CSSDefinition.php 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570
  1. <?php
  2. /**
  3. * Defines allowed CSS attributes and what their values are.
  4. * @see HTMLPurifier_HTMLDefinition
  5. */
  6. class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
  7. {
  8. public $type = 'CSS';
  9. /**
  10. * Assoc array of attribute name to definition object.
  11. * @type HTMLPurifier_AttrDef[]
  12. */
  13. public $info = [];
  14. /**
  15. * Constructs the info array. The meat of this class.
  16. * @param HTMLPurifier_Config $config
  17. */
  18. protected function doSetup($config)
  19. {
  20. $this->info['text-align'] = new HTMLPurifier_AttrDef_Enum(
  21. ['left', 'right', 'center', 'justify'],
  22. false
  23. );
  24. $this->info['direction'] = new HTMLPurifier_AttrDef_Enum(
  25. ['ltr', 'rtl'],
  26. false
  27. );
  28. $border_style =
  29. $this->info['border-bottom-style'] =
  30. $this->info['border-right-style'] =
  31. $this->info['border-left-style'] =
  32. $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum(
  33. [
  34. 'none',
  35. 'hidden',
  36. 'dotted',
  37. 'dashed',
  38. 'solid',
  39. 'double',
  40. 'groove',
  41. 'ridge',
  42. 'inset',
  43. 'outset'
  44. ],
  45. false
  46. );
  47. $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style);
  48. $this->info['clear'] = new HTMLPurifier_AttrDef_Enum(
  49. ['none', 'left', 'right', 'both'],
  50. false
  51. );
  52. $this->info['float'] = new HTMLPurifier_AttrDef_Enum(
  53. ['none', 'left', 'right'],
  54. false
  55. );
  56. $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum(
  57. ['normal', 'italic', 'oblique'],
  58. false
  59. );
  60. $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum(
  61. ['normal', 'small-caps'],
  62. false
  63. );
  64. $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite(
  65. [
  66. new HTMLPurifier_AttrDef_Enum(['none']),
  67. new HTMLPurifier_AttrDef_CSS_URI()
  68. ]
  69. );
  70. $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum(
  71. ['inside', 'outside'],
  72. false
  73. );
  74. $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum(
  75. [
  76. 'disc',
  77. 'circle',
  78. 'square',
  79. 'decimal',
  80. 'lower-roman',
  81. 'upper-roman',
  82. 'lower-alpha',
  83. 'upper-alpha',
  84. 'none'
  85. ],
  86. false
  87. );
  88. $this->info['list-style-image'] = $uri_or_none;
  89. $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config);
  90. $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum(
  91. ['capitalize', 'uppercase', 'lowercase', 'none'],
  92. false
  93. );
  94. $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color();
  95. $this->info['background-image'] = $uri_or_none;
  96. $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum(
  97. ['repeat', 'repeat-x', 'repeat-y', 'no-repeat']
  98. );
  99. $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum(
  100. ['scroll', 'fixed']
  101. );
  102. $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition();
  103. $this->info['background-size'] = new HTMLPurifier_AttrDef_CSS_Composite(
  104. [
  105. new HTMLPurifier_AttrDef_Enum(
  106. [
  107. 'auto',
  108. 'cover',
  109. 'contain',
  110. ]
  111. ),
  112. new HTMLPurifier_AttrDef_CSS_Percentage(),
  113. new HTMLPurifier_AttrDef_CSS_Length()
  114. ]
  115. );
  116. $border_color =
  117. $this->info['border-top-color'] =
  118. $this->info['border-bottom-color'] =
  119. $this->info['border-left-color'] =
  120. $this->info['border-right-color'] =
  121. $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(
  122. [
  123. new HTMLPurifier_AttrDef_Enum(['transparent']),
  124. new HTMLPurifier_AttrDef_CSS_Color()
  125. ]
  126. );
  127. $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config);
  128. $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color);
  129. $border_width =
  130. $this->info['border-top-width'] =
  131. $this->info['border-bottom-width'] =
  132. $this->info['border-left-width'] =
  133. $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(
  134. [
  135. new HTMLPurifier_AttrDef_Enum(['thin', 'medium', 'thick']),
  136. new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative
  137. ]
  138. );
  139. $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width);
  140. $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
  141. [
  142. new HTMLPurifier_AttrDef_Enum(['normal']),
  143. new HTMLPurifier_AttrDef_CSS_Length()
  144. ]
  145. );
  146. $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
  147. [
  148. new HTMLPurifier_AttrDef_Enum(['normal']),
  149. new HTMLPurifier_AttrDef_CSS_Length()
  150. ]
  151. );
  152. $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(
  153. [
  154. new HTMLPurifier_AttrDef_Enum(
  155. [
  156. 'xx-small',
  157. 'x-small',
  158. 'small',
  159. 'medium',
  160. 'large',
  161. 'x-large',
  162. 'xx-large',
  163. 'larger',
  164. 'smaller'
  165. ]
  166. ),
  167. new HTMLPurifier_AttrDef_CSS_Percentage(),
  168. new HTMLPurifier_AttrDef_CSS_Length()
  169. ]
  170. );
  171. $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(
  172. [
  173. new HTMLPurifier_AttrDef_Enum(['normal']),
  174. new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives
  175. new HTMLPurifier_AttrDef_CSS_Length('0'),
  176. new HTMLPurifier_AttrDef_CSS_Percentage(true)
  177. ]
  178. );
  179. $margin =
  180. $this->info['margin-top'] =
  181. $this->info['margin-bottom'] =
  182. $this->info['margin-left'] =
  183. $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
  184. [
  185. new HTMLPurifier_AttrDef_CSS_Length(),
  186. new HTMLPurifier_AttrDef_CSS_Percentage(),
  187. new HTMLPurifier_AttrDef_Enum(['auto'])
  188. ]
  189. );
  190. $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin);
  191. // non-negative
  192. $padding =
  193. $this->info['padding-top'] =
  194. $this->info['padding-bottom'] =
  195. $this->info['padding-left'] =
  196. $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
  197. [
  198. new HTMLPurifier_AttrDef_CSS_Length('0'),
  199. new HTMLPurifier_AttrDef_CSS_Percentage(true)
  200. ]
  201. );
  202. $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding);
  203. $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(
  204. [
  205. new HTMLPurifier_AttrDef_CSS_Length(),
  206. new HTMLPurifier_AttrDef_CSS_Percentage()
  207. ]
  208. );
  209. $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  210. [
  211. new HTMLPurifier_AttrDef_CSS_Length('0'),
  212. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  213. new HTMLPurifier_AttrDef_Enum(['auto'])
  214. ]
  215. );
  216. $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  217. [
  218. new HTMLPurifier_AttrDef_CSS_Length('0'),
  219. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  220. ]
  221. );
  222. $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  223. [
  224. new HTMLPurifier_AttrDef_CSS_Length('0'),
  225. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  226. new HTMLPurifier_AttrDef_Enum(['none'])
  227. ]
  228. );
  229. $max = $config->get('CSS.MaxImgLength');
  230. $this->info['width'] =
  231. $this->info['height'] =
  232. $max === null ?
  233. $trusted_wh :
  234. new HTMLPurifier_AttrDef_Switch(
  235. 'img',
  236. // For img tags:
  237. new HTMLPurifier_AttrDef_CSS_Composite(
  238. [
  239. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  240. new HTMLPurifier_AttrDef_Enum(['auto'])
  241. ]
  242. ),
  243. // For everyone else:
  244. $trusted_wh
  245. );
  246. $this->info['min-width'] =
  247. $this->info['min-height'] =
  248. $max === null ?
  249. $trusted_min_wh :
  250. new HTMLPurifier_AttrDef_Switch(
  251. 'img',
  252. // For img tags:
  253. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  254. // For everyone else:
  255. $trusted_min_wh
  256. );
  257. $this->info['max-width'] =
  258. $this->info['max-height'] =
  259. $max === null ?
  260. $trusted_max_wh :
  261. new HTMLPurifier_AttrDef_Switch(
  262. 'img',
  263. // For img tags:
  264. new HTMLPurifier_AttrDef_CSS_Composite(
  265. [
  266. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  267. new HTMLPurifier_AttrDef_Enum(['none'])
  268. ]
  269. ),
  270. // For everyone else:
  271. $trusted_max_wh
  272. );
  273. $this->info['aspect-ratio'] = new HTMLPurifier_AttrDef_CSS_Multiple(
  274. new HTMLPurifier_AttrDef_CSS_Composite([
  275. new HTMLPurifier_AttrDef_CSS_Ratio(),
  276. new HTMLPurifier_AttrDef_Enum(['auto']),
  277. ])
  278. );
  279. // text-decoration and related shorthands
  280. $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();
  281. $this->info['text-decoration-line'] = new HTMLPurifier_AttrDef_Enum(
  282. ['none', 'underline', 'overline', 'line-through']
  283. );
  284. $this->info['text-decoration-style'] = new HTMLPurifier_AttrDef_Enum(
  285. ['solid', 'double', 'dotted', 'dashed', 'wavy']
  286. );
  287. $this->info['text-decoration-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  288. $this->info['text-decoration-thickness'] = new HTMLPurifier_AttrDef_CSS_Composite([
  289. new HTMLPurifier_AttrDef_CSS_Length(),
  290. new HTMLPurifier_AttrDef_CSS_Percentage(),
  291. new HTMLPurifier_AttrDef_Enum(['auto', 'from-font'])
  292. ]);
  293. $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
  294. // this could use specialized code
  295. $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum(
  296. [
  297. 'normal',
  298. 'bold',
  299. 'bolder',
  300. 'lighter',
  301. '100',
  302. '200',
  303. '300',
  304. '400',
  305. '500',
  306. '600',
  307. '700',
  308. '800',
  309. '900'
  310. ],
  311. false
  312. );
  313. // MUST be called after other font properties, as it references
  314. // a CSSDefinition object
  315. $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config);
  316. // same here
  317. $this->info['border'] =
  318. $this->info['border-bottom'] =
  319. $this->info['border-top'] =
  320. $this->info['border-left'] =
  321. $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config);
  322. $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(
  323. ['collapse', 'separate']
  324. );
  325. $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(
  326. ['top', 'bottom']
  327. );
  328. $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(
  329. ['auto', 'fixed']
  330. );
  331. $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(
  332. [
  333. new HTMLPurifier_AttrDef_Enum(
  334. [
  335. 'baseline',
  336. 'sub',
  337. 'super',
  338. 'top',
  339. 'text-top',
  340. 'middle',
  341. 'bottom',
  342. 'text-bottom'
  343. ]
  344. ),
  345. new HTMLPurifier_AttrDef_CSS_Length(),
  346. new HTMLPurifier_AttrDef_CSS_Percentage()
  347. ]
  348. );
  349. $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2);
  350. // These CSS properties don't work on many browsers, but we live
  351. // in THE FUTURE!
  352. $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(
  353. ['nowrap', 'normal', 'pre', 'pre-wrap', 'pre-line']
  354. );
  355. if ($config->get('CSS.Proprietary')) {
  356. $this->doSetupProprietary($config);
  357. }
  358. if ($config->get('CSS.AllowTricky')) {
  359. $this->doSetupTricky($config);
  360. }
  361. if ($config->get('CSS.Trusted')) {
  362. $this->doSetupTrusted($config);
  363. }
  364. $allow_important = $config->get('CSS.AllowImportant');
  365. // wrap all attr-defs with decorator that handles !important
  366. foreach ($this->info as $k => $v) {
  367. $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important);
  368. }
  369. $this->setupConfigStuff($config);
  370. }
  371. /**
  372. * @param HTMLPurifier_Config $config
  373. */
  374. protected function doSetupProprietary($config)
  375. {
  376. // Internet Explorer only scrollbar colors
  377. $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  378. $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  379. $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  380. $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  381. $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  382. $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  383. // vendor specific prefixes of opacity
  384. $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  385. $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  386. // only opacity, for now
  387. $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter();
  388. // more CSS3
  389. $this->info['page-break-after'] =
  390. $this->info['page-break-before'] = new HTMLPurifier_AttrDef_Enum(
  391. [
  392. 'auto',
  393. 'always',
  394. 'avoid',
  395. 'left',
  396. 'right'
  397. ]
  398. );
  399. $this->info['page-break-inside'] = new HTMLPurifier_AttrDef_Enum(['auto', 'avoid']);
  400. $border_radius = new HTMLPurifier_AttrDef_CSS_Composite(
  401. [
  402. new HTMLPurifier_AttrDef_CSS_Percentage(true), // disallow negative
  403. new HTMLPurifier_AttrDef_CSS_Length('0') // disallow negative
  404. ]);
  405. $this->info['border-top-left-radius'] =
  406. $this->info['border-top-right-radius'] =
  407. $this->info['border-bottom-right-radius'] =
  408. $this->info['border-bottom-left-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 2);
  409. // TODO: support SLASH syntax
  410. $this->info['border-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 4);
  411. }
  412. /**
  413. * @param HTMLPurifier_Config $config
  414. */
  415. protected function doSetupTricky($config)
  416. {
  417. $this->info['display'] = new HTMLPurifier_AttrDef_Enum(
  418. [
  419. 'inline',
  420. 'block',
  421. 'list-item',
  422. 'run-in',
  423. 'compact',
  424. 'marker',
  425. 'table',
  426. 'inline-block',
  427. 'inline-table',
  428. 'table-row-group',
  429. 'table-header-group',
  430. 'table-footer-group',
  431. 'table-row',
  432. 'table-column-group',
  433. 'table-column',
  434. 'table-cell',
  435. 'table-caption',
  436. 'none'
  437. ]
  438. );
  439. $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(
  440. ['visible', 'hidden', 'collapse']
  441. );
  442. $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(['visible', 'hidden', 'auto', 'scroll']);
  443. $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  444. }
  445. /**
  446. * @param HTMLPurifier_Config $config
  447. */
  448. protected function doSetupTrusted($config)
  449. {
  450. $this->info['position'] = new HTMLPurifier_AttrDef_Enum(
  451. ['static', 'relative', 'absolute', 'fixed']
  452. );
  453. $this->info['top'] =
  454. $this->info['left'] =
  455. $this->info['right'] =
  456. $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite(
  457. [
  458. new HTMLPurifier_AttrDef_CSS_Length(),
  459. new HTMLPurifier_AttrDef_CSS_Percentage(),
  460. new HTMLPurifier_AttrDef_Enum(['auto']),
  461. ]
  462. );
  463. $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite(
  464. [
  465. new HTMLPurifier_AttrDef_Integer(),
  466. new HTMLPurifier_AttrDef_Enum(['auto']),
  467. ]
  468. );
  469. }
  470. /**
  471. * Performs extra config-based processing. Based off of
  472. * HTMLPurifier_HTMLDefinition.
  473. * @param HTMLPurifier_Config $config
  474. * @todo Refactor duplicate elements into common class (probably using
  475. * composition, not inheritance).
  476. */
  477. protected function setupConfigStuff($config)
  478. {
  479. // setup allowed elements
  480. $support = "(for information on implementing this, see the " .
  481. "support forums) ";
  482. $allowed_properties = $config->get('CSS.AllowedProperties');
  483. if ($allowed_properties !== null) {
  484. foreach ($this->info as $name => $d) {
  485. if (!isset($allowed_properties[$name])) {
  486. unset($this->info[$name]);
  487. }
  488. unset($allowed_properties[$name]);
  489. }
  490. // emit errors
  491. foreach ($allowed_properties as $name => $d) {
  492. // :TODO: Is this htmlspecialchars() call really necessary?
  493. $name = htmlspecialchars($name);
  494. trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING);
  495. }
  496. }
  497. $forbidden_properties = $config->get('CSS.ForbiddenProperties');
  498. if ($forbidden_properties !== null) {
  499. foreach ($this->info as $name => $d) {
  500. if (isset($forbidden_properties[$name])) {
  501. unset($this->info[$name]);
  502. }
  503. }
  504. }
  505. }
  506. }
  507. // vim: et sw=4 sts=4