108 lines
4.1 KiB
PHP
108 lines
4.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* This file is part of the TYPO3 CMS project.
|
|
*
|
|
* It is free software; you can redistribute it and/or modify it under
|
|
* the terms of the GNU General Public License, either version 2
|
|
* of the License, or any later version.
|
|
*
|
|
* For the full copyright and license information, please read the
|
|
* LICENSE.txt file that was distributed with this source code.
|
|
*
|
|
* The TYPO3 project - inspiring people to share!
|
|
*/
|
|
|
|
namespace TYPO3\CMS\Core\Html;
|
|
|
|
use Psr\Http\Message\ServerRequestInterface;
|
|
use TYPO3\CMS\Core\Resource\Security\SvgSanitizer;
|
|
use TYPO3\CMS\Core\SingletonInterface;
|
|
use TYPO3\CMS\Core\Utility\GeneralUtility;
|
|
use TYPO3\CMS\Core\Utility\PathUtility;
|
|
use TYPO3\HtmlSanitizer\Behavior;
|
|
use TYPO3\HtmlSanitizer\Behavior\NodeInterface;
|
|
use TYPO3\HtmlSanitizer\Builder\CommonBuilder;
|
|
use TYPO3\HtmlSanitizer\Context;
|
|
use TYPO3\HtmlSanitizer\Sanitizer;
|
|
use TYPO3\HtmlSanitizer\Visitor\CommonVisitor;
|
|
|
|
/**
|
|
* Builder, creating a `Sanitizer` instance with "default"
|
|
* behavior for tags, attributes and values.
|
|
*
|
|
* @internal
|
|
*/
|
|
class DefaultSanitizerBuilder extends CommonBuilder implements SingletonInterface
|
|
{
|
|
private Behavior $behavior;
|
|
|
|
public function __construct()
|
|
{
|
|
parent::__construct();
|
|
// + URL must be on local host, or is absolute URI path
|
|
$isOnCurrentHostAttr = new Behavior\ClosureAttrValue(
|
|
// @todo: This closure has a late dependency to $GLOBALS['TYPO3_REQUEST'] that should eventually
|
|
// be made explicit, probably by handing over ServerRequestInterface to build().
|
|
static function (string $value): bool {
|
|
/** @var ServerRequestInterface|null $request */
|
|
$request = $GLOBALS['TYPO3_REQUEST'] ?? null;
|
|
if ($request === null) {
|
|
throw new \RuntimeException('DefaultSanitizerBuilder requires an active PSR-7 request with normalizedParams attribute.', 1775675289);
|
|
}
|
|
return GeneralUtility::isValidUrl($value) && GeneralUtility::isOnCurrentHost($value, $request)
|
|
|| PathUtility::isAbsolutePath($value) && GeneralUtility::isAllowedAbsPath($value);
|
|
}
|
|
);
|
|
// + starting with `t3://`
|
|
$isTypo3Uri = new Behavior\RegExpAttrValue('#^t3://#');
|
|
|
|
// extends common attributes for TYPO3-specific URIs
|
|
$this->srcAttr->addValues($isOnCurrentHostAttr);
|
|
$this->hrefAttr->addValues($isOnCurrentHostAttr, $isTypo3Uri);
|
|
|
|
// @todo `style` used in Introduction Package, inline CSS should be removed
|
|
$this->globalAttrs[] = new Behavior\Attr('style');
|
|
}
|
|
|
|
public function build(): Sanitizer
|
|
{
|
|
$behavior = $this->createBehavior();
|
|
$visitor = GeneralUtility::makeInstance(CommonVisitor::class, $behavior);
|
|
return GeneralUtility::makeInstance(Sanitizer::class, $behavior, $visitor);
|
|
}
|
|
|
|
protected function createBehavior(): Behavior
|
|
{
|
|
if (!isset($this->behavior)) {
|
|
$this->behavior = parent::createBehavior()
|
|
->withName('default')
|
|
->withNodes(new Behavior\NodeHandler(
|
|
new Behavior\Tag('svg'),
|
|
new Behavior\Handler\ClosureHandler(
|
|
static function (NodeInterface $node, ?\DOMNode $domNode, Context $context): ?\DOMNode {
|
|
if ($domNode === null) {
|
|
return null;
|
|
}
|
|
|
|
$newNode = GeneralUtility::makeInstance(SvgSanitizer::class)
|
|
->sanitizeNode($domNode);
|
|
|
|
// purge empty svg nodes
|
|
if ($newNode->childNodes->length === 0) {
|
|
return null;
|
|
}
|
|
|
|
$fragment = $domNode->ownerDocument->createDocumentFragment();
|
|
$fragment->append($newNode);
|
|
return $fragment;
|
|
}
|
|
)
|
|
));
|
|
}
|
|
return $this->behavior;
|
|
}
|
|
}
|