xpressengine / xe-core

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/FontFamily.php

Indentation +171 added lines, -171 removed lines

@@ -6,22 +6,22 @@ 
 class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
 {
 
-    protected $mask = null;
-
-    public function __construct() {
-        $this->mask = '- ';
-        for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c;
-        for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c;
-        for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine
-        // special bytes used by UTF-8
-        for ($i = 0x80; $i <= 0xFF; $i++) {
-            // We don't bother excluding invalid bytes in this range,
-            // because the our restriction of well-formed UTF-8 will
-            // prevent these from ever occurring.
-            $this->mask .= chr($i);
-        }
-
-        /*
+	protected $mask = null;
+
+	public function __construct() {
+		$this->mask = '- ';
+		for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c;
+		for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c;
+		for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine
+		// special bytes used by UTF-8
+		for ($i = 0x80; $i <= 0xFF; $i++) {
+			// We don't bother excluding invalid bytes in this range,
+			// because the our restriction of well-formed UTF-8 will
+			// prevent these from ever occurring.
+			$this->mask .= chr($i);
+		}
+
+		/*
             PHP's internal strcspn implementation is
             O(length of string * length of mask), making it inefficient
             for large masks.  However, it's still faster than
@@ -36,161 +36,161 @@ 
             c = *++p;
           }
          */
-        // possible optimization: invert the mask.
-    }
-
-    public function validate($string, $config, $context) {
-        static $generic_names = array(
-            'serif' => true,
-            'sans-serif' => true,
-            'monospace' => true,
-            'fantasy' => true,
-            'cursive' => true
-        );
-        $allowed_fonts = $config->get('CSS.AllowedFonts');
-
-        // assume that no font names contain commas in them
-        $fonts = explode(',', $string);
-        $final = '';
-        foreach($fonts as $font) {
-            $font = trim($font);
-            if ($font === '') continue;
-            // match a generic name
-            if (isset($generic_names[$font])) {
-                if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
-                    $final .= $font . ', ';
-                }
-                continue;
-            }
-            // match a quoted name
-            if ($font[0] === '"' || $font[0] === "'") {
-                $length = strlen($font);
-                if ($length <= 2) continue;
-                $quote = $font[0];
-                if ($font[$length - 1] !== $quote) continue;
-                $font = substr($font, 1, $length - 2);
-            }
-
-            $font = $this->expandCSSEscape($font);
-
-            // $font is a pure representation of the font name
-
-            if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) {
-                continue;
-            }
-
-            if (ctype_alnum($font) && $font !== '') {
-                // very simple font, allow it in unharmed
-                $final .= $font . ', ';
-                continue;
-            }
-
-            // bugger out on whitespace.  form feed (0C) really
-            // shouldn't show up regardless
-            $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font);
-
-            // Here, there are various classes of characters which need
-            // to be treated differently:
-            //  - Alphanumeric characters are essentially safe.  We
-            //    handled these above.
-            //  - Spaces require quoting, though most parsers will do
-            //    the right thing if there aren't any characters that
-            //    can be misinterpreted
-            //  - Dashes rarely occur, but they fairly unproblematic
-            //    for parsing/rendering purposes.
-            //  The above characters cover the majority of Western font
-            //  names.
-            //  - Arbitrary Unicode characters not in ASCII.  Because
-            //    most parsers give little thought to Unicode, treatment
-            //    of these codepoints is basically uniform, even for
-            //    punctuation-like codepoints.  These characters can
-            //    show up in non-Western pages and are supported by most
-            //    major browsers, for example: "ＭＳ 明朝" is a
-            //    legitimate font-name
-            //    <http://ja.wikipedia.org/wiki/MS_明朝>.  See
-            //    the CSS3 spec for more examples:
-            //    <http://www.w3.org/TR/2011/WD-css3-fonts-20110324/localizedfamilynames.png>
-            //    You can see live samples of these on the Internet:
-            //    <http://www.google.co.jp/search?q=font-family+ＭＳ+明朝|ゴシック>
-            //    However, most of these fonts have ASCII equivalents:
-            //    for example, 'MS Mincho', and it's considered
-            //    professional to use ASCII font names instead of
-            //    Unicode font names.  Thanks Takeshi Terada for
-            //    providing this information.
-            //  The following characters, to my knowledge, have not been
-            //  used to name font names.
-            //  - Single quote.  While theoretically you might find a
-            //    font name that has a single quote in its name (serving
-            //    as an apostrophe, e.g. Dave's Scribble), I haven't
-            //    been able to find any actual examples of this.
-            //    Internet Explorer's cssText translation (which I
-            //    believe is invoked by innerHTML) normalizes any
-            //    quoting to single quotes, and fails to escape single
-            //    quotes.  (Note that this is not IE's behavior for all
-            //    CSS properties, just some sort of special casing for
-            //    font-family).  So a single quote *cannot* be used
-            //    safely in the font-family context if there will be an
-            //    innerHTML/cssText translation.  Note that Firefox 3.x
-            //    does this too.
-            //  - Double quote.  In IE, these get normalized to
-            //    single-quotes, no matter what the encoding.  (Fun
-            //    fact, in IE8, the 'content' CSS property gained
-            //    support, where they special cased to preserve encoded
-            //    double quotes, but still translate unadorned double
-            //    quotes into single quotes.)  So, because their
-            //    fixpoint behavior is identical to single quotes, they
-            //    cannot be allowed either.  Firefox 3.x displays
-            //    single-quote style behavior.
-            //  - Backslashes are reduced by one (so \\ -> \) every
-            //    iteration, so they cannot be used safely.  This shows
-            //    up in IE7, IE8 and FF3
-            //  - Semicolons, commas and backticks are handled properly.
-            //  - The rest of the ASCII punctuation is handled properly.
-            // We haven't checked what browsers do to unadorned
-            // versions, but this is not important as long as the
-            // browser doesn't /remove/ surrounding quotes (as IE does
-            // for HTML).
-            //
-            // With these results in hand, we conclude that there are
-            // various levels of safety:
-            //  - Paranoid: alphanumeric, spaces and dashes(?)
-            //  - International: Paranoid + non-ASCII Unicode
-            //  - Edgy: Everything except quotes, backslashes
-            //  - NoJS: Standards compliance, e.g. sod IE. Note that
-            //    with some judicious character escaping (since certain
-            //    types of escaping doesn't work) this is theoretically
-            //    OK as long as innerHTML/cssText is not called.
-            // We believe that international is a reasonable default
-            // (that we will implement now), and once we do more
-            // extensive research, we may feel comfortable with dropping
-            // it down to edgy.
-
-            // Edgy: alphanumeric, spaces, dashes and Unicode.  Use of
-            // str(c)spn assumes that the string was already well formed
-            // Unicode (which of course it is).
-            if (strspn($font, $this->mask) !== strlen($font)) {
-                continue;
-            }
-
-            // Historical:
-            // In the absence of innerHTML/cssText, these ugly
-            // transforms don't pose a security risk (as \\ and \"
-            // might--these escapes are not supported by most browsers).
-            // We could try to be clever and use single-quote wrapping
-            // when there is a double quote present, but I have choosen
-            // not to implement that.  (NOTE: you can reduce the amount
-            // of escapes by one depending on what quoting style you use)
-            // $font = str_replace('\\', '\\5C ', $font);
-            // $font = str_replace('"',  '\\22 ', $font);
-            // $font = str_replace("'",  '\\27 ', $font);
-
-            // font possibly with spaces, requires quoting
-            $final .= "'$font', ";
-        }
-        $final = rtrim($final, ', ');
-        if ($final === '') return false;
-        return $final;
-    }
+		// possible optimization: invert the mask.
+	}
+
+	public function validate($string, $config, $context) {
+		static $generic_names = array(
+			'serif' => true,
+			'sans-serif' => true,
+			'monospace' => true,
+			'fantasy' => true,
+			'cursive' => true
+		);
+		$allowed_fonts = $config->get('CSS.AllowedFonts');
+
+		// assume that no font names contain commas in them
+		$fonts = explode(',', $string);
+		$final = '';
+		foreach($fonts as $font) {
+			$font = trim($font);
+			if ($font === '') continue;
+			// match a generic name
+			if (isset($generic_names[$font])) {
+				if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
+					$final .= $font . ', ';
+				}
+				continue;
+			}
+			// match a quoted name
+			if ($font[0] === '"' || $font[0] === "'") {
+				$length = strlen($font);
+				if ($length <= 2) continue;
+				$quote = $font[0];
+				if ($font[$length - 1] !== $quote) continue;
+				$font = substr($font, 1, $length - 2);
+			}
+
+			$font = $this->expandCSSEscape($font);
+
+			// $font is a pure representation of the font name
+
+			if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) {
+				continue;
+			}
+
+			if (ctype_alnum($font) && $font !== '') {
+				// very simple font, allow it in unharmed
+				$final .= $font . ', ';
+				continue;
+			}
+
+			// bugger out on whitespace.  form feed (0C) really
+			// shouldn't show up regardless
+			$font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font);
+
+			// Here, there are various classes of characters which need
+			// to be treated differently:
+			//  - Alphanumeric characters are essentially safe.  We
+			//    handled these above.
+			//  - Spaces require quoting, though most parsers will do
+			//    the right thing if there aren't any characters that
+			//    can be misinterpreted
+			//  - Dashes rarely occur, but they fairly unproblematic
+			//    for parsing/rendering purposes.
+			//  The above characters cover the majority of Western font
+			//  names.
+			//  - Arbitrary Unicode characters not in ASCII.  Because
+			//    most parsers give little thought to Unicode, treatment
+			//    of these codepoints is basically uniform, even for
+			//    punctuation-like codepoints.  These characters can
+			//    show up in non-Western pages and are supported by most
+			//    major browsers, for example: "ＭＳ 明朝" is a
+			//    legitimate font-name
+			//    <http://ja.wikipedia.org/wiki/MS_明朝>.  See
+			//    the CSS3 spec for more examples:
+			//    <http://www.w3.org/TR/2011/WD-css3-fonts-20110324/localizedfamilynames.png>
+			//    You can see live samples of these on the Internet:
+			//    <http://www.google.co.jp/search?q=font-family+ＭＳ+明朝|ゴシック>
+			//    However, most of these fonts have ASCII equivalents:
+			//    for example, 'MS Mincho', and it's considered
+			//    professional to use ASCII font names instead of
+			//    Unicode font names.  Thanks Takeshi Terada for
+			//    providing this information.
+			//  The following characters, to my knowledge, have not been
+			//  used to name font names.
+			//  - Single quote.  While theoretically you might find a
+			//    font name that has a single quote in its name (serving
+			//    as an apostrophe, e.g. Dave's Scribble), I haven't
+			//    been able to find any actual examples of this.
+			//    Internet Explorer's cssText translation (which I
+			//    believe is invoked by innerHTML) normalizes any
+			//    quoting to single quotes, and fails to escape single
+			//    quotes.  (Note that this is not IE's behavior for all
+			//    CSS properties, just some sort of special casing for
+			//    font-family).  So a single quote *cannot* be used
+			//    safely in the font-family context if there will be an
+			//    innerHTML/cssText translation.  Note that Firefox 3.x
+			//    does this too.
+			//  - Double quote.  In IE, these get normalized to
+			//    single-quotes, no matter what the encoding.  (Fun
+			//    fact, in IE8, the 'content' CSS property gained
+			//    support, where they special cased to preserve encoded
+			//    double quotes, but still translate unadorned double
+			//    quotes into single quotes.)  So, because their
+			//    fixpoint behavior is identical to single quotes, they
+			//    cannot be allowed either.  Firefox 3.x displays
+			//    single-quote style behavior.
+			//  - Backslashes are reduced by one (so \\ -> \) every
+			//    iteration, so they cannot be used safely.  This shows
+			//    up in IE7, IE8 and FF3
+			//  - Semicolons, commas and backticks are handled properly.
+			//  - The rest of the ASCII punctuation is handled properly.
+			// We haven't checked what browsers do to unadorned
+			// versions, but this is not important as long as the
+			// browser doesn't /remove/ surrounding quotes (as IE does
+			// for HTML).
+			//
+			// With these results in hand, we conclude that there are
+			// various levels of safety:
+			//  - Paranoid: alphanumeric, spaces and dashes(?)
+			//  - International: Paranoid + non-ASCII Unicode
+			//  - Edgy: Everything except quotes, backslashes
+			//  - NoJS: Standards compliance, e.g. sod IE. Note that
+			//    with some judicious character escaping (since certain
+			//    types of escaping doesn't work) this is theoretically
+			//    OK as long as innerHTML/cssText is not called.
+			// We believe that international is a reasonable default
+			// (that we will implement now), and once we do more
+			// extensive research, we may feel comfortable with dropping
+			// it down to edgy.
+
+			// Edgy: alphanumeric, spaces, dashes and Unicode.  Use of
+			// str(c)spn assumes that the string was already well formed
+			// Unicode (which of course it is).
+			if (strspn($font, $this->mask) !== strlen($font)) {
+				continue;
+			}
+
+			// Historical:
+			// In the absence of innerHTML/cssText, these ugly
+			// transforms don't pose a security risk (as \\ and \"
+			// might--these escapes are not supported by most browsers).
+			// We could try to be clever and use single-quote wrapping
+			// when there is a double quote present, but I have choosen
+			// not to implement that.  (NOTE: you can reduce the amount
+			// of escapes by one depending on what quoting style you use)
+			// $font = str_replace('\\', '\\5C ', $font);
+			// $font = str_replace('"',  '\\22 ', $font);
+			// $font = str_replace("'",  '\\27 ', $font);
+
+			// font possibly with spaces, requires quoting
+			$final .= "'$font', ";
+		}
+		$final = rtrim($final, ', ');
+		if ($final === '') return false;
+		return $final;
+	}
 
 }
 

Braces +22 added lines, -7 removed lines

@@ -10,9 +10,16 @@ 
 
     public function __construct() {
         $this->mask = '- ';
-        for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c;
-        for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c;
-        for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine
+        for ($c = 'a'; $c <= 'z'; $c++) {
+        	$this->mask .= $c;
+        }
+        for ($c = 'A'; $c <= 'Z'; $c++) {
+        	$this->mask .= $c;
+        }
+        for ($c = '0'; $c <= '9'; $c++) {
+        	$this->mask .= $c;
+        }
+        // cast-y, but should be fine
         // special bytes used by UTF-8
         for ($i = 0x80; $i <= 0xFF; $i++) {
             // We don't bother excluding invalid bytes in this range,
@@ -54,7 +61,9 @@ 
         $final = '';
         foreach($fonts as $font) {
             $font = trim($font);
-            if ($font === '') continue;
+            if ($font === '') {
+            	continue;
+            }
             // match a generic name
             if (isset($generic_names[$font])) {
                 if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
@@ -65,9 +74,13 @@ 
             // match a quoted name
             if ($font[0] === '"' || $font[0] === "'") {
                 $length = strlen($font);
-                if ($length <= 2) continue;
+                if ($length <= 2) {
+                	continue;
+                }
                 $quote = $font[0];
-                if ($font[$length - 1] !== $quote) continue;
+                if ($font[$length - 1] !== $quote) {
+                	continue;
+                }
                 $font = substr($font, 1, $length - 2);
             }
 
@@ -188,7 +201,9 @@ 
             $final .= "'$font', ";
         }
         $final = rtrim($final, ', ');
-        if ($final === '') return false;
+        if ($final === '') {
+        	return false;
+        }
         return $final;
     }
 

Spacing +3 added lines, -3 removed lines

@@ -52,13 +52,13 @@ 
         // assume that no font names contain commas in them
         $fonts = explode(',', $string);
         $final = '';
-        foreach($fonts as $font) {
+        foreach ($fonts as $font) {
             $font = trim($font);
             if ($font === '') continue;
             // match a generic name
             if (isset($generic_names[$font])) {
                 if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
-                    $final .= $font . ', ';
+                    $final .= $font.', ';
                 }
                 continue;
             }
@@ -81,7 +81,7 @@ 
 
             if (ctype_alnum($font) && $font !== '') {
                 // very simple font, allow it in unharmed
-                $final .= $font . ', ';
+                $final .= $font.', ';
                 continue;
             }
 

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Ident.php

Indentation +8 added lines, -8 removed lines

@@ -6,18 +6,18 @@
 class HTMLPurifier_AttrDef_CSS_Ident extends HTMLPurifier_AttrDef
 {
 
-    public function validate($string, $config, $context) {
+	public function validate($string, $config, $context) {
 
-        $string = trim($string);
+		$string = trim($string);
 
-        // early abort: '' and '0' (strings that convert to false) are invalid
-        if (!$string) return false;
+		// early abort: '' and '0' (strings that convert to false) are invalid
+		if (!$string) return false;
 
-        $pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
-        if (!preg_match($pattern, $string)) return false;
-        return $string;
+		$pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
+		if (!preg_match($pattern, $string)) return false;
+		return $string;
 
-    }
+	}
 
 }
 

Braces +6 added lines, -2 removed lines

@@ -11,10 +11,14 @@
         $string = trim($string);
 
         // early abort: '' and '0' (strings that convert to false) are invalid
-        if (!$string) return false;
+        if (!$string) {
+        	return false;
+        }
 
         $pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
-        if (!preg_match($pattern, $string)) return false;
+        if (!preg_match($pattern, $string)) {
+        	return false;
+        }
         return $string;
 
     }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php

Indentation +29 added lines, -29 removed lines

@@ -5,36 +5,36 @@
  */
 class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef
 {
-    public $def, $allow;
+	public $def, $allow;
 
-    /**
-     * @param $def Definition to wrap
-     * @param $allow Whether or not to allow !important
-     */
-    public function __construct($def, $allow = false) {
-        $this->def = $def;
-        $this->allow = $allow;
-    }
-    /**
-     * Intercepts and removes !important if necessary
-     */
-    public function validate($string, $config, $context) {
-        // test for ! and important tokens
-        $string = trim($string);
-        $is_important = false;
-        // :TODO: optimization: test directly for !important and ! important
-        if (strlen($string) >= 9 && substr($string, -9) === 'important') {
-            $temp = rtrim(substr($string, 0, -9));
-            // use a temp, because we might want to restore important
-            if (strlen($temp) >= 1 && substr($temp, -1) === '!') {
-                $string = rtrim(substr($temp, 0, -1));
-                $is_important = true;
-            }
-        }
-        $string = $this->def->validate($string, $config, $context);
-        if ($this->allow && $is_important) $string .= ' !important';
-        return $string;
-    }
+	/**
+	 * @param $def Definition to wrap
+	 * @param $allow Whether or not to allow !important
+	 */
+	public function __construct($def, $allow = false) {
+		$this->def = $def;
+		$this->allow = $allow;
+	}
+	/**
+	 * Intercepts and removes !important if necessary
+	 */
+	public function validate($string, $config, $context) {
+		// test for ! and important tokens
+		$string = trim($string);
+		$is_important = false;
+		// :TODO: optimization: test directly for !important and ! important
+		if (strlen($string) >= 9 && substr($string, -9) === 'important') {
+			$temp = rtrim(substr($string, 0, -9));
+			// use a temp, because we might want to restore important
+			if (strlen($temp) >= 1 && substr($temp, -1) === '!') {
+				$string = rtrim(substr($temp, 0, -1));
+				$is_important = true;
+			}
+		}
+		$string = $this->def->validate($string, $config, $context);
+		if ($this->allow && $is_important) $string .= ' !important';
+		return $string;
+	}
 }
 
 // vim: et sw=4 sts=4

Braces +3 added lines, -1 removed lines

@@ -32,7 +32,9 @@
             }
         }
         $string = $this->def->validate($string, $config, $context);
-        if ($this->allow && $is_important) $string .= ' !important';
+        if ($this->allow && $is_important) {
+        	$string .= ' !important';
+        }
         return $string;
     }
 }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/ListStyle.php

Indentation +65 added lines, -65 removed lines

@@ -7,71 +7,71 @@
 class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Local copy of component validators.
-     * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
-     */
-    protected $info;
-
-    public function __construct($config) {
-        $def = $config->getCSSDefinition();
-        $this->info['list-style-type']     = $def->info['list-style-type'];
-        $this->info['list-style-position'] = $def->info['list-style-position'];
-        $this->info['list-style-image'] = $def->info['list-style-image'];
-    }
-
-    public function validate($string, $config, $context) {
-
-        // regular pre-processing
-        $string = $this->parseCDATA($string);
-        if ($string === '') return false;
-
-        // assumes URI doesn't have spaces in it
-        $bits = explode(' ', strtolower($string)); // bits to process
-
-        $caught = array();
-        $caught['type']     = false;
-        $caught['position'] = false;
-        $caught['image']    = false;
-
-        $i = 0; // number of catches
-        $none = false;
-
-        foreach ($bits as $bit) {
-            if ($i >= 3) return; // optimization bit
-            if ($bit === '') continue;
-            foreach ($caught as $key => $status) {
-                if ($status !== false) continue;
-                $r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
-                if ($r === false) continue;
-                if ($r === 'none') {
-                    if ($none) continue;
-                    else $none = true;
-                    if ($key == 'image') continue;
-                }
-                $caught[$key] = $r;
-                $i++;
-                break;
-            }
-        }
-
-        if (!$i) return false;
-
-        $ret = array();
-
-        // construct type
-        if ($caught['type']) $ret[] = $caught['type'];
-
-        // construct image
-        if ($caught['image']) $ret[] = $caught['image'];
-
-        // construct position
-        if ($caught['position']) $ret[] = $caught['position'];
-
-        if (empty($ret)) return false;
-        return implode(' ', $ret);
-
-    }
+	/**
+	 * Local copy of component validators.
+	 * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
+	 */
+	protected $info;
+
+	public function __construct($config) {
+		$def = $config->getCSSDefinition();
+		$this->info['list-style-type']     = $def->info['list-style-type'];
+		$this->info['list-style-position'] = $def->info['list-style-position'];
+		$this->info['list-style-image'] = $def->info['list-style-image'];
+	}
+
+	public function validate($string, $config, $context) {
+
+		// regular pre-processing
+		$string = $this->parseCDATA($string);
+		if ($string === '') return false;
+
+		// assumes URI doesn't have spaces in it
+		$bits = explode(' ', strtolower($string)); // bits to process
+
+		$caught = array();
+		$caught['type']     = false;
+		$caught['position'] = false;
+		$caught['image']    = false;
+
+		$i = 0; // number of catches
+		$none = false;
+
+		foreach ($bits as $bit) {
+			if ($i >= 3) return; // optimization bit
+			if ($bit === '') continue;
+			foreach ($caught as $key => $status) {
+				if ($status !== false) continue;
+				$r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
+				if ($r === false) continue;
+				if ($r === 'none') {
+					if ($none) continue;
+					else $none = true;
+					if ($key == 'image') continue;
+				}
+				$caught[$key] = $r;
+				$i++;
+				break;
+			}
+		}
+
+		if (!$i) return false;
+
+		$ret = array();
+
+		// construct type
+		if ($caught['type']) $ret[] = $caught['type'];
+
+		// construct image
+		if ($caught['image']) $ret[] = $caught['image'];
+
+		// construct position
+		if ($caught['position']) $ret[] = $caught['position'];
+
+		if (empty($ret)) return false;
+		return implode(' ', $ret);
+
+	}
 
 }
 

Braces +39 added lines, -13 removed lines

@@ -24,7 +24,9 @@ 
 
         // regular pre-processing
         $string = $this->parseCDATA($string);
-        if ($string === '') return false;
+        if ($string === '') {
+        	return false;
+        }
 
         // assumes URI doesn't have spaces in it
         $bits = explode(' ', strtolower($string)); // bits to process
@@ -38,16 +40,30 @@ 
         $none = false;
 
         foreach ($bits as $bit) {
-            if ($i >= 3) return; // optimization bit
-            if ($bit === '') continue;
+            if ($i >= 3) {
+            	return;
+            }
+            // optimization bit
+            if ($bit === '') {
+            	continue;
+            }
             foreach ($caught as $key => $status) {
-                if ($status !== false) continue;
+                if ($status !== false) {
+                	continue;
+                }
                 $r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
-                if ($r === false) continue;
+                if ($r === false) {
+                	continue;
+                }
                 if ($r === 'none') {
-                    if ($none) continue;
-                    else $none = true;
-                    if ($key == 'image') continue;
+                    if ($none) {
+                    	continue;
+                    } else {
+                    	$none = true;
+                    }
+                    if ($key == 'image') {
+                    	continue;
+                    }
                 }
                 $caught[$key] = $r;
                 $i++;
@@ -55,20 +71,30 @@ 
             }
         }
 
-        if (!$i) return false;
+        if (!$i) {
+        	return false;
+        }
 
         $ret = array();
 
         // construct type
-        if ($caught['type']) $ret[] = $caught['type'];
+        if ($caught['type']) {
+        	$ret[] = $caught['type'];
+        }
 
         // construct image
-        if ($caught['image']) $ret[] = $caught['image'];
+        if ($caught['image']) {
+        	$ret[] = $caught['image'];
+        }
 
         // construct position
-        if ($caught['position']) $ret[] = $caught['position'];
+        if ($caught['position']) {
+        	$ret[] = $caught['position'];
+        }
 
-        if (empty($ret)) return false;
+        if (empty($ret)) {
+        	return false;
+        }
         return implode(' ', $ret);
 
     }

Spacing +1 added lines, -1 removed lines

@@ -42,7 +42,7 @@
             if ($bit === '') continue;
             foreach ($caught as $key => $status) {
                 if ($status !== false) continue;
-                $r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
+                $r = $this->info['list-style-'.$key]->validate($bit, $config, $context);
                 if ($r === false) continue;
                 if ($r === 'none') {
                     if ($none) continue;

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Multiple.php

Indentation +35 added lines, -35 removed lines

@@ -14,44 +14,44 @@
 class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Instance of component definition to defer validation to.
-     * @todo Make protected
-     */
-    public $single;
+	/**
+	 * Instance of component definition to defer validation to.
+	 * @todo Make protected
+	 */
+	public $single;
 
-    /**
-     * Max number of values allowed.
-     * @todo Make protected
-     */
-    public $max;
+	/**
+	 * Max number of values allowed.
+	 * @todo Make protected
+	 */
+	public $max;
 
-    /**
-     * @param $single HTMLPurifier_AttrDef to multiply
-     * @param $max Max number of values allowed (usually four)
-     */
-    public function __construct($single, $max = 4) {
-        $this->single = $single;
-        $this->max = $max;
-    }
+	/**
+	 * @param $single HTMLPurifier_AttrDef to multiply
+	 * @param $max Max number of values allowed (usually four)
+	 */
+	public function __construct($single, $max = 4) {
+		$this->single = $single;
+		$this->max = $max;
+	}
 
-    public function validate($string, $config, $context) {
-        $string = $this->parseCDATA($string);
-        if ($string === '') return false;
-        $parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n
-        $length = count($parts);
-        $final = '';
-        for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) {
-            if (ctype_space($parts[$i])) continue;
-            $result = $this->single->validate($parts[$i], $config, $context);
-            if ($result !== false) {
-                $final .= $result . ' ';
-                $num++;
-            }
-        }
-        if ($final === '') return false;
-        return rtrim($final);
-    }
+	public function validate($string, $config, $context) {
+		$string = $this->parseCDATA($string);
+		if ($string === '') return false;
+		$parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n
+		$length = count($parts);
+		$final = '';
+		for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) {
+			if (ctype_space($parts[$i])) continue;
+			$result = $this->single->validate($parts[$i], $config, $context);
+			if ($result !== false) {
+				$final .= $result . ' ';
+				$num++;
+			}
+		}
+		if ($final === '') return false;
+		return rtrim($final);
+	}
 
 }
 

Braces +9 added lines, -3 removed lines

@@ -37,19 +37,25 @@
 
     public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
-        if ($string === '') return false;
+        if ($string === '') {
+        	return false;
+        }
         $parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n
         $length = count($parts);
         $final = '';
         for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) {
-            if (ctype_space($parts[$i])) continue;
+            if (ctype_space($parts[$i])) {
+            	continue;
+            }
             $result = $this->single->validate($parts[$i], $config, $context);
             if ($result !== false) {
                 $final .= $result . ' ';
                 $num++;
             }
         }
-        if ($final === '') return false;
+        if ($final === '') {
+        	return false;
+        }
         return rtrim($final);
     }
 

Spacing +1 added lines, -1 removed lines

@@ -45,7 +45,7 @@
             if (ctype_space($parts[$i])) continue;
             $result = $this->single->validate($parts[$i], $config, $context);
             if ($result !== false) {
-                $final .= $result . ' ';
+                $final .= $result.' ';
                 $num++;
             }
         }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Number.php

Indentation +57 added lines, -57 removed lines

@@ -6,63 +6,63 @@
 class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Bool indicating whether or not only positive values allowed.
-     */
-    protected $non_negative = false;
-
-    /**
-     * @param $non_negative Bool indicating whether negatives are forbidden
-     */
-    public function __construct($non_negative = false) {
-        $this->non_negative = $non_negative;
-    }
-
-    /**
-     * @warning Some contexts do not pass $config, $context. These
-     *          variables should not be used without checking HTMLPurifier_Length
-     */
-    public function validate($number, $config, $context) {
-
-        $number = $this->parseCDATA($number);
-
-        if ($number === '') return false;
-        if ($number === '0') return '0';
-
-        $sign = '';
-        switch ($number[0]) {
-            case '-':
-                if ($this->non_negative) return false;
-                $sign = '-';
-            case '+':
-                $number = substr($number, 1);
-        }
-
-        if (ctype_digit($number)) {
-            $number = ltrim($number, '0');
-            return $number ? $sign . $number : '0';
-        }
-
-        // Period is the only non-numeric character allowed
-        if (strpos($number, '.') === false) return false;
-
-        list($left, $right) = explode('.', $number, 2);
-
-        if ($left === '' && $right === '') return false;
-        if ($left !== '' && !ctype_digit($left)) return false;
-
-        $left  = ltrim($left,  '0');
-        $right = rtrim($right, '0');
-
-        if ($right === '') {
-            return $left ? $sign . $left : '0';
-        } elseif (!ctype_digit($right)) {
-            return false;
-        }
-
-        return $sign . $left . '.' . $right;
-
-    }
+	/**
+	 * Bool indicating whether or not only positive values allowed.
+	 */
+	protected $non_negative = false;
+
+	/**
+	 * @param $non_negative Bool indicating whether negatives are forbidden
+	 */
+	public function __construct($non_negative = false) {
+		$this->non_negative = $non_negative;
+	}
+
+	/**
+	 * @warning Some contexts do not pass $config, $context. These
+	 *          variables should not be used without checking HTMLPurifier_Length
+	 */
+	public function validate($number, $config, $context) {
+
+		$number = $this->parseCDATA($number);
+
+		if ($number === '') return false;
+		if ($number === '0') return '0';
+
+		$sign = '';
+		switch ($number[0]) {
+			case '-':
+				if ($this->non_negative) return false;
+				$sign = '-';
+			case '+':
+				$number = substr($number, 1);
+		}
+
+		if (ctype_digit($number)) {
+			$number = ltrim($number, '0');
+			return $number ? $sign . $number : '0';
+		}
+
+		// Period is the only non-numeric character allowed
+		if (strpos($number, '.') === false) return false;
+
+		list($left, $right) = explode('.', $number, 2);
+
+		if ($left === '' && $right === '') return false;
+		if ($left !== '' && !ctype_digit($left)) return false;
+
+		$left  = ltrim($left,  '0');
+		$right = rtrim($right, '0');
+
+		if ($right === '') {
+			return $left ? $sign . $left : '0';
+		} elseif (!ctype_digit($right)) {
+			return false;
+		}
+
+		return $sign . $left . '.' . $right;
+
+	}
 
 }
 

Braces +18 added lines, -6 removed lines

@@ -26,13 +26,19 @@ 
 
         $number = $this->parseCDATA($number);
 
-        if ($number === '') return false;
-        if ($number === '0') return '0';
+        if ($number === '') {
+        	return false;
+        }
+        if ($number === '0') {
+        	return '0';
+        }
 
         $sign = '';
         switch ($number[0]) {
             case '-':
-                if ($this->non_negative) return false;
+                if ($this->non_negative) {
+                	return false;
+                }
                 $sign = '-';
             case '+':
                 $number = substr($number, 1);
@@ -44,12 +50,18 @@ 
         }
 
         // Period is the only non-numeric character allowed
-        if (strpos($number, '.') === false) return false;
+        if (strpos($number, '.') === false) {
+        	return false;
+        }
 
         list($left, $right) = explode('.', $number, 2);
 
-        if ($left === '' && $right === '') return false;
-        if ($left !== '' && !ctype_digit($left)) return false;
+        if ($left === '' && $right === '') {
+        	return false;
+        }
+        if ($left !== '' && !ctype_digit($left)) {
+        	return false;
+        }
 
         $left  = ltrim($left,  '0');
         $right = rtrim($right, '0');

Spacing +4 added lines, -4 removed lines

@@ -40,7 +40,7 @@ 
 
         if (ctype_digit($number)) {
             $number = ltrim($number, '0');
-            return $number ? $sign . $number : '0';
+            return $number ? $sign.$number : '0';
         }
 
         // Period is the only non-numeric character allowed
@@ -51,16 +51,16 @@ 
         if ($left === '' && $right === '') return false;
         if ($left !== '' && !ctype_digit($left)) return false;
 
-        $left  = ltrim($left,  '0');
+        $left  = ltrim($left, '0');
         $right = rtrim($right, '0');
 
         if ($right === '') {
-            return $left ? $sign . $left : '0';
+            return $left ? $sign.$left : '0';
         } elseif (!ctype_digit($right)) {
             return false;
         }
 
-        return $sign . $left . '.' . $right;
+        return $sign.$left.'.'.$right;
 
     }
 

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Percentage.php

Indentation +21 added lines, -21 removed lines

@@ -6,34 +6,34 @@
 class HTMLPurifier_AttrDef_CSS_Percentage extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Instance of HTMLPurifier_AttrDef_CSS_Number to defer number validation
-     */
-    protected $number_def;
+	/**
+	 * Instance of HTMLPurifier_AttrDef_CSS_Number to defer number validation
+	 */
+	protected $number_def;
 
-    /**
-     * @param Bool indicating whether to forbid negative values
-     */
-    public function __construct($non_negative = false) {
-        $this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
-    }
+	/**
+	 * @param Bool indicating whether to forbid negative values
+	 */
+	public function __construct($non_negative = false) {
+		$this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
+	}
 
-    public function validate($string, $config, $context) {
+	public function validate($string, $config, $context) {
 
-        $string = $this->parseCDATA($string);
+		$string = $this->parseCDATA($string);
 
-        if ($string === '') return false;
-        $length = strlen($string);
-        if ($length === 1) return false;
-        if ($string[$length - 1] !== '%') return false;
+		if ($string === '') return false;
+		$length = strlen($string);
+		if ($length === 1) return false;
+		if ($string[$length - 1] !== '%') return false;
 
-        $number = substr($string, 0, $length - 1);
-        $number = $this->number_def->validate($number, $config, $context);
+		$number = substr($string, 0, $length - 1);
+		$number = $this->number_def->validate($number, $config, $context);
 
-        if ($number === false) return false;
-        return "$number%";
+		if ($number === false) return false;
+		return "$number%";
 
-    }
+	}
 
 }
 

Braces +12 added lines, -4 removed lines

@@ -22,15 +22,23 @@
 
         $string = $this->parseCDATA($string);
 
-        if ($string === '') return false;
+        if ($string === '') {
+        	return false;
+        }
         $length = strlen($string);
-        if ($length === 1) return false;
-        if ($string[$length - 1] !== '%') return false;
+        if ($length === 1) {
+        	return false;
+        }
+        if ($string[$length - 1] !== '%') {
+        	return false;
+        }
 
         $number = substr($string, 0, $length - 1);
         $number = $this->number_def->validate($number, $config, $context);
 
-        if ($number === false) return false;
+        if ($number === false) {
+        	return false;
+        }
         return "$number%";
 
     }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/TextDecoration.php

Indentation +24 added lines, -24 removed lines

@@ -8,30 +8,30 @@
 class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
 {
 
-    public function validate($string, $config, $context) {
-
-        static $allowed_values = array(
-            'line-through' => true,
-            'overline' => true,
-            'underline' => true,
-        );
-
-        $string = strtolower($this->parseCDATA($string));
-
-        if ($string === 'none') return $string;
-
-        $parts = explode(' ', $string);
-        $final = '';
-        foreach ($parts as $part) {
-            if (isset($allowed_values[$part])) {
-                $final .= $part . ' ';
-            }
-        }
-        $final = rtrim($final);
-        if ($final === '') return false;
-        return $final;
-
-    }
+	public function validate($string, $config, $context) {
+
+		static $allowed_values = array(
+			'line-through' => true,
+			'overline' => true,
+			'underline' => true,
+		);
+
+		$string = strtolower($this->parseCDATA($string));
+
+		if ($string === 'none') return $string;
+
+		$parts = explode(' ', $string);
+		$final = '';
+		foreach ($parts as $part) {
+			if (isset($allowed_values[$part])) {
+				$final .= $part . ' ';
+			}
+		}
+		$final = rtrim($final);
+		if ($final === '') return false;
+		return $final;
+
+	}
 
 }
 

Braces +6 added lines, -2 removed lines

@@ -18,7 +18,9 @@ 
 
         $string = strtolower($this->parseCDATA($string));
 
-        if ($string === 'none') return $string;
+        if ($string === 'none') {
+        	return $string;
+        }
 
         $parts = explode(' ', $string);
         $final = '';
@@ -28,7 +30,9 @@ 
             }
         }
         $final = rtrim($final);
-        if ($final === '') return false;
+        if ($final === '') {
+        	return false;
+        }
         return $final;
 
     }

Spacing +1 added lines, -1 removed lines

@@ -24,7 +24,7 @@
         $final = '';
         foreach ($parts as $part) {
             if (isset($allowed_values[$part])) {
-                $final .= $part . ' ';
+                $final .= $part.' ';
             }
         }
         $final = rtrim($final);

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/URI.php

Indentation +32 added lines, -32 removed lines

@@ -12,49 +12,49 @@
 class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
 {
 
-    public function __construct() {
-        parent::__construct(true); // always embedded
-    }
+	public function __construct() {
+		parent::__construct(true); // always embedded
+	}
 
-    public function validate($uri_string, $config, $context) {
-        // parse the URI out of the string and then pass it onto
-        // the parent object
+	public function validate($uri_string, $config, $context) {
+		// parse the URI out of the string and then pass it onto
+		// the parent object
 
-        $uri_string = $this->parseCDATA($uri_string);
-        if (strpos($uri_string, 'url(') !== 0) return false;
-        $uri_string = substr($uri_string, 4);
-        $new_length = strlen($uri_string) - 1;
-        if ($uri_string[$new_length] != ')') return false;
-        $uri = trim(substr($uri_string, 0, $new_length));
+		$uri_string = $this->parseCDATA($uri_string);
+		if (strpos($uri_string, 'url(') !== 0) return false;
+		$uri_string = substr($uri_string, 4);
+		$new_length = strlen($uri_string) - 1;
+		if ($uri_string[$new_length] != ')') return false;
+		$uri = trim(substr($uri_string, 0, $new_length));
 
-        if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) {
-            $quote = $uri[0];
-            $new_length = strlen($uri) - 1;
-            if ($uri[$new_length] !== $quote) return false;
-            $uri = substr($uri, 1, $new_length - 1);
-        }
+		if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) {
+			$quote = $uri[0];
+			$new_length = strlen($uri) - 1;
+			if ($uri[$new_length] !== $quote) return false;
+			$uri = substr($uri, 1, $new_length - 1);
+		}
 
-        $uri = $this->expandCSSEscape($uri);
+		$uri = $this->expandCSSEscape($uri);
 
-        $result = parent::validate($uri, $config, $context);
+		$result = parent::validate($uri, $config, $context);
 
-        if ($result === false) return false;
+		if ($result === false) return false;
 
-        // extra sanity check; should have been done by URI
-        $result = str_replace(array('"', "\\", "\n", "\x0c", "\r"), "", $result);
+		// extra sanity check; should have been done by URI
+		$result = str_replace(array('"', "\\", "\n", "\x0c", "\r"), "", $result);
 
-        // suspicious characters are ()'; we're going to percent encode
-        // them for safety.
-        $result = str_replace(array('(', ')', "'"), array('%28', '%29', '%27'), $result);
+		// suspicious characters are ()'; we're going to percent encode
+		// them for safety.
+		$result = str_replace(array('(', ')', "'"), array('%28', '%29', '%27'), $result);
 
-        // there's an extra bug where ampersands lose their escaping on
-        // an innerHTML cycle, so a very unlucky query parameter could
-        // then change the meaning of the URL.  Unfortunately, there's
-        // not much we can do about that...
+		// there's an extra bug where ampersands lose their escaping on
+		// an innerHTML cycle, so a very unlucky query parameter could
+		// then change the meaning of the URL.  Unfortunately, there's
+		// not much we can do about that...
 
-        return "url(\"$result\")";
+		return "url(\"$result\")";
 
-    }
+	}
 
 }
 

Braces +12 added lines, -4 removed lines

@@ -21,16 +21,22 @@ 
         // the parent object
 
         $uri_string = $this->parseCDATA($uri_string);
-        if (strpos($uri_string, 'url(') !== 0) return false;
+        if (strpos($uri_string, 'url(') !== 0) {
+        	return false;
+        }
         $uri_string = substr($uri_string, 4);
         $new_length = strlen($uri_string) - 1;
-        if ($uri_string[$new_length] != ')') return false;
+        if ($uri_string[$new_length] != ')') {
+        	return false;
+        }
         $uri = trim(substr($uri_string, 0, $new_length));
 
         if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) {
             $quote = $uri[0];
             $new_length = strlen($uri) - 1;
-            if ($uri[$new_length] !== $quote) return false;
+            if ($uri[$new_length] !== $quote) {
+            	return false;
+            }
             $uri = substr($uri, 1, $new_length - 1);
         }
 
@@ -38,7 +44,9 @@ 
 
         $result = parent::validate($uri, $config, $context);
 
-        if ($result === false) return false;
+        if ($result === false) {
+        	return false;
+        }
 
         // extra sanity check; should have been done by URI
         $result = str_replace(array('"', "\\", "\n", "\x0c", "\r"), "", $result);