| | |
|---|
| | | <?php |
|---|
| | | |
|---|
| | | /** |
|---|
| | | /* |
|---|
| | | +-----------------------------------------------------------------------+ |
|---|
| | | | This file is part of the Roundcube Webmail client | |
|---|
| | | | Copyright (C) 2008-2012, The Roundcube Dev Team | |
|---|
| | |
|---|
| | | +-----------------------------------------------------------------------+ |
|---|
| | | */ |
|---|
| | | |
|---|
| | | /** |
|---|
| | | /* |
|---|
| | | * Washtml, a HTML sanityzer. |
|---|
| | | * |
|---|
| | | * Copyright (c) 2007 Frederic Motte <fmotte@ubixis.com> |
|---|
| | |
|---|
| | | $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; |
|---|
| | | } |
|---|
| | | else if ($key == 'style' && ($style = $this->wash_style($value))) { |
|---|
| | | $quot = strpos($style, '"') !== false ? "'" : '"'; |
|---|
| | | $t .= ' style=' . $quot . $style . $quot; |
|---|
| | | // replace double quotes to prevent syntax error and XSS issues (#1490227) |
|---|
| | | $t .= ' style="' . str_replace('"', '"', $style) . '"'; |
|---|
| | | } |
|---|
| | | else if ($key == 'background' |
|---|
| | | || ($key == 'src' && preg_match('/^(img|source)$/i', $node->tagName)) |
|---|
| | |
|---|
| | | $this->max_nesting_level = (int) @ini_get('xdebug.max_nesting_level'); |
|---|
| | | |
|---|
| | | // Use optimizations if supported |
|---|
| | | if (version_compare(PHP_VERSION, '5.4.0', '>=')) { |
|---|
| | | if (PHP_VERSION_ID >= 50400) { |
|---|
| | | @$node->loadHTML($html, LIBXML_PARSEHUGE | LIBXML_COMPACT); |
|---|
| | | } |
|---|
| | | else { |
|---|
| | |
|---|
| | | { |
|---|
| | | // special replacements (not properly handled by washtml class) |
|---|
| | | $html_search = array( |
|---|
| | | '/(<\/nobr>)(\s+)(<nobr>)/i', // space(s) between <NOBR> |
|---|
| | | '/<title[^>]*>[^<]*<\/title>/i', // PHP bug #32547 workaround: remove title tag |
|---|
| | | '/^(\0\0\xFE\xFF|\xFF\xFE\0\0|\xFE\xFF|\xFF\xFE|\xEF\xBB\xBF)/', // byte-order mark (only outlook?) |
|---|
| | | '/<html\s[^>]+>/i', // washtml/DOMDocument cannot handle xml namespaces |
|---|
| | | // space(s) between <NOBR> |
|---|
| | | '/(<\/nobr>)(\s+)(<nobr>)/i', |
|---|
| | | // PHP bug #32547 workaround: remove title tag |
|---|
| | | '/<title[^>]*>[^<]*<\/title>/i', |
|---|
| | | // remove <!doctype> before BOM (#1490291) |
|---|
| | | '/<\!doctype[^>]+>[^<]*/im', |
|---|
| | | // byte-order mark (only outlook?) |
|---|
| | | '/^(\0\0\xFE\xFF|\xFF\xFE\0\0|\xFE\xFF|\xFF\xFE|\xEF\xBB\xBF)/', |
|---|
| | | // washtml/DOMDocument cannot handle xml namespaces |
|---|
| | | '/<html\s[^>]+>/i', |
|---|
| | | ); |
|---|
| | | |
|---|
| | | $html_replace = array( |
|---|
| | | '\\1'.' '.'\\3', |
|---|
| | | '', |
|---|
| | | '', |
|---|
| | | '', |
|---|
| | | '<html>', |
|---|
| | | ); |
|---|
| | | $html = preg_replace($html_search, $html_replace, trim($html)); |
|---|
