Changeset 33359 for trunk/src/wp-includes/kses.php
- Timestamp:
- 07/22/2015 05:14:50 AM (9 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/wp-includes/kses.php
r32860 r33359 530 530 531 531 /** 532 * Filters one attribute only and ensures its value is allowed. 533 * 534 * This function has the advantage of being more secure than esc_attr() and can 535 * escape data in some situations where wp_kses() must strip the whole attribute. 536 * 537 * @since 4.2.3 538 * 539 * @param string $string The 'whole' attribute, including name and value. 540 * @param string $element The element name to which the attribute belongs. 541 * @return string Filtered attribute. 542 */ 543 function wp_kses_one_attr( $string, $element ) { 544 $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action'); 545 $allowed_html = wp_kses_allowed_html( 'post' ); 546 $allowed_protocols = wp_allowed_protocols(); 547 $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); 548 $string = wp_kses_js_entities( $string ); 549 550 // Preserve leading and trailing whitespace. 551 $matches = array(); 552 preg_match('/^\s*/', $string, $matches); 553 $lead = $matches[0]; 554 preg_match('/\s*$/', $string, $matches); 555 $trail = $matches[0]; 556 if ( empty( $trail ) ) { 557 $string = substr( $string, strlen( $lead ) ); 558 } else { 559 $string = substr( $string, strlen( $lead ), -strlen( $trail ) ); 560 } 561 562 // Parse attribute name and value from input. 563 $split = preg_split( '/\s*=\s*/', $string, 2 ); 564 $name = $split[0]; 565 if ( count( $split ) == 2 ) { 566 $value = $split[1]; 567 568 // Remove quotes surrounding $value. 569 // Also guarantee correct quoting in $string for this one attribute. 570 if ( '' == $value ) { 571 $quote = ''; 572 } else { 573 $quote = $value[0]; 574 } 575 if ( '"' == $quote || "'" == $quote ) { 576 if ( substr( $value, -1 ) != $quote ) { 577 return ''; 578 } 579 $value = substr( $value, 1, -1 ); 580 } else { 581 $quote = '"'; 582 } 583 584 // Sanitize quotes, angle braces, and entities. 585 $value = esc_attr( $value ); 586 587 // Sanitize URI values. 588 if ( in_array( strtolower( $name ), $uris ) ) { 589 $value = wp_kses_bad_protocol( $value, $allowed_protocols ); 590 } 591 592 $string = "$name=$quote$value$quote"; 593 $vless = 'n'; 594 } else { 595 $value = ''; 596 $vless = 'y'; 597 } 598 599 // Sanitize attribute by name. 600 wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html ); 601 602 // Restore whitespace. 603 return $lead . $string . $trail; 604 } 605 606 /** 532 607 * Return a list of allowed tags and attributes for a given context. 533 608 * … … 742 817 */ 743 818 function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { 744 // Is there a closing XHTML slash at the end of the attributes?745 746 819 if ( ! is_array( $allowed_html ) ) 747 820 $allowed_html = wp_kses_allowed_html( $allowed_html ); 748 821 822 // Is there a closing XHTML slash at the end of the attributes? 749 823 $xhtml_slash = ''; 750 824 if (preg_match('%\s*/\s*$%', $attr)) … … 761 835 // in $attr2 762 836 $attr2 = ''; 763 764 $allowed_attr = $allowed_html[strtolower($element)]; 765 foreach ($attrarr as $arreach) { 766 if ( ! isset( $allowed_attr[strtolower($arreach['name'])] ) ) 767 continue; // the attribute is not allowed 768 769 $current = $allowed_attr[strtolower($arreach['name'])]; 770 if ( $current == '' ) 771 continue; // the attribute is not allowed 772 773 if ( strtolower( $arreach['name'] ) == 'style' ) { 774 $orig_value = $arreach['value']; 775 $value = safecss_filter_attr( $orig_value ); 776 777 if ( empty( $value ) ) 778 continue; 779 780 $arreach['value'] = $value; 781 $arreach['whole'] = str_replace( $orig_value, $value, $arreach['whole'] ); 837 foreach ( $attrarr as $arreach ) { 838 if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) { 839 $attr2 .= ' '.$arreach['whole']; 782 840 } 783 784 if ( ! is_array($current) ) { 785 $attr2 .= ' '.$arreach['whole']; 786 // there are no checks 787 788 } else { 789 // there are some checks 790 $ok = true; 791 foreach ($current as $currkey => $currval) { 792 if ( ! wp_kses_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval) ) { 793 $ok = false; 794 break; 795 } 796 } 797 798 if ( $ok ) 799 $attr2 .= ' '.$arreach['whole']; // it passed them 800 } // if !is_array($current) 801 } // foreach 841 } 802 842 803 843 // Remove any "<" or ">" characters … … 805 845 806 846 return "<$element$attr2$xhtml_slash>"; 847 } 848 849 /** 850 * Determine whether an attribute is allowed. 851 * 852 * @since 4.2.3 853 * 854 * @param string $name The attribute name. Returns empty string when not allowed. 855 * @param string $value The attribute value. Returns a filtered value. 856 * @param string $whole The name=value input. Returns filtered input. 857 * @param string $vless 'y' when attribute like "enabled", otherwise 'n'. 858 * @param string $element The name of the element to which this attribute belongs. 859 * @param array $allowed_html The full list of allowed elements and attributes. 860 * @return bool Is the attribute allowed? 861 */ 862 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) { 863 $allowed_attr = $allowed_html[strtolower( $element )]; 864 865 $name_low = strtolower( $name ); 866 if ( ! isset( $allowed_attr[$name_low] ) || '' == $allowed_attr[$name_low] ) { 867 $name = $value = $whole = ''; 868 return false; 869 } 870 871 if ( 'style' == $name_low ) { 872 $new_value = safecss_filter_attr( $value ); 873 874 if ( empty( $new_value ) ) { 875 $name = $value = $whole = ''; 876 return false; 877 } 878 879 $whole = str_replace( $value, $new_value, $whole ); 880 $value = $new_value; 881 } 882 883 if ( is_array( $allowed_attr[$name_low] ) ) { 884 // there are some checks 885 foreach ( $allowed_attr[$name_low] as $currkey => $currval ) { 886 if ( ! wp_kses_check_attr_val( $value, $vless, $currkey, $currval ) ) { 887 $name = $value = $whole = ''; 888 return false; 889 } 890 } 891 } 892 893 return true; 807 894 } 808 895 … … 934 1021 935 1022 return $attrarr; 1023 } 1024 1025 /** 1026 * Finds all attributes of an HTML element. 1027 * 1028 * Does not modify input. May return "evil" output. 1029 * 1030 * Based on wp_kses_split2() and wp_kses_attr() 1031 * 1032 * @since 4.2.3 1033 * 1034 * @param string $element HTML element/tag 1035 * @return array|bool List of attributes found in $element. Returns false on failure. 1036 */ 1037 function wp_kses_attr_parse( $element ) { 1038 $valid = preg_match('%^(<\s*)(/\s*)?([a-zA-Z0-9]+\s*)([^>]*)(>?)$%', $element, $matches); 1039 if ( 1 !== $valid ) { 1040 return false; 1041 } 1042 1043 $begin = $matches[1]; 1044 $slash = $matches[2]; 1045 $elname = $matches[3]; 1046 $attr = $matches[4]; 1047 $end = $matches[5]; 1048 1049 if ( '' !== $slash ) { 1050 // Closing elements do not get parsed. 1051 return false; 1052 } 1053 1054 // Is there a closing XHTML slash at the end of the attributes? 1055 if ( 1 === preg_match( '%\s*/\s*$%', $attr, $matches ) ) { 1056 $xhtml_slash = $matches[0]; 1057 $attr = substr( $attr, 0, -strlen( $xhtml_slash ) ); 1058 } else { 1059 $xhtml_slash = ''; 1060 } 1061 1062 // Split it 1063 $attrarr = wp_kses_hair_parse( $attr ); 1064 if ( false === $attrarr ) { 1065 return false; 1066 } 1067 1068 // Make sure all input is returned by adding front and back matter. 1069 array_unshift( $attrarr, $begin . $slash . $elname ); 1070 array_push( $attrarr, $xhtml_slash . $end ); 1071 1072 return $attrarr; 1073 } 1074 1075 /** 1076 * Builds an attribute list from string containing attributes. 1077 * 1078 * Does not modify input. May return "evil" output. 1079 * In case of unexpected input, returns false instead of stripping things. 1080 * 1081 * Based on wp_kses_hair() but does not return a multi-dimensional array. 1082 * 1083 * @since 4.2.3 1084 * 1085 * @param string $attr Attribute list from HTML element to closing HTML element tag 1086 * @return array|bool List of attributes found in $attr. Returns false on failure. 1087 */ 1088 function wp_kses_hair_parse( $attr ) { 1089 if ( '' === $attr ) { 1090 return array(); 1091 } 1092 1093 $regex = 1094 '(?:' 1095 . '[-a-zA-Z:]+' // Attribute name. 1096 . '|' 1097 . '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html. 1098 . ')' 1099 . '(?:' // Attribute value. 1100 . '\s*=\s*' // All values begin with '=' 1101 . '(?:' 1102 . '"[^"]*"' // Double-quoted 1103 . '|' 1104 . "'[^']*'" // Single-quoted 1105 . '|' 1106 . '[^\s"\']+' // Non-quoted 1107 . '(?:\s|$)' // Must have a space 1108 . ')' 1109 . '|' 1110 . '(?:\s|$)' // If attribute has no value, space is required. 1111 . ')' 1112 . '\s*'; // Trailing space is optional except as mentioned above. 1113 1114 // Although it is possible to reduce this procedure to a single regexp, 1115 // we must run that regexp twice to get exactly the expected result. 1116 1117 $validation = "%^($regex)+$%"; 1118 $extraction = "%$regex%"; 1119 1120 if ( 1 === preg_match( $validation, $attr ) ) { 1121 preg_match_all( $extraction, $attr, $attrarr ); 1122 return $attrarr[0]; 1123 } else { 1124 return false; 1125 } 936 1126 } 937 1127
Note: See TracChangeset
for help on using the changeset viewer.