1 | <?php |
---|
2 | /** |
---|
3 | * htmlfilter.inc |
---|
4 | * --------------- |
---|
5 | * This set of functions allows you to filter html in order to remove |
---|
6 | * any malicious tags from it. Useful in cases when you need to filter |
---|
7 | * user input for any cross-site-scripting attempts. |
---|
8 | * |
---|
9 | * Copyright (C) 2002-2004 by Duke University |
---|
10 | * |
---|
11 | * This library is free software; you can redistribute it and/or |
---|
12 | * modify it under the terms of the GNU Lesser General Public |
---|
13 | * License as published by the Free Software Foundation; either |
---|
14 | * version 2.1 of the License, or (at your option) any later version. |
---|
15 | * |
---|
16 | * This library is distributed in the hope that it will be useful, |
---|
17 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
18 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
---|
19 | * Lesser General Public License for more details. |
---|
20 | * |
---|
21 | * You should have received a copy of the GNU Lesser General Public |
---|
22 | * License along with this library; if not, write to the Free Software |
---|
23 | * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA |
---|
24 | * 02110-1301 USA |
---|
25 | * |
---|
26 | * @Author Konstantin Riabitsev <icon@linux.duke.edu> |
---|
27 | */ |
---|
28 | |
---|
29 | /** |
---|
30 | * This is a debugging function used throughout the code. To enable |
---|
31 | * debugging you have to specify a global variable called "debug" before |
---|
32 | * calling sanitize() and set it to true. |
---|
33 | * |
---|
34 | * Note: Although insignificantly, debugging does slow you down even |
---|
35 | * when $debug is set to false. If you wish to get rid of all |
---|
36 | * debugging calls, run the following command: |
---|
37 | * |
---|
38 | * fgrep -v 'spew("' htmlfilter.inc > htmlfilter.inc.new |
---|
39 | * |
---|
40 | * htmlfilter.inc.new will contain no debugging calls. |
---|
41 | * |
---|
42 | * @param $message A string with the message to output. |
---|
43 | * @return void. |
---|
44 | */ |
---|
45 | function spew($message){ |
---|
46 | global $debug; |
---|
47 | if ($debug == true){ |
---|
48 | echo "$message"; |
---|
49 | } |
---|
50 | } |
---|
51 | |
---|
52 | /** |
---|
53 | * This function returns the final tag out of the tag name, an array |
---|
54 | * of attributes, and the type of the tag. This function is called by |
---|
55 | * sanitize internally. |
---|
56 | * |
---|
57 | * @param $tagname the name of the tag. |
---|
58 | * @param $attary the array of attributes and their values |
---|
59 | * @param $tagtype The type of the tag (see in comments). |
---|
60 | * @return a string with the final tag representation. |
---|
61 | */ |
---|
62 | function tagprint($tagname, $attary, $tagtype){ |
---|
63 | $me = 'tagprint'; |
---|
64 | if ($tagtype == 2){ |
---|
65 | $fulltag = '</' . $tagname . '>'; |
---|
66 | } else { |
---|
67 | $fulltag = '<' . $tagname; |
---|
68 | if (is_array($attary) && sizeof($attary)){ |
---|
69 | $atts = Array(); |
---|
70 | while (list($attname, $attvalue) = each($attary)){ |
---|
71 | array_push($atts, "$attname=$attvalue"); |
---|
72 | } |
---|
73 | $fulltag .= ' ' . join(' ', $atts); |
---|
74 | } |
---|
75 | if ($tagtype == 3){ |
---|
76 | $fulltag .= ' /'; |
---|
77 | } |
---|
78 | $fulltag .= '>'; |
---|
79 | } |
---|
80 | spew("$me: $fulltag\n"); |
---|
81 | return $fulltag; |
---|
82 | } |
---|
83 | |
---|
84 | /** |
---|
85 | * A small helper function to use with array_walk. Modifies a by-ref |
---|
86 | * value and makes it lowercase. |
---|
87 | * |
---|
88 | * @param $val a value passed by-ref. |
---|
89 | * @return void since it modifies a by-ref value. |
---|
90 | */ |
---|
91 | function casenormalize(&$val){ |
---|
92 | $val = strtolower($val); |
---|
93 | } |
---|
94 | |
---|
95 | /** |
---|
96 | * This function skips any whitespace from the current position within |
---|
97 | * a string and to the next non-whitespace value. |
---|
98 | * |
---|
99 | * @param $body the string |
---|
100 | * @param $offset the offset within the string where we should start |
---|
101 | * looking for the next non-whitespace character. |
---|
102 | * @return the location within the $body where the next |
---|
103 | * non-whitespace char is located. |
---|
104 | */ |
---|
105 | function skipspace($body, $offset){ |
---|
106 | $me = 'skipspace'; |
---|
107 | preg_match('/^(\s*)/s', substr($body, $offset), $matches); |
---|
108 | if (sizeof($matches{1})){ |
---|
109 | $count = strlen($matches{1}); |
---|
110 | spew("$me: skipped $count chars\n"); |
---|
111 | $offset += $count; |
---|
112 | } |
---|
113 | return $offset; |
---|
114 | } |
---|
115 | |
---|
116 | /** |
---|
117 | * This function looks for the next character within a string. It's |
---|
118 | * really just a glorified "strpos", except it catches the failures |
---|
119 | * nicely. |
---|
120 | * |
---|
121 | * @param $body The string to look for needle in. |
---|
122 | * @param $offset Start looking from this position. |
---|
123 | * @param $needle The character/string to look for. |
---|
124 | * @return location of the next occurance of the needle, or |
---|
125 | * strlen($body) if needle wasn't found. |
---|
126 | */ |
---|
127 | function findnxstr($body, $offset, $needle){ |
---|
128 | $me = 'findnxstr'; |
---|
129 | $pos = strpos($body, $needle, $offset); |
---|
130 | if ($pos === FALSE){ |
---|
131 | $pos = strlen($body); |
---|
132 | spew("$me: end of body reached\n"); |
---|
133 | } |
---|
134 | spew("$me: '$needle' found at pos $pos\n"); |
---|
135 | return $pos; |
---|
136 | } |
---|
137 | |
---|
138 | /** |
---|
139 | * This function takes a PCRE-style regexp and tries to match it |
---|
140 | * within the string. |
---|
141 | * |
---|
142 | * @param $body The string to look for needle in. |
---|
143 | * @param $offset Start looking from here. |
---|
144 | * @param $reg A PCRE-style regex to match. |
---|
145 | * @return Returns a false if no matches found, or an array |
---|
146 | * with the following members: |
---|
147 | * - integer with the location of the match within $body |
---|
148 | * - string with whatever content between offset and the match |
---|
149 | * - string with whatever it is we matched |
---|
150 | */ |
---|
151 | function findnxreg($body, $offset, $reg){ |
---|
152 | $me = 'findnxreg'; |
---|
153 | $matches = Array(); |
---|
154 | $retarr = Array(); |
---|
155 | $preg_rule = '%^(.*?)(' . $reg . ')%s'; |
---|
156 | preg_match($preg_rule, substr($body, $offset), $matches); |
---|
157 | if (!isset($matches{0})){ |
---|
158 | spew("$me: No matches found.\n"); |
---|
159 | $retarr = false; |
---|
160 | } else { |
---|
161 | $retarr{0} = $offset + strlen($matches{1}); |
---|
162 | $retarr{1} = $matches{1}; |
---|
163 | $retarr{2} = $matches{2}; |
---|
164 | spew("$me: '$reg' found at pos $offset matching '".$matches{2}."'\n"); |
---|
165 | } |
---|
166 | return $retarr; |
---|
167 | } |
---|
168 | |
---|
169 | /** |
---|
170 | * This function looks for the next tag. |
---|
171 | * |
---|
172 | * @param $body String where to look for the next tag. |
---|
173 | * @param $offset Start looking from here. |
---|
174 | * @return false if no more tags exist in the body, or |
---|
175 | * an array with the following members: |
---|
176 | * - string with the name of the tag |
---|
177 | * - array with attributes and their values |
---|
178 | * - integer with tag type (1, 2, or 3) |
---|
179 | * - integer where the tag starts (starting "<") |
---|
180 | * - integer where the tag ends (ending ">") |
---|
181 | * first three members will be false, if the tag is invalid. |
---|
182 | */ |
---|
183 | function getnxtag($body, $offset){ |
---|
184 | $me = 'getnxtag'; |
---|
185 | if ($offset > strlen($body)){ |
---|
186 | spew("$me: Past the end of body\n"); |
---|
187 | return false; |
---|
188 | } |
---|
189 | $lt = findnxstr($body, $offset, '<'); |
---|
190 | if ($lt == strlen($body)){ |
---|
191 | spew("$me: No more tags found!\n"); |
---|
192 | return false; |
---|
193 | } |
---|
194 | /** |
---|
195 | * We are here: |
---|
196 | * blah blah <tag attribute="value"> |
---|
197 | * \---------^ |
---|
198 | */ |
---|
199 | spew("$me: Found '<' at pos $lt\n"); |
---|
200 | $pos = skipspace($body, $lt + 1); |
---|
201 | if ($pos >= strlen($body)){ |
---|
202 | spew("$me: End of body reached.\n"); |
---|
203 | return Array(false, false, false, $lt, strlen($body)); |
---|
204 | } |
---|
205 | /** |
---|
206 | * There are 3 kinds of tags: |
---|
207 | * 1. Opening tag, e.g.: |
---|
208 | * <a href="blah"> |
---|
209 | * 2. Closing tag, e.g.: |
---|
210 | * </a> |
---|
211 | * 3. XHTML-style content-less tag, e.g.: |
---|
212 | * <img src="blah"/> |
---|
213 | */ |
---|
214 | $tagtype = false; |
---|
215 | switch (substr($body, $pos, 1)){ |
---|
216 | case '/': |
---|
217 | spew("$me: This is a closing tag (type 2)\n"); |
---|
218 | $tagtype = 2; |
---|
219 | $pos++; |
---|
220 | break; |
---|
221 | case '!': |
---|
222 | /** |
---|
223 | * A comment or an SGML declaration. |
---|
224 | */ |
---|
225 | if (substr($body, $pos+1, 2) == '--'){ |
---|
226 | spew("$me: A comment found. Stripping.\n"); |
---|
227 | $gt = strpos($body, '-->', $pos); |
---|
228 | if ($gt === false){ |
---|
229 | $gt = strlen($body); |
---|
230 | } else { |
---|
231 | $gt += 2; |
---|
232 | } |
---|
233 | return Array(false, false, false, $lt, $gt); |
---|
234 | } else { |
---|
235 | spew("$me: An SGML declaration found. Stripping.\n"); |
---|
236 | $gt = findnxstr($body, $pos, '>'); |
---|
237 | return Array(false, false, false, $lt, $gt); |
---|
238 | } |
---|
239 | break; |
---|
240 | default: |
---|
241 | /** |
---|
242 | * Assume tagtype 1 for now. If it's type 3, we'll switch values |
---|
243 | * later. |
---|
244 | */ |
---|
245 | $tagtype = 1; |
---|
246 | break; |
---|
247 | } |
---|
248 | |
---|
249 | $tag_start = $pos; |
---|
250 | $tagname = ''; |
---|
251 | /** |
---|
252 | * Look for next [\W-_], which will indicate the end of the tag name. |
---|
253 | */ |
---|
254 | $regary = findnxreg($body, $pos, '[^\w\-_]'); |
---|
255 | if ($regary == false){ |
---|
256 | spew("$me: End of body reached while analyzing tag name\n"); |
---|
257 | return Array(false, false, false, $lt, strlen($body)); |
---|
258 | } |
---|
259 | list($pos, $tagname, $match) = $regary; |
---|
260 | $tagname = strtolower($tagname); |
---|
261 | |
---|
262 | /** |
---|
263 | * $match can be either of these: |
---|
264 | * '>' indicating the end of the tag entirely. |
---|
265 | * '\s' indicating the end of the tag name. |
---|
266 | * '/' indicating that this is type-3 xhtml tag. |
---|
267 | * |
---|
268 | * Whatever else we find there indicates an invalid tag. |
---|
269 | */ |
---|
270 | switch ($match){ |
---|
271 | case '/': |
---|
272 | /** |
---|
273 | * This is an xhtml-style tag with a closing / at the |
---|
274 | * end, like so: <img src="blah"/>. Check if it's followed |
---|
275 | * by the closing bracket. If not, then this tag is invalid |
---|
276 | */ |
---|
277 | if (substr($body, $pos, 2) == '/>'){ |
---|
278 | spew("$me: XHTML-style tag found.\n"); |
---|
279 | $pos++; |
---|
280 | spew("$me: Setting tagtype to 3\n"); |
---|
281 | $tagtype = 3; |
---|
282 | } else { |
---|
283 | spew("$me: Found invalid character '/'.\n"); |
---|
284 | $gt = findnxstr($body, $pos, '>'); |
---|
285 | spew("$me: Tag is invalid. Returning.\n"); |
---|
286 | $retary = Array(false, false, false, $lt, $gt); |
---|
287 | return $retary; |
---|
288 | } |
---|
289 | case '>': |
---|
290 | spew("$me: End of tag found at $pos\n"); |
---|
291 | spew("$me: Tagname is '$tagname'\n"); |
---|
292 | spew("$me: This tag has no attributes\n"); |
---|
293 | return Array($tagname, false, $tagtype, $lt, $pos); |
---|
294 | break; |
---|
295 | default: |
---|
296 | /** |
---|
297 | * Check if it's whitespace |
---|
298 | */ |
---|
299 | if (preg_match('/\s/', $match)){ |
---|
300 | spew("$me: Tagname is '$tagname'\n"); |
---|
301 | } else { |
---|
302 | /** |
---|
303 | * This is an invalid tag! Look for the next closing ">". |
---|
304 | */ |
---|
305 | spew("$me: Invalid characters found in tag name: $match\n"); |
---|
306 | $gt = findnxstr($body, $lt, '>'); |
---|
307 | return Array(false, false, false, $lt, $gt); |
---|
308 | } |
---|
309 | } |
---|
310 | |
---|
311 | /** |
---|
312 | * At this point we're here: |
---|
313 | * <tagname attribute='blah'> |
---|
314 | * \-------^ |
---|
315 | * |
---|
316 | * At this point we loop in order to find all attributes. |
---|
317 | */ |
---|
318 | $attname = ''; |
---|
319 | $atttype = false; |
---|
320 | $attary = Array(); |
---|
321 | |
---|
322 | while ($pos <= strlen($body)){ |
---|
323 | $pos = skipspace($body, $pos); |
---|
324 | if ($pos == strlen($body)){ |
---|
325 | /** |
---|
326 | * Non-closed tag. |
---|
327 | */ |
---|
328 | spew("$me: End of body reached before end of tag. Discarding.\n"); |
---|
329 | return Array(false, false, false, $lt, $pos); |
---|
330 | } |
---|
331 | /** |
---|
332 | * See if we arrived at a ">" or "/>", which means that we reached |
---|
333 | * the end of the tag. |
---|
334 | */ |
---|
335 | $matches = Array(); |
---|
336 | preg_match('%^(\s*)(>|/>)%s', substr($body, $pos), $matches); |
---|
337 | if (isset($matches{0}) && $matches{0}){ |
---|
338 | /** |
---|
339 | * Yep. So we did. |
---|
340 | */ |
---|
341 | spew("$me: Arrived at the end of the tag.\n"); |
---|
342 | $pos += strlen($matches{1}); |
---|
343 | if ($matches{2} == '/>'){ |
---|
344 | $tagtype = 3; |
---|
345 | $pos++; |
---|
346 | } |
---|
347 | return Array($tagname, $attary, $tagtype, $lt, $pos); |
---|
348 | } |
---|
349 | |
---|
350 | /** |
---|
351 | * There are several types of attributes, with optional |
---|
352 | * [:space:] between members. |
---|
353 | * Type 1: |
---|
354 | * attrname[:space:]=[:space:]'CDATA' |
---|
355 | * Type 2: |
---|
356 | * attrname[:space:]=[:space:]"CDATA" |
---|
357 | * Type 3: |
---|
358 | * attr[:space:]=[:space:]CDATA |
---|
359 | * Type 4: |
---|
360 | * attrname |
---|
361 | * |
---|
362 | * We leave types 1 and 2 the same, type 3 we check for |
---|
363 | * '"' and convert to """ if needed, then wrap in |
---|
364 | * double quotes. Type 4 we convert into: |
---|
365 | * attrname="yes". |
---|
366 | */ |
---|
367 | $regary = findnxreg($body, $pos, '[^\w\-_]'); |
---|
368 | if ($regary == false){ |
---|
369 | /** |
---|
370 | * Looks like body ended before the end of tag. |
---|
371 | */ |
---|
372 | spew("$me: End of body found before end of tag.\n"); |
---|
373 | spew("$me: Invalid, returning\n"); |
---|
374 | return Array(false, false, false, $lt, strlen($body)); |
---|
375 | } |
---|
376 | list($pos, $attname, $match) = $regary; |
---|
377 | $attname = strtolower($attname); |
---|
378 | spew("$me: Attribute '$attname' found\n"); |
---|
379 | /** |
---|
380 | * We arrived at the end of attribute name. Several things possible |
---|
381 | * here: |
---|
382 | * '>' means the end of the tag and this is attribute type 4 |
---|
383 | * '/' if followed by '>' means the same thing as above |
---|
384 | * '\s' means a lot of things -- look what it's followed by. |
---|
385 | * anything else means the attribute is invalid. |
---|
386 | */ |
---|
387 | switch($match){ |
---|
388 | case '/': |
---|
389 | /** |
---|
390 | * This is an xhtml-style tag with a closing / at the |
---|
391 | * end, like so: <img src="blah"/>. Check if it's followed |
---|
392 | * by the closing bracket. If not, then this tag is invalid |
---|
393 | */ |
---|
394 | if (substr($body, $pos, 2) == '/>'){ |
---|
395 | spew("$me: This is an xhtml-style tag.\n"); |
---|
396 | $pos++; |
---|
397 | spew("$me: Setting tagtype to 3\n"); |
---|
398 | $tagtype = 3; |
---|
399 | } else { |
---|
400 | spew("$me: Found invalid character '/'.\n"); |
---|
401 | $gt = findnxstr($body, $pos, '>'); |
---|
402 | spew("$me: Tag is invalid. Returning.\n"); |
---|
403 | $retary = Array(false, false, false, $lt, $gt); |
---|
404 | return $retary; |
---|
405 | } |
---|
406 | case '>': |
---|
407 | spew("$me: found type 4 attribute.\n"); |
---|
408 | spew("$me: Additionally, end of tag found at $pos\n"); |
---|
409 | spew("$me: Attname is '$attname'\n"); |
---|
410 | spew("$me: Setting attvalue to 'yes'\n"); |
---|
411 | $attary{$attname} = '"yes"'; |
---|
412 | return Array($tagname, $attary, $tagtype, $lt, $pos); |
---|
413 | break; |
---|
414 | default: |
---|
415 | /** |
---|
416 | * Skip whitespace and see what we arrive at. |
---|
417 | */ |
---|
418 | $pos = skipspace($body, $pos); |
---|
419 | $char = substr($body, $pos, 1); |
---|
420 | /** |
---|
421 | * Two things are valid here: |
---|
422 | * '=' means this is attribute type 1 2 or 3. |
---|
423 | * \w means this was attribute type 4. |
---|
424 | * anything else we ignore and re-loop. End of tag and |
---|
425 | * invalid stuff will be caught by our checks at the beginning |
---|
426 | * of the loop. |
---|
427 | */ |
---|
428 | if ($char == '='){ |
---|
429 | spew("$me: Attribute type 1, 2, or 3 found.\n"); |
---|
430 | $pos++; |
---|
431 | $pos = skipspace($body, $pos); |
---|
432 | /** |
---|
433 | * Here are 3 possibilities: |
---|
434 | * "'" attribute type 1 |
---|
435 | * '"' attribute type 2 |
---|
436 | * everything else is the content of tag type 3 |
---|
437 | */ |
---|
438 | $quot = substr($body, $pos, 1); |
---|
439 | if ($quot == '\''){ |
---|
440 | spew("$me: In fact, this is attribute type 1\n"); |
---|
441 | spew("$me: looking for closing quote\n"); |
---|
442 | $regary = findnxreg($body, $pos+1, '\''); |
---|
443 | if ($regary == false){ |
---|
444 | spew("$me: end of body reached before end of val\n"); |
---|
445 | spew("$me: Returning\n"); |
---|
446 | return Array(false, false, false, $lt, strlen($body)); |
---|
447 | } |
---|
448 | list($pos, $attval, $match) = $regary; |
---|
449 | spew("$me: Attvalue is '$attval'\n"); |
---|
450 | $pos++; |
---|
451 | $attary{$attname} = '\'' . $attval . '\''; |
---|
452 | } else if ($quot == '"'){ |
---|
453 | spew("$me: In fact, this is attribute type 2\n"); |
---|
454 | spew("$me: looking for closing quote\n"); |
---|
455 | $regary = findnxreg($body, $pos+1, '\"'); |
---|
456 | if ($regary == false){ |
---|
457 | spew("$me: end of body reached before end of val\n"); |
---|
458 | spew("$me: Returning\n"); |
---|
459 | return Array(false, false, false, $lt, strlen($body)); |
---|
460 | } |
---|
461 | list($pos, $attval, $match) = $regary; |
---|
462 | spew("$me: Attvalue is \"$attval\"\n"); |
---|
463 | $pos++; |
---|
464 | $attary{$attname} = '"' . $attval . '"'; |
---|
465 | } else { |
---|
466 | spew("$me: This looks like attribute type 3\n"); |
---|
467 | /** |
---|
468 | * These are hateful. Look for \s, or >. |
---|
469 | */ |
---|
470 | spew("$me: Looking for end of attval\n"); |
---|
471 | $regary = findnxreg($body, $pos, '[\s>]'); |
---|
472 | if ($regary == false){ |
---|
473 | spew("$me: end of body reached before end of val\n"); |
---|
474 | spew("$me: Returning\n"); |
---|
475 | return Array(false, false, false, $lt, strlen($body)); |
---|
476 | } |
---|
477 | list($pos, $attval, $match) = $regary; |
---|
478 | /** |
---|
479 | * If it's ">" it will be caught at the top. |
---|
480 | */ |
---|
481 | spew("$me: translating '\"' into "\n"); |
---|
482 | $attval = preg_replace('/\"/s', '"', $attval); |
---|
483 | spew("$me: wrapping in quotes\n"); |
---|
484 | $attary{$attname} = '"' . $attval . '"'; |
---|
485 | } |
---|
486 | } else if (preg_match('|[\w/>]|', $char)) { |
---|
487 | /** |
---|
488 | * That was attribute type 4. |
---|
489 | */ |
---|
490 | spew("$me: attribute type 4 found.\n"); |
---|
491 | spew("$me: Setting value to 'yes'\n"); |
---|
492 | $attary{$attname} = '"yes"'; |
---|
493 | } else { |
---|
494 | /** |
---|
495 | * An illegal character. Find next '>' and return. |
---|
496 | */ |
---|
497 | spew("$me: illegal character '$char' found.\n"); |
---|
498 | spew("$me: returning\n"); |
---|
499 | $gt = findnxstr($body, $pos, '>'); |
---|
500 | return Array(false, false, false, $lt, $gt); |
---|
501 | } |
---|
502 | } |
---|
503 | } |
---|
504 | /** |
---|
505 | * The fact that we got here indicates that the tag end was never |
---|
506 | * found. Return invalid tag indication so it gets stripped. |
---|
507 | */ |
---|
508 | spew("$me: No tag end found\n"); |
---|
509 | return Array(false, false, false, $lt, strlen($body)); |
---|
510 | } |
---|
511 | |
---|
512 | /** |
---|
513 | * Translates entities into literal values so they can be checked. |
---|
514 | * |
---|
515 | * @param $attvalue the by-ref value to check. |
---|
516 | * @param $regex the regular expression to check against. |
---|
517 | * @param $hex whether the entites are hexadecimal. |
---|
518 | * @return True or False depending on whether there were matches. |
---|
519 | */ |
---|
520 | function deent(&$attvalue, $regex, $hex=false){ |
---|
521 | $me = 'deent'; |
---|
522 | spew("$me: matching '$regex' against: $attvalue\n"); |
---|
523 | $ret_match = false; |
---|
524 | preg_match_all($regex, $attvalue, $matches); |
---|
525 | if (is_array($matches) && sizeof($matches[0]) > 0){ |
---|
526 | spew("$me: found " . sizeof($matches[0]) . " matches\n"); |
---|
527 | $repl = Array(); |
---|
528 | for ($i = 0; $i < sizeof($matches[0]); $i++){ |
---|
529 | $numval = $matches[1][$i]; |
---|
530 | spew("$me: numval is $numval\n"); |
---|
531 | if ($hex){ |
---|
532 | $numval = hexdec($numval); |
---|
533 | spew("$me: hex! Numval is now $numval\n"); |
---|
534 | } |
---|
535 | $repl{$matches[0][$i]} = chr($numval); |
---|
536 | } |
---|
537 | $attvalue = strtr($attvalue, $repl); |
---|
538 | spew("$me: attvalue after translation: $attvalue\n"); |
---|
539 | return true; |
---|
540 | } else { |
---|
541 | spew("$me: no matches! Returning false.\n"); |
---|
542 | return false; |
---|
543 | } |
---|
544 | } |
---|
545 | |
---|
546 | /** |
---|
547 | * This function checks attribute values for entity-encoded values |
---|
548 | * and returns them translated into 8-bit strings so we can run |
---|
549 | * checks on them. |
---|
550 | * |
---|
551 | * @param $attvalue A string to run entity check against. |
---|
552 | * @return Nothing, modifies a reference value. |
---|
553 | */ |
---|
554 | function defang(&$attvalue){ |
---|
555 | $me = 'defang'; |
---|
556 | /** |
---|
557 | * Skip this if there aren't ampersands or backslashes. |
---|
558 | */ |
---|
559 | spew("$me: Checking '$attvalue' for suspicious content\n"); |
---|
560 | if (strpos($attvalue, '&') === false |
---|
561 | && strpos($attvalue, '\\') === false){ |
---|
562 | spew("$me: no suspicious content found, returning.\n"); |
---|
563 | return; |
---|
564 | } |
---|
565 | $m = false; |
---|
566 | do { |
---|
567 | $m = false; |
---|
568 | $m = $m || deent($attvalue, '/\�*(\d+);*/s'); |
---|
569 | $m = $m || deent($attvalue, '/\�*((\d|[a-f])+);*/si', true); |
---|
570 | $m = $m || deent($attvalue, '/\\\\(\d+)/s', true); |
---|
571 | spew("$me: m=$m\n"); |
---|
572 | } while ($m == true); |
---|
573 | $attvalue = stripslashes($attvalue); |
---|
574 | spew("$me: translated into: $attvalue\n"); |
---|
575 | } |
---|
576 | |
---|
577 | /** |
---|
578 | * Kill any tabs, newlines, or carriage returns. Our friends the |
---|
579 | * makers of the browser with 95% market value decided that it'd |
---|
580 | * be funny to make "java[tab]script" be just as good as "javascript". |
---|
581 | * |
---|
582 | * @param attvalue The attribute value before extraneous spaces removed. |
---|
583 | * @return attvalue Nothing, modifies a reference value. |
---|
584 | */ |
---|
585 | function unspace(&$attvalue){ |
---|
586 | $me = 'unspace'; |
---|
587 | if (strcspn($attvalue, "\t\r\n\0 ") != strlen($attvalue)){ |
---|
588 | spew("$me: Killing whitespace.\n"); |
---|
589 | $attvalue = str_replace(Array("\t", "\r", "\n", "\0", " "), |
---|
590 | Array('', '', '', '', ''), $attvalue); |
---|
591 | } |
---|
592 | spew("$me: after unspace: $attvalue\n"); |
---|
593 | } |
---|
594 | |
---|
595 | /** |
---|
596 | * This function runs various checks against the attributes. |
---|
597 | * |
---|
598 | * @param $tagname String with the name of the tag. |
---|
599 | * @param $attary Array with all tag attributes. |
---|
600 | * @param $rm_attnames See description for sanitize |
---|
601 | * @param $bad_attvals See description for sanitize |
---|
602 | * @param $add_attr_to_tag See description for sanitize |
---|
603 | * @return Array with modified attributes. |
---|
604 | */ |
---|
605 | function fixatts($tagname, |
---|
606 | $attary, |
---|
607 | $rm_attnames, |
---|
608 | $bad_attvals, |
---|
609 | $add_attr_to_tag |
---|
610 | ){ |
---|
611 | $me = 'fixatts'; |
---|
612 | spew("$me: Fixing attributes\n"); |
---|
613 | while (list($attname, $attvalue) = each($attary)){ |
---|
614 | /** |
---|
615 | * See if this attribute should be removed. |
---|
616 | */ |
---|
617 | foreach ($rm_attnames as $matchtag=>$matchattrs){ |
---|
618 | if (preg_match($matchtag, $tagname)){ |
---|
619 | foreach ($matchattrs as $matchattr){ |
---|
620 | if (preg_match($matchattr, $attname)){ |
---|
621 | spew("$me: Attribute '$attname' defined as bad.\n"); |
---|
622 | spew("$me: Removing.\n"); |
---|
623 | unset($attary{$attname}); |
---|
624 | continue; |
---|
625 | } |
---|
626 | } |
---|
627 | } |
---|
628 | } |
---|
629 | /** |
---|
630 | * Remove any backslashes, entities, or extraneous whitespace. |
---|
631 | */ |
---|
632 | defang($attvalue); |
---|
633 | unspace($attvalue); |
---|
634 | |
---|
635 | /** |
---|
636 | * Now let's run checks on the attvalues. |
---|
637 | * I don't expect anyone to comprehend this. If you do, |
---|
638 | * get in touch with me so I can drive to where you live and |
---|
639 | * shake your hand personally. :) |
---|
640 | */ |
---|
641 | foreach ($bad_attvals as $matchtag=>$matchattrs){ |
---|
642 | if (preg_match($matchtag, $tagname)){ |
---|
643 | foreach ($matchattrs as $matchattr=>$valary){ |
---|
644 | if (preg_match($matchattr, $attname)){ |
---|
645 | /** |
---|
646 | * There are two arrays in valary. |
---|
647 | * First is matches. |
---|
648 | * Second one is replacements |
---|
649 | */ |
---|
650 | list($valmatch, $valrepl) = $valary; |
---|
651 | $newvalue = preg_replace($valmatch,$valrepl,$attvalue); |
---|
652 | if ($newvalue != $attvalue){ |
---|
653 | spew("$me: attvalue is now $newvalue\n"); |
---|
654 | $attary{$attname} = $newvalue; |
---|
655 | } |
---|
656 | } |
---|
657 | } |
---|
658 | } |
---|
659 | } |
---|
660 | } |
---|
661 | /** |
---|
662 | * See if we need to append any attributes to this tag. |
---|
663 | */ |
---|
664 | foreach ($add_attr_to_tag as $matchtag=>$addattary){ |
---|
665 | if (preg_match($matchtag, $tagname)){ |
---|
666 | $attary = array_merge($attary, $addattary); |
---|
667 | spew("$me: Added attributes to this tag\n"); |
---|
668 | } |
---|
669 | } |
---|
670 | return $attary; |
---|
671 | } |
---|
672 | |
---|
673 | /** |
---|
674 | * This is the main function and the one you should actually be calling. |
---|
675 | * There are several variables you should be aware of an which need |
---|
676 | * special description. |
---|
677 | * |
---|
678 | * $tag_list |
---|
679 | * ---------- |
---|
680 | * This is a simple one-dimentional array of strings, except for the |
---|
681 | * very first one. The first member should be einter false or true. |
---|
682 | * In case it's FALSE, the following list will be considered a list of |
---|
683 | * tags that should be explicitly REMOVED from the body, and all |
---|
684 | * others that did not match the list will be allowed. If the first |
---|
685 | * member is TRUE, then the list is the list of tags that should be |
---|
686 | * explicitly ALLOWED -- any tag not matching this list will be |
---|
687 | * discarded. |
---|
688 | * |
---|
689 | * Examples: |
---|
690 | * $tag_list = Array( |
---|
691 | * false, |
---|
692 | * "blink", |
---|
693 | * "link", |
---|
694 | * "object", |
---|
695 | * "meta", |
---|
696 | * "marquee", |
---|
697 | * "html" |
---|
698 | * ); |
---|
699 | * |
---|
700 | * This will allow all tags except for blink, link, object, meta, marquee, |
---|
701 | * and html. |
---|
702 | * |
---|
703 | * $tag_list = Array( |
---|
704 | * true, |
---|
705 | * "b", |
---|
706 | * "a", |
---|
707 | * "i", |
---|
708 | * "img", |
---|
709 | * "strong", |
---|
710 | * "em", |
---|
711 | * "p" |
---|
712 | * ); |
---|
713 | * |
---|
714 | * This will remove all tags from the body except b, a, i, img, strong, em and |
---|
715 | * p. |
---|
716 | * |
---|
717 | * $rm_tags_with_content |
---|
718 | * --------------------- |
---|
719 | * This is a simple one-dimentional array of strings, which specifies the |
---|
720 | * tags to be removed with any and all content between the beginning and |
---|
721 | * the end of the tag. |
---|
722 | * Example: |
---|
723 | * $rm_tags_with_content = Array( |
---|
724 | * "script", |
---|
725 | * "style", |
---|
726 | * "applet", |
---|
727 | * "embed" |
---|
728 | * ); |
---|
729 | * |
---|
730 | * This will remove the following structure: |
---|
731 | * <script> |
---|
732 | * window.alert("Isn't cross-site-scripting fun?!"); |
---|
733 | * </script> |
---|
734 | * |
---|
735 | * $self_closing_tags |
---|
736 | * ------------------ |
---|
737 | * This is a simple one-dimentional array of strings, which specifies which |
---|
738 | * tags contain no content and should not be forcefully closed if this option |
---|
739 | * is turned on (see further). |
---|
740 | * Example: |
---|
741 | * $self_closing_tags = Array( |
---|
742 | * "img", |
---|
743 | * "br", |
---|
744 | * "hr", |
---|
745 | * "input" |
---|
746 | * ); |
---|
747 | * |
---|
748 | * $force_tag_closing |
---|
749 | * ------------------ |
---|
750 | * Set it to true to forcefully close any tags opened within the document. |
---|
751 | * This is good if you want to take care of people who like to screw up |
---|
752 | * the pages by leaving unclosed tags like <a>, <b>, <i>, etc. |
---|
753 | * |
---|
754 | * $rm_attnames |
---|
755 | * ------------- |
---|
756 | * Now we come to parameters that are more obscure. This parameter is |
---|
757 | * a nested array which is used to specify which attributes should be |
---|
758 | * removed. It goes like so: |
---|
759 | * |
---|
760 | * $rm_attnames = Array( |
---|
761 | * "PCRE regex to match tag name" => |
---|
762 | * Array( |
---|
763 | * "PCRE regex to match attribute name" |
---|
764 | * ) |
---|
765 | * ); |
---|
766 | * |
---|
767 | * Example: |
---|
768 | * $rm_attnames = Array( |
---|
769 | * "|.*|" => |
---|
770 | * Array( |
---|
771 | * "|target|i", |
---|
772 | * "|^on.*|i" |
---|
773 | * ) |
---|
774 | * ); |
---|
775 | * |
---|
776 | * This will match all attributes (.*), and specify that all attributes |
---|
777 | * named "target" and starting with "on" should be removed. This will take |
---|
778 | * care of the following problem: |
---|
779 | * <em onmouseover="window.alert('muahahahaha')"> |
---|
780 | * The "onmouseover" will be removed. |
---|
781 | * |
---|
782 | * $bad_attvals |
---|
783 | * ------------ |
---|
784 | * This is where it gets ugly. This is a nested array with many levels. |
---|
785 | * It goes like so: |
---|
786 | * |
---|
787 | * $bad_attvals = Array( |
---|
788 | * "pcre regex to match tag name" => |
---|
789 | * Array( |
---|
790 | * "pcre regex to match attribute name" => |
---|
791 | * Array( |
---|
792 | * "pcre regex to match attribute value" |
---|
793 | * ) |
---|
794 | * Array( |
---|
795 | * "pcre regex replace a match from above with" |
---|
796 | * ) |
---|
797 | * ) |
---|
798 | * ); |
---|
799 | * |
---|
800 | * An extensive example: |
---|
801 | * |
---|
802 | * $bad_attvals = Array( |
---|
803 | * "|.*|" => |
---|
804 | * Array( |
---|
805 | * "/^src|background|href|action/i" => |
---|
806 | * Array( |
---|
807 | * Array( |
---|
808 | * "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si" |
---|
809 | * ), |
---|
810 | * Array( |
---|
811 | * "\\1http://veryfunny.com/\\2" |
---|
812 | * ) |
---|
813 | * ), |
---|
814 | * "/^style/i" => |
---|
815 | * Array( |
---|
816 | * Array( |
---|
817 | * "/expression/si", |
---|
818 | * "/url\(([\'\"])\s*https*:.*([\'\"])\)/si", |
---|
819 | * "/url\(([\'\"])\s*\S+script:.*([\'\"])\)/si" |
---|
820 | * ), |
---|
821 | * Array( |
---|
822 | * "idiocy", |
---|
823 | * "url(\\1http://veryfunny.com/\\2)", |
---|
824 | * "url(\\1http://veryfynny.com/\\2)" |
---|
825 | * ) |
---|
826 | * ) |
---|
827 | * ) |
---|
828 | * ); |
---|
829 | * |
---|
830 | * This will take care of nearly all known cross-site scripting exploits, |
---|
831 | * plus some (see my filter sample at |
---|
832 | * http://www.mricon.com/html/phpfilter.html for a working version). |
---|
833 | * |
---|
834 | * $add_attr_to_tag |
---|
835 | * ---------------- |
---|
836 | * This is a useful little feature which lets you add attributes to |
---|
837 | * certain tags. It is a nested array as well, but not at all like |
---|
838 | * the previous one. It goes like so: |
---|
839 | * |
---|
840 | * $add_attr_to_tag = Array( |
---|
841 | * "PCRE regex to match tag name" => |
---|
842 | * Array( |
---|
843 | * "attribute name"=>'"attribute value"' |
---|
844 | * ) |
---|
845 | * ); |
---|
846 | * |
---|
847 | * Note: don't forget quotes around attribute value. |
---|
848 | * |
---|
849 | * Example: |
---|
850 | * |
---|
851 | * $add_attr_to_tag = Array( |
---|
852 | * "/^a$/si" => |
---|
853 | * Array( |
---|
854 | * 'target'=>'"_new"' |
---|
855 | * ) |
---|
856 | * ); |
---|
857 | * |
---|
858 | * This will change all <a> tags and add target="_new" to them so all links |
---|
859 | * open in a new window. |
---|
860 | * |
---|
861 | * |
---|
862 | * |
---|
863 | * @param $body the string with HTML you wish to filter |
---|
864 | * @param $tag_list see description above |
---|
865 | * @param $rm_tags_with_content see description above |
---|
866 | * @param $self_closing_tags see description above |
---|
867 | * @param $force_tag_closing see description above |
---|
868 | * @param $rm_attnames see description above |
---|
869 | * @param $bad_attvals see description above |
---|
870 | * @param $add_attr_to_tag see description above |
---|
871 | * @return sanitized html safe to show on your pages. |
---|
872 | */ |
---|
873 | function sanitize($body, |
---|
874 | $tag_list, |
---|
875 | $rm_tags_with_content, |
---|
876 | $self_closing_tags, |
---|
877 | $force_tag_closing, |
---|
878 | $rm_attnames, |
---|
879 | $bad_attvals, |
---|
880 | $add_attr_to_tag |
---|
881 | ){ |
---|
882 | $me = 'sanitize'; |
---|
883 | /** |
---|
884 | * Normalize rm_tags and rm_tags_with_content. |
---|
885 | */ |
---|
886 | @array_walk($tag_list, 'casenormalize'); |
---|
887 | @array_walk($rm_tags_with_content, 'casenormalize'); |
---|
888 | @array_walk($self_closing_tags, 'casenormalize'); |
---|
889 | /** |
---|
890 | * See if tag_list is of tags to remove or tags to allow. |
---|
891 | * false means remove these tags |
---|
892 | * true means allow these tags |
---|
893 | */ |
---|
894 | $rm_tags = array_shift($tag_list); |
---|
895 | $curpos = 0; |
---|
896 | $open_tags = Array(); |
---|
897 | //$trusted = "<!-- begin sanitized html -->\n"; |
---|
898 | $trusted = ""; |
---|
899 | $skip_content = false; |
---|
900 | /** |
---|
901 | * Take care of netscape's stupid javascript entities like |
---|
902 | * &{alert('boo')}; |
---|
903 | */ |
---|
904 | $body = preg_replace('/&(\{.*?\};)/si', '&\\1', $body); |
---|
905 | spew("$me: invoking the loop\n"); |
---|
906 | while (($curtag = getnxtag($body, $curpos)) != FALSE){ |
---|
907 | list($tagname, $attary, $tagtype, $lt, $gt) = $curtag; |
---|
908 | spew("$me: grabbing free-standing content\n"); |
---|
909 | $free_content = substr($body, $curpos, $lt - $curpos); |
---|
910 | spew("$me: " . strlen($free_content) . " chars grabbed\n"); |
---|
911 | if ($skip_content == false){ |
---|
912 | spew("$me: appending free content to trusted.\n"); |
---|
913 | $trusted .= $free_content; |
---|
914 | } else { |
---|
915 | spew("$me: Skipping free content.\n"); |
---|
916 | } |
---|
917 | if ($tagname != FALSE){ |
---|
918 | spew("$me: tagname is '$tagname'\n"); |
---|
919 | if ($tagtype == 2){ |
---|
920 | spew("$me: This is a closing tag\n"); |
---|
921 | if ($skip_content == $tagname){ |
---|
922 | /** |
---|
923 | * Got to the end of tag we needed to remove. |
---|
924 | */ |
---|
925 | spew("$me: Finished removing tag with content\n"); |
---|
926 | $tagname = false; |
---|
927 | $skip_content = false; |
---|
928 | } else { |
---|
929 | if ($skip_content == false){ |
---|
930 | if (isset($open_tags{$tagname}) && |
---|
931 | $open_tags{$tagname} > 0){ |
---|
932 | spew("$me: popping '$tagname' from open_tags\n"); |
---|
933 | $open_tags{$tagname}--; |
---|
934 | } else { |
---|
935 | spew("$me: '$tagname' was never opened\n"); |
---|
936 | spew("$me: removing\n"); |
---|
937 | $tagname = false; |
---|
938 | } |
---|
939 | } else { |
---|
940 | spew("$me: Skipping this tag\n"); |
---|
941 | } |
---|
942 | } |
---|
943 | } else { |
---|
944 | /** |
---|
945 | * $rm_tags_with_content |
---|
946 | */ |
---|
947 | if ($skip_content == false){ |
---|
948 | /** |
---|
949 | * See if this is a self-closing type and change |
---|
950 | * tagtype appropriately. |
---|
951 | */ |
---|
952 | if ($tagtype == 1 |
---|
953 | && in_array($tagname, $self_closing_tags)){ |
---|
954 | spew("$me: Self-closing tag. Changing tagtype.\n"); |
---|
955 | $tagtype = 3; |
---|
956 | } |
---|
957 | /** |
---|
958 | * See if we should skip this tag and any content |
---|
959 | * inside it. |
---|
960 | */ |
---|
961 | if ($tagtype == 1 |
---|
962 | && in_array($tagname, $rm_tags_with_content)){ |
---|
963 | spew("$me: removing this tag with content\n"); |
---|
964 | $skip_content = $tagname; |
---|
965 | } else { |
---|
966 | if (($rm_tags == false |
---|
967 | && in_array($tagname, $tag_list)) || |
---|
968 | ($rm_tags == true |
---|
969 | && !in_array($tagname, $tag_list))){ |
---|
970 | spew("$me: Removing this tag.\n"); |
---|
971 | $tagname = false; |
---|
972 | } else { |
---|
973 | if ($tagtype == 1){ |
---|
974 | spew("$me: adding '$tagname' to open_tags\n"); |
---|
975 | if (isset($open_tags{$tagname})){ |
---|
976 | $open_tags{$tagname}++; |
---|
977 | } else { |
---|
978 | $open_tags{$tagname} = 1; |
---|
979 | } |
---|
980 | } |
---|
981 | /** |
---|
982 | * This is where we run other checks. |
---|
983 | */ |
---|
984 | if (is_array($attary) && sizeof($attary) > 0){ |
---|
985 | $attary = fixatts($tagname, |
---|
986 | $attary, |
---|
987 | $rm_attnames, |
---|
988 | $bad_attvals, |
---|
989 | $add_attr_to_tag); |
---|
990 | } |
---|
991 | } |
---|
992 | } |
---|
993 | } else { |
---|
994 | spew("$me: Skipping this tag\n"); |
---|
995 | } |
---|
996 | } |
---|
997 | if ($tagname != false && $skip_content == false){ |
---|
998 | spew("$me: Appending tag to trusted.\n"); |
---|
999 | $trusted .= tagprint($tagname, $attary, $tagtype); |
---|
1000 | } |
---|
1001 | } else { |
---|
1002 | spew("$me: Removing invalid tag\n"); |
---|
1003 | } |
---|
1004 | $curpos = $gt + 1; |
---|
1005 | } |
---|
1006 | spew("$me: Appending any leftover content\n"); |
---|
1007 | $trusted .= substr($body, $curpos, strlen($body) - $curpos); |
---|
1008 | if ($force_tag_closing == true){ |
---|
1009 | foreach ($open_tags as $tagname=>$opentimes){ |
---|
1010 | while ($opentimes > 0){ |
---|
1011 | spew("$me: '$tagname' left open. Closing by force.\n"); |
---|
1012 | $trusted .= '</' . $tagname . '>'; |
---|
1013 | $opentimes--; |
---|
1014 | } |
---|
1015 | } |
---|
1016 | $trusted .= "\n"; |
---|
1017 | } |
---|
1018 | //$trusted .= "<!-- end sanitized html -->\n"; |
---|
1019 | return $trusted; |
---|
1020 | } |
---|
1021 | ?> |
---|