Nevar pievienot vairāk kā 25 tēmas Tēmai ir jāsākas ar burtu vai ciparu, tā var saturēt domu zīmes ('-') un var būt līdz 35 simboliem gara.

rcube_washtml.php 30KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774
  1. <?php
  2. /**
  3. +-----------------------------------------------------------------------+
  4. | This file is part of the Roundcube Webmail client |
  5. | Copyright (C) 2008-2012, The Roundcube Dev Team |
  6. | |
  7. | Licensed under the GNU General Public License version 3 or |
  8. | any later version with exceptions for skins & plugins. |
  9. | See the README file for a full license statement. |
  10. | |
  11. | PURPOSE: |
  12. | Utility class providing HTML sanityzer (based on Washtml class) |
  13. +-----------------------------------------------------------------------+
  14. | Author: Thomas Bruederli <roundcube@gmail.com> |
  15. | Author: Aleksander Machniak <alec@alec.pl> |
  16. | Author: Frederic Motte <fmotte@ubixis.com> |
  17. +-----------------------------------------------------------------------+
  18. */
  19. /*
  20. * Washtml, a HTML sanityzer.
  21. *
  22. * Copyright (c) 2007 Frederic Motte <fmotte@ubixis.com>
  23. * All rights reserved.
  24. *
  25. * Redistribution and use in source and binary forms, with or without
  26. * modification, are permitted provided that the following conditions
  27. * are met:
  28. * 1. Redistributions of source code must retain the above copyright
  29. * notice, this list of conditions and the following disclaimer.
  30. * 2. Redistributions in binary form must reproduce the above copyright
  31. * notice, this list of conditions and the following disclaimer in the
  32. * documentation and/or other materials provided with the distribution.
  33. *
  34. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  35. * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  36. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  37. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  38. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  39. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  40. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  41. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  42. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  43. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  44. *
  45. * OVERVIEW:
  46. *
  47. * Wahstml take an untrusted HTML and return a safe html string.
  48. *
  49. * SYNOPSIS:
  50. *
  51. * $washer = new washtml($config);
  52. * $washer->wash($html);
  53. * It return a sanityzed string of the $html parameter without html and head tags.
  54. * $html is a string containing the html code to wash.
  55. * $config is an array containing options:
  56. * $config['allow_remote'] is a boolean to allow link to remote images.
  57. * $config['blocked_src'] string with image-src to be used for blocked remote images
  58. * $config['show_washed'] is a boolean to include washed out attributes as x-washed
  59. * $config['cid_map'] is an array where cid urls index urls to replace them.
  60. * $config['charset'] is a string containing the charset of the HTML document if it is not defined in it.
  61. * $washer->extlinks is a reference to a boolean that is set to true if remote images were removed. (FE: show remote images link)
  62. *
  63. * INTERNALS:
  64. *
  65. * Only tags and attributes in the static lists $html_elements and $html_attributes
  66. * are kept, inline styles are also filtered: all style identifiers matching
  67. * /[a-z\-]/i are allowed. Values matching colors, sizes, /[a-z\-]/i and safe
  68. * urls if allowed and cid urls if mapped are kept.
  69. *
  70. * Roundcube Changes:
  71. * - added $block_elements
  72. * - changed $ignore_elements behaviour
  73. * - added RFC2397 support
  74. * - base URL support
  75. * - invalid HTML comments removal before parsing
  76. * - "fixing" unitless CSS values for XHTML output
  77. * - base url resolving
  78. */
  79. /**
  80. * Utility class providing HTML sanityzer
  81. *
  82. * @package Framework
  83. * @subpackage Utils
  84. */
  85. class rcube_washtml
  86. {
  87. /* Allowed HTML elements (default) */
  88. static $html_elements = array('a', 'abbr', 'acronym', 'address', 'area', 'b',
  89. 'basefont', 'bdo', 'big', 'blockquote', 'br', 'caption', 'center',
  90. 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl',
  91. 'dt', 'em', 'fieldset', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i',
  92. 'ins', 'label', 'legend', 'li', 'map', 'menu', 'nobr', 'ol', 'p', 'pre', 'q',
  93. 's', 'samp', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table',
  94. 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'wbr', 'img',
  95. 'video', 'source',
  96. // form elements
  97. 'button', 'input', 'textarea', 'select', 'option', 'optgroup',
  98. // SVG
  99. 'svg', 'altglyph', 'altglyphdef', 'altglyphitem', 'animate',
  100. 'animatecolor', 'animatetransform', 'circle', 'clippath', 'defs', 'desc',
  101. 'ellipse', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line',
  102. 'lineargradient', 'marker', 'mask', 'mpath', 'path', 'pattern',
  103. 'polygon', 'polyline', 'radialgradient', 'rect', 'set', 'stop', 'switch', 'symbol',
  104. 'text', 'textpath', 'tref', 'tspan', 'use', 'view', 'vkern', 'filter',
  105. // SVG Filters
  106. 'feblend', 'fecolormatrix', 'fecomponenttransfer', 'fecomposite',
  107. 'feconvolvematrix', 'fediffuselighting', 'fedisplacementmap',
  108. 'feflood', 'fefunca', 'fefuncb', 'fefuncg', 'fefuncr', 'fegaussianblur',
  109. 'feimage', 'femerge', 'femergenode', 'femorphology', 'feoffset',
  110. 'fespecularlighting', 'fetile', 'feturbulence',
  111. );
  112. /* Ignore these HTML tags and their content */
  113. static $ignore_elements = array('script', 'applet', 'embed', 'object', 'style');
  114. /* Allowed HTML attributes */
  115. static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height',
  116. 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing',
  117. 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight',
  118. 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border',
  119. 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace',
  120. 'cellborder', 'size', 'lang', 'dir', 'usemap', 'shape', 'media',
  121. 'background', 'src', 'poster', 'href',
  122. // attributes of form elements
  123. 'type', 'rows', 'cols', 'disabled', 'readonly', 'checked', 'multiple', 'value',
  124. // SVG
  125. 'accent-height', 'accumulate', 'additive', 'alignment-baseline', 'alphabetic',
  126. 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseprofile',
  127. 'baseline-shift', 'begin', 'bias', 'by', 'clip', 'clip-path', 'clip-rule',
  128. 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile',
  129. 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction',
  130. 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity',
  131. 'fill-rule', 'filter', 'flood-color', 'flood-opacity', 'font-family', 'font-size',
  132. 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'from',
  133. 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform',
  134. 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints',
  135. 'keysplines', 'keytimes', 'lengthadjust', 'letter-spacing', 'kernelmatrix',
  136. 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid',
  137. 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits',
  138. 'maskunits', 'max', 'mask', 'mode', 'min', 'numoctaves', 'offset', 'operator',
  139. 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order',
  140. 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits',
  141. 'points', 'preservealpha', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount',
  142. 'repeatdur', 'restart', 'rotate', 'scale', 'seed', 'shape-rendering', 'show', 'specularconstant',
  143. 'specularexponent', 'spreadmethod', 'stddeviation', 'stitchtiles', 'stop-color',
  144. 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap',
  145. 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width',
  146. 'surfacescale', 'targetx', 'targety', 'transform', 'text-anchor', 'text-decoration',
  147. 'text-rendering', 'textlength', 'to', 'u1', 'u2', 'unicode', 'values', 'viewbox',
  148. 'visibility', 'vert-adv-y', 'version', 'vert-origin-x', 'vert-origin-y', 'word-spacing',
  149. 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2',
  150. 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan',
  151. );
  152. /* Elements which could be empty and be returned in short form (<tag />) */
  153. static $void_elements = array('area', 'base', 'br', 'col', 'command', 'embed', 'hr',
  154. 'img', 'input', 'keygen', 'link', 'meta', 'param', 'source', 'track', 'wbr',
  155. );
  156. /* State for linked objects in HTML */
  157. public $extlinks = false;
  158. /* Current settings */
  159. private $config = array();
  160. /* Registered callback functions for tags */
  161. private $handlers = array();
  162. /* Allowed HTML elements */
  163. private $_html_elements = array();
  164. /* Ignore these HTML tags but process their content */
  165. private $_ignore_elements = array();
  166. /* Elements which could be empty and be returned in short form (<tag />) */
  167. private $_void_elements = array();
  168. /* Allowed HTML attributes */
  169. private $_html_attribs = array();
  170. /* Max nesting level */
  171. private $max_nesting_level;
  172. private $is_xml = false;
  173. /**
  174. * Class constructor
  175. */
  176. public function __construct($p = array())
  177. {
  178. $this->_html_elements = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements);
  179. $this->_html_attribs = array_flip((array)$p['html_attribs']) + array_flip(self::$html_attribs);
  180. $this->_ignore_elements = array_flip((array)$p['ignore_elements']) + array_flip(self::$ignore_elements);
  181. $this->_void_elements = array_flip((array)$p['void_elements']) + array_flip(self::$void_elements);
  182. unset($p['html_elements'], $p['html_attribs'], $p['ignore_elements'], $p['void_elements']);
  183. $this->config = $p + array('show_washed' => true, 'allow_remote' => false, 'cid_map' => array());
  184. }
  185. /**
  186. * Register a callback function for a certain tag
  187. */
  188. public function add_callback($tagName, $callback)
  189. {
  190. $this->handlers[$tagName] = $callback;
  191. }
  192. /**
  193. * Check CSS style
  194. */
  195. private function wash_style($style)
  196. {
  197. $result = array();
  198. // Remove unwanted white-space characters so regular expressions below work better
  199. $style = preg_replace('/[\n\r\s\t]+/', ' ', $style);
  200. foreach (explode(';', $style) as $declaration) {
  201. if (preg_match('/^\s*([a-z\-]+)\s*:\s*(.*)\s*$/i', $declaration, $match)) {
  202. $cssid = $match[1];
  203. $str = $match[2];
  204. $value = '';
  205. foreach ($this->explode_style($str) as $val) {
  206. if (preg_match('/^url\(/i', $val)) {
  207. if (preg_match('/^url\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu', $val, $match)) {
  208. if ($url = $this->wash_uri($match[1])) {
  209. $value .= ' url(' . htmlspecialchars($url, ENT_QUOTES) . ')';
  210. }
  211. }
  212. }
  213. else if (!preg_match('/^(behavior|expression)/i', $val)) {
  214. // Set position:fixed to position:absolute for security (#5264)
  215. if (!strcasecmp($cssid, 'position') && !strcasecmp($val, 'fixed')) {
  216. $val = 'absolute';
  217. }
  218. // whitelist ?
  219. $value .= ' ' . $val;
  220. // #1488535: Fix size units, so width:800 would be changed to width:800px
  221. if (preg_match('/^(left|right|top|bottom|width|height)/i', $cssid)
  222. && preg_match('/^[0-9]+$/', $val)
  223. ) {
  224. $value .= 'px';
  225. }
  226. }
  227. }
  228. if (isset($value[0])) {
  229. $result[] = $cssid . ':' . $value;
  230. }
  231. }
  232. }
  233. return implode('; ', $result);
  234. }
  235. /**
  236. * Take a node and return allowed attributes and check values
  237. */
  238. private function wash_attribs($node)
  239. {
  240. $result = '';
  241. $washed = array();
  242. foreach ($node->attributes as $name => $attr) {
  243. $key = strtolower($name);
  244. $value = $attr->nodeValue;
  245. if ($key == 'style' && ($style = $this->wash_style($value))) {
  246. // replace double quotes to prevent syntax error and XSS issues (#1490227)
  247. $result .= ' style="' . str_replace('"', '&quot;', $style) . '"';
  248. }
  249. else if (isset($this->_html_attribs[$key])) {
  250. $value = trim($value);
  251. $out = null;
  252. // in SVG to/from attribs may contain anything, including URIs
  253. if ($key == 'to' || $key == 'from') {
  254. $key = strtolower($node->getAttribute('attributeName'));
  255. if ($key && !isset($this->_html_attribs[$key])) {
  256. $key = null;
  257. }
  258. }
  259. if ($this->is_image_attribute($node->tagName, $key)) {
  260. $out = $this->wash_uri($value, true);
  261. }
  262. else if ($this->is_link_attribute($node->tagName, $key)) {
  263. if (!preg_match('!^(javascript|vbscript|data:text)!i', $value)
  264. && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)
  265. ) {
  266. $out = $value;
  267. }
  268. }
  269. else if ($this->is_funciri_attribute($node->tagName, $key)) {
  270. if (preg_match('/^[a-z:]*url\(/i', $val)) {
  271. if (preg_match('/^([a-z:]*url)\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu', $value, $match)) {
  272. if ($url = $this->wash_uri($match[2])) {
  273. $result .= ' ' . $attr->nodeName . '="' . $match[1] . '(' . htmlspecialchars($url, ENT_QUOTES) . ')'
  274. . substr($val, strlen($match[0])) . '"';
  275. continue;
  276. }
  277. }
  278. else {
  279. $out = $value;
  280. }
  281. }
  282. else {
  283. $out = $value;
  284. }
  285. }
  286. else if ($key) {
  287. $out = $value;
  288. }
  289. if ($out !== null && $out !== '') {
  290. $result .= ' ' . $attr->nodeName . '="' . htmlspecialchars($out, ENT_QUOTES) . '"';
  291. }
  292. else if ($value) {
  293. $washed[] = htmlspecialchars($attr->nodeName, ENT_QUOTES);
  294. }
  295. }
  296. else {
  297. $washed[] = htmlspecialchars($attr->nodeName, ENT_QUOTES);
  298. }
  299. }
  300. if (!empty($washed) && $this->config['show_washed']) {
  301. $result .= ' x-washed="' . implode(' ', $washed) . '"';
  302. }
  303. return $result;
  304. }
  305. /**
  306. * Wash URI value
  307. */
  308. private function wash_uri($uri, $blocked_source = false)
  309. {
  310. if (($src = $this->config['cid_map'][$uri])
  311. || ($src = $this->config['cid_map'][$this->config['base_url'].$uri])
  312. ) {
  313. return $src;
  314. }
  315. // allow url(#id) used in SVG
  316. if ($uri[0] == '#') {
  317. return $uri;
  318. }
  319. if (preg_match('/^(http|https|ftp):.+/i', $uri)) {
  320. if ($this->config['allow_remote']) {
  321. return $uri;
  322. }
  323. $this->extlinks = true;
  324. if ($blocked_source && $this->config['blocked_src']) {
  325. return $this->config['blocked_src'];
  326. }
  327. }
  328. else if (preg_match('/^data:image.+/i', $uri)) { // RFC2397
  329. return $uri;
  330. }
  331. }
  332. /**
  333. * Check it the tag/attribute may contain an URI
  334. */
  335. private function is_link_attribute($tag, $attr)
  336. {
  337. return ($tag == 'a' || $tag == 'area') && $attr == 'href';
  338. }
  339. /**
  340. * Check it the tag/attribute may contain an image URI
  341. */
  342. private function is_image_attribute($tag, $attr)
  343. {
  344. return $attr == 'background'
  345. || $attr == 'color-profile' // SVG
  346. || ($attr == 'poster' && $tag == 'video')
  347. || ($attr == 'src' && preg_match('/^(img|source)$/i', $tag))
  348. || ($tag == 'image' && $attr == 'href'); // SVG
  349. }
  350. /**
  351. * Check it the tag/attribute may contain a FUNCIRI value
  352. */
  353. private function is_funciri_attribute($tag, $attr)
  354. {
  355. return in_array($attr, array('fill', 'filter', 'stroke', 'marker-start',
  356. 'marker-end', 'marker-mid', 'clip-path', 'mask', 'cursor'));
  357. }
  358. /**
  359. * The main loop that recurse on a node tree.
  360. * It output only allowed tags with allowed attributes and allowed inline styles
  361. *
  362. * @param DOMNode $node HTML element
  363. * @param int $level Recurrence level (safe initial value found empirically)
  364. */
  365. private function dumpHtml($node, $level = 20)
  366. {
  367. if (!$node->hasChildNodes()) {
  368. return '';
  369. }
  370. $level++;
  371. if ($this->max_nesting_level > 0 && $level == $this->max_nesting_level - 1) {
  372. // log error message once
  373. if (!$this->max_nesting_level_error) {
  374. $this->max_nesting_level_error = true;
  375. rcube::raise_error(array('code' => 500, 'type' => 'php',
  376. 'line' => __LINE__, 'file' => __FILE__,
  377. 'message' => "Maximum nesting level exceeded (xdebug.max_nesting_level={$this->max_nesting_level})"),
  378. true, false);
  379. }
  380. return '<!-- ignored -->';
  381. }
  382. $node = $node->firstChild;
  383. $dump = '';
  384. do {
  385. switch ($node->nodeType) {
  386. case XML_ELEMENT_NODE: //Check element
  387. $tagName = strtolower($node->tagName);
  388. if ($callback = $this->handlers[$tagName]) {
  389. $dump .= call_user_func($callback, $tagName,
  390. $this->wash_attribs($node), $this->dumpHtml($node, $level), $this);
  391. }
  392. else if (isset($this->_html_elements[$tagName])) {
  393. $content = $this->dumpHtml($node, $level);
  394. $dump .= '<' . $node->tagName;
  395. if ($tagName == 'svg') {
  396. $xpath = new DOMXPath($node->ownerDocument);
  397. foreach ($xpath->query('namespace::*') as $ns) {
  398. if ($ns->nodeName != 'xmlns:xml') {
  399. $dump .= ' ' . $ns->nodeName . '="' . $ns->nodeValue . '"';
  400. }
  401. }
  402. }
  403. $dump .= $this->wash_attribs($node);
  404. if ($content === '' && ($this->is_xml || isset($this->_void_elements[$tagName]))) {
  405. $dump .= ' />';
  406. }
  407. else {
  408. $dump .= '>' . $content . '</' . $node->tagName . '>';
  409. }
  410. }
  411. else if (isset($this->_ignore_elements[$tagName])) {
  412. $dump .= '<!-- ' . htmlspecialchars($node->tagName, ENT_QUOTES) . ' not allowed -->';
  413. }
  414. else {
  415. $dump .= '<!-- ' . htmlspecialchars($node->tagName, ENT_QUOTES) . ' ignored -->';
  416. $dump .= $this->dumpHtml($node, $level); // ignore tags not its content
  417. }
  418. break;
  419. case XML_CDATA_SECTION_NODE:
  420. $dump .= $node->nodeValue;
  421. break;
  422. case XML_TEXT_NODE:
  423. $dump .= htmlspecialchars($node->nodeValue);
  424. break;
  425. case XML_HTML_DOCUMENT_NODE:
  426. $dump .= $this->dumpHtml($node, $level);
  427. break;
  428. }
  429. }
  430. while($node = $node->nextSibling);
  431. return $dump;
  432. }
  433. /**
  434. * Main function, give it untrusted HTML, tell it if you allow loading
  435. * remote images and give it a map to convert "cid:" urls.
  436. */
  437. public function wash($html)
  438. {
  439. // Charset seems to be ignored (probably if defined in the HTML document)
  440. $node = new DOMDocument('1.0', $this->config['charset']);
  441. $this->extlinks = false;
  442. $html = $this->cleanup($html);
  443. // Find base URL for images
  444. if (preg_match('/<base\s+href=[\'"]*([^\'"]+)/is', $html, $matches)) {
  445. $this->config['base_url'] = $matches[1];
  446. }
  447. else {
  448. $this->config['base_url'] = '';
  449. }
  450. // Detect max nesting level (for dumpHTML) (#1489110)
  451. $this->max_nesting_level = (int) @ini_get('xdebug.max_nesting_level');
  452. // SVG need to be parsed as XML
  453. $this->is_xml = stripos($html, '<html') === false && stripos($html, '<svg') !== false;
  454. $method = $this->is_xml ? 'loadXML' : 'loadHTML';
  455. $options = 0;
  456. // Use optimizations if supported
  457. if (PHP_VERSION_ID >= 50400) {
  458. $options = LIBXML_PARSEHUGE | LIBXML_COMPACT | LIBXML_NONET;
  459. @$node->{$method}($html, $options);
  460. }
  461. else {
  462. @$node->{$method}($html);
  463. }
  464. return $this->dumpHtml($node);
  465. }
  466. /**
  467. * Getter for config parameters
  468. */
  469. public function get_config($prop)
  470. {
  471. return $this->config[$prop];
  472. }
  473. /**
  474. * Clean HTML input
  475. */
  476. private function cleanup($html)
  477. {
  478. $html = trim($html);
  479. // special replacements (not properly handled by washtml class)
  480. $html_search = array(
  481. // space(s) between <NOBR>
  482. '/(<\/nobr>)(\s+)(<nobr>)/i',
  483. // PHP bug #32547 workaround: remove title tag
  484. '/<title[^>]*>[^<]*<\/title>/i',
  485. // remove <!doctype> before BOM (#1490291)
  486. '/<\!doctype[^>]+>[^<]*/im',
  487. // byte-order mark (only outlook?)
  488. '/^(\0\0\xFE\xFF|\xFF\xFE\0\0|\xFE\xFF|\xFF\xFE|\xEF\xBB\xBF)/',
  489. // washtml/DOMDocument cannot handle xml namespaces
  490. '/<html\s[^>]+>/i',
  491. );
  492. $html_replace = array(
  493. '\\1'.' &nbsp; '.'\\3',
  494. '',
  495. '',
  496. '',
  497. '<html>',
  498. );
  499. $html = preg_replace($html_search, $html_replace, trim($html));
  500. // Replace all of those weird MS Word quotes and other high characters
  501. $badwordchars = array(
  502. "\xe2\x80\x98", // left single quote
  503. "\xe2\x80\x99", // right single quote
  504. "\xe2\x80\x9c", // left double quote
  505. "\xe2\x80\x9d", // right double quote
  506. "\xe2\x80\x94", // em dash
  507. "\xe2\x80\xa6" // elipses
  508. );
  509. $fixedwordchars = array(
  510. "'",
  511. "'",
  512. '"',
  513. '"',
  514. '&mdash;',
  515. '...'
  516. );
  517. $html = str_replace($badwordchars, $fixedwordchars, $html);
  518. // PCRE errors handling (#1486856), should we use something like for every preg_* use?
  519. if ($html === null && ($preg_error = preg_last_error()) != PREG_NO_ERROR) {
  520. $errstr = "Could not clean up HTML message! PCRE Error: $preg_error.";
  521. if ($preg_error == PREG_BACKTRACK_LIMIT_ERROR) {
  522. $errstr .= " Consider raising pcre.backtrack_limit!";
  523. }
  524. if ($preg_error == PREG_RECURSION_LIMIT_ERROR) {
  525. $errstr .= " Consider raising pcre.recursion_limit!";
  526. }
  527. rcube::raise_error(array('code' => 620, 'type' => 'php',
  528. 'line' => __LINE__, 'file' => __FILE__,
  529. 'message' => $errstr), true, false);
  530. return '';
  531. }
  532. // fix (unknown/malformed) HTML tags before "wash"
  533. $html = preg_replace_callback('/(<(?!\!)[\/]*)([^\s>]+)([^>]*)/', array($this, 'html_tag_callback'), $html);
  534. // Remove invalid HTML comments (#1487759)
  535. // Don't remove valid conditional comments
  536. // Don't remove MSOutlook (<!-->) conditional comments (#1489004)
  537. $html = preg_replace('/<!--[^-<>\[\n]+>/', '', $html);
  538. // fix broken nested lists
  539. self::fix_broken_lists($html);
  540. // turn relative into absolute urls
  541. $html = self::resolve_base($html);
  542. return $html;
  543. }
  544. /**
  545. * Callback function for HTML tags fixing
  546. */
  547. public static function html_tag_callback($matches)
  548. {
  549. $tagname = $matches[2];
  550. $tagname = preg_replace(array(
  551. '/:.*$/', // Microsoft's Smart Tags <st1:xxxx>
  552. '/[^a-z0-9_\[\]\!?-]/i', // forbidden characters
  553. ), '', $tagname);
  554. // fix invalid closing tags - remove any attributes (#1489446)
  555. if ($matches[1] == '</') {
  556. $matches[3] = '';
  557. }
  558. return $matches[1] . $tagname . $matches[3];
  559. }
  560. /**
  561. * Convert all relative URLs according to a <base> in HTML
  562. */
  563. public static function resolve_base($body)
  564. {
  565. // check for <base href=...>
  566. if (preg_match('!(<base.*href=["\']?)([hftps]{3,5}://[a-z0-9/.%-]+)!i', $body, $regs)) {
  567. $replacer = new rcube_base_replacer($regs[2]);
  568. $body = $replacer->replace($body);
  569. }
  570. return $body;
  571. }
  572. /**
  573. * Fix broken nested lists, they are not handled properly by DOMDocument (#1488768)
  574. */
  575. public static function fix_broken_lists(&$html)
  576. {
  577. // do two rounds, one for <ol>, one for <ul>
  578. foreach (array('ol', 'ul') as $tag) {
  579. $pos = 0;
  580. while (($pos = stripos($html, '<' . $tag, $pos)) !== false) {
  581. $pos++;
  582. // make sure this is an ol/ul tag
  583. if (!in_array($html[$pos+2], array(' ', '>'))) {
  584. continue;
  585. }
  586. $p = $pos;
  587. $in_li = false;
  588. $li_pos = 0;
  589. while (($p = strpos($html, '<', $p)) !== false) {
  590. $tt = strtolower(substr($html, $p, 4));
  591. // li open tag
  592. if ($tt == '<li>' || $tt == '<li ') {
  593. $in_li = true;
  594. $p += 4;
  595. }
  596. // li close tag
  597. else if ($tt == '</li' && in_array($html[$p+4], array(' ', '>'))) {
  598. $li_pos = $p;
  599. $p += 4;
  600. $in_li = false;
  601. }
  602. // ul/ol closing tag
  603. else if ($tt == '</' . $tag && in_array($html[$p+4], array(' ', '>'))) {
  604. break;
  605. }
  606. // nested ol/ul element out of li
  607. else if (!$in_li && $li_pos && ($tt == '<ol>' || $tt == '<ol ' || $tt == '<ul>' || $tt == '<ul ')) {
  608. // find closing tag of this ul/ol element
  609. $element = substr($tt, 1, 2);
  610. $cpos = $p;
  611. do {
  612. $tpos = stripos($html, '<' . $element, $cpos+1);
  613. $cpos = stripos($html, '</' . $element, $cpos+1);
  614. }
  615. while ($tpos !== false && $cpos !== false && $cpos > $tpos);
  616. // not found, this is invalid HTML, skip it
  617. if ($cpos === false) {
  618. break;
  619. }
  620. // get element content
  621. $end = strpos($html, '>', $cpos);
  622. $len = $end - $p + 1;
  623. $element = substr($html, $p, $len);
  624. // move element to the end of the last li
  625. $html = substr_replace($html, '', $p, $len);
  626. $html = substr_replace($html, $element, $li_pos, 0);
  627. $p = $end;
  628. }
  629. else {
  630. $p++;
  631. }
  632. }
  633. }
  634. }
  635. }
  636. /**
  637. * Explode css style value
  638. */
  639. protected function explode_style($style)
  640. {
  641. $pos = 0;
  642. // first remove comments
  643. while (($pos = strpos($style, '/*', $pos)) !== false) {
  644. $end = strpos($style, '*/', $pos+2);
  645. if ($end === false) {
  646. $style = substr($style, 0, $pos);
  647. }
  648. else {
  649. $style = substr_replace($style, '', $pos, $end - $pos + 2);
  650. }
  651. }
  652. $style = trim($style);
  653. $strlen = strlen($style);
  654. $result = array();
  655. // explode value
  656. for ($p=$i=0; $i < $strlen; $i++) {
  657. if (($style[$i] == "\"" || $style[$i] == "'") && $style[$i-1] != "\\") {
  658. if ($q == $style[$i]) {
  659. $q = false;
  660. }
  661. else if (!$q) {
  662. $q = $style[$i];
  663. }
  664. }
  665. if (!$q && $style[$i] == ' ' && !preg_match('/[,\(]/', $style[$i-1])) {
  666. $result[] = substr($style, $p, $i - $p);
  667. $p = $i + 1;
  668. }
  669. }
  670. $result[] = (string) substr($style, $p);
  671. return $result;
  672. }
  673. }