xpressengine / xe-core

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme.php

Indentation +77 added lines, -77 removed lines

@@ -6,89 +6,89 @@
 abstract class HTMLPurifier_URIScheme
 {
 
-    /**
-     * Scheme's default port (integer).  If an explicit port number is
-     * specified that coincides with the default port, it will be
-     * elided.
-     */
-    public $default_port = null;
+	/**
+	 * Scheme's default port (integer).  If an explicit port number is
+	 * specified that coincides with the default port, it will be
+	 * elided.
+	 */
+	public $default_port = null;
 
-    /**
-     * Whether or not URIs of this schem are locatable by a browser
-     * http and ftp are accessible, while mailto and news are not.
-     */
-    public $browsable = false;
+	/**
+	 * Whether or not URIs of this schem are locatable by a browser
+	 * http and ftp are accessible, while mailto and news are not.
+	 */
+	public $browsable = false;
 
-    /**
-     * Whether or not data transmitted over this scheme is encrypted.
-     * https is secure, http is not.
-     */
-    public $secure = false;
+	/**
+	 * Whether or not data transmitted over this scheme is encrypted.
+	 * https is secure, http is not.
+	 */
+	public $secure = false;
 
-    /**
-     * Whether or not the URI always uses <hier_part>, resolves edge cases
-     * with making relative URIs absolute
-     */
-    public $hierarchical = false;
+	/**
+	 * Whether or not the URI always uses <hier_part>, resolves edge cases
+	 * with making relative URIs absolute
+	 */
+	public $hierarchical = false;
 
-    /**
-     * Whether or not the URI may omit a hostname when the scheme is
-     * explicitly specified, ala file:///path/to/file. As of writing,
-     * 'file' is the only scheme that browsers support his properly.
-     */
-    public $may_omit_host = false;
+	/**
+	 * Whether or not the URI may omit a hostname when the scheme is
+	 * explicitly specified, ala file:///path/to/file. As of writing,
+	 * 'file' is the only scheme that browsers support his properly.
+	 */
+	public $may_omit_host = false;
 
-    /**
-     * Validates the components of a URI for a specific scheme.
-     * @param $uri Reference to a HTMLPurifier_URI object
-     * @param $config HTMLPurifier_Config object
-     * @param $context HTMLPurifier_Context object
-     * @return Bool success or failure
-     */
-    public abstract function doValidate(&$uri, $config, $context);
+	/**
+	 * Validates the components of a URI for a specific scheme.
+	 * @param $uri Reference to a HTMLPurifier_URI object
+	 * @param $config HTMLPurifier_Config object
+	 * @param $context HTMLPurifier_Context object
+	 * @return Bool success or failure
+	 */
+	public abstract function doValidate(&$uri, $config, $context);
 
-    /**
-     * Public interface for validating components of a URI.  Performs a
-     * bunch of default actions. Don't overload this method.
-     * @param $uri Reference to a HTMLPurifier_URI object
-     * @param $config HTMLPurifier_Config object
-     * @param $context HTMLPurifier_Context object
-     * @return Bool success or failure
-     */
-    public function validate(&$uri, $config, $context) {
-        if ($this->default_port == $uri->port) $uri->port = null;
-        // kludge: browsers do funny things when the scheme but not the
-        // authority is set
-        if (!$this->may_omit_host &&
-            // if the scheme is present, a missing host is always in error
-            (!is_null($uri->scheme) && ($uri->host === '' || is_null($uri->host))) ||
-            // if the scheme is not present, a *blank* host is in error,
-            // since this translates into '///path' which most browsers
-            // interpret as being 'http://path'.
-             (is_null($uri->scheme) && $uri->host === '')
-        ) {
-            do {
-                if (is_null($uri->scheme)) {
-                    if (substr($uri->path, 0, 2) != '//') {
-                        $uri->host = null;
-                        break;
-                    }
-                    // URI is '////path', so we cannot nullify the
-                    // host to preserve semantics.  Try expanding the
-                    // hostname instead (fall through)
-                }
-                // first see if we can manually insert a hostname
-                $host = $config->get('URI.Host');
-                if (!is_null($host)) {
-                    $uri->host = $host;
-                } else {
-                    // we can't do anything sensible, reject the URL.
-                    return false;
-                }
-            } while (false);
-        }
-        return $this->doValidate($uri, $config, $context);
-    }
+	/**
+	 * Public interface for validating components of a URI.  Performs a
+	 * bunch of default actions. Don't overload this method.
+	 * @param $uri Reference to a HTMLPurifier_URI object
+	 * @param $config HTMLPurifier_Config object
+	 * @param $context HTMLPurifier_Context object
+	 * @return Bool success or failure
+	 */
+	public function validate(&$uri, $config, $context) {
+		if ($this->default_port == $uri->port) $uri->port = null;
+		// kludge: browsers do funny things when the scheme but not the
+		// authority is set
+		if (!$this->may_omit_host &&
+			// if the scheme is present, a missing host is always in error
+			(!is_null($uri->scheme) && ($uri->host === '' || is_null($uri->host))) ||
+			// if the scheme is not present, a *blank* host is in error,
+			// since this translates into '///path' which most browsers
+			// interpret as being 'http://path'.
+			 (is_null($uri->scheme) && $uri->host === '')
+		) {
+			do {
+				if (is_null($uri->scheme)) {
+					if (substr($uri->path, 0, 2) != '//') {
+						$uri->host = null;
+						break;
+					}
+					// URI is '////path', so we cannot nullify the
+					// host to preserve semantics.  Try expanding the
+					// hostname instead (fall through)
+				}
+				// first see if we can manually insert a hostname
+				$host = $config->get('URI.Host');
+				if (!is_null($host)) {
+					$uri->host = $host;
+				} else {
+					// we can't do anything sensible, reject the URL.
+					return false;
+				}
+			} while (false);
+		}
+		return $this->doValidate($uri, $config, $context);
+	}
 
 }
 

Braces +3 added lines, -1 removed lines

@@ -56,7 +56,9 @@
      * @return Bool success or failure
      */
     public function validate(&$uri, $config, $context) {
-        if ($this->default_port == $uri->port) $uri->port = null;
+        if ($this->default_port == $uri->port) {
+        	$uri->port = null;
+        }
         // kludge: browsers do funny things when the scheme but not the
         // authority is set
         if (!$this->may_omit_host &&

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/data.php

Indentation +84 added lines, -84 removed lines

@@ -5,92 +5,92 @@
  */
 class HTMLPurifier_URIScheme_data extends HTMLPurifier_URIScheme {
 
-    public $browsable = true;
-    public $allowed_types = array(
-        // you better write validation code for other types if you
-        // decide to allow them
-        'image/jpeg' => true,
-        'image/gif' => true,
-        'image/png' => true,
-        );
-    // this is actually irrelevant since we only write out the path
-    // component
-    public $may_omit_host = true;
+	public $browsable = true;
+	public $allowed_types = array(
+		// you better write validation code for other types if you
+		// decide to allow them
+		'image/jpeg' => true,
+		'image/gif' => true,
+		'image/png' => true,
+		);
+	// this is actually irrelevant since we only write out the path
+	// component
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $result = explode(',', $uri->path, 2);
-        $is_base64 = false;
-        $charset = null;
-        $content_type = null;
-        if (count($result) == 2) {
-            list($metadata, $data) = $result;
-            // do some legwork on the metadata
-            $metas = explode(';', $metadata);
-            while(!empty($metas)) {
-                $cur = array_shift($metas);
-                if ($cur == 'base64') {
-                    $is_base64 = true;
-                    break;
-                }
-                if (substr($cur, 0, 8) == 'charset=') {
-                    // doesn't match if there are arbitrary spaces, but
-                    // whatever dude
-                    if ($charset !== null) continue; // garbage
-                    $charset = substr($cur, 8); // not used
-                } else {
-                    if ($content_type !== null) continue; // garbage
-                    $content_type = $cur;
-                }
-            }
-        } else {
-            $data = $result[0];
-        }
-        if ($content_type !== null && empty($this->allowed_types[$content_type])) {
-            return false;
-        }
-        if ($charset !== null) {
-            // error; we don't allow plaintext stuff
-            $charset = null;
-        }
-        $data = rawurldecode($data);
-        if ($is_base64) {
-            $raw_data = base64_decode($data);
-        } else {
-            $raw_data = $data;
-        }
-        // XXX probably want to refactor this into a general mechanism
-        // for filtering arbitrary content types
-        $file = tempnam("/tmp", "");
-        file_put_contents($file, $raw_data, LOCK_EX);
-        if (function_exists('exif_imagetype')) {
-            $image_code = exif_imagetype($file);
-        } elseif (function_exists('getimagesize')) {
-            set_error_handler(array($this, 'muteErrorHandler'));
-            $info = getimagesize($file);
-            restore_error_handler();
-            if ($info == false) return false;
-            $image_code = $info[2];
-        } else {
-            trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
-        }
-        $real_content_type = image_type_to_mime_type($image_code);
-        if ($real_content_type != $content_type) {
-            // we're nice guys; if the content type is something else we
-            // support, change it over
-            if (empty($this->allowed_types[$real_content_type])) return false;
-            $content_type = $real_content_type;
-        }
-        // ok, it's kosher, rewrite what we need
-        $uri->userinfo = null;
-        $uri->host = null;
-        $uri->port = null;
-        $uri->fragment = null;
-        $uri->query = null;
-        $uri->path = "$content_type;base64," . base64_encode($raw_data);
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$result = explode(',', $uri->path, 2);
+		$is_base64 = false;
+		$charset = null;
+		$content_type = null;
+		if (count($result) == 2) {
+			list($metadata, $data) = $result;
+			// do some legwork on the metadata
+			$metas = explode(';', $metadata);
+			while(!empty($metas)) {
+				$cur = array_shift($metas);
+				if ($cur == 'base64') {
+					$is_base64 = true;
+					break;
+				}
+				if (substr($cur, 0, 8) == 'charset=') {
+					// doesn't match if there are arbitrary spaces, but
+					// whatever dude
+					if ($charset !== null) continue; // garbage
+					$charset = substr($cur, 8); // not used
+				} else {
+					if ($content_type !== null) continue; // garbage
+					$content_type = $cur;
+				}
+			}
+		} else {
+			$data = $result[0];
+		}
+		if ($content_type !== null && empty($this->allowed_types[$content_type])) {
+			return false;
+		}
+		if ($charset !== null) {
+			// error; we don't allow plaintext stuff
+			$charset = null;
+		}
+		$data = rawurldecode($data);
+		if ($is_base64) {
+			$raw_data = base64_decode($data);
+		} else {
+			$raw_data = $data;
+		}
+		// XXX probably want to refactor this into a general mechanism
+		// for filtering arbitrary content types
+		$file = tempnam("/tmp", "");
+		file_put_contents($file, $raw_data, LOCK_EX);
+		if (function_exists('exif_imagetype')) {
+			$image_code = exif_imagetype($file);
+		} elseif (function_exists('getimagesize')) {
+			set_error_handler(array($this, 'muteErrorHandler'));
+			$info = getimagesize($file);
+			restore_error_handler();
+			if ($info == false) return false;
+			$image_code = $info[2];
+		} else {
+			trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
+		}
+		$real_content_type = image_type_to_mime_type($image_code);
+		if ($real_content_type != $content_type) {
+			// we're nice guys; if the content type is something else we
+			// support, change it over
+			if (empty($this->allowed_types[$real_content_type])) return false;
+			$content_type = $real_content_type;
+		}
+		// ok, it's kosher, rewrite what we need
+		$uri->userinfo = null;
+		$uri->host = null;
+		$uri->port = null;
+		$uri->fragment = null;
+		$uri->query = null;
+		$uri->path = "$content_type;base64," . base64_encode($raw_data);
+		return true;
+	}
 
-    public function muteErrorHandler($errno, $errstr) {}
+	public function muteErrorHandler($errno, $errstr) {}
 
 }
 

Spacing +1 added lines, -1 removed lines

@@ -26,7 +26,7 @@
             list($metadata, $data) = $result;
             // do some legwork on the metadata
             $metas = explode(';', $metadata);
-            while(!empty($metas)) {
+            while (!empty($metas)) {
                 $cur = array_shift($metas);
                 if ($cur == 'base64') {
                     $is_base64 = true;

Braces +14 added lines, -4 removed lines

@@ -35,10 +35,16 @@ 
                 if (substr($cur, 0, 8) == 'charset=') {
                     // doesn't match if there are arbitrary spaces, but
                     // whatever dude
-                    if ($charset !== null) continue; // garbage
+                    if ($charset !== null) {
+                    	continue;
+                    }
+                    // garbage
                     $charset = substr($cur, 8); // not used
                 } else {
-                    if ($content_type !== null) continue; // garbage
+                    if ($content_type !== null) {
+                    	continue;
+                    }
+                    // garbage
                     $content_type = $cur;
                 }
             }
@@ -68,7 +74,9 @@ 
             set_error_handler(array($this, 'muteErrorHandler'));
             $info = getimagesize($file);
             restore_error_handler();
-            if ($info == false) return false;
+            if ($info == false) {
+            	return false;
+            }
             $image_code = $info[2];
         } else {
             trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
@@ -77,7 +85,9 @@ 
         if ($real_content_type != $content_type) {
             // we're nice guys; if the content type is something else we
             // support, change it over
-            if (empty($this->allowed_types[$real_content_type])) return false;
+            if (empty($this->allowed_types[$real_content_type])) {
+            	return false;
+            }
             $content_type = $real_content_type;
         }
         // ok, it's kosher, rewrite what we need

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/file.php

Indentation +19 added lines, -19 removed lines

@@ -5,27 +5,27 @@
  */
 class HTMLPurifier_URIScheme_file extends HTMLPurifier_URIScheme {
 
-    // Generally file:// URLs are not accessible from most
-    // machines, so placing them as an img src is incorrect.
-    public $browsable = false;
+	// Generally file:// URLs are not accessible from most
+	// machines, so placing them as an img src is incorrect.
+	public $browsable = false;
 
-    // Basically the *only* URI scheme for which this is true, since
-    // accessing files on the local machine is very common.  In fact,
-    // browsers on some operating systems don't understand the
-    // authority, though I hear it is used on Windows to refer to
-    // network shares.
-    public $may_omit_host = true;
+	// Basically the *only* URI scheme for which this is true, since
+	// accessing files on the local machine is very common.  In fact,
+	// browsers on some operating systems don't understand the
+	// authority, though I hear it is used on Windows to refer to
+	// network shares.
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        // Authentication method is not supported
-        $uri->userinfo = null;
-        // file:// makes no provisions for accessing the resource
-        $uri->port     = null;
-        // While it seems to work on Firefox, the querystring has
-        // no possible effect and is thus stripped.
-        $uri->query    = null;
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		// Authentication method is not supported
+		$uri->userinfo = null;
+		// file:// makes no provisions for accessing the resource
+		$uri->port     = null;
+		// While it seems to work on Firefox, the querystring has
+		// no possible effect and is thus stripped.
+		$uri->query    = null;
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/ftp.php

Indentation +28 added lines, -28 removed lines

@@ -5,37 +5,37 @@
  */
 class HTMLPurifier_URIScheme_ftp extends HTMLPurifier_URIScheme {
 
-    public $default_port = 21;
-    public $browsable = true; // usually
-    public $hierarchical = true;
+	public $default_port = 21;
+	public $browsable = true; // usually
+	public $hierarchical = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->query    = null;
+	public function doValidate(&$uri, $config, $context) {
+		$uri->query    = null;
 
-        // typecode check
-        $semicolon_pos = strrpos($uri->path, ';'); // reverse
-        if ($semicolon_pos !== false) {
-            $type = substr($uri->path, $semicolon_pos + 1); // no semicolon
-            $uri->path = substr($uri->path, 0, $semicolon_pos);
-            $type_ret = '';
-            if (strpos($type, '=') !== false) {
-                // figure out whether or not the declaration is correct
-                list($key, $typecode) = explode('=', $type, 2);
-                if ($key !== 'type') {
-                    // invalid key, tack it back on encoded
-                    $uri->path .= '%3B' . $type;
-                } elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') {
-                    $type_ret = ";type=$typecode";
-                }
-            } else {
-                $uri->path .= '%3B' . $type;
-            }
-            $uri->path = str_replace(';', '%3B', $uri->path);
-            $uri->path .= $type_ret;
-        }
+		// typecode check
+		$semicolon_pos = strrpos($uri->path, ';'); // reverse
+		if ($semicolon_pos !== false) {
+			$type = substr($uri->path, $semicolon_pos + 1); // no semicolon
+			$uri->path = substr($uri->path, 0, $semicolon_pos);
+			$type_ret = '';
+			if (strpos($type, '=') !== false) {
+				// figure out whether or not the declaration is correct
+				list($key, $typecode) = explode('=', $type, 2);
+				if ($key !== 'type') {
+					// invalid key, tack it back on encoded
+					$uri->path .= '%3B' . $type;
+				} elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') {
+					$type_ret = ";type=$typecode";
+				}
+			} else {
+				$uri->path .= '%3B' . $type;
+			}
+			$uri->path = str_replace(';', '%3B', $uri->path);
+			$uri->path .= $type_ret;
+		}
 
-        return true;
-    }
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/http.php

Indentation +7 added lines, -7 removed lines

@@ -5,14 +5,14 @@
  */
 class HTMLPurifier_URIScheme_http extends HTMLPurifier_URIScheme {
 
-    public $default_port = 80;
-    public $browsable = true;
-    public $hierarchical = true;
+	public $default_port = 80;
+	public $browsable = true;
+	public $hierarchical = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/https.php

Indentation +2 added lines, -2 removed lines

@@ -5,8 +5,8 @@
  */
 class HTMLPurifier_URIScheme_https extends HTMLPurifier_URIScheme_http {
 
-    public $default_port = 443;
-    public $secure = true;
+	public $default_port = 443;
+	public $secure = true;
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/mailto.php

Indentation +9 added lines, -9 removed lines

@@ -11,16 +11,16 @@
 
 class HTMLPurifier_URIScheme_mailto extends HTMLPurifier_URIScheme {
 
-    public $browsable = false;
-    public $may_omit_host = true;
+	public $browsable = false;
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        $uri->host     = null;
-        $uri->port     = null;
-        // we need to validate path against RFC 2368's addr-spec
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		$uri->host     = null;
+		$uri->port     = null;
+		// we need to validate path against RFC 2368's addr-spec
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/news.php

Indentation +10 added lines, -10 removed lines

@@ -5,17 +5,17 @@
  */
 class HTMLPurifier_URIScheme_news extends HTMLPurifier_URIScheme {
 
-    public $browsable = false;
-    public $may_omit_host = true;
+	public $browsable = false;
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        $uri->host     = null;
-        $uri->port     = null;
-        $uri->query    = null;
-        // typecode check needed on path
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		$uri->host     = null;
+		$uri->port     = null;
+		$uri->query    = null;
+		// typecode check needed on path
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/nntp.php

Indentation +7 added lines, -7 removed lines

@@ -5,14 +5,14 @@
  */
 class HTMLPurifier_URIScheme_nntp extends HTMLPurifier_URIScheme {
 
-    public $default_port = 119;
-    public $browsable = false;
+	public $default_port = 119;
+	public $browsable = false;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        $uri->query    = null;
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		$uri->query    = null;
+		return true;
+	}
 
 }