TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Core\Html;
+
+use Psr\Http\Message\ServerRequestInterface;
+use TYPO3\CMS\Core\Resource\Security\SvgSanitizer;
+use TYPO3\CMS\Core\SingletonInterface;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+use TYPO3\CMS\Core\Utility\PathUtility;
+use TYPO3\HtmlSanitizer\Behavior;
+use TYPO3\HtmlSanitizer\Behavior\NodeInterface;
+use TYPO3\HtmlSanitizer\Builder\CommonBuilder;
+use TYPO3\HtmlSanitizer\Context;
+use TYPO3\HtmlSanitizer\Sanitizer;
+use TYPO3\HtmlSanitizer\Visitor\CommonVisitor;
+
+/**
+ * Builder, creating a `Sanitizer` instance with "default"
+ * behavior for tags, attributes and values.
+ *
+ * @internal
+ */
+class DefaultSanitizerBuilder extends CommonBuilder implements SingletonInterface
+{
+    private Behavior $behavior;
+
+    public function __construct()
+    {
+        parent::__construct();
+        // + URL must be on local host, or is absolute URI path
+        $isOnCurrentHostAttr = new Behavior\ClosureAttrValue(
+            // @todo: This closure has a late dependency to $GLOBALS['TYPO3_REQUEST'] that should eventually
+            //        be made explicit, probably by handing over ServerRequestInterface to build().
+            static function (string $value): bool {
+                /** @var ServerRequestInterface|null $request */
+                $request = $GLOBALS['TYPO3_REQUEST'] ?? null;
+                if ($request === null) {
+                    throw new \RuntimeException('DefaultSanitizerBuilder requires an active PSR-7 request with normalizedParams attribute.', 1775675289);
+                }
+                return GeneralUtility::isValidUrl($value) && GeneralUtility::isOnCurrentHost($value, $request)
+                    || PathUtility::isAbsolutePath($value) && GeneralUtility::isAllowedAbsPath($value);
+            }
+        );
+        // + starting with `t3://`
+        $isTypo3Uri = new Behavior\RegExpAttrValue('#^t3://#');
+
+        // extends common attributes for TYPO3-specific URIs
+        $this->srcAttr->addValues($isOnCurrentHostAttr);
+        $this->hrefAttr->addValues($isOnCurrentHostAttr, $isTypo3Uri);
+
+        // @todo `style` used in Introduction Package, inline CSS should be removed
+        $this->globalAttrs[] = new Behavior\Attr('style');
+    }
+
+    public function build(): Sanitizer
+    {
+        $behavior = $this->createBehavior();
+        $visitor = GeneralUtility::makeInstance(CommonVisitor::class, $behavior);
+        return GeneralUtility::makeInstance(Sanitizer::class, $behavior, $visitor);
+    }
+
+    protected function createBehavior(): Behavior
+    {
+        if (!isset($this->behavior)) {
+            $this->behavior = parent::createBehavior()
+                ->withName('default')
+                ->withNodes(new Behavior\NodeHandler(
+                    new Behavior\Tag('svg'),
+                    new Behavior\Handler\ClosureHandler(
+                        static function (NodeInterface $node, ?\DOMNode $domNode, Context $context): ?\DOMNode {
+                            if ($domNode === null) {
+                                return null;
+                            }
+
+                            $newNode = GeneralUtility::makeInstance(SvgSanitizer::class)
+                                ->sanitizeNode($domNode);
+
+                            // purge empty svg nodes
+                            if ($newNode->childNodes->length === 0) {
+                                return null;
+                            }
+
+                            $fragment = $domNode->ownerDocument->createDocumentFragment();
+                            $fragment->append($newNode);
+                            return $fragment;
+                        }
+                    )
+                ));
+        }
+        return $this->behavior;
+    }
+}