Verzeichnisstruktur phpBB-3.3.15
- Veröffentlicht
- 28.08.2024
So funktioniert es
|
|
Auf das letzte Element klicken. Dies geht jeweils ein Schritt zurück |
Auf das Icon klicken, dies öffnet das Verzeichnis. Nochmal klicken schließt das Verzeichnis. |
|
|
(Beispiel Datei-Icons)
|
Auf das Icon klicken um den Quellcode anzuzeigen |
DisallowUnsafeDynamicURL.php
001 <?php
002
003 /**
004 * @package s9e\TextFormatter
005 * @copyright Copyright (c) 2010-2022 The s9e authors
006 * @license http://www.opensource.org/licenses/mit-license.php The MIT License
007 */
008 namespace s9e\TextFormatter\Configurator\TemplateChecks;
009
010 use DOMAttr;
011 use DOMElement;
012 use DOMText;
013 use DOMXPath;
014 use s9e\TextFormatter\Configurator\Helpers\NodeLocator;
015 use s9e\TextFormatter\Configurator\Items\Attribute;
016 use s9e\TextFormatter\Configurator\Items\Tag;
017
018 /**
019 * This primary use of this check is to ensure that dynamic content cannot be used to create
020 * javascript: links
021 */
022 class DisallowUnsafeDynamicURL extends AbstractDynamicContentCheck
023 {
024 /**
025 * @var string Regexp used to exclude nodes that start with a hardcoded scheme part, a hardcoded
026 * local part, or a fragment
027 */
028 protected $safeUrlRegexp = '(^(?:(?!data|\\w*script)\\w+:|[^:]*[#/?]))i';
029
030 /**
031 * {@inheritdoc}
032 */
033 protected function getNodes(DOMElement $template)
034 {
035 return NodeLocator::getURLNodes($template->ownerDocument);
036 }
037
038 /**
039 * {@inheritdoc}
040 */
041 protected function isSafe(Attribute $attribute)
042 {
043 return $attribute->isSafeAsURL();
044 }
045
046 /**
047 * {@inheritdoc}
048 */
049 protected function checkAttributeNode(DOMAttr $attribute, Tag $tag)
050 {
051 if (!$this->isSafeUrl($attribute->value))
052 {
053 parent::checkAttributeNode($attribute, $tag);
054 }
055 }
056
057 /**
058 * {@inheritdoc}
059 */
060 protected function checkElementNode(DOMElement $element, Tag $tag)
061 {
062 if (!$this->elementHasSafeUrl($element))
063 {
064 parent::checkElementNode($element, $tag);
065 }
066 }
067
068 /**
069 * Test whether every branch of a given xsl:choose element contains a known-safe URL
070 *
071 * @param DOMElement $choose
072 * @return bool
073 */
074 protected function chooseHasSafeUrl(DOMElement $choose)
075 {
076 $xpath = new DOMXPath($choose->ownerDocument);
077 $hasOtherwise = false;
078 foreach ($xpath->query('xsl:when | xsl:otherwise', $choose) as $branch)
079 {
080 if (!$this->elementHasSafeUrl($branch))
081 {
082 return false;
083 }
084 if ($branch->nodeName === 'xsl:otherwise')
085 {
086 $hasOtherwise = true;
087 }
088 }
089
090 return $hasOtherwise;
091 }
092
093 /**
094 * Test whether given element contains a known-safe URL
095 *
096 * @param DOMElement $element
097 * @return bool
098 */
099 protected function elementHasSafeUrl(DOMElement $element)
100 {
101 if ($element->firstChild instanceof DOMElement && $element->firstChild->nodeName === 'xsl:choose')
102 {
103 return $this->chooseHasSafeUrl($element->firstChild);
104 }
105
106 return $element->firstChild instanceof DOMText && $this->isSafeUrl($element->firstChild->textContent);
107 }
108
109 /**
110 * Test whether given URL is known to be safe
111 *
112 * @param string $url
113 * @return bool
114 */
115 protected function isSafeUrl($url)
116 {
117 return (bool) preg_match($this->safeUrlRegexp, $url);
118 }
119 }