1<?php
2
3/**
4 * Validates the HTML attribute style, otherwise known as CSS.
5 * @note We don't implement the whole CSS specification, so it might be
6 *       difficult to reuse this component in the context of validating
7 *       actual stylesheet declarations.
8 * @note If we were really serious about validating the CSS, we would
9 *       tokenize the styles and then parse the tokens. Obviously, we
10 *       are not doing that. Doing that could seriously harm performance,
11 *       but would make these components a lot more viable for a CSS
12 *       filtering solution.
13 */
14class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
15{
16
17    /**
18     * @param string $css
19     * @param HTMLPurifier_Config $config
20     * @param HTMLPurifier_Context $context
21     * @return bool|string
22     */
23    public function validate($css, $config, $context)
24    {
25        $css = $this->parseCDATA($css);
26
27        $definition = $config->getCSSDefinition();
28        $allow_duplicates = $config->get("CSS.AllowDuplicates");
29
30
31        // According to the CSS2.1 spec, the places where a
32        // non-delimiting semicolon can appear are in strings
33        // escape sequences.   So here is some dumb hack to
34        // handle quotes.
35        $len = strlen($css);
36        $accum = "";
37        $declarations = array();
38        $quoted = false;
39        for ($i = 0; $i < $len; $i++) {
40            $c = strcspn($css, ";'\"", $i);
41            $accum .= substr($css, $i, $c);
42            $i += $c;
43            if ($i == $len) break;
44            $d = $css[$i];
45            if ($quoted) {
46                $accum .= $d;
47                if ($d == $quoted) {
48                    $quoted = false;
49                }
50            } else {
51                if ($d == ";") {
52                    $declarations[] = $accum;
53                    $accum = "";
54                } else {
55                    $accum .= $d;
56                    $quoted = $d;
57                }
58            }
59        }
60        if ($accum != "") $declarations[] = $accum;
61
62        $propvalues = array();
63        $new_declarations = '';
64
65        /**
66         * Name of the current CSS property being validated.
67         */
68        $property = false;
69        $context->register('CurrentCSSProperty', $property);
70
71        foreach ($declarations as $declaration) {
72            if (!$declaration) {
73                continue;
74            }
75            if (!strpos($declaration, ':')) {
76                continue;
77            }
78            list($property, $value) = explode(':', $declaration, 2);
79            $property = trim($property);
80            $value = trim($value);
81            $ok = false;
82            do {
83                if (isset($definition->info[$property])) {
84                    $ok = true;
85                    break;
86                }
87                if (ctype_lower($property)) {
88                    break;
89                }
90                $property = strtolower($property);
91                if (isset($definition->info[$property])) {
92                    $ok = true;
93                    break;
94                }
95            } while (0);
96            if (!$ok) {
97                continue;
98            }
99            // inefficient call, since the validator will do this again
100            if (strtolower(trim($value)) !== 'inherit') {
101                // inherit works for everything (but only on the base property)
102                $result = $definition->info[$property]->validate(
103                    $value,
104                    $config,
105                    $context
106                );
107            } else {
108                $result = 'inherit';
109            }
110            if ($result === false) {
111                continue;
112            }
113            if ($allow_duplicates) {
114                $new_declarations .= "$property:$result;";
115            } else {
116                $propvalues[$property] = $result;
117            }
118        }
119
120        $context->destroy('CurrentCSSProperty');
121
122        // procedure does not write the new CSS simultaneously, so it's
123        // slightly inefficient, but it's the only way of getting rid of
124        // duplicates. Perhaps config to optimize it, but not now.
125
126        foreach ($propvalues as $prop => $value) {
127            $new_declarations .= "$prop:$value;";
128        }
129
130        return $new_declarations ? $new_declarations : false;
131
132    }
133
134}
135
136// vim: et sw=4 sts=4
137