Actualización
This commit is contained in:
26
main/inc/lib/kses-0.2.2/AUTHORS
Normal file
26
main/inc/lib/kses-0.2.2/AUTHORS
Normal file
@@ -0,0 +1,26 @@
|
||||
kses AUTHORS
|
||||
============
|
||||
|
||||
* Ulf Harnhammar (main coder, project leader)
|
||||
metaur at users dot sourceforge dot net
|
||||
http://www.advogato.org/person/metaur/
|
||||
|
||||
* Richard R. V<>squez, Jr. (coder of object-oriented kses)
|
||||
contact him at http://chaos.org/contact/
|
||||
|
||||
|
||||
THANKS TO
|
||||
=========
|
||||
|
||||
* Peter Valach (code review and feature suggestions)
|
||||
* Simon Cornelius P. Umacob (testing)
|
||||
* unitedhacker2000@yahoo.com (bug report)
|
||||
* Dirk Haun (feature suggestion)
|
||||
* Hendy Irawan (bug report and documentation suggestion)
|
||||
* dude21 (feature suggestion)
|
||||
* Christian Bolstad (documentation suggestion)
|
||||
* SourceForge (project hosting)
|
||||
|
||||
Thanks also go to a lot of people who posted to the Bugtraq and
|
||||
Webappsec mailing lists about XSS or HTML filters. They gave us some
|
||||
valuable insights.
|
||||
340
main/inc/lib/kses-0.2.2/COPYING
Normal file
340
main/inc/lib/kses-0.2.2/COPYING
Normal file
@@ -0,0 +1,340 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Library General
|
||||
Public License instead of this License.
|
||||
168
main/inc/lib/kses-0.2.2/ChangeLog
Normal file
168
main/inc/lib/kses-0.2.2/ChangeLog
Normal file
@@ -0,0 +1,168 @@
|
||||
kses ChangeLog
|
||||
==============
|
||||
|
||||
* 0.2.2 and 0.2.2-rc1
|
||||
|
||||
0.2.2 was released on the 7th of February 2005. We also had a release
|
||||
candidate, 0.2.2-rc1, that was released on the 30th of January 2005.
|
||||
|
||||
I (Ulf) am sorry for this long delay, but I lost interest in kses for a
|
||||
while and worked on auditing C/C++ code for buffer overflows and format
|
||||
string bugs in the Debian Security Audit Project instead
|
||||
( http://www.debian.org/security/audit/ ).
|
||||
|
||||
This version has the following changes:
|
||||
|
||||
- Richard contributed an additional object-oriented kses version for
|
||||
PHP 5, which takes advantage of that PHP version's improved object
|
||||
orientation. You can find it in the oop/ directory.
|
||||
|
||||
- Richard added RemoveProtocol(), RemoveProtocols() and SetProtocols()
|
||||
methods to both object-oriented kses versions. This closes SourceForge
|
||||
bug #892477.
|
||||
|
||||
- Richard also did other smaller changes to the object-oriented kses
|
||||
versions. See oop/oop.kses.changelog.txt for the gory details.
|
||||
|
||||
- The code that checks whether used elements and attributes are allowed
|
||||
now uses isset() to avoid notices under certain configurations. This
|
||||
hopefully closes SourceForge bug #918493.
|
||||
|
||||
- The check for the Opera extra whitespace character #173 was moved so
|
||||
it only affects attribute values and nothing else. This is helpful for
|
||||
Asian kses users, who use that character in writing. (This is just a
|
||||
temporary solution. A better one will show up in the next version, when
|
||||
the parser is rewritten.) This closes SourceForge bug #834645, kind of.
|
||||
|
||||
- Now the program will not even look at attributes and closing XHTML
|
||||
slashes for closing HTML elements. This will make kses execute faster
|
||||
and it won't accept atrocities like </br /> anymore.
|
||||
|
||||
- Moved references in examples/test.php from function calls to the function
|
||||
definition, making it better PHP.
|
||||
|
||||
- The output of examples/test.php and examples/filter.php now conform fully
|
||||
to W3C's HTML specification.
|
||||
|
||||
- From now on, kses releases will be distributed both as .tar.gz and .zip
|
||||
archives to please our Wintendo users. This closes SourceForge feature
|
||||
request #900380.
|
||||
|
||||
- Changed to new copyright year and paper mail address.
|
||||
|
||||
|
||||
* 0.2.1
|
||||
|
||||
0.2.1 was released on the 29th of September 2003.
|
||||
It has the following changes:
|
||||
|
||||
|
||||
- There is now an additional version of kses, using the object-oriented
|
||||
paradigm. Thanks a lot to Richard R. Vasquez, Jr., who created it! Anyone
|
||||
who wants to make functional programming, logical programming or spaghetti
|
||||
programming versions of kses as well (or any other programming paradigm that
|
||||
you like), go ahead! All the people who like old procedural programming for
|
||||
web applications shouldn't despair, though, as both versions will be
|
||||
maintained with each release.
|
||||
|
||||
- kses now has some new attribute value checks: minlen, minval and valueless.
|
||||
See docs/attribute-value-checks for an explanation.
|
||||
|
||||
- For some reason, the Opera developers decided to make chr(173) a whitespace
|
||||
character in URL protocols, both when it occurs raw and in an entity. kses
|
||||
now handles this.
|
||||
|
||||
- The URL protocol whitelisting system now decodes entities before removing
|
||||
NULLs and whitespaces.
|
||||
|
||||
|
||||
* 0.2.0
|
||||
|
||||
0.2.0 was released on the 25th of July 2003.
|
||||
It has the following changes:
|
||||
|
||||
|
||||
- kses now supports checking of attribute values, and not just element names
|
||||
and attribute names. The attribute value checks that exist so far are
|
||||
'maxlen' (checks how long attribute values are, to avoid Buffer Overflows)
|
||||
and 'maxval' (checks how big an integer value is, to avoid Denial of Service
|
||||
attacks).
|
||||
|
||||
Buffer Overflows could both be a problem for WWW clients and different
|
||||
servers on the Internet that an HTML document links to. One example is
|
||||
<frame src="ftp://ftp.v1ct1m.com/AAAAAA..thousands_of_A's...">.
|
||||
|
||||
Denial of Service attacks can take the form of too big sizes of iframes or
|
||||
other things. One example is <iframe src="http://some.web.server/"
|
||||
width="20000" height="2000">, which makes some client machines completely
|
||||
overloaded.
|
||||
|
||||
- kses' old feature of removing "javascript:" from attribute values has been
|
||||
improved. It now has a whole system for white listing of URL protocols, so
|
||||
you can specify that it's acceptable with http:, https:, ftp: and gopher:,
|
||||
but no other protocols in attribute values. The system tries pretty hard to
|
||||
do the right thing with whitespace, upper/lower case, HTML entities
|
||||
("javascript:") and repeated entries ("javascript:javascript:alert(57)").
|
||||
|
||||
- kses now supports both HTML and XHTML code, by allowing " /" at the end of
|
||||
tags.
|
||||
|
||||
- kses now removes Netscape 4's JavaScript entities, having the form
|
||||
"&{alert(57)};". They don't even seem to work on all versions of Netscape 4,
|
||||
but for completeness' sake it seemed like a good feature to add.
|
||||
|
||||
- A bug with NULLs in javascript: URLs was fixed.
|
||||
(Reported by Simon Cornelius P. Umacob - thanks!)
|
||||
|
||||
- As a nice side effect of the white listing of URL protocols, kses now also
|
||||
normalizes all HTML entities in documents. It will change HTML code with bad
|
||||
entities to the right form, for example "AT&T" will be converted to
|
||||
"AT&T" and "<a href='lyrics.php?band=ladytron&lyrics=playgirl'>" will be
|
||||
converted to "<a href='lyrics.php?band=ladytron&lyrics=playgirl'>".
|
||||
":" will be converted to ":", "&#XYZZY;" will be converted to
|
||||
"&#XYZZY;", "ä!;" will be converted to "&auml!;" and so on.
|
||||
|
||||
As shown above, it will process HTML entities that it doesn't understand.
|
||||
It will also deal with too big numbers in numeric HTML entities, which is
|
||||
helpful as many browsers seem to wrap them around at 2 ** 32, so the
|
||||
characters 58, 58 + (2 ** 32), 58 + (2 ** 64) etcetera are all colons to the
|
||||
web browser.
|
||||
|
||||
- You can now use upper case letters in your $allowed_html array, in element
|
||||
names, attribute names and attribute value check names. Version 0.1.0
|
||||
required everything in that array to be in lower case, but that's not
|
||||
necessary any more. You can also use upper case letters in
|
||||
$allowed_protocols.
|
||||
|
||||
- The "Really malformed thing" bug from the TODO file was fixed.
|
||||
It used to convert this string:
|
||||
x > 5 <a href="blah">
|
||||
to:
|
||||
x > 5 <a href="blah">
|
||||
and now it converts it to:
|
||||
x > 5 <a href="blah">
|
||||
|
||||
- The "Weird malformed thing" bug from the TODO file was fixed.
|
||||
It used to convert this string:
|
||||
<a href="5 href=6>
|
||||
to:
|
||||
<a href="6">
|
||||
because of the way kses restarts after a parse error in kses_hair(). Now it
|
||||
converts it to:
|
||||
<a>
|
||||
|
||||
- A problem with slashes in HTML tags was fixed.
|
||||
|
||||
- examples/filter.php used to use $SCRIPT_NAME, which doesn't work on
|
||||
Windows.
|
||||
(Reported by Simon Cornelius P. Umacob - thanks!)
|
||||
|
||||
- kses now allows dashes in attribute names, for things like
|
||||
<meta http-equiv=..>.
|
||||
|
||||
|
||||
* 0.1.0, first public version
|
||||
|
||||
0.1.0 was released on the 9th of June 2003.
|
||||
It was announced on three security related mailing lists on Friday the 13th
|
||||
of June (nothing bad happened to it though).
|
||||
206
main/inc/lib/kses-0.2.2/README
Normal file
206
main/inc/lib/kses-0.2.2/README
Normal file
@@ -0,0 +1,206 @@
|
||||
kses 0.2.2 README [kses strips evil scripts!]
|
||||
=================
|
||||
|
||||
|
||||
* INTRODUCTION *
|
||||
|
||||
|
||||
Welcome to kses - an HTML/XHTML filter written in PHP. It removes all unwanted
|
||||
HTML elements and attributes, no matter how malformed HTML input you give it.
|
||||
It also does several checks on attribute values. kses can be used to avoid
|
||||
Cross-Site Scripting (XSS), Buffer Overflows and Denial of Service attacks,
|
||||
among other things.
|
||||
|
||||
The program is released under the terms of the GNU General Public License. You
|
||||
should look into what that means, before using kses in your programs. You can
|
||||
find the full text of the license in the file COPYING.
|
||||
|
||||
|
||||
* FEATURES *
|
||||
|
||||
|
||||
Some of kses' current features are:
|
||||
|
||||
* It will only allow the HTML elements and attributes that it was explicitly
|
||||
told to allow.
|
||||
|
||||
* Element and attribute names are case-insensitive (a href vs A HREF).
|
||||
|
||||
* It will understand and process whitespace correctly.
|
||||
|
||||
* Attribute values can be surrounded with quotes, apostrophes or nothing.
|
||||
|
||||
* It will accept valueless attributes with just names and no values (selected).
|
||||
|
||||
* It will accept XHTML's closing " /" marks.
|
||||
|
||||
* Attribute values that are surrounded with nothing will get quotes to avoid
|
||||
producing non-W3C conforming HTML
|
||||
(<a href=http://sourceforge.net/projects/kses> works but isn't valid HTML).
|
||||
|
||||
* It handles lots of types of malformed HTML, by interpreting the existing
|
||||
code the best it can and then rebuilding new code from it. That's a better
|
||||
approach than trying to process existing code, as you're bound to forget about
|
||||
some weird special case somewhere. It handles problems like never-ending
|
||||
quotes and tags gracefully.
|
||||
|
||||
* It will remove additional "<" and ">" characters that people may try to
|
||||
sneak in somewhere.
|
||||
|
||||
* It supports checking attribute values for minimum/maximum length and
|
||||
minimum/maximum value, to protect against Buffer Overflows and Denial of
|
||||
Service attacks against WWW clients and various servers. You can stop
|
||||
<iframe src= width= height=> from having too high values for width and height,
|
||||
for instance.
|
||||
|
||||
* It has got a system for whitelisting URL protocols. You can say that
|
||||
attribute values may only start with http:, https:, ftp: and gopher:, but no
|
||||
other URL protocols (javascript:, java:, about:, telnet:..). The functions that
|
||||
do this work handle whitespace, upper/lower case, HTML entities
|
||||
("javascript:") and repeated entries ("javascript:javascript:alert(57)").
|
||||
It also normalizes HTML entities as a nice side effect.
|
||||
|
||||
* It removes Netscape 4's JavaScript entities ("&{alert(57)};").
|
||||
|
||||
* It handles NULL bytes and Opera's chr(173) whitespace characters.
|
||||
|
||||
* There is a procedural version and two object-oriented versions (for PHP 4
|
||||
and PHP 5) of kses.
|
||||
|
||||
|
||||
* USE IT *
|
||||
|
||||
|
||||
It's very easy to use kses in your own PHP web application! Basic usage looks
|
||||
like this:
|
||||
|
||||
|
||||
<?php
|
||||
|
||||
include 'kses.php';
|
||||
|
||||
$allowed = array('b' => array(),
|
||||
'i' => array(),
|
||||
'a' => array('href' => 1, 'title' => 1),
|
||||
'p' => array('align' => 1),
|
||||
'br' => array());
|
||||
|
||||
$val = $_POST['val'];
|
||||
if (get_magic_quotes_gpc())
|
||||
$val = stripslashes($val);
|
||||
# You must strip slashes from magic quotes, or kses will get confused.
|
||||
|
||||
$val = kses($val, $allowed); # The filtering takes place here.
|
||||
|
||||
# Do something with $val.
|
||||
|
||||
?>
|
||||
|
||||
|
||||
This definition of $allowed means that only the elements B, I, A, P and BR are
|
||||
allowed (along with their closing tags /B, /I, /A, /P and /BR). B, I and BR
|
||||
may not have any attributes. A may only have the attributes HREF and TITLE,
|
||||
while P may only have the attribute ALIGN. You can list the elements and
|
||||
attributes in the array in any mixture of upper and lower case. kses will also
|
||||
recognize HTML code that uses both lower and upper case.
|
||||
|
||||
It's important to select the right allowed attributes, so you won't open up
|
||||
an XSS hole by mistake. Some important attributes that you mustn't allow
|
||||
include but are not limited to: 1) style, and 2) all intrinsic events
|
||||
attributes (onMouseOver and so on, on* really). I'll write more about this in
|
||||
the documentation that will be distributed with future versions of kses.
|
||||
|
||||
It's also important to note that kses' HTML input must be cleaned of all
|
||||
slashes coming from magic quotes. If the rest of your code requires these
|
||||
slashes to be present, you can always add them again after calling kses with
|
||||
a simple addslashes() call.
|
||||
|
||||
You should take a look at the documentation in the docs/ directory and the
|
||||
examples in the examples/ directory, to get more information on how to use
|
||||
kses. The object-oriented versions of kses are also worth checking out, and
|
||||
they're included in the oop/ directory.
|
||||
|
||||
|
||||
* UPGRADING TO 0.2.2 *
|
||||
|
||||
|
||||
kses 0.2.2 is backwards compatible with all previous releases, so upgrading
|
||||
should just be a matter of using a new version of kses.php instead of an old
|
||||
one.
|
||||
|
||||
|
||||
* NEW VERSIONS, MAILING LISTS AND BUG REPORTS *
|
||||
|
||||
|
||||
If you want to download new versions, subscribe to the kses-general mailing
|
||||
list or even take part in the development of kses, we refer you to its
|
||||
homepage at http://sourceforge.net/projects/kses . New developers and beta
|
||||
testers are more than welcome!
|
||||
|
||||
If you have any bug reports, suggestions for improvement or simply want to tell
|
||||
us that you use kses for some project, feel free to post to the kses-general
|
||||
mailing list. If you have found any security problems (particularly XSS,
|
||||
naturally) in kses, please contact Ulf privately at metaur at users dot
|
||||
sourceforge dot net so he can correct it before you or someone else tells the
|
||||
public about it.
|
||||
|
||||
(No, it's not a security problem in kses if some program that uses it allows a
|
||||
bad attribute, silly. If kses is told to accept the element body with the
|
||||
attributes style and onLoad, it will accept them, even if that's a really bad
|
||||
idea, securitywise.)
|
||||
|
||||
|
||||
* OTHER HTML FILTERS *
|
||||
|
||||
|
||||
Here are the other stand-alone, open source HTML filters that we currently know
|
||||
of:
|
||||
|
||||
* Htmlfilter for PHP - the filter from Squirrelmail
|
||||
PHP
|
||||
Konstantin Riabitsev
|
||||
http://linux.duke.edu/projects/mini/htmlfilter/
|
||||
|
||||
* HTML::StripScripts and related CPAN modules
|
||||
Perl
|
||||
Nick Cleaton
|
||||
http://search.cpan.org/perldoc?HTML%3A%3AStripScripts
|
||||
|
||||
* SafeHtmlChecker [is this really open source?]
|
||||
PHP
|
||||
Simon Willison
|
||||
http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker
|
||||
|
||||
There are also a lot of HTML filters that were written specifically for some
|
||||
program. Some of them are better than others.
|
||||
|
||||
Please write to the kses-general mailing list if you know of any other
|
||||
stand-alone, open-source filters.
|
||||
|
||||
|
||||
* DEDICATION *
|
||||
|
||||
|
||||
kses 0.2.2 is dedicated to Audrey Tautou and Jean-Pierre Jeunet.
|
||||
|
||||
|
||||
* MISC *
|
||||
|
||||
|
||||
The kses code is based on an HTML filter that Ulf wrote on his own back in 2002
|
||||
for the open-source project Gnuheter ( http://savannah.nongnu.org/projects/
|
||||
gnuheter ). Gnuheter is a fork from PHP-Nuke. The HTML filter has been
|
||||
improved a lot since then.
|
||||
|
||||
To stop people from having sleepless nights, we feel the urgent need to state
|
||||
that kses doesn't have anything to do with the KDE project, despite having a
|
||||
name that starts with a K.
|
||||
|
||||
In case someone was wondering, Ulf is available for kses-related consulting.
|
||||
|
||||
Finally, the name kses comes from the terms XSS and access. It's also a
|
||||
recursive acronym (every open-source project should have one!) for "kses
|
||||
strips evil scripts".
|
||||
|
||||
|
||||
// Ulf and the kses development group, February 2005
|
||||
40
main/inc/lib/kses-0.2.2/TODO
Normal file
40
main/inc/lib/kses-0.2.2/TODO
Normal file
@@ -0,0 +1,40 @@
|
||||
kses TODO
|
||||
=========
|
||||
|
||||
* create a nice homepage with interactive kses testing
|
||||
|
||||
* remove stuff in between <script>..</script> and <style>..</style>
|
||||
|
||||
* better fix for chr(173) bug and try to allow for "style:" where people
|
||||
want to use it
|
||||
|
||||
* XHTML tags of the style <br/> instead of <br />
|
||||
This is related to a small bug with <a href="blah />
|
||||
Solution: rewrite parser.
|
||||
|
||||
(* rewrite document to XHTML or HTML)
|
||||
|
||||
* more attribute value checks
|
||||
|
||||
* more types of hooks
|
||||
|
||||
* return array of removed elements and attributes
|
||||
|
||||
* give the option of turning unacceptable elements to entities instead of
|
||||
removing them (and turn unacceptable attributes to their own tag, which is
|
||||
then turned to entities?) .. perhaps turn to comments as well?
|
||||
|
||||
* ">" in HTML tags
|
||||
<img src="blah.gif" alt="x > 5">
|
||||
Not very important, but..
|
||||
|
||||
(* make document well-formed.. there is HTML Tidy, but perhaps we want this
|
||||
functionality in kses itself?)
|
||||
|
||||
* port to other programming languages to achieve world domination
|
||||
|
||||
* lots of testing
|
||||
|
||||
* write better documentation
|
||||
|
||||
* feedback from users
|
||||
68
main/inc/lib/kses-0.2.2/docs/attribute-value-checks
Normal file
68
main/inc/lib/kses-0.2.2/docs/attribute-value-checks
Normal file
@@ -0,0 +1,68 @@
|
||||
kses attribute value checks
|
||||
===========================
|
||||
|
||||
As you've probably already read in the README file, an $allowed_html array
|
||||
normally looks like this:
|
||||
|
||||
$allowed = array('b' => array(),
|
||||
'i' => array(),
|
||||
'a' => array('href' => 1,
|
||||
'title' => 1),
|
||||
'p' => array('align' => 1),
|
||||
'br' => array());
|
||||
|
||||
This sets what elements and attributes are allowed.
|
||||
|
||||
From kses 0.2.0, you can also perform some checks on the attribute values. You
|
||||
do it like this:
|
||||
|
||||
$allowed = array('b' => array(),
|
||||
'i' => array(),
|
||||
'a' => array('href' =>
|
||||
array('maxlen' => 100),
|
||||
'title' => 1),
|
||||
'p' => array('align' => 1),
|
||||
'font' => array('size' =>
|
||||
array('maxval' => 20)),
|
||||
'br' => array());
|
||||
|
||||
This means that kses should perform the maxlen check with the value 100 on the
|
||||
<a href=> value, as well as the maxval check with the value 20 on the <font
|
||||
size=> value.
|
||||
|
||||
The currently implemented checks (with more to come) are 'maxlen', 'maxval',
|
||||
'minlen', 'minval' and 'valueless'.
|
||||
|
||||
'maxlen' checks that the length of the attribute value is not greater than the
|
||||
given value. It is helpful against Buffer Overflows in WWW clients and various
|
||||
servers on the Internet. In my example above, it would mean that
|
||||
"<a href='ftp://ftp.v1ct1m.com/AAAA..thousands_of_A's...'>" wouldn't be
|
||||
accepted.
|
||||
|
||||
Of course, this problem is even worse if you put that long URL in a <frame>
|
||||
tag instead, so the WWW client will fetch it automatically without a user
|
||||
having to click it.
|
||||
|
||||
'maxval' checks that the attribute value is an integer greater than or equal to
|
||||
zero, that it doesn't have an unreasonable amount of zeroes or whitespace (to
|
||||
avoid Buffer Overflows), and that it is not greater than the given value. In
|
||||
my example above, it would mean that "<font size='20'>" is accepted but
|
||||
"<font size='21'>" is not. This check helps against Denial of Service attacks
|
||||
against WWW clients.
|
||||
|
||||
One example of this DoS problem is <iframe src="http://some.web.server/"
|
||||
width="20000" height="2000">, which makes some client machines completely
|
||||
overloaded.
|
||||
|
||||
'minlen' and 'minval' works the same as 'maxlen' and 'maxval', except that they
|
||||
check for minimum lengths and values instead of maximum ones.
|
||||
|
||||
'valueless' checks if an attribute has a value (like <a href="blah">) or not
|
||||
(<option selected>). If the given value is a "y" or a "Y", the attribute must
|
||||
not have a value to be accepted. If the given value is an "n" or an "N", the
|
||||
attribute must have a value. Note that <a href=""> is considered to have a
|
||||
value, so there's a difference between valueless attributes and attribute
|
||||
values with the length zero.
|
||||
|
||||
You can combine more than one check, by putting one after the other in the
|
||||
inner array.
|
||||
7
main/inc/lib/kses-0.2.2/docs/hooks
Normal file
7
main/inc/lib/kses-0.2.2/docs/hooks
Normal file
@@ -0,0 +1,7 @@
|
||||
kses hooks
|
||||
==========
|
||||
|
||||
Sometimes you want to perform one more action on all data that kses will
|
||||
filter. There is a special function for that purpose called kses_hook(). kses
|
||||
calls it from its main function kses(), so if you insert some code in
|
||||
kses_hook(), it will always be called to change all data that kses sees.
|
||||
6
main/inc/lib/kses-0.2.2/docs/index.html
Normal file
6
main/inc/lib/kses-0.2.2/docs/index.html
Normal file
@@ -0,0 +1,6 @@
|
||||
<html>
|
||||
<head>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
7
main/inc/lib/kses-0.2.2/docs/stripping-everything
Normal file
7
main/inc/lib/kses-0.2.2/docs/stripping-everything
Normal file
@@ -0,0 +1,7 @@
|
||||
kses stripping everything
|
||||
=========================
|
||||
|
||||
Sometimes you want to use kses for stripping all (X)HTML tags from a document.
|
||||
You do it by calling kses like this:
|
||||
|
||||
$doc = kses($doc, array());
|
||||
6
main/inc/lib/kses-0.2.2/docs/supported-formats
Normal file
6
main/inc/lib/kses-0.2.2/docs/supported-formats
Normal file
@@ -0,0 +1,6 @@
|
||||
kses supported formats
|
||||
======================
|
||||
|
||||
It should be noted that kses doesn't deal with any smiley plus newline plus
|
||||
HTML format. It uses HTML or XHTML, both as input and as output.
|
||||
Conversions from the preferred format to or from HTML or XHTML is up to you.
|
||||
15
main/inc/lib/kses-0.2.2/docs/whitelisted-url-protocols
Normal file
15
main/inc/lib/kses-0.2.2/docs/whitelisted-url-protocols
Normal file
@@ -0,0 +1,15 @@
|
||||
kses whitelisted URL protocols
|
||||
==============================
|
||||
|
||||
From kses 0.2.0, it has a function that checks all attribute values for URL
|
||||
protocols and only allows the protocols given in a whitelist.
|
||||
|
||||
If you call kses the old way with two parameters - a string and an
|
||||
$allowed_html array - it will take its own default array, which whitelists the
|
||||
protocols http, https, ftp, news, nntp, telnet, gopher and mailto. Pretty
|
||||
reasonable, but anyone who wants to change it just calls the kses() function
|
||||
with a third parameter, like this:
|
||||
|
||||
$string = kses($string, $allowed_html, array('http', 'https'));
|
||||
|
||||
Note that you shouldn't include any colon after http or other protocol names.
|
||||
0
main/inc/lib/kses-0.2.2/examples/filter.php
Normal file
0
main/inc/lib/kses-0.2.2/examples/filter.php
Normal file
6
main/inc/lib/kses-0.2.2/examples/index.html
Normal file
6
main/inc/lib/kses-0.2.2/examples/index.html
Normal file
@@ -0,0 +1,6 @@
|
||||
<html>
|
||||
<head>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
0
main/inc/lib/kses-0.2.2/examples/test.php
Normal file
0
main/inc/lib/kses-0.2.2/examples/test.php
Normal file
6
main/inc/lib/kses-0.2.2/index.html
Normal file
6
main/inc/lib/kses-0.2.2/index.html
Normal file
@@ -0,0 +1,6 @@
|
||||
<html>
|
||||
<head>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
866
main/inc/lib/kses-0.2.2/kses.php
Normal file
866
main/inc/lib/kses-0.2.2/kses.php
Normal file
@@ -0,0 +1,866 @@
|
||||
<?php
|
||||
/**
|
||||
* kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes
|
||||
* Copyright (C) 2002, 2003, 2005 Ulf Harnhammar
|
||||
*
|
||||
* This program is free software and open source software; you can redistribute
|
||||
* it and/or modify it under the terms of the GNU General Public License as
|
||||
* published by the Free Software Foundation; either version 3 of the License,
|
||||
* or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
||||
* more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along
|
||||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA or visit
|
||||
* http://www.gnu.org/licenses/gpl.html
|
||||
*
|
||||
* *** CONTACT INFORMATION ***
|
||||
*
|
||||
* E-mail: metaur at users dot sourceforge dot net
|
||||
* Web page: http://sourceforge.net/projects/kses
|
||||
* Paper mail: Ulf Harnhammar
|
||||
* Ymergatan 17 C
|
||||
* 753 25 Uppsala
|
||||
* SWEDEN
|
||||
*
|
||||
* [kses strips evil scripts!]
|
||||
*
|
||||
* @package chamilo.kses
|
||||
* @copyright Ulf Harnhammar {@link http://sourceforge.net/projects/kses}
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
|
||||
*/
|
||||
|
||||
$kses_allowedentitynames = array(
|
||||
'nbsp', 'iexcl', 'cent', 'pound', 'curren', 'yen',
|
||||
'brvbar', 'sect', 'uml', 'copy', 'ordf', 'laquo',
|
||||
'not', 'shy', 'reg', 'macr', 'deg', 'plusmn',
|
||||
'acute', 'micro', 'para', 'middot', 'cedil', 'ordm',
|
||||
'raquo', 'iquest', 'Agrave', 'Aacute', 'Acirc', 'Atilde',
|
||||
'Auml', 'Aring', 'AElig', 'Ccedil', 'Egrave', 'Eacute',
|
||||
'Ecirc', 'Euml', 'Igrave', 'Iacute', 'Icirc', 'Iuml',
|
||||
'ETH', 'Ntilde', 'Ograve', 'Oacute', 'Ocirc', 'Otilde',
|
||||
'Ouml', 'times', 'Oslash', 'Ugrave', 'Uacute', 'Ucirc',
|
||||
'Uuml', 'Yacute', 'THORN', 'szlig', 'agrave', 'aacute',
|
||||
'acirc', 'atilde', 'auml', 'aring', 'aelig', 'ccedil',
|
||||
'egrave', 'eacute', 'ecirc', 'euml', 'igrave', 'iacute',
|
||||
'icirc', 'iuml', 'eth', 'ntilde', 'ograve', 'oacute',
|
||||
'ocirc', 'otilde', 'ouml', 'divide', 'oslash', 'ugrave',
|
||||
'uacute', 'ucirc', 'uuml', 'yacute', 'thorn', 'yuml',
|
||||
'quot', 'amp', 'lt', 'gt', 'apos', 'OElig',
|
||||
'oelig', 'Scaron', 'scaron', 'Yuml', 'circ', 'tilde',
|
||||
'ensp', 'emsp', 'thinsp', 'zwnj', 'zwj', 'lrm',
|
||||
'rlm', 'ndash', 'mdash', 'lsquo', 'rsquo', 'sbquo',
|
||||
'ldquo', 'rdquo', 'bdquo', 'dagger', 'Dagger', 'permil',
|
||||
'lsaquo', 'rsaquo', 'euro', 'fnof', 'Alpha', 'Beta',
|
||||
'Gamma', 'Delta', 'Epsilon', 'Zeta', 'Eta', 'Theta',
|
||||
'Iota', 'Kappa', 'Lambda', 'Mu', 'Nu', 'Xi',
|
||||
'Omicron', 'Pi', 'Rho', 'Sigma', 'Tau', 'Upsilon',
|
||||
'Phi', 'Chi', 'Psi', 'Omega', 'alpha', 'beta',
|
||||
'gamma', 'delta', 'epsilon', 'zeta', 'eta', 'theta',
|
||||
'iota', 'kappa', 'lambda', 'mu', 'nu', 'xi',
|
||||
'omicron', 'pi', 'rho', 'sigmaf', 'sigma', 'tau',
|
||||
'upsilon', 'phi', 'chi', 'psi', 'omega', 'thetasym',
|
||||
'upsih', 'piv', 'bull', 'hellip', 'prime', 'Prime',
|
||||
'oline', 'frasl', 'weierp', 'image', 'real', 'trade',
|
||||
'alefsym', 'larr', 'uarr', 'rarr', 'darr', 'harr',
|
||||
'crarr', 'lArr', 'uArr', 'rArr', 'dArr', 'hArr',
|
||||
'forall', 'part', 'exist', 'empty', 'nabla', 'isin',
|
||||
'notin', 'ni', 'prod', 'sum', 'minus', 'lowast',
|
||||
'radic', 'prop', 'infin', 'ang', 'and', 'or',
|
||||
'cap', 'cup', 'int', 'sim', 'cong', 'asymp',
|
||||
'ne', 'equiv', 'le', 'ge', 'sub', 'sup',
|
||||
'nsub', 'sube', 'supe', 'oplus', 'otimes', 'perp',
|
||||
'sdot', 'lceil', 'rceil', 'lfloor', 'rfloor', 'lang',
|
||||
'rang', 'loz', 'spades', 'clubs', 'hearts', 'diams',
|
||||
);
|
||||
|
||||
/**
|
||||
* Filters content and keeps only allowable HTML elements.
|
||||
*
|
||||
* This function makes sure that only the allowed HTML element names, attribute
|
||||
* names and attribute values plus only sane HTML entities will occur in
|
||||
* $string. You have to remove any slashes from PHP's magic quotes before you
|
||||
* call this function.
|
||||
*
|
||||
* The default allowed protocols are 'http', 'https', 'ftp', 'news',
|
||||
* 'nntp', 'telnet', 'gopher', 'mailto'.
|
||||
* This covers all common link protocols, except for 'javascript' which should not
|
||||
* be allowed for untrusted users.
|
||||
*
|
||||
* @param string $string
|
||||
* @param string $allowed_html
|
||||
* @param array $allowed_protocols
|
||||
* @return string
|
||||
*/
|
||||
function kses($string, $allowed_html, $allowed_protocols =
|
||||
array('http', 'https', 'ftp', 'news', 'nntp', 'telnet',
|
||||
'gopher', 'mailto'))
|
||||
{
|
||||
$string = kses_no_null($string);
|
||||
$string = kses_js_entities($string);
|
||||
$string = kses_normalize_entities($string);
|
||||
$string = kses_hook($string);
|
||||
$allowed_html_fixed = kses_array_lc($allowed_html);
|
||||
return kses_split($string, $allowed_html_fixed, $allowed_protocols);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* You add any kses hooks here.
|
||||
*
|
||||
* @param string $string
|
||||
* @return string
|
||||
*/
|
||||
function kses_hook($string)
|
||||
{
|
||||
return $string;
|
||||
}
|
||||
|
||||
/**
|
||||
* This function returns kses' version number.
|
||||
*
|
||||
* @return string KSES Version Number
|
||||
*/
|
||||
function kses_version()
|
||||
{
|
||||
return '0.2.2';
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* This function searches for HTML tags, no matter how malformed.
|
||||
* It also matches stray ">" characters.
|
||||
*
|
||||
* @param string $string Content to filter
|
||||
* @param array $allowed_html Allowed HTML elements
|
||||
* @param array $allowed_protocols Allowed protocols to keep
|
||||
* @return string Content with fixed HTML tags
|
||||
*/
|
||||
function kses_split($string, $allowed_html, $allowed_protocols)
|
||||
{
|
||||
global $pass_allowed_html, $pass_allowed_protocols;
|
||||
$pass_allowed_html = $allowed_html;
|
||||
$pass_allowed_protocols = $allowed_protocols;
|
||||
return preg_replace_callback( '%((<!--.*?(-->|$))|(<[^>]*(>|$)|>))%', '_kses_split_callback', $string );
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback for kses_split.
|
||||
*
|
||||
* @access private
|
||||
*/
|
||||
function _kses_split_callback( $match )
|
||||
{
|
||||
global $pass_allowed_html, $pass_allowed_protocols;
|
||||
return kses_split2( $match[1], $pass_allowed_html, $pass_allowed_protocols );
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback for kses_split for fixing malformed HTML tags.
|
||||
*
|
||||
* This function does a lot of work. It rejects some very malformed things like
|
||||
* <:::>. It returns an empty string, if the element isn't allowed (look ma, no
|
||||
* strip_tags()!). Otherwise it splits the tag into an element and an attribute
|
||||
* list.
|
||||
*
|
||||
* After the tag is split into an element and an attribute list, it is run
|
||||
* through another filter which will remove illegal attributes and once that is
|
||||
* completed, will be returned.
|
||||
*
|
||||
* @access private
|
||||
* @uses kses_attr()
|
||||
*
|
||||
* @param string $string Content to filter
|
||||
* @param array $allowed_html Allowed HTML elements
|
||||
* @param array $allowed_protocols Allowed protocols to keep
|
||||
* @return string Fixed HTML element
|
||||
*/
|
||||
function kses_split2($string, $allowed_html, $allowed_protocols)
|
||||
{
|
||||
$string = kses_stripslashes($string);
|
||||
|
||||
if (substr($string, 0, 1) != '<')
|
||||
return '>';
|
||||
// It matched a ">" character
|
||||
|
||||
if (preg_match('%^<!--(.*?)(-->)?$%', $string, $matches)) {
|
||||
$string = str_replace(array('<!--', '-->'), '', $matches[1]);
|
||||
while ( $string != $newstring = kses($string, $allowed_html, $allowed_protocols) )
|
||||
$string = $newstring;
|
||||
if ( $string == '' )
|
||||
return '';
|
||||
// prevent multiple dashes in comments
|
||||
$string = preg_replace('/--+/', '-', $string);
|
||||
// prevent three dashes closing a comment
|
||||
$string = preg_replace('/-$/', '', $string);
|
||||
return "<!--{$string}-->";
|
||||
}
|
||||
// Allow HTML comments
|
||||
|
||||
if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches))
|
||||
return '';
|
||||
// It's seriously malformed
|
||||
|
||||
$slash = trim($matches[1]);
|
||||
$elem = $matches[2];
|
||||
$attrlist = $matches[3];
|
||||
|
||||
if (!@isset($allowed_html[strtolower($elem)]))
|
||||
return '';
|
||||
// They are using a not allowed HTML element
|
||||
|
||||
if ($slash != '')
|
||||
return "<$slash$elem>";
|
||||
// No attributes are allowed for closing elements
|
||||
|
||||
return kses_attr("$slash$elem", $attrlist, $allowed_html,
|
||||
$allowed_protocols);
|
||||
}
|
||||
|
||||
/**
|
||||
* This function removes all attributes, if none are allowed for this element.
|
||||
*
|
||||
* If some are allowed it calls kses_hair() to split them further, and then
|
||||
* it builds up new HTML code from the data that kses_hair() returns. It also
|
||||
* removes "<" and ">" characters, if there are any left. One more thing it does
|
||||
* is to check if the tag has a closing XHTML slash, and if it does, it puts one
|
||||
* in the returned code as well.
|
||||
*
|
||||
* @param string $element HTML element/tag
|
||||
* @param string $attr HTML attributes from HTML element to closing HTML element tag
|
||||
* @param array $allowed_html Allowed HTML elements
|
||||
* @param array $allowed_protocols Allowed protocols to keep
|
||||
* @return string Sanitized HTML element
|
||||
*/
|
||||
function kses_attr($element, $attr, $allowed_html, $allowed_protocols)
|
||||
{
|
||||
// Is there a closing XHTML slash at the end of the attributes?
|
||||
|
||||
$xhtml_slash = '';
|
||||
if (preg_match('%\s*/\s*$%', $attr))
|
||||
$xhtml_slash = ' /';
|
||||
|
||||
// Are any attributes allowed at all for this element?
|
||||
|
||||
if (@count($allowed_html[strtolower($element)]) == 0)
|
||||
return "<$element$xhtml_slash>";
|
||||
|
||||
// Split it
|
||||
|
||||
$attrarr = kses_hair($attr, $allowed_protocols);
|
||||
|
||||
// Go through $attrarr, and save the allowed attributes for this element
|
||||
// in $attr2
|
||||
|
||||
$attr2 = '';
|
||||
|
||||
foreach ($attrarr as $arreach)
|
||||
{
|
||||
if (!@isset($allowed_html[strtolower($element)]
|
||||
[strtolower($arreach['name'])]))
|
||||
continue; // the attribute is not allowed
|
||||
|
||||
$current = $allowed_html[strtolower($element)]
|
||||
[strtolower($arreach['name'])];
|
||||
if ($current == '')
|
||||
continue; // the attribute is not allowed
|
||||
|
||||
if (!is_array($current))
|
||||
$attr2 .= ' '.$arreach['whole'];
|
||||
// there are no checks
|
||||
|
||||
else
|
||||
{
|
||||
// there are some checks
|
||||
$ok = true;
|
||||
foreach ($current as $currkey => $currval)
|
||||
if (!kses_check_attr_val($arreach['value'], $arreach['vless'],
|
||||
$currkey, $currval))
|
||||
{ $ok = false; break; }
|
||||
|
||||
if ( strtolower($arreach['name']) == 'style' ) {
|
||||
$orig_value = $arreach['value'];
|
||||
|
||||
$value = kses_safecss_filter_attr($orig_value);
|
||||
|
||||
if ( empty($value) )
|
||||
continue;
|
||||
|
||||
$arreach['value'] = $value;
|
||||
|
||||
$arreach['whole'] = str_replace($orig_value, $value, $arreach['whole']);
|
||||
}
|
||||
|
||||
if ($ok)
|
||||
$attr2 .= ' '.$arreach['whole']; // it passed them
|
||||
} // if !is_array($current)
|
||||
} // foreach
|
||||
|
||||
// Remove any "<" or ">" characters
|
||||
|
||||
$attr2 = preg_replace('/[<>]/', '', $attr2);
|
||||
|
||||
return "<$element$attr2$xhtml_slash>";
|
||||
}
|
||||
|
||||
/**
|
||||
* Builds an attribute list from string containing attributes.
|
||||
*
|
||||
* This function does a lot of work. It parses an attribute list into an array
|
||||
* with attribute data, and tries to do the right thing even if it gets weird
|
||||
* input. It will add quotes around attribute values that don't have any quotes
|
||||
* or apostrophes around them, to make it easier to produce HTML code that will
|
||||
* conform to W3C's HTML specification. It will also remove bad URL protocols
|
||||
* from attribute values.
|
||||
* It also reduces duplicate attributes by using the
|
||||
* attribute defined first (foo='bar' foo='baz' will result in foo='bar').
|
||||
*
|
||||
* @param string $attr Attribute list from HTML element to closing HTML element tag
|
||||
* @param array $allowed_protocols Allowed protocols to keep
|
||||
* @return array List of attributes after parsing
|
||||
*/
|
||||
function kses_hair($attr, $allowed_protocols)
|
||||
{
|
||||
$attrarr = array();
|
||||
$mode = 0;
|
||||
$attrname = '';
|
||||
$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
|
||||
|
||||
// Loop through the whole attribute list
|
||||
|
||||
while (strlen($attr) != 0)
|
||||
{
|
||||
$working = 0; // Was the last operation successful?
|
||||
|
||||
switch ($mode)
|
||||
{
|
||||
case 0: // attribute name, href for instance
|
||||
|
||||
if (preg_match('/^([-a-zA-Z]+)/', $attr, $match))
|
||||
{
|
||||
$attrname = $match[1];
|
||||
$working = $mode = 1;
|
||||
$attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case 1: // equals sign or valueless ("selected")
|
||||
|
||||
if (preg_match('/^\s*=\s*/', $attr)) // equals sign
|
||||
{
|
||||
$working = 1; $mode = 2;
|
||||
$attr = preg_replace('/^\s*=\s*/', '', $attr);
|
||||
break;
|
||||
}
|
||||
|
||||
if (preg_match('/^\s+/', $attr)) // valueless
|
||||
{
|
||||
$working = 1; $mode = 0;
|
||||
if(FALSE === array_key_exists($attrname, $attrarr)) {
|
||||
$attrarr[$attrname] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');
|
||||
}
|
||||
$attr = preg_replace('/^\s+/', '', $attr);
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case 2: // attribute value, a URL after href= for instance
|
||||
|
||||
if (preg_match('%^"([^"]*)"(\s+|/?$)%', $attr, $match))
|
||||
// "value"
|
||||
{
|
||||
// MDL-2684 - kses stripping CSS styles that it thinks look like protocols
|
||||
if ($attrname == 'style') {
|
||||
$thisval = $match[1];
|
||||
} else {
|
||||
$thisval = $match[1];
|
||||
if ( in_array(strtolower($attrname), $uris) )
|
||||
$thisval = kses_bad_protocol($thisval, $allowed_protocols);
|
||||
}
|
||||
|
||||
if(FALSE === array_key_exists($attrname, $attrarr)) {
|
||||
$attrarr[$attrname] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n');
|
||||
}
|
||||
$working = 1; $mode = 0;
|
||||
$attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr);
|
||||
break;
|
||||
}
|
||||
|
||||
if (preg_match("%^'([^']*)'(\s+|/?$)%", $attr, $match))
|
||||
// 'value'
|
||||
{
|
||||
$thisval = $match[1];
|
||||
if ( in_array(strtolower($attrname), $uris) )
|
||||
$thisval = kses_bad_protocol($thisval, $allowed_protocols);
|
||||
|
||||
if(FALSE === array_key_exists($attrname, $attrarr)) {
|
||||
$attrarr[$attrname] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname='$thisval'", 'vless' => 'n');
|
||||
}
|
||||
$working = 1; $mode = 0;
|
||||
$attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr);
|
||||
break;
|
||||
}
|
||||
|
||||
if (preg_match("%^([^\s\"']+)(\s+|/?$)%", $attr, $match))
|
||||
// value
|
||||
{
|
||||
$thisval = $match[1];
|
||||
if ( in_array(strtolower($attrname), $uris) )
|
||||
$thisval = kses_bad_protocol($thisval, $allowed_protocols);
|
||||
|
||||
if(FALSE === array_key_exists($attrname, $attrarr)) {
|
||||
$attrarr[$attrname] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n');
|
||||
}
|
||||
// We add quotes to conform to W3C's HTML spec.
|
||||
$working = 1; $mode = 0;
|
||||
$attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr);
|
||||
}
|
||||
|
||||
break;
|
||||
} // switch
|
||||
|
||||
if ($working == 0) // not well formed, remove and try again
|
||||
{
|
||||
$attr = kses_html_error($attr);
|
||||
$mode = 0;
|
||||
}
|
||||
} // while
|
||||
|
||||
if ($mode == 1 && FALSE === array_key_exists($attrname, $attrarr))
|
||||
// special case, for when the attribute list ends with a valueless
|
||||
// attribute like "selected"
|
||||
$attrarr[$attrname] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');
|
||||
|
||||
return $attrarr;
|
||||
}
|
||||
|
||||
/**
|
||||
* This function performs different checks for attribute values.
|
||||
*
|
||||
* The currently implemented checks are "maxlen", "minlen", "maxval", "minval"
|
||||
* and "valueless" with even more checks to come soon.
|
||||
*
|
||||
* @param string $value Attribute value
|
||||
* @param string $vless Whether the value is valueless. Use 'y' or 'n'
|
||||
* @param string $checkname What $checkvalue is checking for.
|
||||
* @param mixed $checkvalue What constraint the value should pass
|
||||
* @return bool Whether check passes
|
||||
*/
|
||||
function kses_check_attr_val($value, $vless, $checkname, $checkvalue)
|
||||
{
|
||||
$ok = true;
|
||||
|
||||
switch (strtolower($checkname))
|
||||
{
|
||||
case 'maxlen':
|
||||
// The maxlen check makes sure that the attribute value has a length not
|
||||
// greater than the given value. This can be used to avoid Buffer Overflows
|
||||
// in WWW clients and various Internet servers.
|
||||
|
||||
if (strlen($value) > $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'minlen':
|
||||
// The minlen check makes sure that the attribute value has a length not
|
||||
// smaller than the given value.
|
||||
|
||||
if (strlen($value) < $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'maxval':
|
||||
// The maxval check does two things: it checks that the attribute value is
|
||||
// an integer from 0 and up, without an excessive amount of zeroes or
|
||||
// whitespace (to avoid Buffer Overflows). It also checks that the attribute
|
||||
// value is not greater than the given value.
|
||||
// This check can be used to avoid Denial of Service attacks.
|
||||
|
||||
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
|
||||
$ok = false;
|
||||
if ($value > $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'minval':
|
||||
// The minval check checks that the attribute value is a positive integer,
|
||||
// and that it is not smaller than the given value.
|
||||
|
||||
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
|
||||
$ok = false;
|
||||
if ($value < $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'valueless':
|
||||
// The valueless check checks if the attribute has a value
|
||||
// (like <a href="blah">) or not (<option selected>). If the given value
|
||||
// is a "y" or a "Y", the attribute must not have a value.
|
||||
// If the given value is an "n" or an "N", the attribute must have one.
|
||||
|
||||
if (strtolower($checkvalue) != $vless)
|
||||
$ok = false;
|
||||
break;
|
||||
} // switch
|
||||
|
||||
return $ok;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sanitize string from bad protocols.
|
||||
*
|
||||
* This function removes all non-allowed protocols from the beginning of
|
||||
* $string. It ignores whitespace and the case of the letters, and it does
|
||||
* understand HTML entities. It does its work in a while loop, so it won't be
|
||||
* fooled by a string like "javascript:javascript:alert(57)".
|
||||
*
|
||||
* @param string $string Content to filter bad protocols from
|
||||
* @param array $allowed_protocols Allowed protocols to keep
|
||||
* @return string Filtered content
|
||||
*/
|
||||
function kses_bad_protocol($string, $allowed_protocols)
|
||||
{
|
||||
$string = kses_no_null($string);
|
||||
$string = preg_replace('/([^\xc3-\xcf])\xad+/', '\\1', $string); // deals with Opera "feature" -- moodle utf8 fix
|
||||
$string2 = $string.'a';
|
||||
|
||||
while ($string != $string2)
|
||||
{
|
||||
$string2 = $string;
|
||||
$string = kses_bad_protocol_once($string, $allowed_protocols);
|
||||
} // while
|
||||
|
||||
return $string;
|
||||
}
|
||||
|
||||
/**
|
||||
* This function removes any NULL characters in $string.
|
||||
*
|
||||
* @param string $string
|
||||
* @return string
|
||||
*/
|
||||
function kses_no_null($string)
|
||||
{
|
||||
$string = preg_replace('/\0+/', '', $string);
|
||||
$string = preg_replace('/(\\\\0)+/', '', $string);
|
||||
|
||||
return $string;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Strips slashes from in front of quotes.
|
||||
*
|
||||
* This function changes the character sequence \" to just "
|
||||
* It leaves all other slashes alone. It's really weird, but the quoting from
|
||||
* preg_replace(//e) seems to require this.
|
||||
*
|
||||
* @param string $string String to strip slashes
|
||||
* @return string Fixed strings with quoted slashes
|
||||
*/
|
||||
function kses_stripslashes($string)
|
||||
{
|
||||
return preg_replace('%\\\\"%', '"', $string);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* This function goes through an array, and changes the keys to all lower case.
|
||||
*
|
||||
* @param array $inarray Unfiltered array
|
||||
* @return array Fixed array with all lowercase keys
|
||||
*/
|
||||
function kses_array_lc($inarray)
|
||||
{
|
||||
$outarray = array();
|
||||
|
||||
foreach ( (array) $inarray as $inkey => $inval)
|
||||
{
|
||||
$outkey = strtolower($inkey);
|
||||
$outarray[$outkey] = array();
|
||||
|
||||
foreach ( (array) $inval as $inkey2 => $inval2)
|
||||
{
|
||||
$outkey2 = strtolower($inkey2);
|
||||
$outarray[$outkey][$outkey2] = $inval2;
|
||||
} // foreach $inval
|
||||
} // foreach $inarray
|
||||
|
||||
return $outarray;
|
||||
}
|
||||
|
||||
/**
|
||||
* This function removes the HTML JavaScript entities found in early versions of Netscape 4.
|
||||
*
|
||||
* @param string $string
|
||||
* @return string
|
||||
*/
|
||||
function kses_js_entities($string)
|
||||
{
|
||||
return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);
|
||||
}
|
||||
|
||||
/**
|
||||
* This function handles parsing errors in kses_hair().
|
||||
*
|
||||
* The general plan is to remove everything to and including some whitespace,
|
||||
* but it deals with quotes and apostrophes as well.
|
||||
*
|
||||
* @param string $string
|
||||
* @return string
|
||||
*/
|
||||
function kses_html_error($string)
|
||||
{
|
||||
return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sanitizes content from bad protocols and other characters.
|
||||
*
|
||||
* This function searches for URL protocols at the beginning of $string, while
|
||||
* handling whitespace and HTML entities.
|
||||
*
|
||||
* @param string $string Content to check for bad protocols
|
||||
* @param string $allowed_protocols Allowed protocols
|
||||
* @return string Sanitized content
|
||||
*/
|
||||
function kses_bad_protocol_once($string, $allowed_protocols)
|
||||
{
|
||||
$string2 = preg_split('/:|�*58;|�*3a;|:/i', $string, 2);
|
||||
if(isset($string2[1]) && !preg_match('%/\?%',$string2[0]))
|
||||
{
|
||||
$string = kses_bad_protocol_once2($string2[0],$allowed_protocols).trim($string2[1]);
|
||||
}
|
||||
return $string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback for kses_bad_protocol_once() regular expression.
|
||||
*
|
||||
* This function processes URL protocols, checks to see if they're in the
|
||||
* white-list or not, and returns different data depending on the answer.
|
||||
*
|
||||
* @access private
|
||||
*
|
||||
* @param string $string URI scheme to check against the whitelist
|
||||
* @param string $allowed_protocols Allowed protocols
|
||||
* @return string Sanitized content
|
||||
*/
|
||||
function kses_bad_protocol_once2($string, $allowed_protocols)
|
||||
{
|
||||
$string2 = kses_decode_entities($string);
|
||||
$string2 = preg_replace('/\s/', '', $string2);
|
||||
$string2 = kses_no_null($string2);
|
||||
$string2 = preg_replace('/\xad+/', '', $string2); // deals with Opera "feature"
|
||||
$string2 = strtolower($string2);
|
||||
|
||||
$allowed = false;
|
||||
foreach ( (array) $allowed_protocols as $one_protocol)
|
||||
if (strtolower($one_protocol) == $string2)
|
||||
{
|
||||
$allowed = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if ($allowed)
|
||||
return "$string2:";
|
||||
else
|
||||
return '';
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts and fixes HTML entities.
|
||||
*
|
||||
* This function normalizes HTML entities. It will convert "AT&T" to the correct
|
||||
* "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on.
|
||||
*
|
||||
* @param string $string Content to normalize entities
|
||||
* @return string Content with normalized entities
|
||||
*/
|
||||
function kses_normalize_entities($string)
|
||||
{
|
||||
// Disarm all entities by converting & to &
|
||||
|
||||
$string = str_replace('&', '&', $string);
|
||||
|
||||
// Change back the allowed entities in our entity whitelist
|
||||
|
||||
$string = preg_replace_callback('/&([A-Za-z]{2,8});/', 'kses_named_entities', $string);
|
||||
$string = preg_replace_callback('/&#(0*[0-9]{1,7});/', 'kses_normalize_entities2', $string);
|
||||
$string = preg_replace_callback('/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'kses_normalize_entities3', $string);
|
||||
|
||||
return $string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback for kses_normalize_entities() regular expression.
|
||||
*
|
||||
* This function only accepts valid named entity references, which are finite,
|
||||
* case-sensitive, and highly scrutinized by HTML and XML validators.
|
||||
*
|
||||
* @since 3.0.0
|
||||
*
|
||||
* @param array $matches preg_replace_callback() matches array
|
||||
* @return string Correctly encoded entity
|
||||
*/
|
||||
function kses_named_entities($matches) {
|
||||
global $kses_allowedentitynames;
|
||||
|
||||
if ( empty($matches[1]) )
|
||||
return '';
|
||||
|
||||
$i = $matches[1];
|
||||
return ( ( ! in_array($i, $kses_allowedentitynames) ) ? "&$i;" : "&$i;" );
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback for kses_normalize_entities() regular expression.
|
||||
*
|
||||
* This function helps kses_normalize_entities() to only accept 16 bit values
|
||||
* and nothing more for &#number; entities.
|
||||
*
|
||||
* @access private
|
||||
*
|
||||
* @param array $matches preg_replace_callback() matches array
|
||||
* @return string Correctly encoded entity
|
||||
*/
|
||||
function kses_normalize_entities2($matches) {
|
||||
if ( empty($matches[1]) )
|
||||
return '';
|
||||
|
||||
$i = $matches[1];
|
||||
if (kses_valid_unicode($i)) {
|
||||
$i = str_pad(ltrim($i,'0'), 3, '0', STR_PAD_LEFT);
|
||||
$i = "&#$i;";
|
||||
} else {
|
||||
$i = "&#$i;";
|
||||
}
|
||||
|
||||
return $i;
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback for kses_normalize_entities() for regular expression.
|
||||
*
|
||||
* This function helps kses_normalize_entities() to only accept valid Unicode
|
||||
* numeric entities in hex form.
|
||||
*
|
||||
* @access private
|
||||
*
|
||||
* @param array $matches preg_replace_callback() matches array
|
||||
* @return string Correctly encoded entity
|
||||
*/
|
||||
function kses_normalize_entities3($matches) {
|
||||
if ( empty($matches[1]) )
|
||||
return '';
|
||||
|
||||
$hexchars = $matches[1];
|
||||
return ( ( ! kses_valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper function to determine if a Unicode value is valid.
|
||||
*
|
||||
* @param int $i Unicode value
|
||||
* @return bool true if the value was a valid Unicode number
|
||||
*/
|
||||
function kses_valid_unicode($i) {
|
||||
return ( $i == 0x9 || $i == 0xa || $i == 0xd ||
|
||||
($i >= 0x20 && $i <= 0xd7ff) ||
|
||||
($i >= 0xe000 && $i <= 0xfffd) ||
|
||||
($i >= 0x10000 && $i <= 0x10ffff) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert all entities to their character counterparts.
|
||||
*
|
||||
* This function decodes numeric HTML entities (A and A). It doesn't do
|
||||
* anything with other entities like ä, but we don't need them in the URL
|
||||
* protocol whitelisting system anyway.
|
||||
*
|
||||
* @param string $string Content to change entities
|
||||
* @return string Content after decoded entities
|
||||
*/
|
||||
function kses_decode_entities($string)
|
||||
{
|
||||
$string = preg_replace_callback('/&#([0-9]+);/', '_kses_decode_entities_chr', $string);
|
||||
$string = preg_replace_callback('/&#[Xx]([0-9A-Fa-f]+);/', '_kses_decode_entities_chr_hexdec', $string);
|
||||
|
||||
return $string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Regex callback for kses_decode_entities()
|
||||
*
|
||||
* @param array $match preg match
|
||||
* @return string
|
||||
*/
|
||||
function _kses_decode_entities_chr( $match ) {
|
||||
return chr( $match[1] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Regex callback for kses_decode_entities()
|
||||
*
|
||||
* @param array $match preg match
|
||||
* @return string
|
||||
*/
|
||||
function _kses_decode_entities_chr_hexdec( $match ) {
|
||||
return chr( hexdec( $match[1] ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Inline CSS filter
|
||||
*
|
||||
*/
|
||||
function kses_safecss_filter_attr( $css ) {
|
||||
|
||||
$css = kses_no_null($css);
|
||||
$css = str_replace(array("\n","\r","\t"), '', $css);
|
||||
|
||||
if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
|
||||
return '';
|
||||
|
||||
$css_array = explode( ';', trim( $css ) );
|
||||
$allowed_attr = array( 'text-align', 'margin', 'color', 'float',
|
||||
'border', 'background', 'background-color', 'border-bottom', 'border-bottom-color',
|
||||
'border-bottom-style', 'border-bottom-width', 'border-collapse', 'border-color', 'border-left',
|
||||
'border-left-color', 'border-left-style', 'border-left-width', 'border-right', 'border-right-color',
|
||||
'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top',
|
||||
'border-top-color', 'border-top-style', 'border-top-width', 'border-width', 'caption-side',
|
||||
'clear', 'cursor', 'direction', 'display', 'font', 'font-family', 'font-size', 'font-style',
|
||||
'font-variant', 'font-weight', 'height', 'letter-spacing', 'line-height', 'margin-bottom',
|
||||
'margin-left', 'margin-right', 'margin-top', 'overflow', 'padding', 'padding-bottom',
|
||||
'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'text-indent', 'vertical-align',
|
||||
'width' );
|
||||
|
||||
if ( empty($allowed_attr) )
|
||||
return $css;
|
||||
|
||||
$css = '';
|
||||
foreach ( $css_array as $css_item ) {
|
||||
if ( $css_item == '' )
|
||||
continue;
|
||||
$css_item = trim( $css_item );
|
||||
$found = false;
|
||||
if ( strpos( $css_item, ':' ) === false ) {
|
||||
$found = true;
|
||||
} else {
|
||||
$parts = split( ':', $css_item );
|
||||
if ( in_array( strtolower( trim( $parts[0] ) ), $allowed_attr ) )
|
||||
$found = true;
|
||||
}
|
||||
if ( $found ) {
|
||||
if( $css != '' )
|
||||
$css .= ';';
|
||||
$css .= $css_item;
|
||||
}
|
||||
}
|
||||
|
||||
return $css;
|
||||
}
|
||||
556
main/inc/lib/kses-0.2.2/kses_original.php
Normal file
556
main/inc/lib/kses-0.2.2/kses_original.php
Normal file
@@ -0,0 +1,556 @@
|
||||
<?php
|
||||
|
||||
# kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes
|
||||
# Copyright (C) 2002, 2003, 2005 Ulf Harnhammar
|
||||
#
|
||||
# This program is free software and open source software; you can redistribute
|
||||
# it and/or modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation; either version 2 of the License,
|
||||
# or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
||||
# more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License along
|
||||
# with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
# 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA or visit
|
||||
# http://www.gnu.org/licenses/gpl.html
|
||||
#
|
||||
# *** CONTACT INFORMATION ***
|
||||
#
|
||||
# E-mail: metaur at users dot sourceforge dot net
|
||||
# Web page: http://sourceforge.net/projects/kses
|
||||
# Paper mail: Ulf Harnhammar
|
||||
# Ymergatan 17 C
|
||||
# 753 25 Uppsala
|
||||
# SWEDEN
|
||||
#
|
||||
# [kses strips evil scripts!]
|
||||
|
||||
|
||||
function kses($string, $allowed_html, $allowed_protocols =
|
||||
array('http', 'https', 'ftp', 'news', 'nntp', 'telnet',
|
||||
'gopher', 'mailto'))
|
||||
###############################################################################
|
||||
# This function makes sure that only the allowed HTML element names, attribute
|
||||
# names and attribute values plus only sane HTML entities will occur in
|
||||
# $string. You have to remove any slashes from PHP's magic quotes before you
|
||||
# call this function.
|
||||
###############################################################################
|
||||
{
|
||||
$string = kses_no_null($string);
|
||||
$string = kses_js_entities($string);
|
||||
$string = kses_normalize_entities($string);
|
||||
$string = kses_hook($string);
|
||||
$allowed_html_fixed = kses_array_lc($allowed_html);
|
||||
return kses_split($string, $allowed_html_fixed, $allowed_protocols);
|
||||
} # function kses
|
||||
|
||||
|
||||
function kses_hook($string)
|
||||
###############################################################################
|
||||
# You add any kses hooks here.
|
||||
###############################################################################
|
||||
{
|
||||
return $string;
|
||||
} # function kses_hook
|
||||
|
||||
|
||||
function kses_version()
|
||||
###############################################################################
|
||||
# This function returns kses' version number.
|
||||
###############################################################################
|
||||
{
|
||||
return '0.2.2';
|
||||
} # function kses_version
|
||||
|
||||
|
||||
function kses_split($string, $allowed_html, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function searches for HTML tags, no matter how malformed. It also
|
||||
# matches stray ">" characters.
|
||||
###############################################################################
|
||||
{
|
||||
return preg_replace('%(<'. # EITHER: <
|
||||
'[^>]*'. # things that aren't >
|
||||
'(>|$)'. # > or end of string
|
||||
'|>)%e', # OR: just a >
|
||||
"kses_split2('\\1', \$allowed_html, ".
|
||||
'$allowed_protocols)',
|
||||
$string);
|
||||
} # function kses_split
|
||||
|
||||
|
||||
function kses_split2($string, $allowed_html, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function does a lot of work. It rejects some very malformed things
|
||||
# like <:::>. It returns an empty string, if the element isn't allowed (look
|
||||
# ma, no strip_tags()!). Otherwise it splits the tag into an element and an
|
||||
# attribute list.
|
||||
###############################################################################
|
||||
{
|
||||
$string = kses_stripslashes($string);
|
||||
|
||||
if (substr($string, 0, 1) != '<')
|
||||
return '>';
|
||||
# It matched a ">" character
|
||||
|
||||
if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches))
|
||||
return '';
|
||||
# It's seriously malformed
|
||||
|
||||
$slash = trim($matches[1]);
|
||||
$elem = $matches[2];
|
||||
$attrlist = $matches[3];
|
||||
|
||||
if (!@isset($allowed_html[strtolower($elem)]))
|
||||
return '';
|
||||
# They are using a not allowed HTML element
|
||||
|
||||
if ($slash != '')
|
||||
return "<$slash$elem>";
|
||||
# No attributes are allowed for closing elements
|
||||
|
||||
return kses_attr("$slash$elem", $attrlist, $allowed_html,
|
||||
$allowed_protocols);
|
||||
} # function kses_split2
|
||||
|
||||
|
||||
function kses_attr($element, $attr, $allowed_html, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function removes all attributes, if none are allowed for this element.
|
||||
# If some are allowed it calls kses_hair() to split them further, and then it
|
||||
# builds up new HTML code from the data that kses_hair() returns. It also
|
||||
# removes "<" and ">" characters, if there are any left. One more thing it
|
||||
# does is to check if the tag has a closing XHTML slash, and if it does,
|
||||
# it puts one in the returned code as well.
|
||||
###############################################################################
|
||||
{
|
||||
# Is there a closing XHTML slash at the end of the attributes?
|
||||
|
||||
$xhtml_slash = '';
|
||||
if (preg_match('%\s/\s*$%', $attr))
|
||||
$xhtml_slash = ' /';
|
||||
|
||||
# Are any attributes allowed at all for this element?
|
||||
|
||||
if (@count($allowed_html[strtolower($element)]) == 0)
|
||||
return "<$element$xhtml_slash>";
|
||||
|
||||
# Split it
|
||||
|
||||
$attrarr = kses_hair($attr, $allowed_protocols);
|
||||
|
||||
# Go through $attrarr, and save the allowed attributes for this element
|
||||
# in $attr2
|
||||
|
||||
$attr2 = '';
|
||||
|
||||
foreach ($attrarr as $arreach)
|
||||
{
|
||||
if (!@isset($allowed_html[strtolower($element)]
|
||||
[strtolower($arreach['name'])]))
|
||||
continue; # the attribute is not allowed
|
||||
|
||||
$current = $allowed_html[strtolower($element)]
|
||||
[strtolower($arreach['name'])];
|
||||
|
||||
if (!is_array($current))
|
||||
$attr2 .= ' '.$arreach['whole'];
|
||||
# there are no checks
|
||||
|
||||
else
|
||||
{
|
||||
# there are some checks
|
||||
$ok = true;
|
||||
foreach ($current as $currkey => $currval)
|
||||
if (!kses_check_attr_val($arreach['value'], $arreach['vless'],
|
||||
$currkey, $currval))
|
||||
{ $ok = false; break; }
|
||||
|
||||
if ($ok)
|
||||
$attr2 .= ' '.$arreach['whole']; # it passed them
|
||||
} # if !is_array($current)
|
||||
} # foreach
|
||||
|
||||
# Remove any "<" or ">" characters
|
||||
|
||||
$attr2 = preg_replace('/[<>]/', '', $attr2);
|
||||
|
||||
return "<$element$attr2$xhtml_slash>";
|
||||
} # function kses_attr
|
||||
|
||||
|
||||
function kses_hair($attr, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function does a lot of work. It parses an attribute list into an array
|
||||
# with attribute data, and tries to do the right thing even if it gets weird
|
||||
# input. It will add quotes around attribute values that don't have any quotes
|
||||
# or apostrophes around them, to make it easier to produce HTML code that will
|
||||
# conform to W3C's HTML specification. It will also remove bad URL protocols
|
||||
# from attribute values.
|
||||
###############################################################################
|
||||
{
|
||||
$attrarr = array();
|
||||
$mode = 0;
|
||||
$attrname = '';
|
||||
|
||||
# Loop through the whole attribute list
|
||||
|
||||
while (strlen($attr) != 0)
|
||||
{
|
||||
$working = 0; # Was the last operation successful?
|
||||
|
||||
switch ($mode)
|
||||
{
|
||||
case 0: # attribute name, href for instance
|
||||
|
||||
if (preg_match('/^([-a-zA-Z]+)/', $attr, $match))
|
||||
{
|
||||
$attrname = $match[1];
|
||||
$working = $mode = 1;
|
||||
$attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case 1: # equals sign or valueless ("selected")
|
||||
|
||||
if (preg_match('/^\s*=\s*/', $attr)) # equals sign
|
||||
{
|
||||
$working = 1; $mode = 2;
|
||||
$attr = preg_replace('/^\s*=\s*/', '', $attr);
|
||||
break;
|
||||
}
|
||||
|
||||
if (preg_match('/^\s+/', $attr)) # valueless
|
||||
{
|
||||
$working = 1; $mode = 0;
|
||||
$attrarr[] = array
|
||||
('name' => $attrname,
|
||||
'value' => '',
|
||||
'whole' => $attrname,
|
||||
'vless' => 'y');
|
||||
$attr = preg_replace('/^\s+/', '', $attr);
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case 2: # attribute value, a URL after href= for instance
|
||||
|
||||
if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match))
|
||||
# "value"
|
||||
{
|
||||
$thisval = kses_bad_protocol($match[1], $allowed_protocols);
|
||||
|
||||
$attrarr[] = array
|
||||
('name' => $attrname,
|
||||
'value' => $thisval,
|
||||
'whole' => "$attrname=\"$thisval\"",
|
||||
'vless' => 'n');
|
||||
$working = 1; $mode = 0;
|
||||
$attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr);
|
||||
break;
|
||||
}
|
||||
|
||||
if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match))
|
||||
# 'value'
|
||||
{
|
||||
$thisval = kses_bad_protocol($match[1], $allowed_protocols);
|
||||
|
||||
$attrarr[] = array
|
||||
('name' => $attrname,
|
||||
'value' => $thisval,
|
||||
'whole' => "$attrname='$thisval'",
|
||||
'vless' => 'n');
|
||||
$working = 1; $mode = 0;
|
||||
$attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr);
|
||||
break;
|
||||
}
|
||||
|
||||
if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match))
|
||||
# value
|
||||
{
|
||||
$thisval = kses_bad_protocol($match[1], $allowed_protocols);
|
||||
|
||||
$attrarr[] = array
|
||||
('name' => $attrname,
|
||||
'value' => $thisval,
|
||||
'whole' => "$attrname=\"$thisval\"",
|
||||
'vless' => 'n');
|
||||
# We add quotes to conform to W3C's HTML spec.
|
||||
$working = 1; $mode = 0;
|
||||
$attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr);
|
||||
}
|
||||
|
||||
break;
|
||||
} # switch
|
||||
|
||||
if ($working == 0) # not well formed, remove and try again
|
||||
{
|
||||
$attr = kses_html_error($attr);
|
||||
$mode = 0;
|
||||
}
|
||||
} # while
|
||||
|
||||
if ($mode == 1)
|
||||
# special case, for when the attribute list ends with a valueless
|
||||
# attribute like "selected"
|
||||
$attrarr[] = array
|
||||
('name' => $attrname,
|
||||
'value' => '',
|
||||
'whole' => $attrname,
|
||||
'vless' => 'y');
|
||||
|
||||
return $attrarr;
|
||||
} # function kses_hair
|
||||
|
||||
|
||||
function kses_check_attr_val($value, $vless, $checkname, $checkvalue)
|
||||
###############################################################################
|
||||
# This function performs different checks for attribute values. The currently
|
||||
# implemented checks are "maxlen", "minlen", "maxval", "minval" and "valueless"
|
||||
# with even more checks to come soon.
|
||||
###############################################################################
|
||||
{
|
||||
$ok = true;
|
||||
|
||||
switch (strtolower($checkname))
|
||||
{
|
||||
case 'maxlen':
|
||||
# The maxlen check makes sure that the attribute value has a length not
|
||||
# greater than the given value. This can be used to avoid Buffer Overflows
|
||||
# in WWW clients and various Internet servers.
|
||||
|
||||
if (strlen($value) > $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'minlen':
|
||||
# The minlen check makes sure that the attribute value has a length not
|
||||
# smaller than the given value.
|
||||
|
||||
if (strlen($value) < $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'maxval':
|
||||
# The maxval check does two things: it checks that the attribute value is
|
||||
# an integer from 0 and up, without an excessive amount of zeroes or
|
||||
# whitespace (to avoid Buffer Overflows). It also checks that the attribute
|
||||
# value is not greater than the given value.
|
||||
# This check can be used to avoid Denial of Service attacks.
|
||||
|
||||
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
|
||||
$ok = false;
|
||||
if ($value > $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'minval':
|
||||
# The minval check checks that the attribute value is a positive integer,
|
||||
# and that it is not smaller than the given value.
|
||||
|
||||
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
|
||||
$ok = false;
|
||||
if ($value < $checkvalue)
|
||||
$ok = false;
|
||||
break;
|
||||
|
||||
case 'valueless':
|
||||
# The valueless check checks if the attribute has a value
|
||||
# (like <a href="blah">) or not (<option selected>). If the given value
|
||||
# is a "y" or a "Y", the attribute must not have a value.
|
||||
# If the given value is an "n" or an "N", the attribute must have one.
|
||||
|
||||
if (strtolower($checkvalue) != $vless)
|
||||
$ok = false;
|
||||
break;
|
||||
} # switch
|
||||
|
||||
return $ok;
|
||||
} # function kses_check_attr_val
|
||||
|
||||
|
||||
function kses_bad_protocol($string, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function removes all non-allowed protocols from the beginning of
|
||||
# $string. It ignores whitespace and the case of the letters, and it does
|
||||
# understand HTML entities. It does its work in a while loop, so it won't be
|
||||
# fooled by a string like "javascript:javascript:alert(57)".
|
||||
###############################################################################
|
||||
{
|
||||
$string = kses_no_null($string);
|
||||
$string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature"
|
||||
$string2 = $string.'a';
|
||||
|
||||
while ($string != $string2)
|
||||
{
|
||||
$string2 = $string;
|
||||
$string = kses_bad_protocol_once($string, $allowed_protocols);
|
||||
} # while
|
||||
|
||||
return $string;
|
||||
} # function kses_bad_protocol
|
||||
|
||||
|
||||
function kses_no_null($string)
|
||||
###############################################################################
|
||||
# This function removes any NULL characters in $string.
|
||||
###############################################################################
|
||||
{
|
||||
$string = preg_replace('/\0+/', '', $string);
|
||||
$string = preg_replace('/(\\\\0)+/', '', $string);
|
||||
|
||||
return $string;
|
||||
} # function kses_no_null
|
||||
|
||||
|
||||
function kses_stripslashes($string)
|
||||
###############################################################################
|
||||
# This function changes the character sequence \" to just "
|
||||
# It leaves all other slashes alone. It's really weird, but the quoting from
|
||||
# preg_replace(//e) seems to require this.
|
||||
###############################################################################
|
||||
{
|
||||
return preg_replace('%\\\\"%', '"', $string);
|
||||
} # function kses_stripslashes
|
||||
|
||||
|
||||
function kses_array_lc($inarray)
|
||||
###############################################################################
|
||||
# This function goes through an array, and changes the keys to all lower case.
|
||||
###############################################################################
|
||||
{
|
||||
$outarray = array();
|
||||
|
||||
foreach ($inarray as $inkey => $inval)
|
||||
{
|
||||
$outkey = strtolower($inkey);
|
||||
$outarray[$outkey] = array();
|
||||
|
||||
foreach ($inval as $inkey2 => $inval2)
|
||||
{
|
||||
$outkey2 = strtolower($inkey2);
|
||||
$outarray[$outkey][$outkey2] = $inval2;
|
||||
} # foreach $inval
|
||||
} # foreach $inarray
|
||||
|
||||
return $outarray;
|
||||
} # function kses_array_lc
|
||||
|
||||
|
||||
function kses_js_entities($string)
|
||||
###############################################################################
|
||||
# This function removes the HTML JavaScript entities found in early versions of
|
||||
# Netscape 4.
|
||||
###############################################################################
|
||||
{
|
||||
return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);
|
||||
} # function kses_js_entities
|
||||
|
||||
|
||||
function kses_html_error($string)
|
||||
###############################################################################
|
||||
# This function deals with parsing errors in kses_hair(). The general plan is
|
||||
# to remove everything to and including some whitespace, but it deals with
|
||||
# quotes and apostrophes as well.
|
||||
###############################################################################
|
||||
{
|
||||
return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string);
|
||||
} # function kses_html_error
|
||||
|
||||
|
||||
function kses_bad_protocol_once($string, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function searches for URL protocols at the beginning of $string, while
|
||||
# handling whitespace and HTML entities.
|
||||
###############################################################################
|
||||
{
|
||||
$string2 = preg_split('/:|:|:/i', $string, 2);
|
||||
if(isset($string2[1]) && !preg_match('%/\?%',$string2[0]))
|
||||
{
|
||||
$string = kses_bad_protocol_once2($string2[0],$allowed_protocols).trim($string2[1]);
|
||||
}
|
||||
return $string;
|
||||
} # function kses_bad_protocol_once
|
||||
|
||||
|
||||
function kses_bad_protocol_once2($string, $allowed_protocols)
|
||||
###############################################################################
|
||||
# This function processes URL protocols, checks to see if they're in the white-
|
||||
# list or not, and returns different data depending on the answer.
|
||||
###############################################################################
|
||||
{
|
||||
$string2 = kses_decode_entities($string);
|
||||
$string2 = preg_replace('/\s/', '', $string2);
|
||||
$string2 = kses_no_null($string2);
|
||||
$string2 = preg_replace('/\xad+/', '', $string2);
|
||||
# deals with Opera "feature"
|
||||
$string2 = strtolower($string2);
|
||||
|
||||
$allowed = false;
|
||||
foreach ($allowed_protocols as $one_protocol)
|
||||
if (strtolower($one_protocol) == $string2)
|
||||
{
|
||||
$allowed = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if ($allowed)
|
||||
return "$string2:";
|
||||
else
|
||||
return '';
|
||||
} # function kses_bad_protocol_once2
|
||||
|
||||
|
||||
function kses_normalize_entities($string)
|
||||
###############################################################################
|
||||
# This function normalizes HTML entities. It will convert "AT&T" to the correct
|
||||
# "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on.
|
||||
###############################################################################
|
||||
{
|
||||
# Disarm all entities by converting & to &
|
||||
|
||||
$string = str_replace('&', '&', $string);
|
||||
|
||||
# Change back the allowed entities in our entity whitelist
|
||||
|
||||
$string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/',
|
||||
'&\\1;', $string);
|
||||
$string = preg_replace('/&#0*([0-9]{1,5});/e',
|
||||
'kses_normalize_entities2("\\1")', $string);
|
||||
$string = preg_replace('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/',
|
||||
'&#\\1\\2;', $string);
|
||||
|
||||
return $string;
|
||||
} # function kses_normalize_entities
|
||||
|
||||
|
||||
function kses_normalize_entities2($i)
|
||||
###############################################################################
|
||||
# This function helps kses_normalize_entities() to only accept 16 bit values
|
||||
# and nothing more for &#number; entities.
|
||||
###############################################################################
|
||||
{
|
||||
return (($i > 65535) ? "&#$i;" : "&#$i;");
|
||||
} # function kses_normalize_entities2
|
||||
|
||||
|
||||
function kses_decode_entities($string)
|
||||
###############################################################################
|
||||
# This function decodes numeric HTML entities (A and A). It doesn't
|
||||
# do anything with other entities like ä, but we don't need them in the
|
||||
# URL protocol whitelisting system anyway.
|
||||
###############################################################################
|
||||
{
|
||||
$string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string);
|
||||
$string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))',
|
||||
$string);
|
||||
|
||||
return $string;
|
||||
} # function kses_decode_entities
|
||||
|
||||
?>
|
||||
6
main/inc/lib/kses-0.2.2/oop/index.html
Normal file
6
main/inc/lib/kses-0.2.2/oop/index.html
Normal file
@@ -0,0 +1,6 @@
|
||||
<html>
|
||||
<head>
|
||||
</head>
|
||||
<body>
|
||||
</body>
|
||||
</html>
|
||||
204
main/inc/lib/kses-0.2.2/oop/oop.kses.changelog.txt
Normal file
204
main/inc/lib/kses-0.2.2/oop/oop.kses.changelog.txt
Normal file
@@ -0,0 +1,204 @@
|
||||
kses ChangeLog
|
||||
==============
|
||||
|
||||
KSES5
|
||||
* 1.0.2
|
||||
KSES4
|
||||
* 0.2.2
|
||||
- Folded in code from kses 0.2.2.
|
||||
|
||||
KSES5
|
||||
* 1.0.1rc
|
||||
KSES4
|
||||
* 0.2.2rc
|
||||
- Added SetProtocols() to make protocol replacement a single step
|
||||
to fully answer concerns in bug #892477
|
||||
|
||||
KSES5
|
||||
* 1.0.0
|
||||
- Turned many methods private
|
||||
|
||||
- Now using __construct default constructor
|
||||
|
||||
- Only runs in PHP5 or better
|
||||
|
||||
- All method names changed to reflect verb status
|
||||
|
||||
- Folded sinlge line functions into calling methods
|
||||
|
||||
- Deprecated _hook(), Protocols()
|
||||
|
||||
- Added AddProtocols() to replace Protocols()
|
||||
|
||||
- Added filterKsesTextHook() to replace _hook()
|
||||
|
||||
- Added RemoveProtocol() and RemoveProtocols() to remove protocols
|
||||
singly, or batch. This should clear bug #892477
|
||||
|
||||
- Version number is 1.0.0
|
||||
|
||||
KSES4
|
||||
* 0.2.1
|
||||
- Synced version number to procedural code
|
||||
|
||||
- Deprecated _hook(), Protocols()
|
||||
|
||||
- Added AddProtocols() to replace Protocols()
|
||||
|
||||
- Added filterKsesTextHook() to replace _hook()
|
||||
|
||||
- Added RemoveProtocol() and RemoveProtocols() to remove protocols singly,
|
||||
or batch. This should clear bug #892477
|
||||
|
||||
OOP
|
||||
- Forked code into PHP4 and PHP5 versions. Use '$myKses = new kses[45]'
|
||||
from now on.
|
||||
|
||||
- Modified code to run in E_STRICT. This should clear bug #918493
|
||||
|
||||
- Added phpDoc commenting
|
||||
|
||||
OOP
|
||||
* 0.0.2
|
||||
- Fixed a bug in AddProtocol that wasn't adding new protocols to
|
||||
$this->allowed_protocols
|
||||
|
||||
- Modified internal methods to correspond to kses 0.2.1 modifications.
|
||||
|
||||
- Created a basic test suite that can be run via web or CLI.
|
||||
|
||||
- Started CVSing the code.
|
||||
|
||||
OOP
|
||||
* 0.0.1
|
||||
- Turned all the kses_function_name functions to _function_name methods.
|
||||
|
||||
- Added a couple of properties (allowed_protocols, allowed_html) with
|
||||
$this->allowed_protocols defaulting to the lion's share of usual
|
||||
protocols.
|
||||
|
||||
- Modified the applicable use of preg_replace() functions to point to
|
||||
internal class methods.
|
||||
|
||||
- Reduced the parameter list of some methods since internal properties
|
||||
are now being used.
|
||||
|
||||
- Added "public" methods to set up the allowed protocols and HTML.
|
||||
|
||||
Procedural
|
||||
* 0.2.1
|
||||
|
||||
0.2.1 was released on the 29th of September 2003.
|
||||
It has the following changes:
|
||||
|
||||
- There is now an additional version of kses, using the object-oriented
|
||||
paradigm. Thanks a lot to Richard R. Vasquez, Jr., who created it!
|
||||
Anyone who wants to make functional programming, logical programming or
|
||||
spaghetti programming versions of kses as well (or any other programming
|
||||
paradigm that you like), go ahead! All the people who like old
|
||||
procedural programming for web applications shouldn't despair, though,
|
||||
as both versions will be maintained with each release.
|
||||
|
||||
- kses now has some new attribute value checks: minlen, minval and
|
||||
valueless. See docs/attribute-value-checks for an explanation.
|
||||
|
||||
- For some reason, the Opera developers decided to make chr(173) a
|
||||
whitespace character in URL protocols, both when it occurs raw and in an
|
||||
entity. kses now handles this.
|
||||
|
||||
- The URL protocol whitelisting system now decodes entities before
|
||||
removing NULLs and whitespaces.
|
||||
|
||||
Procedural
|
||||
* 0.2.0
|
||||
|
||||
0.2.0 was released on the 25th of July 2003.
|
||||
It has the following changes:
|
||||
|
||||
- kses now supports checking of attribute values, and not just element
|
||||
names and attribute names. The attribute value checks that exist so far
|
||||
are 'maxlen' (checks how long attribute values are, to avoid Buffer
|
||||
Overflows) and 'maxval' (checks how big an integer value is, to avoid
|
||||
Denial of Service attacks).
|
||||
|
||||
Buffer Overflows could both be a problem for WWW clients and different
|
||||
servers on the Internet that an HTML document links to. One example is
|
||||
<frame src="ftp://ftp.v1ct1m.com/AAAAAA..thousands_of_A's...">.
|
||||
|
||||
Denial of Service attacks can take the form of too big sizes of iframes
|
||||
or other things. One example is <iframe src="http://some.web.server/"
|
||||
width="20000" height="2000">, which makes some client machines
|
||||
completely overloaded.
|
||||
|
||||
- kses' old feature of removing "javascript:" from attribute values has
|
||||
been improved. It now has a whole system for white listing of URL
|
||||
protocols, so you can specify that it's acceptable with http:, https:,
|
||||
ftp: and gopher:, but no other protocols in attribute values. The system
|
||||
tries pretty hard to do the right thing with whitespace, upper/lower
|
||||
case, HTML entities ("javascript:") and repeated entries
|
||||
("javascript:javascript:alert(57)").
|
||||
|
||||
- kses now supports both HTML and XHTML code, by allowing " /" at the end
|
||||
of tags.
|
||||
|
||||
- kses now removes Netscape 4's JavaScript entities, having the form
|
||||
"&{alert(57)};". They don't even seem to work on all versions of
|
||||
Netscape 4, but for completeness' sake it seemed like a good feature to
|
||||
add.
|
||||
|
||||
- A bug with NULLs in javascript: URLs was fixed.
|
||||
(Reported by Simon Cornelius P. Umacob - thanks!)
|
||||
|
||||
- As a nice side effect of the white listing of URL protocols, kses now
|
||||
also normalizes all HTML entities in documents. It will change HTML code
|
||||
with bad entities to the right form, for example "AT&T" will be
|
||||
converted to "AT&T" and "<a href='lyrics.php?band=ladytron&lyrics=
|
||||
playgirl'>" will be converted to "<a href='lyrics.php?band=
|
||||
ladytron&lyrics=playgirl'>". ":" will be converted to
|
||||
":", "&#XYZZY;" will be converted to "&#XYZZY;", "ä!;" will
|
||||
be converted to "&auml!;" and so on.
|
||||
|
||||
As shown above, it will process HTML entities that it doesn't
|
||||
understand. It will also deal with too big numbers in numeric HTML
|
||||
entities, which is helpful as many browsers seem to wrap them around at
|
||||
2 ** 32, so the characters 58, 58 + (2 ** 32), 58 + (2 ** 64) etcetera
|
||||
are all colons to the web browser.
|
||||
|
||||
- You can now use upper case letters in your $allowed_html array, in
|
||||
element names, attribute names and attribute value check names. Version
|
||||
0.1.0 required everything in that array to be in lower case, but that's
|
||||
not necessary any more. You can also use upper case letters in
|
||||
$allowed_protocols.
|
||||
|
||||
- The "Really malformed thing" bug from the TODO file was fixed.
|
||||
It used to convert this string:
|
||||
x > 5 <a href="blah">
|
||||
to:
|
||||
x > 5 <a href="blah">
|
||||
and now it converts it to:
|
||||
x > 5 <a href="blah">
|
||||
|
||||
- The "Weird malformed thing" bug from the TODO file was fixed.
|
||||
It used to convert this string:
|
||||
<a href="5 href=6>
|
||||
to:
|
||||
<a href="6">
|
||||
because of the way kses restarts after a parse error in kses_hair().
|
||||
Now it converts it to:
|
||||
<a>
|
||||
|
||||
- A problem with slashes in HTML tags was fixed.
|
||||
|
||||
- examples/filter.php used to use $SCRIPT_NAME, which doesn't work on
|
||||
Windows.
|
||||
(Reported by Simon Cornelius P. Umacob - thanks!)
|
||||
|
||||
- kses now allows dashes in attribute names, for things like
|
||||
<meta http-equiv=..>.
|
||||
|
||||
Procedural
|
||||
* 0.1.0, first public version
|
||||
|
||||
0.1.0 was released on the 9th of June 2003.
|
||||
It was announced on three security related mailing lists on Friday the
|
||||
13th of June (nothing bad happened to it though).
|
||||
58
main/inc/lib/kses-0.2.2/oop/oop.simple.api.txt
Normal file
58
main/inc/lib/kses-0.2.2/oop/oop.simple.api.txt
Normal file
@@ -0,0 +1,58 @@
|
||||
Parse($string = "")
|
||||
The basic function of kses. Give it a $string, and it will strip
|
||||
out the unwanted HTML and attributes.
|
||||
|
||||
AddProtocols()
|
||||
Add a protocol or list of protocols to the kses object to be
|
||||
considered valid during a Parse(). The parameter can be a string
|
||||
containing a single protocol, or an array of strings, each
|
||||
containing a single protocol.
|
||||
|
||||
Protocols()
|
||||
Deprecated. Use AddProtocols()
|
||||
|
||||
AddProtocol($protocol = "")
|
||||
Adds a single protocol to the kses object that will be considered
|
||||
valid during a Parse().
|
||||
|
||||
SetProtocols()
|
||||
This is a straight setting/overwrite of existing protocols in the
|
||||
kses object. All existing protocols are removed, and the parameter
|
||||
is used to determine what protocol(s) the kses object will consider
|
||||
valid. The parameter can be a string containing a single protocol,
|
||||
or an array of strings, each constaining a single protocol.
|
||||
|
||||
DumpProtocols()
|
||||
This returns an indexed array of the valid protocols contained in
|
||||
the kses object.
|
||||
|
||||
DumpElements()
|
||||
This returns an associative array of the valid (X)HTML elements in
|
||||
the kses object along with attributes for each element, and tests
|
||||
that will be performed on each attribute.
|
||||
|
||||
AddHTML($tag = "", $attribs = array())
|
||||
This allows the end user to add a single (X)HTML element to the
|
||||
kses object along with the (if any) attributes that the specific
|
||||
(X)HTML element is allowed to have.
|
||||
|
||||
See the file 'attribute-value-checks' for more information as to
|
||||
the format of the data to be provided to this method.
|
||||
|
||||
RemoveProtocol($protocol = "")
|
||||
This allows for the removal of a single protocol from the list of
|
||||
valid protocols in the kses object.
|
||||
|
||||
RemoveProtocols()
|
||||
This allows for the single or batch removal of protocols from the
|
||||
kses object. The parameter is either a string containing a
|
||||
protocol to be removed, or an array of strings that each contain
|
||||
a protocol.
|
||||
|
||||
filterKsesTextHook($string)
|
||||
For the OOP version of kses, this is an additional hook that allows
|
||||
the end user to perform additional postprocessing of a string
|
||||
that's being run through Parse().
|
||||
|
||||
_hook()
|
||||
Deprecated. Use filterKsesTextHook().
|
||||
1162
main/inc/lib/kses-0.2.2/oop/php4.class.kses.php
Normal file
1162
main/inc/lib/kses-0.2.2/oop/php4.class.kses.php
Normal file
File diff suppressed because it is too large
Load Diff
1166
main/inc/lib/kses-0.2.2/oop/php5.class.kses.php
Normal file
1166
main/inc/lib/kses-0.2.2/oop/php5.class.kses.php
Normal file
File diff suppressed because it is too large
Load Diff
507
main/inc/lib/kses-0.2.2/oop/test.oop.kses.php
Normal file
507
main/inc/lib/kses-0.2.2/oop/test.oop.kses.php
Normal file
@@ -0,0 +1,507 @@
|
||||
<?php
|
||||
|
||||
// This is a q&d program that shows some of the results of
|
||||
// running KSES. If you have further questions, check the
|
||||
// current valid email address at http://chaos.org/contact/
|
||||
|
||||
// Make sure we're in a usable PHP environment
|
||||
if(substr(phpversion(), 0, 1) < 4)
|
||||
{
|
||||
define('KSESTEST_VER', 0);
|
||||
}
|
||||
elseif(substr(phpversion(), 0, 1) >= 5)
|
||||
{
|
||||
define('KSESTEST_VER', 5);
|
||||
}
|
||||
else
|
||||
{
|
||||
define('KSESTEST_VER', 4);
|
||||
}
|
||||
|
||||
// See if we're in command line or web
|
||||
if($_SERVER["DOCUMENT_ROOT"] == "")
|
||||
{
|
||||
define('KSESTEST_ENV', 'CLI');
|
||||
}
|
||||
else
|
||||
{
|
||||
define('KSESTEST_ENV', 'WEB');
|
||||
}
|
||||
|
||||
if(KSESTEST_VER == 0)
|
||||
{
|
||||
$message = array(
|
||||
"Error: Not using a current version of PHP!",
|
||||
"You are using PHP version " . phpversion() . ".",
|
||||
"KSES Class version requires PHP4 or better.",
|
||||
"KSES test program ending."
|
||||
);
|
||||
|
||||
displayPage(
|
||||
array("title" => "Error running KSES test", "message" => $message)
|
||||
);
|
||||
|
||||
exit();
|
||||
}
|
||||
|
||||
$include_file = "php" . KSESTEST_VER . ".class.kses.php";
|
||||
if(file_exists($include_file) && is_readable($include_file))
|
||||
{
|
||||
include_once($include_file);
|
||||
}
|
||||
else
|
||||
{
|
||||
$message = array(
|
||||
"Error: Unable to find '" . $include_file . "'.",
|
||||
"Please check your include path and make sure the file is available.",
|
||||
"Path: " . ini_get('include_path')
|
||||
);
|
||||
|
||||
displayPage(
|
||||
array('title' => 'Unable to include ' . $include_file, 'message' => $message)
|
||||
);
|
||||
|
||||
exit();
|
||||
}
|
||||
|
||||
$kses_type = "kses" . KSESTEST_VER;
|
||||
$myKses = new $kses_type;
|
||||
|
||||
$test_text = array();
|
||||
$test_text = test1_protocols($myKses);
|
||||
$test_text = array_merge($test_text, test1_html($myKses));
|
||||
$test_text = array_merge($test_text, test1_kses($myKses));
|
||||
|
||||
displayPage(
|
||||
array('title' => 'New Test', 'message' => $test_text)
|
||||
);
|
||||
|
||||
function test1_kses(&$myKses)
|
||||
{
|
||||
$out = array(output_hr(), "Testing current configuration");
|
||||
|
||||
$test_tags = array(
|
||||
'<a href="http://www.chaos.org/">www.chaos.org</a>',
|
||||
'<a name="X">Short \'a name\' tag</a>',
|
||||
'<td colspan="3" rowspan="5">Foo</td>',
|
||||
'<td rowspan="2" class="mugwump" style="background-color: rgb(255, 204 204);">Bar</td>',
|
||||
'<td nowrap>Very Long String running to 1000 characters...</td>',
|
||||
'<td bgcolor="#00ff00" nowrap>Very Long String with a blue background</td>',
|
||||
'<a href="proto1://www.foo.com">New protocol test</a>',
|
||||
'<img src="proto2://www.foo.com" />',
|
||||
'<a href="javascript:javascript:javascript:javascript:javascript:alert(\'Boo!\');">bleep</a>',
|
||||
'<a href="proto4://abc.xyz.foo.com">Another new protocol</a>',
|
||||
'<a href="proto9://foo.foo.foo.foo.foo.org/">Test of "proto9"</a>',
|
||||
'<td width="75">Bar!</td>',
|
||||
'<td width="200">Long Cell</td>'
|
||||
);
|
||||
|
||||
$out_li = array();
|
||||
// Keep only allowed HTML from the presumed 'form'.
|
||||
foreach($test_tags as $tag)
|
||||
{
|
||||
$temp = $myKses->Parse($tag);
|
||||
$check = ($temp == $tag) ? true : false;
|
||||
$text = ($temp == $tag) ? 'pass' : 'fail';
|
||||
|
||||
$li_text = output_testresult($check, $text) . output_newline();
|
||||
$li_text .= "Input: " . output_translate($tag) . output_newline();
|
||||
$li_text .= "Output: " . output_translate($temp);
|
||||
if(KSESTEST_ENV == 'CLI')
|
||||
{
|
||||
$li_text .= output_newline();
|
||||
}
|
||||
|
||||
array_push($out_li, output_code_wrap($li_text));
|
||||
}
|
||||
|
||||
$out = array_merge($out, array(output_ul($out_li)));
|
||||
array_push($out, output_hr());
|
||||
array_push($out, "Testing is now finished.");
|
||||
return $out;
|
||||
}
|
||||
|
||||
function output_code_wrap($text)
|
||||
{
|
||||
if(KSESTEST_ENV == 'CLI')
|
||||
{
|
||||
return $text;
|
||||
}
|
||||
else
|
||||
{
|
||||
return "<code>\n$text<code>\n";
|
||||
}
|
||||
}
|
||||
|
||||
function output_translate($text)
|
||||
{
|
||||
if(KSESTEST_ENV == 'CLI')
|
||||
{
|
||||
return $text;
|
||||
}
|
||||
else
|
||||
{
|
||||
return htmlentities($text);
|
||||
}
|
||||
}
|
||||
|
||||
function output_testresult($pass = false, $text = "")
|
||||
{
|
||||
if(KSESTEST_ENV == 'CLI')
|
||||
{
|
||||
return '[' . $text . ']';
|
||||
}
|
||||
else
|
||||
{
|
||||
if($pass == true)
|
||||
{
|
||||
return '<span style="color: green;">[' . $text . ']</span>';
|
||||
}
|
||||
else
|
||||
{
|
||||
return '<span style="color: red;">[' . $text . ']</span>';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function output_spaces()
|
||||
{
|
||||
if(KSESTEST_ENV == 'WEB')
|
||||
{
|
||||
$out = " ";
|
||||
}
|
||||
else
|
||||
{
|
||||
$out = " ";
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
function output_newline()
|
||||
{
|
||||
if(KSESTEST_ENV == 'WEB')
|
||||
{
|
||||
$out = "<br />\n";
|
||||
}
|
||||
else
|
||||
{
|
||||
$out = "\n";
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
function displayPage($data = array())
|
||||
{
|
||||
$title = ($data['title'] == '') ? 'No title' : $data['title'];
|
||||
$message = ($data['message'] == '') ? array('No message') : $data['message'];
|
||||
|
||||
$out = "";
|
||||
|
||||
foreach($message as $text)
|
||||
{
|
||||
if(KSESTEST_ENV == 'WEB')
|
||||
{
|
||||
$header = "\t\t<h1>$title</h1>\n\t\t<hr />\n";
|
||||
$out .= "\t\t<p>\n";
|
||||
$out .= "\t\t\t$text\n";
|
||||
$out .= "\t\t</p>\n";
|
||||
}
|
||||
else
|
||||
{
|
||||
$header = "$title\n" . str_repeat('-', 60) . "\n\n";
|
||||
$out .= "\t$text\n\n";
|
||||
}
|
||||
}
|
||||
|
||||
if(KSESTEST_ENV == 'WEB')
|
||||
{
|
||||
echo "<html>\n";
|
||||
echo "\t<head>\n";
|
||||
echo "\t\t<title>$title</title>\n";
|
||||
echo "\t</head>\n";
|
||||
echo "\t<body>\n";
|
||||
echo $header;
|
||||
echo $out;
|
||||
echo "\t</body>\n";
|
||||
echo "</html>\n";
|
||||
}
|
||||
else
|
||||
{
|
||||
echo $header;
|
||||
echo $out;
|
||||
}
|
||||
}
|
||||
|
||||
function output_hr()
|
||||
{
|
||||
if(KSESTEST_ENV == 'WEB')
|
||||
{
|
||||
return "\t\t\t<hr />\n";
|
||||
}
|
||||
else
|
||||
{
|
||||
return str_repeat(60, '-') . "\n";
|
||||
}
|
||||
}
|
||||
|
||||
function output_ul($data = array(), $padding = "")
|
||||
{
|
||||
if(!is_array($data) || count($data) < 1)
|
||||
{
|
||||
return "";
|
||||
}
|
||||
|
||||
$text = "";
|
||||
if(KSESTEST_ENV == 'WEB')
|
||||
{
|
||||
$text = "\t\t\t<ul>\n";
|
||||
foreach($data as $li)
|
||||
{
|
||||
$text .= "\t\t\t\t<li>$li</li>\n";
|
||||
}
|
||||
$text .= "\t\t\t</ul>\n";
|
||||
}
|
||||
else
|
||||
{
|
||||
foreach($data as $li)
|
||||
{
|
||||
$text .= $padding . " * $li\n";
|
||||
}
|
||||
}
|
||||
|
||||
return $text;
|
||||
}
|
||||
|
||||
function test1_protocols(&$myKses)
|
||||
{
|
||||
$default_prots = $myKses->dumpProtocols();
|
||||
$out_text = array();
|
||||
if(count($default_prots) > 0)
|
||||
{
|
||||
array_push($out_text, "Initial protocols from KSES" . KSESTEST_VER . ":");
|
||||
array_push($out_text, output_ul($default_prots));
|
||||
array_push($out_text, output_hr());
|
||||
}
|
||||
|
||||
$myKses->AddProtocols(array("proto1", "proto2:", "proto3")); // Add a list of protocols
|
||||
$myKses->AddProtocols("proto4:"); // Add a single protocol (Note ':' is optional at end)
|
||||
$myKses->AddProtocol("proto9", "mystery:", "anarchy");
|
||||
$myKses->AddProtocol("alpha", "beta", "gamma:");
|
||||
|
||||
$add_protocol = "\t\t\t<ol>\n";
|
||||
$add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols(array("proto1", "proto2:", "proto3"));</li>' . "\n";
|
||||
$add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n";
|
||||
$add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n";
|
||||
$add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("proto9", "mystery:", "anarchy");</li>' . "\n";
|
||||
$add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("alpha", "beta", "gamma:");</li>' . "\n";
|
||||
$add_protocol .= "\t\t\t</ol>\n";
|
||||
|
||||
array_push($out_text, $add_protocol);
|
||||
|
||||
$new_prots = $myKses->dumpProtocols();
|
||||
if(count($new_prots) > 0)
|
||||
{
|
||||
array_push($out_text, "New protocols from KSES" . KSESTEST_VER . " after using AddProtocol(s):");
|
||||
array_push($out_text, output_ul($new_prots));
|
||||
array_push($out_text, output_hr());
|
||||
}
|
||||
|
||||
$myKses->RemoveProtocols(array("mystery", "anarchy:"));
|
||||
$myKses->RemoveProtocols("alpha:");
|
||||
$myKses->RemoveProtocol("beta:");
|
||||
$myKses->RemoveProtocol("gamma");
|
||||
|
||||
$remove_protocol = "\t\t\t<ol>\n";
|
||||
$remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols(array("mystery", "anarchy:"));</li>' . "\n";
|
||||
$remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols("alpha:");</li>' . "\n";
|
||||
$remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("beta:");</li>' . "\n";
|
||||
$remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("gamma");</li>' . "\n";
|
||||
$remove_protocol .= "\t\t\t</ol>\n";
|
||||
array_push($out_text, $remove_protocol);
|
||||
|
||||
$new_prots = $myKses->dumpProtocols();
|
||||
if(count($new_prots) > 0)
|
||||
{
|
||||
array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using RemoveProtocol(s):");
|
||||
array_push($out_text, output_ul($new_prots));
|
||||
array_push($out_text, output_hr());
|
||||
}
|
||||
|
||||
$myKses->SetProtocols(array("https", "gopher", "news"));
|
||||
$set_protocol = "\t\t\t<ol>\n";
|
||||
$set_protocol .= "\t\t\t\t" . '<li>$myKses->SetProtocols(array("https", "gopher", "news"));</li>' . "\n";
|
||||
$set_protocol .= "\t\t\t</ol>\n";
|
||||
array_push($out_text, $set_protocol);
|
||||
|
||||
$new_prots = $myKses->dumpProtocols();
|
||||
if(count($new_prots) > 0)
|
||||
{
|
||||
array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using SetProtocols:");
|
||||
array_push($out_text, output_ul($new_prots));
|
||||
array_push($out_text, output_hr());
|
||||
}
|
||||
|
||||
// Invisible reset
|
||||
$myKses->SetProtocols(array("http", "proto1", "proto2", "proto9"));
|
||||
|
||||
return $out_text;
|
||||
}
|
||||
|
||||
function test1_html(&$myKses)
|
||||
{
|
||||
$out = array();
|
||||
|
||||
// Allows <p>|</p> tag
|
||||
$myKses->AddHTML("p");
|
||||
|
||||
// Allows 'a' tag with href|name attributes,
|
||||
// href has minlen of 10 chars, and maxlen of 25 chars
|
||||
// name has minlen of 2 chars
|
||||
$myKses->AddHTML(
|
||||
"a",
|
||||
array(
|
||||
"href" => array('maxlen' => 25, 'minlen' => 10),
|
||||
"name" => array('minlen' => 2)
|
||||
)
|
||||
);
|
||||
|
||||
// Allows 'td' tag with colspan|rowspan|class|style|width|nowrap attributes,
|
||||
// colspan has minval of 2 and maxval of 5
|
||||
// rowspan has minval of 3 and maxval of 6
|
||||
// class has minlen of 1 char and maxlen of 10 chars
|
||||
// style has minlen of 10 chars and maxlen of 100 chars
|
||||
// width has maxval of 100
|
||||
// nowrap is valueless
|
||||
$myKses->AddHTML(
|
||||
"td",
|
||||
array(
|
||||
"colspan" => array('minval' => 2, 'maxval' => 5),
|
||||
"rowspan" => array('minval' => 3, 'maxval' => 6),
|
||||
"class" => array("minlen" => 1, 'maxlen' => 10),
|
||||
"width" => array("maxval" => 100),
|
||||
"style" => array('minlen' => 10, 'maxlen' => 100),
|
||||
"nowrap" => array('valueless' => 'y')
|
||||
)
|
||||
);
|
||||
|
||||
array_push($out, "Modifying HTML Tests:");
|
||||
$code_text = "<pre>\n";
|
||||
$code_text .= " // Allows <p>|</p> tag\n";
|
||||
$code_text .= " \$myKses->AddHTML(\"p\");\n";
|
||||
$code_text .= "\n";
|
||||
$code_text .= " // Allows 'a' tag with href|name attributes,\n";
|
||||
$code_text .= " // href has minlen of 10 chars, and maxlen of 25 chars\n";
|
||||
$code_text .= " // name has minlen of 2 chars\n";
|
||||
$code_text .= " \$myKses->AddHTML(\n";
|
||||
$code_text .= " \"a\",\n";
|
||||
$code_text .= " array(\n";
|
||||
$code_text .= " \"href\" => array('maxlen' => 25, 'minlen' => 10),\n";
|
||||
$code_text .= " \"name\" => array('minlen' => 2)\n";
|
||||
$code_text .= " )\n";
|
||||
$code_text .= " );\n";
|
||||
$code_text .= "\n";
|
||||
$code_text .= " // Allows 'td' tag with colspan|rowspan|class|style|width|nowrap attributes,\n";
|
||||
$code_text .= " // colspan has minval of 2 and maxval of 5\n";
|
||||
$code_text .= " // rowspan has minval of 3 and maxval of 6\n";
|
||||
$code_text .= " // class has minlen of 1 char and maxlen of 10 chars\n";
|
||||
$code_text .= " // style has minlen of 10 chars and maxlen of 100 chars\n";
|
||||
$code_text .= " // width has maxval of 100\n";
|
||||
$code_text .= " // nowrap is valueless\n";
|
||||
$code_text .= " \$myKses->AddHTML(\n";
|
||||
$code_text .= " \"td\",\n";
|
||||
$code_text .= " array(\n";
|
||||
$code_text .= " \"colspan\" => array('minval' => 2, 'maxval' => 5),\n";
|
||||
$code_text .= " \"rowspan\" => array('minval' => 3, 'maxval' => 6),\n";
|
||||
$code_text .= " \"class\" => array(\"minlen\" => 1, 'maxlen' => 10),\n";
|
||||
$code_text .= " \"width\" => array(\"maxval\" => 100),\n";
|
||||
$code_text .= " \"style\" => array('minlen' => 10, 'maxlen' => 100),\n";
|
||||
$code_text .= " \"nowrap\" => array('valueless' => 'y')\n";
|
||||
$code_text .= " )\n";
|
||||
$code_text .= " );\n";
|
||||
$code_text .= "</pre>\n";
|
||||
|
||||
array_push($out, $code_text);
|
||||
array_push($out, output_hr());
|
||||
array_push($out, "Net results:");
|
||||
|
||||
$out_elems = $myKses->DumpElements();
|
||||
if(count($out_elems) > 0)
|
||||
{
|
||||
//array_push($out, "\t\t\t<ul>\n");
|
||||
foreach($out_elems as $tag => $attr_data)
|
||||
{
|
||||
$out_li_elems = array();
|
||||
$elem_text = "(X)HTML element $tag";
|
||||
$allow = "";
|
||||
if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0)
|
||||
{
|
||||
$allow = " allows attribute";
|
||||
if(count($attr_data) > 1)
|
||||
{
|
||||
$allow .= "s";
|
||||
}
|
||||
$allow .= ":\n";
|
||||
}
|
||||
|
||||
array_push($out_li_elems, "$elem_text$allow");
|
||||
|
||||
$attr_test_li = array();
|
||||
if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0)
|
||||
{
|
||||
foreach($attr_data as $attr_name => $attr_tests)
|
||||
{
|
||||
$li_text = $attr_name;
|
||||
if(isset($attr_tests) && count($attr_tests) > 0)
|
||||
{
|
||||
foreach($attr_tests as $test_name => $test_val)
|
||||
{
|
||||
switch($test_name)
|
||||
{
|
||||
case "maxlen":
|
||||
$li_text .= " - maximum length of '" . $test_val . "' characters";
|
||||
break;
|
||||
case "minlen":
|
||||
$li_text .= " - minimum length of '" . $test_val . "' characters";
|
||||
break;
|
||||
case "minval":
|
||||
$li_text .= " - minimum value of '" . $test_val . "'";
|
||||
break;
|
||||
case "maxval":
|
||||
$li_text .= " - maximum value of '" . $test_val . "'";
|
||||
break;
|
||||
case "valueless":
|
||||
switch(strtolower($test_val))
|
||||
{
|
||||
case 'n':
|
||||
$li_text .= " - must not be valueless";
|
||||
break;
|
||||
case 'y':
|
||||
$li_text .= " - must be valueless";
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
array_push($attr_test_li, $li_text);
|
||||
}
|
||||
if(count($attr_test_li) > 0)
|
||||
{
|
||||
$attr_test_li = output_ul($attr_test_li, " ");
|
||||
$out_li_elems = array("$elem_text$allow$attr_test_li");
|
||||
}
|
||||
}
|
||||
$out = array_merge($out, $out_li_elems);
|
||||
}
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
?>
|
||||
Reference in New Issue
Block a user