This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace BeyondCode\InlineTranslation; |
||
4 | |||
5 | use Exception; |
||
6 | |||
7 | class TemplateParser |
||
8 | { |
||
9 | const DATA_TRANSLATE = 'data-translate'; |
||
10 | |||
11 | /** |
||
12 | * @var array |
||
13 | */ |
||
14 | private $viewData; |
||
15 | |||
16 | /** |
||
17 | * List of simple tags |
||
18 | * |
||
19 | * @var array |
||
20 | */ |
||
21 | protected $allowedTags = [ |
||
22 | 'legend' => 'Caption for the fieldset element', |
||
23 | 'label' => 'Label for an input element.', |
||
24 | 'button' => 'Push button', |
||
25 | 'a' => 'Link label', |
||
26 | 'b' => 'Bold text', |
||
27 | 'strong' => 'Strong emphasized text', |
||
28 | 'i' => 'Italic text', |
||
29 | 'em' => 'Emphasized text', |
||
30 | 'u' => 'Underlined text', |
||
31 | 'sup' => 'Superscript text', |
||
32 | 'sub' => 'Subscript text', |
||
33 | 'span' => 'Span element', |
||
34 | 'small' => 'Smaller text', |
||
35 | 'big' => 'Bigger text', |
||
36 | 'address' => 'Contact information', |
||
37 | 'blockquote' => 'Long quotation', |
||
38 | 'q' => 'Short quotation', |
||
39 | 'cite' => 'Citation', |
||
40 | 'caption' => 'Table caption', |
||
41 | 'abbr' => 'Abbreviated phrase', |
||
42 | 'acronym' => 'An acronym', |
||
43 | 'var' => 'Variable part of a text', |
||
44 | 'dfn' => 'Term', |
||
45 | 'strike' => 'Strikethrough text', |
||
46 | 'del' => 'Deleted text', |
||
47 | 'ins' => 'Inserted text', |
||
48 | 'h1' => 'Heading level 1', |
||
49 | 'h2' => 'Heading level 2', |
||
50 | 'h3' => 'Heading level 3', |
||
51 | 'h4' => 'Heading level 4', |
||
52 | 'h5' => 'Heading level 5', |
||
53 | 'h6' => 'Heading level 6', |
||
54 | 'center' => 'Centered text', |
||
55 | 'select' => 'List options', |
||
56 | 'img' => 'Image', |
||
57 | 'input' => 'Form element', |
||
58 | 'p' => 'Generic Paragraph', |
||
59 | ]; |
||
60 | |||
61 | /** |
||
62 | * TemplateParser constructor. |
||
63 | * @param array $viewData |
||
64 | */ |
||
65 | public function __construct(array $viewData = []) |
||
66 | { |
||
67 | $this->viewData = $viewData; |
||
68 | } |
||
69 | |||
70 | public function parseTranslationTags(string &$viewContent) |
||
71 | { |
||
72 | $nextTag = 0; |
||
73 | |||
74 | $tags = implode('|', array_keys($this->allowedTags)); |
||
75 | |||
76 | $tagRegExp = '#<(' . $tags . ')(/?>| \s*[^>]*+/?>)#iSU'; |
||
77 | |||
78 | $tagMatch = []; |
||
79 | |||
80 | while (preg_match($tagRegExp, $viewContent, $tagMatch, PREG_OFFSET_CAPTURE, $nextTag)) { |
||
81 | $tagName = strtolower($tagMatch[1][0]); |
||
82 | |||
83 | if (substr($tagMatch[0][0], -2) == '/>') { |
||
84 | $tagClosurePos = $tagMatch[0][1] + strlen($tagMatch[0][0]); |
||
85 | } else { |
||
86 | $tagClosurePos = $this->findEndOfTag($viewContent, $tagName, $tagMatch[0][1]); |
||
87 | } |
||
88 | |||
89 | if ($tagClosurePos === false) { |
||
90 | $nextTag += strlen($tagMatch[0][0]); |
||
91 | continue; |
||
92 | } |
||
93 | |||
94 | $tagLength = $tagClosurePos - $tagMatch[0][1]; |
||
95 | $tagStartLength = strlen($tagMatch[0][0]); |
||
96 | |||
97 | $tagHtml = $tagMatch[0][0] . substr( |
||
98 | $viewContent, |
||
99 | $tagMatch[0][1] + $tagStartLength, |
||
100 | $tagLength - $tagStartLength |
||
101 | ); |
||
102 | |||
103 | $tagClosurePos = $tagMatch[0][1] + strlen($tagHtml); |
||
104 | |||
105 | $trArr = $this->getTranslateData( |
||
106 | '/({{|{!!)\s*(__|\@lang|\@trans|\@choice|trans|trans_choice)\((.*?)\)\s*(}}|!!})/m', |
||
107 | $tagHtml, |
||
108 | ['tagName' => $tagName, 'tagList' => $this->allowedTags] |
||
109 | ); |
||
110 | |||
111 | if (!empty($trArr)) { |
||
112 | $trArr = array_unique($trArr); |
||
113 | |||
114 | $tagHtml = $this->applyTranslationTags($tagHtml, $tagName, $trArr); |
||
115 | |||
116 | $tagClosurePos = $tagMatch[0][1] + strlen($tagHtml); |
||
117 | $viewContent = substr_replace($viewContent, $tagHtml, $tagMatch[0][1], $tagLength); |
||
118 | } |
||
119 | |||
120 | $nextTag = $tagClosurePos; |
||
121 | } |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * Format translation for simple tags. Added translate mode attribute for vde requests. |
||
126 | * |
||
127 | * @param string $tagHtml |
||
128 | * @param string $tagName |
||
129 | * @param array $trArr |
||
130 | * @return string |
||
131 | */ |
||
132 | protected function applyTranslationTags($tagHtml, $tagName, $trArr) |
||
133 | { |
||
134 | $simpleTags = substr( |
||
135 | $tagHtml, |
||
136 | 0, |
||
137 | strlen($tagName) + 1 |
||
138 | ) . ' ' . $this->getHtmlAttribute( |
||
139 | self::DATA_TRANSLATE, |
||
140 | htmlspecialchars('[' . join(',', $trArr) . ']') |
||
141 | ); |
||
142 | |||
143 | $simpleTags .= substr($tagHtml, strlen($tagName) + 1); |
||
144 | return $simpleTags; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * Get html element attribute |
||
149 | * |
||
150 | * @param string $name |
||
151 | * @param string $value |
||
152 | * @return string |
||
153 | */ |
||
154 | private function getHtmlAttribute($name, $value) |
||
155 | { |
||
156 | return $name . '="' . $value . '"'; |
||
157 | } |
||
158 | |||
159 | /** |
||
160 | * Get translate data by regexp |
||
161 | * |
||
162 | * @param string $regexp |
||
163 | * @param string $text |
||
164 | * @param array $options |
||
165 | * @return array |
||
166 | */ |
||
167 | private function getTranslateData($regexp, $text, $options = []) |
||
168 | { |
||
169 | $trArr = []; |
||
170 | $nextRegexOffset = 0; |
||
171 | while (preg_match($regexp, $text, $matches, PREG_OFFSET_CAPTURE, $nextRegexOffset)) { |
||
172 | |||
173 | extract($this->viewData, EXTR_OVERWRITE); |
||
174 | $translationParameters = $this->extractVariablesFromLocalizationParameters($matches[3][0]); |
||
175 | |||
176 | try { |
||
177 | $translated = eval('return ' . $matches[2][0] . '(' . $matches[3][0] . ');'); |
||
178 | } catch (Exception $e) { |
||
179 | $translated = ''; |
||
180 | } |
||
181 | |||
182 | $trArr[] = json_encode( |
||
183 | [ |
||
184 | 'translated' => $translated, |
||
185 | 'original' => $translationParameters[0], |
||
186 | 'parameters' => $translationParameters[1] ?? [], |
||
187 | 'location' => htmlspecialchars_decode($this->getTagLocation($matches, $options)), |
||
188 | ] |
||
189 | ); |
||
190 | $nextRegexOffset = $matches[4][1]; |
||
191 | } |
||
192 | return $trArr; |
||
193 | } |
||
194 | |||
195 | /** |
||
196 | * Get tag location |
||
197 | * |
||
198 | * @param array $matches |
||
199 | * @param array $options |
||
200 | * @return string |
||
201 | * @SuppressWarnings(PHPMD.UnusedFormalParameter) |
||
202 | */ |
||
203 | protected function getTagLocation($matches, $options) |
||
0 ignored issues
–
show
|
|||
204 | { |
||
205 | $tagName = strtolower($options['tagName']); |
||
206 | if (isset($options['tagList'][$tagName])) { |
||
207 | return $options['tagList'][$tagName]; |
||
208 | } |
||
209 | return ucfirst($tagName) . ' Text'; |
||
210 | } |
||
211 | |||
212 | private function _returnViewData() |
||
0 ignored issues
–
show
|
|||
213 | { |
||
214 | $args = func_get_args(); |
||
215 | $return = []; |
||
216 | |||
217 | foreach ($args as $argument) { |
||
218 | $return[] = $argument; |
||
219 | } |
||
220 | |||
221 | return $return; |
||
222 | } |
||
223 | |||
224 | /** |
||
225 | * @param string $localizationParameters |
||
226 | * @return array|mixed |
||
227 | */ |
||
228 | private function extractVariablesFromLocalizationParameters($localizationParameters) |
||
229 | { |
||
230 | try { |
||
231 | extract($this->viewData, EXTR_OVERWRITE); |
||
232 | return eval('return $this->_returnViewData(' . $localizationParameters . ');'); |
||
233 | } catch (Exception $e) { |
||
234 | return [ |
||
235 | $localizationParameters |
||
236 | ]; |
||
237 | } |
||
238 | } |
||
239 | |||
240 | /** |
||
241 | * Find end of tag |
||
242 | * |
||
243 | * @param string $body |
||
244 | * @param string $tagName |
||
245 | * @param int $from |
||
246 | * @return bool|int return false if end of tag is not found |
||
247 | */ |
||
248 | private function findEndOfTag($body, $tagName, $from) |
||
249 | { |
||
250 | $openTag = '<' . $tagName; |
||
251 | $closeTag = '</' . $tagName; |
||
252 | $tagLength = strlen($tagName); |
||
253 | $length = $tagLength + 1; |
||
254 | $end = $from + 1; |
||
255 | |||
256 | while (substr_count($body, $openTag, $from, $length) !== substr_count($body, $closeTag, $from, $length)) { |
||
257 | $end = strpos($body, $closeTag, $end + $tagLength + 1); |
||
258 | if ($end === false) { |
||
259 | return false; |
||
260 | } |
||
261 | $length = $end - $from + $tagLength + 3; |
||
262 | } |
||
263 | |||
264 | if (preg_match('#<\\\\?\/' . $tagName . '\s*?>#i', $body, $tagMatch, null, $end)) { |
||
265 | return $end + strlen($tagMatch[0]); |
||
266 | } else { |
||
267 | return false; |
||
268 | } |
||
269 | } |
||
270 | } |
||
271 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.