remove autoload section in composer.json

[github/wallabag/wallabag.git] / inc / 3rdparty / htmlpurifier / HTMLPurifier / AttrDef / CSS / FontFamily.php

<?php\r
\r
/**\r
 * Validates a font family list according to CSS spec\r
 */\r
class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef\r
{\r
\r
    protected $mask = null;\r
\r
    public function __construct()\r
    {\r
        $this->mask = '_- ';\r
        for ($c = 'a'; $c <= 'z'; $c++) {\r
            $this->mask .= $c;\r
        }\r
        for ($c = 'A'; $c <= 'Z'; $c++) {\r
            $this->mask .= $c;\r
        }\r
        for ($c = '0'; $c <= '9'; $c++) {\r
            $this->mask .= $c;\r
        } // cast-y, but should be fine\r
        // special bytes used by UTF-8\r
        for ($i = 0x80; $i <= 0xFF; $i++) {\r
            // We don't bother excluding invalid bytes in this range,\r
            // because the our restriction of well-formed UTF-8 will\r
            // prevent these from ever occurring.\r
            $this->mask .= chr($i);\r
        }\r
\r
        /*\r
            PHP's internal strcspn implementation is\r
            O(length of string * length of mask), making it inefficient\r
            for large masks.  However, it's still faster than\r
            preg_match 8)\r
          for (p = s1;;) {\r
            spanp = s2;\r
            do {\r
              if (*spanp == c || p == s1_end) {\r
                return p - s1;\r
              }\r
            } while (spanp++ < (s2_end - 1));\r
            c = *++p;\r
          }\r
         */\r
        // possible optimization: invert the mask.\r
    }\r
\r
    /**\r
     * @param string $string\r
     * @param HTMLPurifier_Config $config\r
     * @param HTMLPurifier_Context $context\r
     * @return bool|string\r
     */\r
    public function validate($string, $config, $context)\r
    {\r
        static $generic_names = array(\r
            'serif' => true,\r
            'sans-serif' => true,\r
            'monospace' => true,\r
            'fantasy' => true,\r
            'cursive' => true\r
        );\r
        $allowed_fonts = $config->get('CSS.AllowedFonts');\r
\r
        // assume that no font names contain commas in them\r
        $fonts = explode(',', $string);\r
        $final = '';\r
        foreach ($fonts as $font) {\r
            $font = trim($font);\r
            if ($font === '') {\r
                continue;\r
            }\r
            // match a generic name\r
            if (isset($generic_names[$font])) {\r
                if ($allowed_fonts === null || isset($allowed_fonts[$font])) {\r
                    $final .= $font . ', ';\r
                }\r
                continue;\r
            }\r
            // match a quoted name\r
            if ($font[0] === '"' || $font[0] === "'") {\r
                $length = strlen($font);\r
                if ($length <= 2) {\r
                    continue;\r
                }\r
                $quote = $font[0];\r
                if ($font[$length - 1] !== $quote) {\r
                    continue;\r
                }\r
                $font = substr($font, 1, $length - 2);\r
            }\r
\r
            $font = $this->expandCSSEscape($font);\r
\r
            // $font is a pure representation of the font name\r
\r
            if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) {\r
                continue;\r
            }\r
\r
            if (ctype_alnum($font) && $font !== '') {\r
                // very simple font, allow it in unharmed\r
                $final .= $font . ', ';\r
                continue;\r
            }\r
\r
            // bugger out on whitespace.  form feed (0C) really\r
            // shouldn't show up regardless\r
            $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font);\r
\r
            // Here, there are various classes of characters which need\r
            // to be treated differently:\r
            //  - Alphanumeric characters are essentially safe.  We\r
            //    handled these above.\r
            //  - Spaces require quoting, though most parsers will do\r
            //    the right thing if there aren't any characters that\r
            //    can be misinterpreted\r
            //  - Dashes rarely occur, but they fairly unproblematic\r
            //    for parsing/rendering purposes.\r
            //  The above characters cover the majority of Western font\r
            //  names.\r
            //  - Arbitrary Unicode characters not in ASCII.  Because\r
            //    most parsers give little thought to Unicode, treatment\r
            //    of these codepoints is basically uniform, even for\r
            //    punctuation-like codepoints.  These characters can\r
            //    show up in non-Western pages and are supported by most\r
            //    major browsers, for example: "ＭＳ 明朝" is a\r
            //    legitimate font-name\r
            //    <http://ja.wikipedia.org/wiki/MS_明朝>.  See\r
            //    the CSS3 spec for more examples:\r
            //    <http://www.w3.org/TR/2011/WD-css3-fonts-20110324/localizedfamilynames.png>\r
            //    You can see live samples of these on the Internet:\r
            //    <http://www.google.co.jp/search?q=font-family+ＭＳ+明朝|ゴシック>\r
            //    However, most of these fonts have ASCII equivalents:\r
            //    for example, 'MS Mincho', and it's considered\r
            //    professional to use ASCII font names instead of\r
            //    Unicode font names.  Thanks Takeshi Terada for\r
            //    providing this information.\r
            //  The following characters, to my knowledge, have not been\r
            //  used to name font names.\r
            //  - Single quote.  While theoretically you might find a\r
            //    font name that has a single quote in its name (serving\r
            //    as an apostrophe, e.g. Dave's Scribble), I haven't\r
            //    been able to find any actual examples of this.\r
            //    Internet Explorer's cssText translation (which I\r
            //    believe is invoked by innerHTML) normalizes any\r
            //    quoting to single quotes, and fails to escape single\r
            //    quotes.  (Note that this is not IE's behavior for all\r
            //    CSS properties, just some sort of special casing for\r
            //    font-family).  So a single quote *cannot* be used\r
            //    safely in the font-family context if there will be an\r
            //    innerHTML/cssText translation.  Note that Firefox 3.x\r
            //    does this too.\r
            //  - Double quote.  In IE, these get normalized to\r
            //    single-quotes, no matter what the encoding.  (Fun\r
            //    fact, in IE8, the 'content' CSS property gained\r
            //    support, where they special cased to preserve encoded\r
            //    double quotes, but still translate unadorned double\r
            //    quotes into single quotes.)  So, because their\r
            //    fixpoint behavior is identical to single quotes, they\r
            //    cannot be allowed either.  Firefox 3.x displays\r
            //    single-quote style behavior.\r
            //  - Backslashes are reduced by one (so \\ -> \) every\r
            //    iteration, so they cannot be used safely.  This shows\r
            //    up in IE7, IE8 and FF3\r
            //  - Semicolons, commas and backticks are handled properly.\r
            //  - The rest of the ASCII punctuation is handled properly.\r
            // We haven't checked what browsers do to unadorned\r
            // versions, but this is not important as long as the\r
            // browser doesn't /remove/ surrounding quotes (as IE does\r
            // for HTML).\r
            //\r
            // With these results in hand, we conclude that there are\r
            // various levels of safety:\r
            //  - Paranoid: alphanumeric, spaces and dashes(?)\r
            //  - International: Paranoid + non-ASCII Unicode\r
            //  - Edgy: Everything except quotes, backslashes\r
            //  - NoJS: Standards compliance, e.g. sod IE. Note that\r
            //    with some judicious character escaping (since certain\r
            //    types of escaping doesn't work) this is theoretically\r
            //    OK as long as innerHTML/cssText is not called.\r
            // We believe that international is a reasonable default\r
            // (that we will implement now), and once we do more\r
            // extensive research, we may feel comfortable with dropping\r
            // it down to edgy.\r
\r
            // Edgy: alphanumeric, spaces, dashes, underscores and Unicode.  Use of\r
            // str(c)spn assumes that the string was already well formed\r
            // Unicode (which of course it is).\r
            if (strspn($font, $this->mask) !== strlen($font)) {\r
                continue;\r
            }\r
\r
            // Historical:\r
            // In the absence of innerHTML/cssText, these ugly\r
            // transforms don't pose a security risk (as \\ and \"\r
            // might--these escapes are not supported by most browsers).\r
            // We could try to be clever and use single-quote wrapping\r
            // when there is a double quote present, but I have choosen\r
            // not to implement that.  (NOTE: you can reduce the amount\r
            // of escapes by one depending on what quoting style you use)\r
            // $font = str_replace('\\', '\\5C ', $font);\r
            // $font = str_replace('"',  '\\22 ', $font);\r
            // $font = str_replace("'",  '\\27 ', $font);\r
\r
            // font possibly with spaces, requires quoting\r
            $final .= "'$font', ";\r
        }\r
        $final = rtrim($final, ', ');\r
        if ($final === '') {\r
            return false;\r
        }\r
        return $final;\r
    }\r
\r
}\r
\r
// vim: et sw=4 sts=4\r