Changeset 33386 for branches/3.9/src/wp-includes/kses.php
- Timestamp:
- 07/23/2015 05:00:44 AM (9 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/3.9/src/wp-includes/kses.php
r30427 r33386 491 491 492 492 /** 493 * Filters one attribute only and ensures its value is allowed. 494 * 495 * This function has the advantage of being more secure than esc_attr() and can 496 * escape data in some situations where wp_kses() must strip the whole attribute. 497 * 498 * @since 4.2.3 499 * 500 * @param string $string The 'whole' attribute, including name and value. 501 * @param string $element The element name to which the attribute belongs. 502 * @return string Filtered attribute. 503 */ 504 function wp_kses_one_attr( $string, $element ) { 505 $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action'); 506 $allowed_html = wp_kses_allowed_html( 'post' ); 507 $allowed_protocols = wp_allowed_protocols(); 508 $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); 509 $string = wp_kses_js_entities( $string ); 510 $string = wp_kses_normalize_entities( $string ); 511 512 // Preserve leading and trailing whitespace. 513 $matches = array(); 514 preg_match('/^\s*/', $string, $matches); 515 $lead = $matches[0]; 516 preg_match('/\s*$/', $string, $matches); 517 $trail = $matches[0]; 518 if ( empty( $trail ) ) { 519 $string = substr( $string, strlen( $lead ) ); 520 } else { 521 $string = substr( $string, strlen( $lead ), -strlen( $trail ) ); 522 } 523 524 // Parse attribute name and value from input. 525 $split = preg_split( '/\s*=\s*/', $string, 2 ); 526 $name = $split[0]; 527 if ( count( $split ) == 2 ) { 528 $value = $split[1]; 529 530 // Remove quotes surrounding $value. 531 // Also guarantee correct quoting in $string for this one attribute. 532 if ( '' == $value ) { 533 $quote = ''; 534 } else { 535 $quote = $value[0]; 536 } 537 if ( '"' == $quote || "'" == $quote ) { 538 if ( substr( $value, -1 ) != $quote ) { 539 return ''; 540 } 541 $value = substr( $value, 1, -1 ); 542 } else { 543 $quote = '"'; 544 } 545 546 // Sanitize quotes and angle braces. 547 $value = htmlspecialchars( $value, ENT_QUOTES, null, false ); 548 549 // Sanitize URI values. 550 if ( in_array( strtolower( $name ), $uris ) ) { 551 $value = wp_kses_bad_protocol( $value, $allowed_protocols ); 552 } 553 554 $string = "$name=$quote$value$quote"; 555 $vless = 'n'; 556 } else { 557 $value = ''; 558 $vless = 'y'; 559 } 560 561 // Sanitize attribute by name. 562 wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html ); 563 564 // Restore whitespace. 565 return $lead . $string . $trail; 566 } 567 568 /** 493 569 * Return a list of allowed tags and attributes for a given context. 494 570 * … … 711 787 # in $attr2 712 788 $attr2 = ''; 713 714 $allowed_attr = $allowed_html[strtolower($element)]; 715 foreach ($attrarr as $arreach) { 716 if ( ! isset( $allowed_attr[strtolower($arreach['name'])] ) ) 717 continue; # the attribute is not allowed 718 719 $current = $allowed_attr[strtolower($arreach['name'])]; 720 if ( $current == '' ) 721 continue; # the attribute is not allowed 722 723 if ( strtolower( $arreach['name'] ) == 'style' ) { 724 $orig_value = $arreach['value']; 725 $value = safecss_filter_attr( $orig_value ); 726 727 if ( empty( $value ) ) 728 continue; 729 730 $arreach['value'] = $value; 731 $arreach['whole'] = str_replace( $orig_value, $value, $arreach['whole'] ); 789 foreach ( $attrarr as $arreach ) { 790 if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) { 791 $attr2 .= ' '.$arreach['whole']; 732 792 } 733 734 if ( ! is_array($current) ) { 735 $attr2 .= ' '.$arreach['whole']; 736 # there are no checks 737 738 } else { 739 # there are some checks 740 $ok = true; 741 foreach ($current as $currkey => $currval) { 742 if ( ! wp_kses_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval) ) { 743 $ok = false; 744 break; 745 } 746 } 747 748 if ( $ok ) 749 $attr2 .= ' '.$arreach['whole']; # it passed them 750 } # if !is_array($current) 751 } # foreach 793 } 752 794 753 795 # Remove any "<" or ">" characters … … 755 797 756 798 return "<$element$attr2$xhtml_slash>"; 799 } 800 801 /** 802 * Determine whether an attribute is allowed. 803 * 804 * @since 4.2.3 805 * 806 * @param string $name The attribute name. Returns empty string when not allowed. 807 * @param string $value The attribute value. Returns a filtered value. 808 * @param string $whole The name=value input. Returns filtered input. 809 * @param string $vless 'y' when attribute like "enabled", otherwise 'n'. 810 * @param string $element The name of the element to which this attribute belongs. 811 * @param array $allowed_html The full list of allowed elements and attributes. 812 * @return bool Is the attribute allowed? 813 */ 814 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) { 815 $allowed_attr = $allowed_html[strtolower( $element )]; 816 817 $name_low = strtolower( $name ); 818 if ( ! isset( $allowed_attr[$name_low] ) || '' == $allowed_attr[$name_low] ) { 819 $name = $value = $whole = ''; 820 return false; 821 } 822 823 if ( 'style' == $name_low ) { 824 $new_value = safecss_filter_attr( $value ); 825 826 if ( empty( $new_value ) ) { 827 $name = $value = $whole = ''; 828 return false; 829 } 830 831 $whole = str_replace( $value, $new_value, $whole ); 832 $value = $new_value; 833 } 834 835 if ( is_array( $allowed_attr[$name_low] ) ) { 836 // there are some checks 837 foreach ( $allowed_attr[$name_low] as $currkey => $currval ) { 838 if ( ! wp_kses_check_attr_val( $value, $vless, $currkey, $currval ) ) { 839 $name = $value = $whole = ''; 840 return false; 841 } 842 } 843 } 844 845 return true; 757 846 } 758 847 … … 884 973 885 974 return $attrarr; 975 } 976 977 /** 978 * Finds all attributes of an HTML element. 979 * 980 * Does not modify input. May return "evil" output. 981 * 982 * Based on wp_kses_split2() and wp_kses_attr() 983 * 984 * @since 4.2.3 985 * 986 * @param string $element HTML element/tag 987 * @return array|bool List of attributes found in $element. Returns false on failure. 988 */ 989 function wp_kses_attr_parse( $element ) { 990 $valid = preg_match('%^(<\s*)(/\s*)?([a-zA-Z0-9]+\s*)([^>]*)(>?)$%', $element, $matches); 991 if ( 1 !== $valid ) { 992 return false; 993 } 994 995 $begin = $matches[1]; 996 $slash = $matches[2]; 997 $elname = $matches[3]; 998 $attr = $matches[4]; 999 $end = $matches[5]; 1000 1001 if ( '' !== $slash ) { 1002 // Closing elements do not get parsed. 1003 return false; 1004 } 1005 1006 // Is there a closing XHTML slash at the end of the attributes? 1007 if ( 1 === preg_match( '%\s*/\s*$%', $attr, $matches ) ) { 1008 $xhtml_slash = $matches[0]; 1009 $attr = substr( $attr, 0, -strlen( $xhtml_slash ) ); 1010 } else { 1011 $xhtml_slash = ''; 1012 } 1013 1014 // Split it 1015 $attrarr = wp_kses_hair_parse( $attr ); 1016 if ( false === $attrarr ) { 1017 return false; 1018 } 1019 1020 // Make sure all input is returned by adding front and back matter. 1021 array_unshift( $attrarr, $begin . $slash . $elname ); 1022 array_push( $attrarr, $xhtml_slash . $end ); 1023 1024 return $attrarr; 1025 } 1026 1027 /** 1028 * Builds an attribute list from string containing attributes. 1029 * 1030 * Does not modify input. May return "evil" output. 1031 * In case of unexpected input, returns false instead of stripping things. 1032 * 1033 * Based on wp_kses_hair() but does not return a multi-dimensional array. 1034 * 1035 * @since 4.2.3 1036 * 1037 * @param string $attr Attribute list from HTML element to closing HTML element tag 1038 * @return array|bool List of attributes found in $attr. Returns false on failure. 1039 */ 1040 function wp_kses_hair_parse( $attr ) { 1041 if ( '' === $attr ) { 1042 return array(); 1043 } 1044 1045 $regex = 1046 '(?:' 1047 . '[-a-zA-Z:]+' // Attribute name. 1048 . '|' 1049 . '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html. 1050 . ')' 1051 . '(?:' // Attribute value. 1052 . '\s*=\s*' // All values begin with '=' 1053 . '(?:' 1054 . '"[^"]*"' // Double-quoted 1055 . '|' 1056 . "'[^']*'" // Single-quoted 1057 . '|' 1058 . '[^\s"\']+' // Non-quoted 1059 . '(?:\s|$)' // Must have a space 1060 . ')' 1061 . '|' 1062 . '(?:\s|$)' // If attribute has no value, space is required. 1063 . ')' 1064 . '\s*'; // Trailing space is optional except as mentioned above. 1065 1066 // Although it is possible to reduce this procedure to a single regexp, 1067 // we must run that regexp twice to get exactly the expected result. 1068 1069 $validation = "%^($regex)+$%"; 1070 $extraction = "%$regex%"; 1071 1072 if ( 1 === preg_match( $validation, $attr ) ) { 1073 preg_match_all( $extraction, $attr, $attrarr ); 1074 return $attrarr[0]; 1075 } else { 1076 return false; 1077 } 886 1078 } 887 1079
Note: See TracChangeset
for help on using the changeset viewer.