1<?php
2
3/**
4 * Generates HTML from tokens.
5 * @todo Refactor interface so that configuration/context is determined
6 *       upon instantiation, no need for messy generateFromTokens() calls
7 * @todo Make some of the more internal functions protected, and have
8 *       unit tests work around that
9 */
10class HTMLPurifier_Generator
11{
12
13    /**
14     * Whether or not generator should produce XML output.
15     * @type bool
16     */
17    private $_xhtml = true;
18
19    /**
20     * :HACK: Whether or not generator should comment the insides of <script> tags.
21     * @type bool
22     */
23    private $_scriptFix = false;
24
25    /**
26     * Cache of HTMLDefinition during HTML output to determine whether or
27     * not attributes should be minimized.
28     * @type HTMLPurifier_HTMLDefinition
29     */
30    private $_def;
31
32    /**
33     * Cache of %Output.SortAttr.
34     * @type bool
35     */
36    private $_sortAttr;
37
38    /**
39     * Cache of %Output.FlashCompat.
40     * @type bool
41     */
42    private $_flashCompat;
43
44    /**
45     * Cache of %Output.FixInnerHTML.
46     * @type bool
47     */
48    private $_innerHTMLFix;
49
50    /**
51     * Stack for keeping track of object information when outputting IE
52     * compatibility code.
53     * @type array
54     */
55    private $_flashStack = array();
56
57    /**
58     * Configuration for the generator
59     * @type HTMLPurifier_Config
60     */
61    protected $config;
62
63    /**
64     * @param HTMLPurifier_Config $config
65     * @param HTMLPurifier_Context $context
66     */
67    public function __construct($config, $context)
68    {
69        $this->config = $config;
70        $this->_scriptFix = $config->get('Output.CommentScriptContents');
71        $this->_innerHTMLFix = $config->get('Output.FixInnerHTML');
72        $this->_sortAttr = $config->get('Output.SortAttr');
73        $this->_flashCompat = $config->get('Output.FlashCompat');
74        $this->_def = $config->getHTMLDefinition();
75        $this->_xhtml = $this->_def->doctype->xml;
76    }
77
78    /**
79     * Generates HTML from an array of tokens.
80     * @param HTMLPurifier_Token[] $tokens Array of HTMLPurifier_Token
81     * @return string Generated HTML
82     */
83    public function generateFromTokens($tokens)
84    {
85        if (!$tokens) {
86            return '';
87        }
88
89        // Basic algorithm
90        $html = '';
91        for ($i = 0, $size = count($tokens); $i < $size; $i++) {
92            if ($this->_scriptFix && $tokens[$i]->name === 'script'
93                && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) {
94                // script special case
95                // the contents of the script block must be ONE token
96                // for this to work.
97                $html .= $this->generateFromToken($tokens[$i++]);
98                $html .= $this->generateScriptFromToken($tokens[$i++]);
99            }
100            $html .= $this->generateFromToken($tokens[$i]);
101        }
102
103        // Tidy cleanup
104        if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) {
105            $tidy = new Tidy;
106            $tidy->parseString(
107                $html,
108                array(
109                   'indent'=> true,
110                   'output-xhtml' => $this->_xhtml,
111                   'show-body-only' => true,
112                   'indent-spaces' => 2,
113                   'wrap' => 68,
114                ),
115                'utf8'
116            );
117            $tidy->cleanRepair();
118            $html = (string) $tidy; // explicit cast necessary
119        }
120
121        // Normalize newlines to system defined value
122        if ($this->config->get('Core.NormalizeNewlines')) {
123            $nl = $this->config->get('Output.Newline');
124            if ($nl === null) {
125                $nl = PHP_EOL;
126            }
127            if ($nl !== "\n") {
128                $html = str_replace("\n", $nl, $html);
129            }
130        }
131        return $html;
132    }
133
134    /**
135     * Generates HTML from a single token.
136     * @param HTMLPurifier_Token $token HTMLPurifier_Token object.
137     * @return string Generated HTML
138     */
139    public function generateFromToken($token)
140    {
141        if (!$token instanceof HTMLPurifier_Token) {
142            trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING);
143            return '';
144
145        } elseif ($token instanceof HTMLPurifier_Token_Start) {
146            $attr = $this->generateAttributes($token->attr, $token->name);
147            if ($this->_flashCompat) {
148                if ($token->name == "object") {
149                    $flash = new stdClass();
150                    $flash->attr = $token->attr;
151                    $flash->param = array();
152                    $this->_flashStack[] = $flash;
153                }
154            }
155            return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>';
156
157        } elseif ($token instanceof HTMLPurifier_Token_End) {
158            $_extra = '';
159            if ($this->_flashCompat) {
160                if ($token->name == "object" && !empty($this->_flashStack)) {
161                    // doesn't do anything for now
162                }
163            }
164            return $_extra . '</' . $token->name . '>';
165
166        } elseif ($token instanceof HTMLPurifier_Token_Empty) {
167            if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) {
168                $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value'];
169            }
170            $attr = $this->generateAttributes($token->attr, $token->name);
171             return '<' . $token->name . ($attr ? ' ' : '') . $attr .
172                ( $this->_xhtml ? ' /': '' ) // <br /> v. <br>
173                . '>';
174
175        } elseif ($token instanceof HTMLPurifier_Token_Text) {
176            return $this->escape($token->data, ENT_NOQUOTES);
177
178        } elseif ($token instanceof HTMLPurifier_Token_Comment) {
179            return '<!--' . $token->data . '-->';
180        } else {
181            return '';
182
183        }
184    }
185
186    /**
187     * Special case processor for the contents of script tags
188     * @param HTMLPurifier_Token $token HTMLPurifier_Token object.
189     * @return string
190     * @warning This runs into problems if there's already a literal
191     *          --> somewhere inside the script contents.
192     */
193    public function generateScriptFromToken($token)
194    {
195        if (!$token instanceof HTMLPurifier_Token_Text) {
196            return $this->generateFromToken($token);
197        }
198        // Thanks <http://lachy.id.au/log/2005/05/script-comments>
199        $data = preg_replace('#//\s*$#', '', $token->data);
200        return '<!--//--><![CDATA[//><!--' . "\n" . trim($data) . "\n" . '//--><!]]>';
201    }
202
203    /**
204     * Generates attribute declarations from attribute array.
205     * @note This does not include the leading or trailing space.
206     * @param array $assoc_array_of_attributes Attribute array
207     * @param string $element Name of element attributes are for, used to check
208     *        attribute minimization.
209     * @return string Generated HTML fragment for insertion.
210     */
211    public function generateAttributes($assoc_array_of_attributes, $element = '')
212    {
213        $html = '';
214        if ($this->_sortAttr) {
215            ksort($assoc_array_of_attributes);
216        }
217        foreach ($assoc_array_of_attributes as $key => $value) {
218            if (!$this->_xhtml) {
219                // Remove namespaced attributes
220                if (strpos($key, ':') !== false) {
221                    continue;
222                }
223                // Check if we should minimize the attribute: val="val" -> val
224                if ($element && !empty($this->_def->info[$element]->attr[$key]->minimized)) {
225                    $html .= $key . ' ';
226                    continue;
227                }
228            }
229            // Workaround for Internet Explorer innerHTML bug.
230            // Essentially, Internet Explorer, when calculating
231            // innerHTML, omits quotes if there are no instances of
232            // angled brackets, quotes or spaces.  However, when parsing
233            // HTML (for example, when you assign to innerHTML), it
234            // treats backticks as quotes.  Thus,
235            //      <img alt="``" />
236            // becomes
237            //      <img alt=`` />
238            // becomes
239            //      <img alt='' />
240            // Fortunately, all we need to do is trigger an appropriate
241            // quoting style, which we do by adding an extra space.
242            // This also is consistent with the W3C spec, which states
243            // that user agents may ignore leading or trailing
244            // whitespace (in fact, most don't, at least for attributes
245            // like alt, but an extra space at the end is barely
246            // noticeable).  Still, we have a configuration knob for
247            // this, since this transformation is not necesary if you
248            // don't process user input with innerHTML or you don't plan
249            // on supporting Internet Explorer.
250            if ($this->_innerHTMLFix) {
251                if (strpos($value, '`') !== false) {
252                    // check if correct quoting style would not already be
253                    // triggered
254                    if (strcspn($value, '"\' <>') === strlen($value)) {
255                        // protect!
256                        $value .= ' ';
257                    }
258                }
259            }
260            $html .= $key.'="'.$this->escape($value).'" ';
261        }
262        return rtrim($html);
263    }
264
265    /**
266     * Escapes raw text data.
267     * @todo This really ought to be protected, but until we have a facility
268     *       for properly generating HTML here w/o using tokens, it stays
269     *       public.
270     * @param string $string String data to escape for HTML.
271     * @param int $quote Quoting style, like htmlspecialchars. ENT_NOQUOTES is
272     *               permissible for non-attribute output.
273     * @return string escaped data.
274     */
275    public function escape($string, $quote = null)
276    {
277        // Workaround for APC bug on Mac Leopard reported by sidepodcast
278        // http://htmlpurifier.org/phorum/read.php?3,4823,4846
279        if ($quote === null) {
280            $quote = ENT_COMPAT;
281        }
282        return htmlspecialchars($string, $quote, 'UTF-8');
283    }
284}
285
286// vim: et sw=4 sts=4
287