HTMLPurifier 4.4.0
|
00001 <?php 00002 00010 class HTMLPurifier_Generator 00011 { 00012 00016 private $_xhtml = true; 00017 00021 private $_scriptFix = false; 00022 00027 private $_def; 00028 00032 private $_sortAttr; 00033 00037 private $_flashCompat; 00038 00042 private $_innerHTMLFix; 00043 00048 private $_flashStack = array(); 00049 00053 protected $config; 00054 00059 public function __construct($config, $context) { 00060 $this->config = $config; 00061 $this->_scriptFix = $config->get('Output.CommentScriptContents'); 00062 $this->_innerHTMLFix = $config->get('Output.FixInnerHTML'); 00063 $this->_sortAttr = $config->get('Output.SortAttr'); 00064 $this->_flashCompat = $config->get('Output.FlashCompat'); 00065 $this->_def = $config->getHTMLDefinition(); 00066 $this->_xhtml = $this->_def->doctype->xml; 00067 } 00068 00075 public function generateFromTokens($tokens) { 00076 if (!$tokens) return ''; 00077 00078 // Basic algorithm 00079 $html = ''; 00080 for ($i = 0, $size = count($tokens); $i < $size; $i++) { 00081 if ($this->_scriptFix && $tokens[$i]->name === 'script' 00082 && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) { 00083 // script special case 00084 // the contents of the script block must be ONE token 00085 // for this to work. 00086 $html .= $this->generateFromToken($tokens[$i++]); 00087 $html .= $this->generateScriptFromToken($tokens[$i++]); 00088 } 00089 $html .= $this->generateFromToken($tokens[$i]); 00090 } 00091 00092 // Tidy cleanup 00093 if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) { 00094 $tidy = new Tidy; 00095 $tidy->parseString($html, array( 00096 'indent'=> true, 00097 'output-xhtml' => $this->_xhtml, 00098 'show-body-only' => true, 00099 'indent-spaces' => 2, 00100 'wrap' => 68, 00101 ), 'utf8'); 00102 $tidy->cleanRepair(); 00103 $html = (string) $tidy; // explicit cast necessary 00104 } 00105 00106 // Normalize newlines to system defined value 00107 if ($this->config->get('Core.NormalizeNewlines')) { 00108 $nl = $this->config->get('Output.Newline'); 00109 if ($nl === null) $nl = PHP_EOL; 00110 if ($nl !== "\n") $html = str_replace("\n", $nl, $html); 00111 } 00112 return $html; 00113 } 00114 00120 public function generateFromToken($token) { 00121 if (!$token instanceof HTMLPurifier_Token) { 00122 trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); 00123 return ''; 00124 00125 } elseif ($token instanceof HTMLPurifier_Token_Start) { 00126 $attr = $this->generateAttributes($token->attr, $token->name); 00127 if ($this->_flashCompat) { 00128 if ($token->name == "object") { 00129 $flash = new stdclass(); 00130 $flash->attr = $token->attr; 00131 $flash->param = array(); 00132 $this->_flashStack[] = $flash; 00133 } 00134 } 00135 return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; 00136 00137 } elseif ($token instanceof HTMLPurifier_Token_End) { 00138 $_extra = ''; 00139 if ($this->_flashCompat) { 00140 if ($token->name == "object" && !empty($this->_flashStack)) { 00141 // doesn't do anything for now 00142 } 00143 } 00144 return $_extra . '</' . $token->name . '>'; 00145 00146 } elseif ($token instanceof HTMLPurifier_Token_Empty) { 00147 if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) { 00148 $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value']; 00149 } 00150 $attr = $this->generateAttributes($token->attr, $token->name); 00151 return '<' . $token->name . ($attr ? ' ' : '') . $attr . 00152 ( $this->_xhtml ? ' /': '' ) // <br /> v. <br> 00153 . '>'; 00154 00155 } elseif ($token instanceof HTMLPurifier_Token_Text) { 00156 return $this->escape($token->data, ENT_NOQUOTES); 00157 00158 } elseif ($token instanceof HTMLPurifier_Token_Comment) { 00159 return '<!--' . $token->data . '-->'; 00160 } else { 00161 return ''; 00162 00163 } 00164 } 00165 00171 public function generateScriptFromToken($token) { 00172 if (!$token instanceof HTMLPurifier_Token_Text) return $this->generateFromToken($token); 00173 // Thanks <http://lachy.id.au/log/2005/05/script-comments> 00174 $data = preg_replace('#//\s*$#', '', $token->data); 00175 return '<!--//--><![CDATA[//><!--' . "\n" . trim($data) . "\n" . '//--><!]]>'; 00176 } 00177 00186 public function generateAttributes($assoc_array_of_attributes, $element = false) { 00187 $html = ''; 00188 if ($this->_sortAttr) ksort($assoc_array_of_attributes); 00189 foreach ($assoc_array_of_attributes as $key => $value) { 00190 if (!$this->_xhtml) { 00191 // Remove namespaced attributes 00192 if (strpos($key, ':') !== false) continue; 00193 // Check if we should minimize the attribute: val="val" -> val 00194 if ($element && !empty($this->_def->info[$element]->attr[$key]->minimized)) { 00195 $html .= $key . ' '; 00196 continue; 00197 } 00198 } 00199 // Workaround for Internet Explorer innerHTML bug. 00200 // Essentially, Internet Explorer, when calculating 00201 // innerHTML, omits quotes if there are no instances of 00202 // angled brackets, quotes or spaces. However, when parsing 00203 // HTML (for example, when you assign to innerHTML), it 00204 // treats backticks as quotes. Thus, 00205 // <img alt="``" /> 00206 // becomes 00207 // <img alt=`` /> 00208 // becomes 00209 // <img alt='' /> 00210 // Fortunately, all we need to do is trigger an appropriate 00211 // quoting style, which we do by adding an extra space. 00212 // This also is consistent with the W3C spec, which states 00213 // that user agents may ignore leading or trailing 00214 // whitespace (in fact, most don't, at least for attributes 00215 // like alt, but an extra space at the end is barely 00216 // noticeable). Still, we have a configuration knob for 00217 // this, since this transformation is not necesary if you 00218 // don't process user input with innerHTML or you don't plan 00219 // on supporting Internet Explorer. 00220 if ($this->_innerHTMLFix) { 00221 if (strpos($value, '`') !== false) { 00222 // check if correct quoting style would not already be 00223 // triggered 00224 if (strcspn($value, '"\' <>') === strlen($value)) { 00225 // protect! 00226 $value .= ' '; 00227 } 00228 } 00229 } 00230 $html .= $key.'="'.$this->escape($value).'" '; 00231 } 00232 return rtrim($html); 00233 } 00234 00245 public function escape($string, $quote = null) { 00246 // Workaround for APC bug on Mac Leopard reported by sidepodcast 00247 // http://htmlpurifier.org/phorum/read.php?3,4823,4846 00248 if ($quote === null) $quote = ENT_COMPAT; 00249 return htmlspecialchars($string, $quote, 'UTF-8'); 00250 } 00251 00252 } 00253 00254 // vim: et sw=4 sts=4