+++ /dev/null
-<?php\r
-\r
-/**\r
- * Validates the HTML attribute style, otherwise known as CSS.\r
- * @note We don't implement the whole CSS specification, so it might be\r
- * difficult to reuse this component in the context of validating\r
- * actual stylesheet declarations.\r
- * @note If we were really serious about validating the CSS, we would\r
- * tokenize the styles and then parse the tokens. Obviously, we\r
- * are not doing that. Doing that could seriously harm performance,\r
- * but would make these components a lot more viable for a CSS\r
- * filtering solution.\r
- */\r
-class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef\r
-{\r
-\r
- /**\r
- * @param string $css\r
- * @param HTMLPurifier_Config $config\r
- * @param HTMLPurifier_Context $context\r
- * @return bool|string\r
- */\r
- public function validate($css, $config, $context)\r
- {\r
- $css = $this->parseCDATA($css);\r
-\r
- $definition = $config->getCSSDefinition();\r
-\r
- // we're going to break the spec and explode by semicolons.\r
- // This is because semicolon rarely appears in escaped form\r
- // Doing this is generally flaky but fast\r
- // IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI\r
- // for details\r
-\r
- $declarations = explode(';', $css);\r
- $propvalues = array();\r
-\r
- /**\r
- * Name of the current CSS property being validated.\r
- */\r
- $property = false;\r
- $context->register('CurrentCSSProperty', $property);\r
-\r
- foreach ($declarations as $declaration) {\r
- if (!$declaration) {\r
- continue;\r
- }\r
- if (!strpos($declaration, ':')) {\r
- continue;\r
- }\r
- list($property, $value) = explode(':', $declaration, 2);\r
- $property = trim($property);\r
- $value = trim($value);\r
- $ok = false;\r
- do {\r
- if (isset($definition->info[$property])) {\r
- $ok = true;\r
- break;\r
- }\r
- if (ctype_lower($property)) {\r
- break;\r
- }\r
- $property = strtolower($property);\r
- if (isset($definition->info[$property])) {\r
- $ok = true;\r
- break;\r
- }\r
- } while (0);\r
- if (!$ok) {\r
- continue;\r
- }\r
- // inefficient call, since the validator will do this again\r
- if (strtolower(trim($value)) !== 'inherit') {\r
- // inherit works for everything (but only on the base property)\r
- $result = $definition->info[$property]->validate(\r
- $value,\r
- $config,\r
- $context\r
- );\r
- } else {\r
- $result = 'inherit';\r
- }\r
- if ($result === false) {\r
- continue;\r
- }\r
- $propvalues[$property] = $result;\r
- }\r
-\r
- $context->destroy('CurrentCSSProperty');\r
-\r
- // procedure does not write the new CSS simultaneously, so it's\r
- // slightly inefficient, but it's the only way of getting rid of\r
- // duplicates. Perhaps config to optimize it, but not now.\r
-\r
- $new_declarations = '';\r
- foreach ($propvalues as $prop => $value) {\r
- $new_declarations .= "$prop:$value;";\r
- }\r
-\r
- return $new_declarations ? $new_declarations : false;\r
-\r
- }\r
-\r
-}\r
-\r
-// vim: et sw=4 sts=4\r