SimplePie_Sanitize

Used for data cleanup and post-processing.

Defined (1)

The class is defined in the following location(s).

/wp-includes/SimplePie/Sanitize.php  
  1. class SimplePie_Sanitize 
  2. { 
  3.     // Private vars 
  4.     var $base; 
  5.  
  6.     // Options 
  7.     var $remove_div = true; 
  8.     var $image_handler = ''; 
  9.     var $strip_htmltags = array('base', 'blink', 'body', 'doctype', 'embed', 'font', 'form', 'frame', 'frameset', 'html', 'iframe', 'input', 'marquee', 'meta', 'noscript', 'object', 'param', 'script', 'style'); 
  10.     var $encode_instead_of_strip = false; 
  11.     var $strip_attributes = array('bgsound', 'class', 'expr', 'id', 'style', 'onclick', 'onerror', 'onfinish', 'onmouseover', 'onmouseout', 'onfocus', 'onblur', 'lowsrc', 'dynsrc'); 
  12.     var $strip_comments = false; 
  13.     var $output_encoding = 'UTF-8'; 
  14.     var $enable_cache = true; 
  15.     var $cache_location = './cache'; 
  16.     var $cache_name_function = 'md5'; 
  17.     var $timeout = 10; 
  18.     var $useragent = ''; 
  19.     var $force_fsockopen = false; 
  20.     var $replace_url_attributes = null; 
  21.  
  22.     public function __construct() 
  23.     { 
  24.         // Set defaults 
  25.         $this->set_url_replacements(null); 
  26.     } 
  27.  
  28.     public function remove_div($enable = true) 
  29.     { 
  30.         $this->remove_div = (bool) $enable; 
  31.     } 
  32.  
  33.     public function set_image_handler($page = false) 
  34.     { 
  35.         if ($page) 
  36.         { 
  37.             $this->image_handler = (string) $page; 
  38.         } 
  39.         else 
  40.         { 
  41.             $this->image_handler = false; 
  42.         } 
  43.     } 
  44.  
  45.     public function set_registry(SimplePie_Registry $registry) 
  46.     { 
  47.         $this->registry = $registry; 
  48.     } 
  49.  
  50.     public function pass_cache_data($enable_cache = true, $cache_location = './cache', $cache_name_function = 'md5', $cache_class = 'SimplePie_Cache') 
  51.     { 
  52.         if (isset($enable_cache)) 
  53.         { 
  54.             $this->enable_cache = (bool) $enable_cache; 
  55.         } 
  56.  
  57.         if ($cache_location) 
  58.         { 
  59.             $this->cache_location = (string) $cache_location; 
  60.         } 
  61.  
  62.         if ($cache_name_function) 
  63.         { 
  64.             $this->cache_name_function = (string) $cache_name_function; 
  65.         } 
  66.     } 
  67.  
  68.     public function pass_file_data($file_class = 'SimplePie_File', $timeout = 10, $useragent = '', $force_fsockopen = false) 
  69.     { 
  70.         if ($timeout) 
  71.         { 
  72.             $this->timeout = (string) $timeout; 
  73.         } 
  74.  
  75.         if ($useragent) 
  76.         { 
  77.             $this->useragent = (string) $useragent; 
  78.         } 
  79.  
  80.         if ($force_fsockopen) 
  81.         { 
  82.             $this->force_fsockopen = (string) $force_fsockopen; 
  83.         } 
  84.     } 
  85.  
  86.     public function strip_htmltags($tags = array('base', 'blink', 'body', 'doctype', 'embed', 'font', 'form', 'frame', 'frameset', 'html', 'iframe', 'input', 'marquee', 'meta', 'noscript', 'object', 'param', 'script', 'style')) 
  87.     { 
  88.         if ($tags) 
  89.         { 
  90.             if (is_array($tags)) 
  91.             { 
  92.                 $this->strip_htmltags = $tags; 
  93.             } 
  94.             else 
  95.             { 
  96.                 $this->strip_htmltags = explode(', ', $tags); 
  97.             } 
  98.         } 
  99.         else 
  100.         { 
  101.             $this->strip_htmltags = false; 
  102.         } 
  103.     } 
  104.  
  105.     public function encode_instead_of_strip($encode = false) 
  106.     { 
  107.         $this->encode_instead_of_strip = (bool) $encode; 
  108.     } 
  109.  
  110.     public function strip_attributes($attribs = array('bgsound', 'class', 'expr', 'id', 'style', 'onclick', 'onerror', 'onfinish', 'onmouseover', 'onmouseout', 'onfocus', 'onblur', 'lowsrc', 'dynsrc')) 
  111.     { 
  112.         if ($attribs) 
  113.         { 
  114.             if (is_array($attribs)) 
  115.             { 
  116.                 $this->strip_attributes = $attribs; 
  117.             } 
  118.             else 
  119.             { 
  120.                 $this->strip_attributes = explode(', ', $attribs); 
  121.             } 
  122.         } 
  123.         else 
  124.         { 
  125.             $this->strip_attributes = false; 
  126.         } 
  127.     } 
  128.  
  129.     public function strip_comments($strip = false) 
  130.     { 
  131.         $this->strip_comments = (bool) $strip; 
  132.     } 
  133.  
  134.     public function set_output_encoding($encoding = 'UTF-8') 
  135.     { 
  136.         $this->output_encoding = (string) $encoding; 
  137.     } 
  138.  
  139.     /** 
  140.      * Set element/attribute key/value pairs of HTML attributes 
  141.      * containing URLs that need to be resolved relative to the feed 
  142.      * 
  143.      * Defaults to |a|@href, |area|@href, |blockquote|@cite, |del|@cite,  
  144.      * |form|@action, |img|@longdesc, |img|@src, |input|@src, |ins|@cite,  
  145.      * |q|@cite 
  146.      * 
  147.      * @since 1.0 
  148.      * @param array|null $element_attribute Element/attribute key/value pairs, null for default 
  149.      */ 
  150.     public function set_url_replacements($element_attribute = null) 
  151.     { 
  152.         if ($element_attribute === null) 
  153.         { 
  154.             $element_attribute = array( 
  155.                 'a' => 'href',  
  156.                 'area' => 'href',  
  157.                 'blockquote' => 'cite',  
  158.                 'del' => 'cite',  
  159.                 'form' => 'action',  
  160.                 'img' => array( 
  161.                     'longdesc',  
  162.                     'src' 
  163.  ),  
  164.                 'input' => 'src',  
  165.                 'ins' => 'cite',  
  166.                 'q' => 'cite' 
  167.  ); 
  168.         } 
  169.         $this->replace_url_attributes = (array) $element_attribute; 
  170.     } 
  171.  
  172.     public function sanitize($data, $type, $base = '') 
  173.     { 
  174.         $data = trim($data); 
  175.         if ($data !== '' || $type & SIMPLEPIE_CONSTRUCT_IRI) 
  176.         { 
  177.             if ($type & SIMPLEPIE_CONSTRUCT_MAYBE_HTML) 
  178.             { 
  179.                 if (preg_match('/(&(#(x[0-9a-fA-F]+|[0-9]+)|[a-zA-Z0-9]+)|<\/[A-Za-z][^\x09\x0A\x0B\x0C\x0D\x20\x2F\x3E]*' . SIMPLEPIE_PCRE_HTML_ATTRIBUTE . '>)/', $data)) 
  180.                 { 
  181.                     $type |= SIMPLEPIE_CONSTRUCT_HTML; 
  182.                 } 
  183.                 else 
  184.                 { 
  185.                     $type |= SIMPLEPIE_CONSTRUCT_TEXT; 
  186.                 } 
  187.             } 
  188.  
  189.             if ($type & SIMPLEPIE_CONSTRUCT_BASE64) 
  190.             { 
  191.                 $data = base64_decode($data); 
  192.             } 
  193.  
  194.             if ($type & (SIMPLEPIE_CONSTRUCT_HTML | SIMPLEPIE_CONSTRUCT_XHTML)) 
  195.             { 
  196.  
  197.                 if (!class_exists('DOMDocument')) 
  198.                 { 
  199.                     $this->registry->call('Misc', 'error', array('DOMDocument not found, unable to use sanitizer', E_USER_WARNING, __FILE__, __LINE__)); 
  200.                     return ''; 
  201.                 } 
  202.                 $document = new DOMDocument(); 
  203.                 $document->encoding = 'UTF-8'; 
  204.                 $data = $this->preprocess($data, $type); 
  205.  
  206.                 set_error_handler(array('SimplePie_Misc', 'silence_errors')); 
  207.                 $document->loadHTML($data); 
  208.                 restore_error_handler(); 
  209.  
  210.                 // Strip comments 
  211.                 if ($this->strip_comments) 
  212.                 { 
  213.                     $xpath = new DOMXPath($document); 
  214.                     $comments = $xpath->query('//comment()'); 
  215.  
  216.                     foreach ($comments as $comment) 
  217.                     { 
  218.                         $comment->parentNode->removeChild($comment); 
  219.                     } 
  220.                 } 
  221.  
  222.                 // Strip out HTML tags and attributes that might cause various security problems. 
  223.                 // Based on recommendations by Mark Pilgrim at: 
  224.                 // http://diveintomark.org/archives/2003/06/12/how_to_consume_rss_safely 
  225.                 if ($this->strip_htmltags) 
  226.                 { 
  227.                     foreach ($this->strip_htmltags as $tag) 
  228.                     { 
  229.                         $this->strip_tag($tag, $document, $type); 
  230.                     } 
  231.                 } 
  232.  
  233.                 if ($this->strip_attributes) 
  234.                 { 
  235.                     foreach ($this->strip_attributes as $attrib) 
  236.                     { 
  237.                         $this->strip_attr($attrib, $document); 
  238.                     } 
  239.                 } 
  240.  
  241.                 // Replace relative URLs 
  242.                 $this->base = $base; 
  243.                 foreach ($this->replace_url_attributes as $element => $attributes) 
  244.                 { 
  245.                     $this->replace_urls($document, $element, $attributes); 
  246.                 } 
  247.  
  248.                 // If image handling (caching, etc.) is enabled, cache and rewrite all the image tags. 
  249.                 if (isset($this->image_handler) && ((string) $this->image_handler) !== '' && $this->enable_cache) 
  250.                 { 
  251.                     $images = $document->getElementsByTagName('img'); 
  252.                     foreach ($images as $img) 
  253.                     { 
  254.                         if ($img->hasAttribute('src')) 
  255.                         { 
  256.                             $image_url = call_user_func($this->cache_name_function, $img->getAttribute('src')); 
  257.                             $cache = $this->registry->call('Cache', 'get_handler', array($this->cache_location, $image_url, 'spi')); 
  258.  
  259.                             if ($cache->load()) 
  260.                             { 
  261.                                 $img->setAttribute('src', $this->image_handler . $image_url); 
  262.                             } 
  263.                             else 
  264.                             { 
  265.                                 $file = $this->registry->create('File', array($img->getAttribute('src'), $this->timeout, 5, array('X-FORWARDED-FOR' => $_SERVER['REMOTE_ADDR']), $this->useragent, $this->force_fsockopen)); 
  266.                                 $headers = $file->headers; 
  267.  
  268.                                 if ($file->success && ($file->method & SIMPLEPIE_FILE_SOURCE_REMOTE === 0 || ($file->status_code === 200 || $file->status_code > 206 && $file->status_code < 300))) 
  269.                                 { 
  270.                                     if ($cache->save(array('headers' => $file->headers, 'body' => $file->body))) 
  271.                                     { 
  272.                                         $img->setAttribute('src', $this->image_handler . $image_url); 
  273.                                     } 
  274.                                     else 
  275.                                     { 
  276.                                         trigger_error("$this->cache_location is not writeable. Make sure you've set the correct relative or absolute path, and that the location is server-writable.", E_USER_WARNING); 
  277.                                     } 
  278.                                 } 
  279.                             } 
  280.                         } 
  281.                     } 
  282.                 } 
  283.  
  284.                 // Remove the DOCTYPE 
  285.                 // Seems to cause segfaulting if we don't do this 
  286.                 if ($document->firstChild instanceof DOMDocumentType) 
  287.                 { 
  288.                     $document->removeChild($document->firstChild); 
  289.                 } 
  290.  
  291.                 // Move everything from the body to the root 
  292.                 $real_body = $document->getElementsByTagName('body')->item(0)->childNodes->item(0); 
  293.                 $document->replaceChild($real_body, $document->firstChild); 
  294.  
  295.                 // Finally, convert to a HTML string 
  296.                 $data = trim($document->saveHTML()); 
  297.  
  298.                 if ($this->remove_div) 
  299.                 { 
  300.                     $data = preg_replace('/^<div' . SIMPLEPIE_PCRE_XML_ATTRIBUTE . '>/', '', $data); 
  301.                     $data = preg_replace('/<\/div>$/', '', $data); 
  302.                 } 
  303.                 else 
  304.                 { 
  305.                     $data = preg_replace('/^<div' . SIMPLEPIE_PCRE_XML_ATTRIBUTE . '>/', '<div>', $data); 
  306.                 } 
  307.             } 
  308.  
  309.             if ($type & SIMPLEPIE_CONSTRUCT_IRI) 
  310.             { 
  311.                 $absolute = $this->registry->call('Misc', 'absolutize_url', array($data, $base)); 
  312.                 if ($absolute !== false) 
  313.                 { 
  314.                     $data = $absolute; 
  315.                 } 
  316.             } 
  317.  
  318.             if ($type & (SIMPLEPIE_CONSTRUCT_TEXT | SIMPLEPIE_CONSTRUCT_IRI)) 
  319.             { 
  320.                 $data = htmlspecialchars($data, ENT_COMPAT, 'UTF-8'); 
  321.             } 
  322.  
  323.             if ($this->output_encoding !== 'UTF-8') 
  324.             { 
  325.                 $data = $this->registry->call('Misc', 'change_encoding', array($data, 'UTF-8', $this->output_encoding)); 
  326.             } 
  327.         } 
  328.         return $data; 
  329.     } 
  330.  
  331.     protected function preprocess($html, $type) 
  332.     { 
  333.         $ret = ''; 
  334.         if ($type & ~SIMPLEPIE_CONSTRUCT_XHTML) 
  335.         { 
  336.             // Atom XHTML constructs are wrapped with a div by default 
  337.             // Note: No protection if $html contains a stray </div>! 
  338.             $html = '<div>' . $html . '</div>'; 
  339.             $ret .= '<!DOCTYPE html>'; 
  340.             $content_type = 'text/html'; 
  341.         } 
  342.         else 
  343.         { 
  344.             $ret .= '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">'; 
  345.             $content_type = 'application/xhtml+xml'; 
  346.         } 
  347.  
  348.         $ret .= '<html><head>'; 
  349.         $ret .= '<meta http-equiv="Content-Type" content="' . $content_type . '; charset=utf-8" />'; 
  350.         $ret .= '</head><body>' . $html . '</body></html>'; 
  351.         return $ret; 
  352.     } 
  353.  
  354.     public function replace_urls($document, $tag, $attributes) 
  355.     { 
  356.         if (!is_array($attributes)) 
  357.         { 
  358.             $attributes = array($attributes); 
  359.         } 
  360.  
  361.         if (!is_array($this->strip_htmltags) || !in_array($tag, $this->strip_htmltags)) 
  362.         { 
  363.             $elements = $document->getElementsByTagName($tag); 
  364.             foreach ($elements as $element) 
  365.             { 
  366.                 foreach ($attributes as $attribute) 
  367.                 { 
  368.                     if ($element->hasAttribute($attribute)) 
  369.                     { 
  370.                         $value = $this->registry->call('Misc', 'absolutize_url', array($element->getAttribute($attribute), $this->base)); 
  371.                         if ($value !== false) 
  372.                         { 
  373.                             $element->setAttribute($attribute, $value); 
  374.                         } 
  375.                     } 
  376.                 } 
  377.             } 
  378.         } 
  379.     } 
  380.  
  381.     public function do_strip_htmltags($match) 
  382.     { 
  383.         if ($this->encode_instead_of_strip) 
  384.         { 
  385.             if (isset($match[4]) && !in_array(strtolower($match[1]), array('script', 'style'))) 
  386.             { 
  387.                 $match[1] = htmlspecialchars($match[1], ENT_COMPAT, 'UTF-8'); 
  388.                 $match[2] = htmlspecialchars($match[2], ENT_COMPAT, 'UTF-8'); 
  389.                 return "<$match[1]$match[2]>$match[3]</$match[1]>"; 
  390.             } 
  391.             else 
  392.             { 
  393.                 return htmlspecialchars($match[0], ENT_COMPAT, 'UTF-8'); 
  394.             } 
  395.         } 
  396.         elseif (isset($match[4]) && !in_array(strtolower($match[1]), array('script', 'style'))) 
  397.         { 
  398.             return $match[4]; 
  399.         } 
  400.         else 
  401.         { 
  402.             return ''; 
  403.         } 
  404.     } 
  405.  
  406.     protected function strip_tag($tag, $document, $type) 
  407.     { 
  408.         $xpath = new DOMXPath($document); 
  409.         $elements = $xpath->query('body//' . $tag); 
  410.         if ($this->encode_instead_of_strip) 
  411.         { 
  412.             foreach ($elements as $element) 
  413.             { 
  414.                 $fragment = $document->createDocumentFragment(); 
  415.  
  416.                 // For elements which aren't script or style, include the tag itself 
  417.                 if (!in_array($tag, array('script', 'style'))) 
  418.                 { 
  419.                     $text = '<' . $tag; 
  420.                     if ($element->hasAttributes()) 
  421.                     { 
  422.                         $attrs = array(); 
  423.                         foreach ($element->attributes as $name => $attr) 
  424.                         { 
  425.                             $value = $attr->value; 
  426.  
  427.                             // In XHTML, empty values should never exist, so we repeat the value 
  428.                             if (empty($value) && ($type & SIMPLEPIE_CONSTRUCT_XHTML)) 
  429.                             { 
  430.                                 $value = $name; 
  431.                             } 
  432.                             // For HTML, empty is fine 
  433.                             elseif (empty($value) && ($type & SIMPLEPIE_CONSTRUCT_HTML)) 
  434.                             { 
  435.                                 $attrs[] = $name; 
  436.                                 continue; 
  437.                             } 
  438.  
  439.                             // Standard attribute text 
  440.                             $attrs[] = $name . '="' . $attr->value . '"'; 
  441.                         } 
  442.                         $text .= ' ' . implode(' ', $attrs); 
  443.                     } 
  444.                     $text .= '>'; 
  445.                     $fragment->appendChild(new DOMText($text)); 
  446.                 } 
  447.  
  448.                 $number = $element->childNodes->length; 
  449.                 for ($i = $number; $i > 0; $i--) 
  450.                 { 
  451.                     $child = $element->childNodes->item(0); 
  452.                     $fragment->appendChild($child); 
  453.                 } 
  454.  
  455.                 if (!in_array($tag, array('script', 'style'))) 
  456.                 { 
  457.                     $fragment->appendChild(new DOMText('</' . $tag . '>')); 
  458.                 } 
  459.  
  460.                 $element->parentNode->replaceChild($fragment, $element); 
  461.             } 
  462.  
  463.             return; 
  464.         } 
  465.         elseif (in_array($tag, array('script', 'style'))) 
  466.         { 
  467.             foreach ($elements as $element) 
  468.             { 
  469.                 $element->parentNode->removeChild($element); 
  470.             } 
  471.  
  472.             return; 
  473.         } 
  474.         else 
  475.         { 
  476.             foreach ($elements as $element) 
  477.             { 
  478.                 $fragment = $document->createDocumentFragment(); 
  479.                 $number = $element->childNodes->length; 
  480.                 for ($i = $number; $i > 0; $i--) 
  481.                 { 
  482.                     $child = $element->childNodes->item(0); 
  483.                     $fragment->appendChild($child); 
  484.                 } 
  485.  
  486.                 $element->parentNode->replaceChild($fragment, $element); 
  487.             } 
  488.         } 
  489.     } 
  490.  
  491.     protected function strip_attr($attrib, $document) 
  492.     { 
  493.         $xpath = new DOMXPath($document); 
  494.         $elements = $xpath->query('//*[@' . $attrib . ']'); 
  495.  
  496.         foreach ($elements as $element) 
  497.         { 
  498.             $element->removeAttribute($attrib); 
  499.         } 
  500.     } 
  501. }