📄 php5.class.kses.php
字号:
}
/**
* This method combs through an attribute list string and returns an associative array of attributes and values.
*
* This method does a lot of work. It parses an attribute list into an array
* with attribute data, and tries to do the right thing even if it gets weird
* input. It will add quotes around attribute values that don't have any quotes
* or apostrophes around them, to make it easier to produce HTML code that will
* conform to W3C's HTML specification. It will also remove bad URL protocols
* from attribute values.
*
* @access private
* @param string $attr Text containing tag attributes for parsing
* @return array Associative array containing data on attribute and value
* @since PHP4 OOP 0.0.1
*/
private function combAttributes($attr)
{
$attrarr = array();
$mode = 0;
$attrname = '';
# Loop through the whole attribute list
while (strlen($attr) != 0)
{
# Was the last operation successful?
$working = 0;
switch ($mode)
{
case 0: # attribute name, href for instance
if (preg_match('/^([-a-zA-Z]+)/', $attr, $match))
{
$attrname = $match[1];
$working = $mode = 1;
$attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);
}
break;
case 1: # equals sign or valueless ("selected")
if (preg_match('/^\s*=\s*/', $attr)) # equals sign
{
$working = 1;
$mode = 2;
$attr = preg_replace('/^\s*=\s*/', '', $attr);
break;
}
if (preg_match('/^\s+/', $attr)) # valueless
{
$working = 1;
$mode = 0;
$attrarr[] = array(
'name' => $attrname,
'value' => '',
'whole' => $attrname,
'vless' => 'y'
);
$attr = preg_replace('/^\s+/', '', $attr);
}
break;
case 2: # attribute value, a URL after href= for instance
if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value"
{
$thisval = $this->removeBadProtocols($match[1]);
$attrarr[] = array(
'name' => $attrname,
'value' => $thisval,
'whole' => $attrname . '="' . $thisval . '"',
'vless' => 'n'
);
$working = 1;
$mode = 0;
$attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr);
break;
}
if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value'
{
$thisval = $this->removeBadProtocols($match[1]);
$attrarr[] = array(
'name' => $attrname,
'value' => $thisval,
'whole' => "$attrname='$thisval'",
'vless' => 'n'
);
$working = 1;
$mode = 0;
$attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr);
break;
}
if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value
{
$thisval = $this->removeBadProtocols($match[1]);
$attrarr[] = array(
'name' => $attrname,
'value' => $thisval,
'whole' => $attrname . '="' . $thisval . '"',
'vless' => 'n'
);
# We add quotes to conform to W3C's HTML spec.
$working = 1;
$mode = 0;
$attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr);
}
break;
}
if ($working == 0) # not well formed, remove and try again
{
$attr = preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr);
$mode = 0;
}
}
# special case, for when the attribute list ends with a valueless
# attribute like "selected"
if ($mode == 1)
{
$attrarr[] = array(
'name' => $attrname,
'value' => '',
'whole' => $attrname,
'vless' => 'y'
);
}
return $attrarr;
}
/**
* This method removes disallowed protocols.
*
* This method removes all non-allowed protocols from the beginning of
* $string. It ignores whitespace and the case of the letters, and it does
* understand HTML entities. It does its work in a while loop, so it won't be
* fooled by a string like "javascript:javascript:alert(57)".
*
* @access private
* @param string $string String to check for protocols
* @return string String with removed protocols
* @since PHP4 OOP 0.0.1
*/
private function removeBadProtocols($string)
{
$string = $this->RemoveNulls($string);
$string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature"
$string2 = $string . 'a';
$string2 = preg_split('/:|:|:/i', $string, 2);
if(isset($string2[1]) && !preg_match('%/\?%',$string2[0]))
{
$string = $this->filterProtocols($string2[0]).trim($string2[1]);
}
return $string;
}
/**
* Helper method used by removeBadProtocols()
*
* This function processes URL protocols, checks to see if they're in the white-
* list or not, and returns different data depending on the answer.
*
* @access private
* @param string $string String to check for protocols
* @return string String with removed protocols
* @see removeBadProtocols()
* @since PHP4 OOP 0.0.1
*/
private function filterProtocols($string)
{
$string = $this->decodeEntities($string);
$string = preg_replace('/\s/', '', $string);
$string = $this->removeNulls($string);
$string = preg_replace('/\xad+/', '', $string2); # deals with Opera "feature"
$string = strtolower($string);
if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0)
{
foreach ($this->allowed_protocols as $one_protocol)
{
if (strtolower($one_protocol) == $string)
{
return "$string:";
}
}
}
return '';
}
/**
* Controller method for performing checks on attribute values.
*
* This method calls the appropriate method as specified by $checkname with
* the parameters $value, $vless, and $checkvalue, and returns the result
* of the call.
*
* This method's functionality can be expanded by creating new methods
* that would match checkAttributeValue[$checkname].
*
* Current checks implemented are: "maxlen", "minlen", "maxval", "minval" and "valueless"
*
* @access private
* @param string $value The value of the attribute to be checked.
* @param string $vless Indicates whether the the value is supposed to be valueless
* @param string $checkname The check to be performed
* @param string $checkvalue The value that is to be checked against
* @return bool Indicates whether the check passed or not
* @since PHP5 OOP 1.0.0
*/
private function checkAttributeValue($value, $vless, $checkname, $checkvalue)
{
$ok = true;
$check_attribute_method_name = 'checkAttributeValue' . ucfirst(strtolower($checkname));
if(method_exists($this, $check_attribute_method_name))
{
$ok = $this->$check_attribute_method_name($value, $checkvalue, $vless);
}
return $ok;
}
/**
* Helper method invoked by checkAttributeValue().
*
* The maxlen check makes sure that the attribute value has a length not
* greater than the given value. This can be used to avoid Buffer Overflows
* in WWW clients and various Internet servers.
*
* @access private
* @param string $value The value of the attribute to be checked.
* @param int $checkvalue The maximum value allowed
* @return bool Indicates whether the check passed or not
* @see checkAttributeValue()
* @since PHP5 OOP 1.0.0
*/
private function checkAttributeValueMaxlen($value, $checkvalue)
{
if (strlen($value) > intval($checkvalue))
{
return false;
}
return true;
}
/**
* Helper method invoked by checkAttributeValue().
*
* The minlen check makes sure that the attribute value has a length not
* smaller than the given value.
*
* @access private
* @param string $value The value of the attribute to be checked.
* @param int $checkvalue The minimum value allowed
* @return bool Indicates whether the check passed or not
* @see checkAttributeValue()
* @since PHP5 OOP 1.0.0
*/
private function checkAttributeValueMinlen($value, $checkvalue)
{
if (strlen($value) < intval($checkvalue))
{
return false;
}
return true;
}
/**
* Helper method invoked by checkAttributeValue().
*
* The maxval check does two things: it checks that the attribute value is
* an integer from 0 and up, without an excessive amount of zeroes or
* whitespace (to avoid Buffer Overflows). It also checks that the attribute
* value is not greater than the given value.
*
* This check can be used to avoid Denial of Service attacks.
*
* @access private
* @param int $value The value of the attribute to be checked.
* @param int $checkvalue The maximum numeric value allowed
* @return bool Indicates whether the check passed or not
* @see checkAttributeValue()
* @since PHP5 OOP 1.0.0
*/
private function checkAttributeValueMaxval($value, $checkvalue)
{
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
{
return false;
}
if (intval($value) > intval($checkvalue))
{
return false;
}
return true;
}
/**
* Helper method invoked by checkAttributeValue().
*
* The minval check checks that the attribute value is a positive integer,
* and that it is not smaller than the given value.
*
* @access private
* @param int $value The value of the attribute to be checked.
* @param int $checkvalue The minimum numeric value allowed
* @return bool Indicates whether the check passed or not
* @see checkAttributeValue()
* @since PHP5 OOP 1.0.0
*/
private function checkAttributeValueMinval($value, $checkvalue)
{
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
{
return false;
}
if (intval($value) < ($checkvalue))
{
return false;
}
return true;
}
/**
* Helper method invoked by checkAttributeValue().
*
* The valueless check checks if the attribute has a value
* (like <a href="blah">) or not (<option selected>). If the given value
* is a "y" or a "Y", the attribute must not have a value.
*
* If the given value is an "n" or an "N", the attribute must have one.
*
* @access private
* @param int $value The value of the attribute to be checked.
* @param mixed $checkvalue This variable is ignored for this test
* @param string $vless Flag indicating if this attribute is not supposed to have an attribute
* @return bool Indicates whether the check passed or not
* @see checkAttributeValue()
* @since PHP5 OOP 1.0.0
*/
private function checkAttributeValueValueless($value, $checkvalue, $vless)
{
if (strtolower($checkvalue) != $vless)
{
return false;
}
return true;
}
/**
* Decodes numeric HTML entities
*
* This method decodes numeric HTML entities (A and A). It doesn't
* do anything with other entities like ä, but we don't need them in the
* URL protocol white listing system anyway.
*
* @access private
* @param string $value The entitiy to be decoded.
* @return string Decoded entity
* @since PHP4 OOP 0.0.1
*/
private function decodeEntities($string)
{
$string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string);
$string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string);
return $string;
}
/**
* Returns PHP5 OOP version # of kses.
*
* Since this class has been refactored and documented and proven to work,
* I'm fixing the version number at 1.0.0.
*
* This version is syntax compatible with the PHP4 OOP version 0.0.2. Future
* versions may not be syntax compatible.
*
* @access public
* @return string Version number
* @since PHP4 OOP 0.0.1
*/
public function Version()
{
return 'PHP5 OOP 1.0.2';
}
}
}
?>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -