PHP HTMLPurifier_ConfigSchema类代码示例

 /**
  * Retrieves an instance of the application-wide configuration definition.
  */
 public static function instance($prototype = null)
 {
     if ($prototype !== null) {
         HTMLPurifier_ConfigSchema::$singleton = $prototype;
     } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) {
         HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial();
     }
     return HTMLPurifier_ConfigSchema::$singleton;
 }

 public function register(Application $app)
 {
     parent::register($app);
     $app['form.secret'] = $app->share(function () use($app) {
         return md5('form_secret' . $app['salt']);
     });
     $app['html_purifier.allowed_elements'] = ['p', 'ul', 'ol', 'li', 'b', 'i', 'strong', 'em', 'img', 'sub', 'sup', 'blockquote', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'a', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'address', 'br', 'dl', 'dt', 'dd'];
     $app['html_purifier.allowed_attributes'] = ['*.class', 'img.src', 'img.alt', 'a.href', 'a.title', 'td.abbr', 'td.colspan', 'td.rowspan', 'th.abbr', 'th.colspan', 'th.rowspan', 'table.summary'];
     $app['html_purifier.config'] = $app->share(function () use($app) {
         $config = new \HTMLPurifier_Config(\HTMLPurifier_ConfigSchema::instance());
         $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
         $config->set('HTML.AllowedElements', implode(',', $app['html_purifier.allowed_elements']));
         $config->set('HTML.AllowedAttributes', implode(',', $app['html_purifier.allowed_attributes']));
         $config->set('AutoFormat.RemoveEmpty', true);
         $config->set('AutoFormat.AutoParagraph', true);
         $config->set('AutoFormat.RemoveEmpty.RemoveNbsp', true);
         $cachePath = $app['paths.cache'] . '/htmlpurifier';
         if (!is_dir($cachePath)) {
             mkdir($cachePath, 0777, true);
         }
         $config->set('Cache.SerializerPath', $cachePath);
         return $config;
     });
     $app['html_purifier'] = $app->share(function () use($app) {
         return new \HTMLPurifier($app['html_purifier.config']);
     });
     $app['form.html_purifier'] = $app->share(function () use($app) {
         return new HtmlPurifier($app['html_purifier']);
     });
     $app['form.html_extension'] = $app->share(function () use($app) {
         return new HtmlExtension(new HtmlType($app['form.html_purifier']), new HtmlTypeGuesser($app['annotations.reader']));
     });
     $app['form.extensions'] = $app->share($app->extend('form.extensions', function (array $extensions) use($app) {
         $extensions[] = new DoctrineOrmExtension($app['orm.manager_registry']);
         $extensions[] = $app['form.html_extension'];
         return $extensions;
     }));
     $app['form.type.extensions'] = $app->share($app->extend('form.type.extensions', function (array $extensions) use($app) {
         $extensions[] = new FormTypeExtension();
         $extensions[] = new DateTypeExtension();
         $extensions[] = new TimeTypeExtension();
         return $extensions;
     }));
 }

 public function build($interchange)
 {
     $schema = new HTMLPurifier_ConfigSchema();
     foreach ($interchange->namespaces as $n) {
         $schema->addNamespace($n->namespace);
     }
     foreach ($interchange->directives as $d) {
         $schema->add($d->id->namespace, $d->id->directive, $d->default, $d->type, $d->typeAllowsNull);
         if ($d->allowed !== null) {
             $schema->addAllowedValues($d->id->namespace, $d->id->directive, $d->allowed);
         }
         foreach ($d->aliases as $alias) {
             $schema->addAlias($alias->namespace, $alias->directive, $d->id->namespace, $d->id->directive);
         }
         if ($d->valueAliases !== null) {
             $schema->addValueAliases($d->id->namespace, $d->id->directive, $d->valueAliases);
         }
     }
     $schema->postProcess();
     return $schema;
 }

<?php

// HTMLPurifier_ChildDef and inheritance have three types of output:
// true = leave nodes as is
// false = delete parent node and all children
// array(...) = replace children nodes with these
HTMLPurifier_ConfigSchema::define('Core', 'EscapeInvalidChildren', false, 'bool', 'When true, a child is found that is not allowed in the context of the ' . 'parent element will be transformed into text as if it were ASCII. When ' . 'false, that element and all internal tags will be dropped, though text ' . 'will be preserved.  There is no option for dropping the element but ' . 'preserving child nodes.');
/**
 * Defines allowed child nodes and validates tokens against it.
 */
class HTMLPurifier_ChildDef
{
    /**
     * Type of child definition, usually right-most part of class name lowercase.
     * Used occasionally in terms of context.
     */
    public $type;
    /**
     * Bool that indicates whether or not an empty array of children is okay
     * 
     * This is necessary for redundant checking when changes affecting
     * a child node may cause a parent node to now be disallowed.
     */
    public $allow_empty;
    /**
     * Lookup array of all elements that this definition could possibly allow
     */
    public $elements = array();
    /**
     * Validates nodes according to definition and returns modification.
     * 

    <strong>Warning:</strong> If another directive conflicts with the 
    elements here, <em>that</em> directive will win and override. For 
    example, %HTML.EnableAttrID will take precedence over *.id in this 
    directive.  You must set that directive to true before you can use 
    IDs at all. This directive has been available since 1.3.0.
</p>
');
HTMLPurifier_ConfigSchema::define('HTML', 'Allowed', null, 'itext/null', '
<p>
    This is a convenience directive that rolls the functionality of
    %HTML.AllowedElements and %HTML.AllowedAttributes into one directive.
    Specify elements and attributes that are allowed using:
    <code>element1[attr1|attr2],element2...</code>. You can also use
    newlines instead of commas to separate elements.
</p>
<p>
    <strong>Warning</strong>:
    All of the constraints on the component directives are still enforced.
    The syntax is a <em>subset</em> of TinyMCE\'s <code>valid_elements</code>
    whitelist: directly copy-pasting it here will probably result in
    broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
    are set, this directive has no effect.
    This directive has been available since 2.0.0.
</p>
');
/**
 * Definition of the purified HTML that describes allowed children,
 * attributes, and many other things.
 * 
 * Conventions:
 * 
 * All member variables that are prefixed with info

<?php

// overload default configuration schema temporarily
$custom_schema = new HTMLPurifier_ConfigSchema();
$old = HTMLPurifier_ConfigSchema::instance();
$custom_schema =& HTMLPurifier_ConfigSchema::instance($custom_schema);
HTMLPurifier_ConfigSchema::defineNamespace('Element', 'Chemical substances that cannot be further decomposed');
HTMLPurifier_ConfigSchema::define('Element', 'Abbr', 'H', 'string', 'Abbreviation of element name.');
HTMLPurifier_ConfigSchema::define('Element', 'Name', 'hydrogen', 'istring', 'Full name of atoms.');
HTMLPurifier_ConfigSchema::define('Element', 'Number', 1, 'int', 'Atomic number, is identity.');
HTMLPurifier_ConfigSchema::define('Element', 'Mass', 1.00794, 'float', 'Atomic mass.');
HTMLPurifier_ConfigSchema::define('Element', 'Radioactive', false, 'bool', 'Does it have rapid decay?');
HTMLPurifier_ConfigSchema::define('Element', 'Isotopes', array('1' => true, '2' => true, '3' => true), 'lookup', 'What numbers of neutrons for this element have been observed?');
HTMLPurifier_ConfigSchema::define('Element', 'Traits', array('nonmetallic', 'odorless', 'flammable'), 'list', 'What are general properties of the element?');
HTMLPurifier_ConfigSchema::define('Element', 'IsotopeNames', array('1' => 'protium', '2' => 'deuterium', '3' => 'tritium'), 'hash', 'Lookup hash of neutron counts to formal names.');
HTMLPurifier_ConfigSchema::defineNamespace('Instrument', 'Of the musical type.');
HTMLPurifier_ConfigSchema::define('Instrument', 'Manufacturer', 'Yamaha', 'string', 'Who made it?');
HTMLPurifier_ConfigSchema::defineAllowedValues('Instrument', 'Manufacturer', array('Yamaha', 'Conn-Selmer', 'Vandoren', 'Laubin', 'Buffet', 'other'));
HTMLPurifier_ConfigSchema::defineValueAliases('Instrument', 'Manufacturer', array('Selmer' => 'Conn-Selmer'));
HTMLPurifier_ConfigSchema::define('Instrument', 'Family', 'woodwind', 'istring', 'What family is it?');
HTMLPurifier_ConfigSchema::defineAllowedValues('Instrument', 'Family', array('brass', 'woodwind', 'percussion', 'string', 'keyboard', 'electronic'));
HTMLPurifier_ConfigSchema::defineValueAliases('Instrument', 'Family', array('synth' => 'electronic'));
HTMLPurifier_ConfigSchema::defineNamespace('ReportCard', 'It is for grades.');
HTMLPurifier_ConfigSchema::define('ReportCard', 'English', null, 'string/null', 'Grade from English class.');
HTMLPurifier_ConfigSchema::define('ReportCard', 'Absences', 0, 'int', 'How many times missing from school?');
HTMLPurifier_ConfigSchema::defineNamespace('Text', 'This stuff is long, boring, and English.');
HTMLPurifier_ConfigSchema::define('Text', 'AboutUs', 'Nothing much, but this should be decently long so that a textarea would be better', 'text', 'Who are we? What are we up to?');
HTMLPurifier_ConfigSchema::define('Text', 'Hash', "not-case-sensitive\nstill-not-case-sensitive\nsuper-not-case-sensitive", 'itext', 'This is of limited utility, but of course it ends up being used.');

');
HTMLPurifier_ConfigSchema::define('Core', 'RemoveScriptContents', null, 'bool/null', '
<p>
  This directive enables HTML Purifier to remove not only script tags
  but all of their contents. This directive has been deprecated since 2.1.0,
  and when not set the value of %Core.HiddenElements will take
  precedence. This directive has been available since 2.0.0, and can be used to 
  revert to pre-2.0.0 behavior by setting it to false.
</p>
');
HTMLPurifier_ConfigSchema::define('Core', 'HiddenElements', array('script' => true, 'style' => true), 'lookup', '
<p>
  This directive is a lookup array of elements which should have their
  contents removed when they are not allowed by the HTML definition.
  For example, the contents of a <code>script</code> tag are not 
  normally shown in a document, so if script tags are to be removed,
  their contents should be removed to. This is opposed to a <code>b</code>
  tag, which defines some presentational changes but does not hide its
  contents.
</p>
');
/**
 * Removes all unrecognized tags from the list of tokens.
 * 
 * This strategy iterates through all the tokens and removes unrecognized
 * tokens. If a token is not recognized but a TagTransform is defined for
 * that element, the element will be transformed accordingly.
 */
class HTMLPurifier_Strategy_RemoveForeignElements extends HTMLPurifier_Strategy
{
    function execute($tokens, $config, &$context)

 /** @see HTMLPurifier_ConfigSchema->addAlias() */
 public static function defineAlias($namespace, $name, $new_namespace, $new_name)
 {
     HTMLPurifier_ConfigSchema::deprecated(__METHOD__);
     $def = HTMLPurifier_ConfigSchema::instance();
     $def->addAlias($namespace, $name, $new_namespace, $new_name);
 }

 /**
  * Returns a list of array(namespace, directive) for all directives
  * that are allowed in a web-form context as per an allowed
  * namespaces/directives list.
  * @param $allowed List of allowed namespaces/directives
  */
 public static function getAllowedDirectivesForForm($allowed, $schema = null)
 {
     if (!$schema) {
         $schema = HTMLPurifier_ConfigSchema::instance();
     }
     if ($allowed !== true) {
         if (is_string($allowed)) {
             $allowed = array($allowed);
         }
         $allowed_ns = array();
         $allowed_directives = array();
         $blacklisted_directives = array();
         foreach ($allowed as $ns_or_directive) {
             if (strpos($ns_or_directive, '.') !== false) {
                 // directive
                 if ($ns_or_directive[0] == '-') {
                     $blacklisted_directives[substr($ns_or_directive, 1)] = true;
                 } else {
                     $allowed_directives[$ns_or_directive] = true;
                 }
             } else {
                 // namespace
                 $allowed_ns[$ns_or_directive] = true;
             }
         }
     }
     $ret = array();
     foreach ($schema->info as $key => $def) {
         list($ns, $directive) = explode('.', $key, 2);
         if ($allowed !== true) {
             if (isset($blacklisted_directives["{$ns}.{$directive}"])) {
                 continue;
             }
             if (!isset($allowed_directives["{$ns}.{$directive}"]) && !isset($allowed_ns[$ns])) {
                 continue;
             }
         }
         if (isset($def->isAlias)) {
             continue;
         }
         if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') {
             continue;
         }
         $ret[] = array($ns, $directive);
     }
     return $ret;
 }

define('HTMLPURIFIER_PREFIX', dirname(__FILE__));
// almost every class has an undocumented dependency to these, so make sure
// they get included
require_once 'HTMLPurifier/ConfigSchema.php';
// important
require_once 'HTMLPurifier/Config.php';
require_once 'HTMLPurifier/Context.php';
require_once 'HTMLPurifier/Lexer.php';
require_once 'HTMLPurifier/Generator.php';
require_once 'HTMLPurifier/Strategy/Core.php';
require_once 'HTMLPurifier/Encoder.php';
require_once 'HTMLPurifier/ErrorCollector.php';
require_once 'HTMLPurifier/LanguageFactory.php';
HTMLPurifier_ConfigSchema::define('Core', 'CollectErrors', false, 'bool', '
Whether or not to collect errors found while filtering the document. This
is a useful way to give feedback to your users. CURRENTLY NOT IMPLEMENTED.
This directive has been available since 2.0.0.
');
/**
 * Main library execution class.
 * 
 * Facade that performs calls to the HTMLPurifier_Lexer,
 * HTMLPurifier_Strategy and HTMLPurifier_Generator subsystems in order to
 * purify HTML.
 * 
 * @todo We need an easier way to inject strategies, it'll probably end
 *       up getting done through config though.
 */
class HTMLPurifier
{
    var $version = '2.1.2';

    lack of support in doctype</dd>
    <dt>medium</dt>
    <dd>Enforce best practices</dd>
    <dt>heavy</dt>
    <dd>Transform all deprecated elements and attributes to standards
    compliant equivalents</dd>
</dl>
<p>This directive has been available since 2.0.0</p>
');
HTMLPurifier_ConfigSchema::defineAllowedValues('HTML', 'TidyLevel', array('none', 'light', 'medium', 'heavy'));
HTMLPurifier_ConfigSchema::define('HTML', 'TidyAdd', array(), 'lookup', '
Fixes to add to the default set of Tidy fixes as per your level. This
directive has been available since 2.0.0.
');
HTMLPurifier_ConfigSchema::define('HTML', 'TidyRemove', array(), 'lookup', '
Fixes to remove from the default set of Tidy fixes as per your level. This
directive has been available since 2.0.0.
');
/**
 * Abstract class for a set of proprietary modules that clean up (tidy)
 * poorly written HTML.
 */
class HTMLPurifier_HTMLModule_Tidy extends HTMLPurifier_HTMLModule
{
    /**
     * List of supported levels. Index zero is a special case "no fixes"
     * level.
     */
    var $levels = array(0 => 'none', 'light', 'medium', 'heavy');
    /**
     * Default level to place all fixes in. Disabled by default
     */

<?php

require_once 'HTMLPurifier/URIScheme/http.php';
require_once 'HTMLPurifier/URIScheme/https.php';
require_once 'HTMLPurifier/URIScheme/mailto.php';
require_once 'HTMLPurifier/URIScheme/ftp.php';
require_once 'HTMLPurifier/URIScheme/nntp.php';
require_once 'HTMLPurifier/URIScheme/news.php';
HTMLPurifier_ConfigSchema::define('URI', 'AllowedSchemes', array('http' => true, 'https' => true, 'mailto' => true, 'ftp' => true, 'nntp' => true, 'news' => true), 'lookup', 'Whitelist that defines the schemes that a URI is allowed to have.  This ' . 'prevents XSS attacks from using pseudo-schemes like javascript or mocha.');
HTMLPurifier_ConfigSchema::define('URI', 'OverrideAllowedSchemes', true, 'bool', 'If this is set to true (which it is by default), you can override ' . '%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme ' . 'to the registry.  If false, you will also have to update that directive ' . 'in order to add more schemes.');
/**
 * Registry for retrieving specific URI scheme validator objects.
 */
class HTMLPurifier_URISchemeRegistry
{
    /**
     * Retrieve sole instance of the registry.
     * @param $prototype Optional prototype to overload sole instance with,
     *                   or bool true to reset to default registry.
     * @note Pass a registry object $prototype with a compatible interface and
     *       the function will copy it and return it all further times.
     */
    public static function instance($prototype = null)
    {
        static $instance = null;
        if ($prototype !== null) {
            $instance = $prototype;
        } elseif ($instance === null || $prototype == true) {
            $instance = new HTMLPurifier_URISchemeRegistry();
        }
        return $instance;

<?php

require_once HTML_PURIFIER_LIB_PATH . '/HTMLPurifier/Doctype.php';
// Legacy directives for doctype specification
HTMLPurifier_ConfigSchema::define('HTML', 'Strict', false, 'bool', 'Determines whether or not to use Transitional (loose) or Strict rulesets. ' . 'This directive is deprecated in favor of %HTML.Doctype. ' . 'This directive has been available since 1.3.0.');
HTMLPurifier_ConfigSchema::define('HTML', 'XHTML', true, 'bool', 'Determines whether or not output is XHTML 1.0 or HTML 4.01 flavor. ' . 'This directive is deprecated in favor of %HTML.Doctype. ' . 'This directive was available since 1.1.');
HTMLPurifier_ConfigSchema::defineAlias('Core', 'XHTML', 'HTML', 'XHTML');
class HTMLPurifier_DoctypeRegistry
{
    /**
     * Hash of doctype names to doctype objects
     * @protected
     */
    var $doctypes;
    /**
     * Lookup table of aliases to real doctype names
     * @protected
     */
    var $aliases;
    /**
     * Registers a doctype to the registry
     * @note Accepts a fully-formed doctype object, or the
     *       parameters for constructing a doctype object
     * @param $doctype Name of doctype or literal doctype object
     * @param $modules Modules doctype will load
     * @param $modules_for_modes Modules doctype will load for certain modes
     * @param $aliases Alias names for doctype
     * @return Reference to registered doctype (usable for further editing)
     */
    function &register($doctype, $xml = true, $modules = array(), $tidy_modules = array(), $aliases = array(), $dtd_public = null, $dtd_system = null)
    {

<?php

require_once HTML_PURIFIER_LIB_PATH . '/HTMLPurifier/AttrDef.php';
HTMLPurifier_ConfigSchema::define('Attr', 'AllowedRel', array(), 'lookup', 'List of allowed forward document relationships in the rel attribute. ' . 'Common values may be nofollow or print. By default, this is empty, ' . 'meaning that no document relationships are allowed. This directive ' . 'was available since 1.6.0.');
HTMLPurifier_ConfigSchema::define('Attr', 'AllowedRev', array(), 'lookup', 'List of allowed reverse document relationships in the rev attribute. ' . 'This attribute is a bit of an edge-case; if you don\'t know what it ' . 'is for, stay away. This directive was available since 1.6.0.');
/**
 * Validates a rel/rev link attribute against a directive of allowed values
 * @note We cannot use Enum because link types allow multiple
 *       values.
 * @note Assumes link types are ASCII text
 */
class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
{
    /** Name config attribute to pull. */
    var $name;
    function HTMLPurifier_AttrDef_HTML_LinkTypes($name)
    {
        $configLookup = array('rel' => 'AllowedRel', 'rev' => 'AllowedRev');
        if (!isset($configLookup[$name])) {
            trigger_error('Unrecognized attribute name for link ' . 'relationship.', E_USER_ERROR);
            return;
        }
        $this->name = $configLookup[$name];
    }
    function validate($string, $config, &$context)
    {
        $allowed = $config->get('Attr', $this->name);
        if (empty($allowed)) {
            return false;
        }
        $string = $this->parseCDATA($string);

require_once 'HTMLPurifier/AttrDef/CSS/Border.php';
require_once 'HTMLPurifier/AttrDef/CSS/Color.php';
require_once 'HTMLPurifier/AttrDef/CSS/Composite.php';
require_once 'HTMLPurifier/AttrDef/CSS/Font.php';
require_once 'HTMLPurifier/AttrDef/CSS/FontFamily.php';
require_once 'HTMLPurifier/AttrDef/CSS/Length.php';
require_once 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
require_once 'HTMLPurifier/AttrDef/CSS/Multiple.php';
require_once 'HTMLPurifier/AttrDef/CSS/Percentage.php';
require_once 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
require_once 'HTMLPurifier/AttrDef/CSS/URI.php';
require_once 'HTMLPurifier/AttrDef/Enum.php';
HTMLPurifier_ConfigSchema::define('CSS', 'DefinitionRev', 1, 'int', '
<p>
    Revision identifier for your custom definition. See
    %HTML.DefinitionRev for details. This directive has been available
    since 2.0.0.
</p>
');
/**
 * Defines allowed CSS attributes and what their values are.
 * @see HTMLPurifier_HTMLDefinition
 */
class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
{
    var $type = 'CSS';
    /**
     * Assoc array of attribute name to definition object.
     */
    var $info = array();
    /**