[Summary view]

   1  <?php
   2  
   3  /**

   4   * Adds important param elements to inside of object in order to make

   5   * things safe.

   6   */
   7  class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
   8  {
   9      /**

  10       * @type string

  11       */
  12      public $name = 'SafeObject';
  13  
  14      /**

  15       * @type array

  16       */
  17      public $needed = array('object', 'param');
  18  
  19      /**

  20       * @type array

  21       */
  22      protected $objectStack = array();
  23  
  24      /**

  25       * @type array

  26       */
  27      protected $paramStack = array();
  28  
  29      /**

  30       * Keep this synchronized with AttrTransform/SafeParam.php.

  31       * @type array

  32       */
  33      protected $addParam = array(
  34          'allowScriptAccess' => 'never',
  35          'allowNetworking' => 'internal',
  36      );
  37  
  38      /**

  39       * These are all lower-case keys.

  40       * @type array

  41       */
  42      protected $allowedParam = array(
  43          'wmode' => true,
  44          'movie' => true,
  45          'flashvars' => true,
  46          'src' => true,
  47          'allowfullscreen' => true, // if omitted, assume to be 'false'
  48      );
  49  
  50      /**

  51       * @param HTMLPurifier_Config $config

  52       * @param HTMLPurifier_Context $context

  53       * @return void

  54       */
  55      public function prepare($config, $context)
  56      {
  57          parent::prepare($config, $context);
  58      }
  59  
  60      /**

  61       * @param HTMLPurifier_Token $token

  62       */
  63      public function handleElement(&$token)
  64      {
  65          if ($token->name == 'object') {
  66              $this->objectStack[] = $token;
  67              $this->paramStack[] = array();
  68              $new = array($token);
  69              foreach ($this->addParam as $name => $value) {
  70                  $new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value));
  71              }
  72              $token = $new;
  73          } elseif ($token->name == 'param') {
  74              $nest = count($this->currentNesting) - 1;
  75              if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
  76                  $i = count($this->objectStack) - 1;
  77                  if (!isset($token->attr['name'])) {
  78                      $token = false;
  79                      return;
  80                  }
  81                  $n = $token->attr['name'];
  82                  // We need this fix because YouTube doesn't supply a data

  83                  // attribute, which we need if a type is specified. This is

  84                  // *very* Flash specific.

  85                  if (!isset($this->objectStack[$i]->attr['data']) &&
  86                      ($token->attr['name'] == 'movie' || $token->attr['name'] == 'src')
  87                  ) {
  88                      $this->objectStack[$i]->attr['data'] = $token->attr['value'];
  89                  }
  90                  // Check if the parameter is the correct value but has not

  91                  // already been added

  92                  if (!isset($this->paramStack[$i][$n]) &&
  93                      isset($this->addParam[$n]) &&
  94                      $token->attr['name'] === $this->addParam[$n]) {
  95                      // keep token, and add to param stack

  96                      $this->paramStack[$i][$n] = true;
  97                  } elseif (isset($this->allowedParam[strtolower($n)])) {
  98                      // keep token, don't do anything to it

  99                      // (could possibly check for duplicates here)

 100                      // Note: In principle, parameters should be case sensitive.

 101                      // But it seems they are not really; so accept any case.

 102                  } else {
 103                      $token = false;
 104                  }
 105              } else {
 106                  // not directly inside an object, DENY!

 107                  $token = false;
 108              }
 109          }
 110      }
 111  
 112      public function handleEnd(&$token)
 113      {
 114          // This is the WRONG way of handling the object and param stacks;

 115          // we should be inserting them directly on the relevant object tokens

 116          // so that the global stack handling handles it.

 117          if ($token->name == 'object') {
 118              array_pop($this->objectStack);
 119              array_pop($this->paramStack);
 120          }
 121      }
 122  }
 123  
 124  // vim: et sw=4 sts=4