You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

488 lines
17KB

  1. <?php
  2. /**
  3. * Defines allowed CSS attributes and what their values are.
  4. * @see HTMLPurifier_HTMLDefinition
  5. */
  6. class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
  7. {
  8. public $type = 'CSS';
  9. /**
  10. * Assoc array of attribute name to definition object.
  11. * @type HTMLPurifier_AttrDef[]
  12. */
  13. public $info = array();
  14. /**
  15. * Constructs the info array. The meat of this class.
  16. * @param HTMLPurifier_Config $config
  17. */
  18. protected function doSetup($config)
  19. {
  20. $this->info['text-align'] = new HTMLPurifier_AttrDef_Enum(
  21. array('left', 'right', 'center', 'justify'),
  22. false
  23. );
  24. $border_style =
  25. $this->info['border-bottom-style'] =
  26. $this->info['border-right-style'] =
  27. $this->info['border-left-style'] =
  28. $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum(
  29. array(
  30. 'none',
  31. 'hidden',
  32. 'dotted',
  33. 'dashed',
  34. 'solid',
  35. 'double',
  36. 'groove',
  37. 'ridge',
  38. 'inset',
  39. 'outset'
  40. ),
  41. false
  42. );
  43. $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style);
  44. $this->info['clear'] = new HTMLPurifier_AttrDef_Enum(
  45. array('none', 'left', 'right', 'both'),
  46. false
  47. );
  48. $this->info['float'] = new HTMLPurifier_AttrDef_Enum(
  49. array('none', 'left', 'right'),
  50. false
  51. );
  52. $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum(
  53. array('normal', 'italic', 'oblique'),
  54. false
  55. );
  56. $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum(
  57. array('normal', 'small-caps'),
  58. false
  59. );
  60. $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite(
  61. array(
  62. new HTMLPurifier_AttrDef_Enum(array('none')),
  63. new HTMLPurifier_AttrDef_CSS_URI()
  64. )
  65. );
  66. $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum(
  67. array('inside', 'outside'),
  68. false
  69. );
  70. $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum(
  71. array(
  72. 'disc',
  73. 'circle',
  74. 'square',
  75. 'decimal',
  76. 'lower-roman',
  77. 'upper-roman',
  78. 'lower-alpha',
  79. 'upper-alpha',
  80. 'none'
  81. ),
  82. false
  83. );
  84. $this->info['list-style-image'] = $uri_or_none;
  85. $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config);
  86. $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum(
  87. array('capitalize', 'uppercase', 'lowercase', 'none'),
  88. false
  89. );
  90. $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color();
  91. $this->info['background-image'] = $uri_or_none;
  92. $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum(
  93. array('repeat', 'repeat-x', 'repeat-y', 'no-repeat')
  94. );
  95. $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum(
  96. array('scroll', 'fixed')
  97. );
  98. $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition();
  99. $border_color =
  100. $this->info['border-top-color'] =
  101. $this->info['border-bottom-color'] =
  102. $this->info['border-left-color'] =
  103. $this->info['border-right-color'] =
  104. $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(
  105. array(
  106. new HTMLPurifier_AttrDef_Enum(array('transparent')),
  107. new HTMLPurifier_AttrDef_CSS_Color()
  108. )
  109. );
  110. $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config);
  111. $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color);
  112. $border_width =
  113. $this->info['border-top-width'] =
  114. $this->info['border-bottom-width'] =
  115. $this->info['border-left-width'] =
  116. $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(
  117. array(
  118. new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')),
  119. new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative
  120. )
  121. );
  122. $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width);
  123. $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
  124. array(
  125. new HTMLPurifier_AttrDef_Enum(array('normal')),
  126. new HTMLPurifier_AttrDef_CSS_Length()
  127. )
  128. );
  129. $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
  130. array(
  131. new HTMLPurifier_AttrDef_Enum(array('normal')),
  132. new HTMLPurifier_AttrDef_CSS_Length()
  133. )
  134. );
  135. $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(
  136. array(
  137. new HTMLPurifier_AttrDef_Enum(
  138. array(
  139. 'xx-small',
  140. 'x-small',
  141. 'small',
  142. 'medium',
  143. 'large',
  144. 'x-large',
  145. 'xx-large',
  146. 'larger',
  147. 'smaller'
  148. )
  149. ),
  150. new HTMLPurifier_AttrDef_CSS_Percentage(),
  151. new HTMLPurifier_AttrDef_CSS_Length()
  152. )
  153. );
  154. $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(
  155. array(
  156. new HTMLPurifier_AttrDef_Enum(array('normal')),
  157. new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives
  158. new HTMLPurifier_AttrDef_CSS_Length('0'),
  159. new HTMLPurifier_AttrDef_CSS_Percentage(true)
  160. )
  161. );
  162. $margin =
  163. $this->info['margin-top'] =
  164. $this->info['margin-bottom'] =
  165. $this->info['margin-left'] =
  166. $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
  167. array(
  168. new HTMLPurifier_AttrDef_CSS_Length(),
  169. new HTMLPurifier_AttrDef_CSS_Percentage(),
  170. new HTMLPurifier_AttrDef_Enum(array('auto'))
  171. )
  172. );
  173. $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin);
  174. // non-negative
  175. $padding =
  176. $this->info['padding-top'] =
  177. $this->info['padding-bottom'] =
  178. $this->info['padding-left'] =
  179. $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
  180. array(
  181. new HTMLPurifier_AttrDef_CSS_Length('0'),
  182. new HTMLPurifier_AttrDef_CSS_Percentage(true)
  183. )
  184. );
  185. $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding);
  186. $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(
  187. array(
  188. new HTMLPurifier_AttrDef_CSS_Length(),
  189. new HTMLPurifier_AttrDef_CSS_Percentage()
  190. )
  191. );
  192. $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  193. array(
  194. new HTMLPurifier_AttrDef_CSS_Length('0'),
  195. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  196. new HTMLPurifier_AttrDef_Enum(array('auto'))
  197. )
  198. );
  199. $max = $config->get('CSS.MaxImgLength');
  200. $this->info['width'] =
  201. $this->info['height'] =
  202. $max === null ?
  203. $trusted_wh :
  204. new HTMLPurifier_AttrDef_Switch(
  205. 'img',
  206. // For img tags:
  207. new HTMLPurifier_AttrDef_CSS_Composite(
  208. array(
  209. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  210. new HTMLPurifier_AttrDef_Enum(array('auto'))
  211. )
  212. ),
  213. // For everyone else:
  214. $trusted_wh
  215. );
  216. $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();
  217. $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
  218. // this could use specialized code
  219. $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum(
  220. array(
  221. 'normal',
  222. 'bold',
  223. 'bolder',
  224. 'lighter',
  225. '100',
  226. '200',
  227. '300',
  228. '400',
  229. '500',
  230. '600',
  231. '700',
  232. '800',
  233. '900'
  234. ),
  235. false
  236. );
  237. // MUST be called after other font properties, as it references
  238. // a CSSDefinition object
  239. $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config);
  240. // same here
  241. $this->info['border'] =
  242. $this->info['border-bottom'] =
  243. $this->info['border-top'] =
  244. $this->info['border-left'] =
  245. $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config);
  246. $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(
  247. array('collapse', 'separate')
  248. );
  249. $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(
  250. array('top', 'bottom')
  251. );
  252. $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(
  253. array('auto', 'fixed')
  254. );
  255. $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(
  256. array(
  257. new HTMLPurifier_AttrDef_Enum(
  258. array(
  259. 'baseline',
  260. 'sub',
  261. 'super',
  262. 'top',
  263. 'text-top',
  264. 'middle',
  265. 'bottom',
  266. 'text-bottom'
  267. )
  268. ),
  269. new HTMLPurifier_AttrDef_CSS_Length(),
  270. new HTMLPurifier_AttrDef_CSS_Percentage()
  271. )
  272. );
  273. $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2);
  274. // These CSS properties don't work on many browsers, but we live
  275. // in THE FUTURE!
  276. $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(
  277. array('nowrap', 'normal', 'pre', 'pre-wrap', 'pre-line')
  278. );
  279. if ($config->get('CSS.Proprietary')) {
  280. $this->doSetupProprietary($config);
  281. }
  282. if ($config->get('CSS.AllowTricky')) {
  283. $this->doSetupTricky($config);
  284. }
  285. if ($config->get('CSS.Trusted')) {
  286. $this->doSetupTrusted($config);
  287. }
  288. $allow_important = $config->get('CSS.AllowImportant');
  289. // wrap all attr-defs with decorator that handles !important
  290. foreach ($this->info as $k => $v) {
  291. $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important);
  292. }
  293. $this->setupConfigStuff($config);
  294. }
  295. /**
  296. * @param HTMLPurifier_Config $config
  297. */
  298. protected function doSetupProprietary($config)
  299. {
  300. // Internet Explorer only scrollbar colors
  301. $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  302. $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  303. $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  304. $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  305. $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  306. $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  307. // vendor specific prefixes of opacity
  308. $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  309. $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  310. // only opacity, for now
  311. $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter();
  312. // more CSS3
  313. $this->info['page-break-after'] =
  314. $this->info['page-break-before'] = new HTMLPurifier_AttrDef_Enum(
  315. array(
  316. 'auto',
  317. 'always',
  318. 'avoid',
  319. 'left',
  320. 'right'
  321. )
  322. );
  323. $this->info['page-break-inside'] = new HTMLPurifier_AttrDef_Enum(array('auto', 'avoid'));
  324. $border_radius = new HTMLPurifier_AttrDef_CSS_Composite(
  325. array(
  326. new HTMLPurifier_AttrDef_CSS_Percentage(true), // disallow negative
  327. new HTMLPurifier_AttrDef_CSS_Length('0') // disallow negative
  328. ));
  329. $this->info['border-top-left-radius'] =
  330. $this->info['border-top-right-radius'] =
  331. $this->info['border-bottom-right-radius'] =
  332. $this->info['border-bottom-left-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 2);
  333. // TODO: support SLASH syntax
  334. $this->info['border-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 4);
  335. }
  336. /**
  337. * @param HTMLPurifier_Config $config
  338. */
  339. protected function doSetupTricky($config)
  340. {
  341. $this->info['display'] = new HTMLPurifier_AttrDef_Enum(
  342. array(
  343. 'inline',
  344. 'block',
  345. 'list-item',
  346. 'run-in',
  347. 'compact',
  348. 'marker',
  349. 'table',
  350. 'inline-block',
  351. 'inline-table',
  352. 'table-row-group',
  353. 'table-header-group',
  354. 'table-footer-group',
  355. 'table-row',
  356. 'table-column-group',
  357. 'table-column',
  358. 'table-cell',
  359. 'table-caption',
  360. 'none'
  361. )
  362. );
  363. $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(
  364. array('visible', 'hidden', 'collapse')
  365. );
  366. $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(array('visible', 'hidden', 'auto', 'scroll'));
  367. $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  368. }
  369. /**
  370. * @param HTMLPurifier_Config $config
  371. */
  372. protected function doSetupTrusted($config)
  373. {
  374. $this->info['position'] = new HTMLPurifier_AttrDef_Enum(
  375. array('static', 'relative', 'absolute', 'fixed')
  376. );
  377. $this->info['top'] =
  378. $this->info['left'] =
  379. $this->info['right'] =
  380. $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite(
  381. array(
  382. new HTMLPurifier_AttrDef_CSS_Length(),
  383. new HTMLPurifier_AttrDef_CSS_Percentage(),
  384. new HTMLPurifier_AttrDef_Enum(array('auto')),
  385. )
  386. );
  387. $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite(
  388. array(
  389. new HTMLPurifier_AttrDef_Integer(),
  390. new HTMLPurifier_AttrDef_Enum(array('auto')),
  391. )
  392. );
  393. }
  394. /**
  395. * Performs extra config-based processing. Based off of
  396. * HTMLPurifier_HTMLDefinition.
  397. * @param HTMLPurifier_Config $config
  398. * @todo Refactor duplicate elements into common class (probably using
  399. * composition, not inheritance).
  400. */
  401. protected function setupConfigStuff($config)
  402. {
  403. // setup allowed elements
  404. $support = "(for information on implementing this, see the " .
  405. "support forums) ";
  406. $allowed_properties = $config->get('CSS.AllowedProperties');
  407. if ($allowed_properties !== null) {
  408. foreach ($this->info as $name => $d) {
  409. if (!isset($allowed_properties[$name])) {
  410. unset($this->info[$name]);
  411. }
  412. unset($allowed_properties[$name]);
  413. }
  414. // emit errors
  415. foreach ($allowed_properties as $name => $d) {
  416. // :TODO: Is this htmlspecialchars() call really necessary?
  417. $name = htmlspecialchars($name);
  418. trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING);
  419. }
  420. }
  421. $forbidden_properties = $config->get('CSS.ForbiddenProperties');
  422. if ($forbidden_properties !== null) {
  423. foreach ($this->info as $name => $d) {
  424. if (isset($forbidden_properties[$name])) {
  425. unset($this->info[$name]);
  426. }
  427. }
  428. }
  429. }
  430. }
  431. // vim: et sw=4 sts=4