvbar|ccedil|cedil|cent|copy|curren|deg|divide|eacute|ecirc|egrave|eth|euml|frac12|frac14|frac34|iacute|icirc|iexcl|igrave|iquest|iuml|laquo|macr|micro|middot|nbsp|not|ntilde|oacute|ocirc|ograve|ordf|ordm|oslash|otilde|ouml|para|plusmn|pound|raquo|reg|sect|shy|sup1|sup2|sup3|szlig|thorn|times|uacute|ucirc|ugrave|uml|uuml|yacute|yen|yuml";
  40  
  41          // NB: three empty captures to put the fourth match in the right

  42          // place

  43          $this->_semiOptionalPrefixRegex = "/&()()()($semi_optional)/";
  44  
  45          $this->_textEntitiesRegex =
  46              '/&(?:'.
  47              // hex

  48              '[#]x([a-fA-F0-9]+);?|'.
  49              // dec

  50              '[#]0*(\d+);?|'.
  51              // string (mandatory semicolon)

  52              // NB: order matters: match semicolon preferentially

  53              '([A-Za-z_:][A-Za-z0-9.\-_:]*);|'.
  54              // string (optional semicolon)

  55              "($semi_optional)".
  56              ')/';
  57  
  58          $this->_attrEntitiesRegex =
  59              '/&(?:'.
  60              // hex

  61              '[#]x([a-fA-F0-9]+);?|'.
  62              // dec

  63              '[#]0*(\d+);?|'.
  64              // string (mandatory semicolon)

  65              // NB: order matters: match semicolon preferentially

  66              '([A-Za-z_:][A-Za-z0-9.\-_:]*);|'.
  67              // string (optional semicolon)

  68              // don't match if trailing is equals or alphanumeric (URL

  69              // like)

  70              "($semi_optional)(?![=;A-Za-z0-9])".
  71              ')/';
  72  
  73      }
  74  
  75      /**

  76       * Substitute entities with the parsed equivalents.  Use this on

  77       * textual data in an HTML document (as opposed to attributes.)

  78       *

  79       * @param string $string String to have entities parsed.

  80       * @return string Parsed string.

  81       */
  82      public function substituteTextEntities($string)
  83      {
  84          return preg_replace_callback(
  85              $this->_textEntitiesRegex,
  86              array($this, 'entityCallback'),
  87              $string
  88          );
  89      }
  90  
  91      /**

  92       * Substitute entities with the parsed equivalents.  Use this on

  93       * attribute contents in documents.

  94       *

  95       * @param string $string String to have entities parsed.

  96       * @return string Parsed string.

  97       */
  98      public function substituteAttrEntities($string)
  99      {
 100          return preg_replace_callback(
 101              $this->_attrEntitiesRegex,
 102              array($this, 'entityCallback'),
 103              $string
 104          );
 105      }
 106  
 107      /**

 108       * Callback function for substituteNonSpecialEntities() that does the work.

 109       *

 110       * @param array $matches  PCRE matches array, with 0 the entire match, and

 111       *                  either index 1, 2 or 3 set with a hex value, dec value,

 112       *                  or string (respectively).

 113       * @return string Replacement string.

 114       */
 115  
 116      protected function entityCallback($matches)
 117      {
 118          $entity = $matches[0];
 119          $hex_part = @$matches[1];
 120          $dec_part = @$matches[2];
 121          $named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3];
 122          if ($hex_part !== NULL && $hex_part !== "") {
 123              return HTMLPurifier_Encoder::unichr(hexdec($hex_part));
 124          } elseif ($dec_part !== NULL && $dec_part !== "") {
 125              return HTMLPurifier_Encoder::unichr((int) $dec_part);
 126          } else {
 127              if (!$this->_entity_lookup) {
 128                  $this->_entity_lookup = HTMLPurifier_EntityLookup::instance();
 129              }
 130              if (isset($this->_entity_lookup->table[$named_part])) {
 131                  return $this->_entity_lookup->table[$named_part];
 132              } else {
 133                  // exact match didn't match anything, so test if

 134                  // any of the semicolon optional match the prefix.

 135                  // Test that this is an EXACT match is important to

 136                  // prevent infinite loop

 137                  if (!empty($matches[3])) {
 138                      return preg_replace_callback(
 139                          $this->_semiOptionalPrefixRegex,
 140                          array($this, 'entityCallback'),
 141                          $entity
 142                      );
 143                  }
 144                  return $entity;
 145              }
 146          }
 147      }
 148  
 149      // LEGACY CODE BELOW

 150  
 151      /**

 152       * Callback regex string for parsing entities.

 153       * @type string

 154       */
 155      protected $_substituteEntitiesRegex =
 156          '/&(?:[#]x([a-fA-F0-9]+)|[#]0*(\d+)|([A-Za-z_:][A-Za-z0-9.\-_:]*));?/';
 157          //     1. hex             2. dec      3. string (XML style)

 158  
 159      /**

 160       * Decimal to parsed string conversion table for special entities.

 161       * @type array

 162       */
 163      protected $_special_dec2str =
 164              array(
 165                      34 => '"',
 166                      38 => '&',
 167                      39 => "'",
 168                      60 => '<',
 169                      62 => '>'
 170              );
 171  
 172      /**

 173       * Stripped entity names to decimal conversion table for special entities.

 174       * @type array

 175       */
 176      protected $_special_ent2dec =
 177              array(
 178                      'quot' => 34,
 179                      'amp'  => 38,
 180                      'lt'   => 60,
 181                      'gt'   => 62
 182              );
 183  
 184      /**

 185       * Substitutes non-special entities with their parsed equivalents. Since

 186       * running this whenever you have parsed character is t3h 5uck, we run

 187       * it before everything else.

 188       *

 189       * @param string $string String to have non-special entities parsed.

 190       * @return string Parsed string.

 191       */
 192      public function substituteNonSpecialEntities($string)
 193      {
 194          // it will try to detect missing semicolons, but don't rely on it

 195          return preg_replace_callback(
 196              $this->_substituteEntitiesRegex,
 197              array($this, 'nonSpecialEntityCallback'),
 198              $string
 199          );
 200      }
 201  
 202      /**

 203       * Callback function for substituteNonSpecialEntities() that does the work.

 204       *

 205       * @param array $matches  PCRE matches array, with 0 the entire match, and

 206       *                  either index 1, 2 or 3 set with a hex value, dec value,

 207       *                  or string (respectively).

 208       * @return string Replacement string.

 209       */
 210  
 211      protected function nonSpecialEntityCallback($matches)
 212      {
 213          // replaces all but big five

 214          $entity = $matches[0];
 215          $is_num = (@$matches[0][1] === '#');
 216          if ($is_num) {
 217              $is_hex = (@$entity[2] === 'x');
 218              $code = $is_hex ? hexdec($matches[1]) : (int) $matches[2];
 219              // abort for special characters

 220              if (isset($this->_special_dec2str[$code])) {
 221                  return $entity;
 222              }
 223              return HTMLPurifier_Encoder::unichr($code);
 224          } else {
 225              if (isset($this->_special_ent2dec[$matches[3]])) {
 226                  return $entity;
 227              }
 228              if (!$this->_entity_lookup) {
 229                  $this->_entity_lookup = HTMLPurifier_EntityLookup::instance();
 230              }
 231              if (isset($this->_entity_lookup->table[$matches[3]])) {
 232                  return $this->_entity_lookup->table[$matches[3]];
 233              } else {
 234                  return $entity;
 235              }
 236          }
 237      }
 238  
 239      /**

 240       * Substitutes only special entities with their parsed equivalents.

 241       *

 242       * @notice We try to avoid calling this function because otherwise, it

 243       * would have to be called a lot (for every parsed section).

 244       *

 245       * @param string $string String to have non-special entities parsed.

 246       * @return string Parsed string.

 247       */
 248      public function substituteSpecialEntities($string)
 249      {
 250          return preg_replace_callback(
 251              $this->_substituteEntitiesRegex,
 252              array($this, 'specialEntityCallback'),
 253              $string
 254          );
 255      }
 256  
 257      /**

 258       * Callback function for substituteSpecialEntities() that does the work.

 259       *

 260       * This callback has same syntax as nonSpecialEntityCallback().

 261       *

 262       * @param array $matches  PCRE-style matches array, with 0 the entire match, and

 263       *                  either index 1, 2 or 3 set with a hex value, dec value,

 264       *                  or string (respectively).

 265       * @return string Replacement string.

 266       */
 267      protected function specialEntityCallback($matches)
 268      {
 269          $entity = $matches[0];
 270          $is_num = (@$matches[0][1] === '#');
 271          if ($is_num) {
 272              $is_hex = (@$entity[2] === 'x');
 273              $int = $is_hex ? hexdec($matches[1]) : (int) $matches[2];
 274              return isset($this->_special_dec2str[$int]) ?
 275                  $this->_special_dec2str[$int] :
 276                  $entity;
 277          } else {
 278              return isset($this->_special_ent2dec[$matches[3]]) ?
 279                  $this->_special_dec2str[$this->_special_ent2dec[$matches[3]]] :
 280                  $entity;
 281          }
 282      }
 283  }
 284  
 285  // vim: et sw=4 sts=4