URIScheme.php 3.3 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495
  1. <?php
  2. /**
  3. * Validator for the components of a URI for a specific scheme
  4. */
  5. abstract class HTMLPurifier_URIScheme
  6. {
  7. /**
  8. * Scheme's default port (integer). If an explicit port number is
  9. * specified that coincides with the default port, it will be
  10. * elided.
  11. */
  12. public $default_port = null;
  13. /**
  14. * Whether or not URIs of this schem are locatable by a browser
  15. * http and ftp are accessible, while mailto and news are not.
  16. */
  17. public $browsable = false;
  18. /**
  19. * Whether or not data transmitted over this scheme is encrypted.
  20. * https is secure, http is not.
  21. */
  22. public $secure = false;
  23. /**
  24. * Whether or not the URI always uses <hier_part>, resolves edge cases
  25. * with making relative URIs absolute
  26. */
  27. public $hierarchical = false;
  28. /**
  29. * Whether or not the URI may omit a hostname when the scheme is
  30. * explicitly specified, ala file:///path/to/file. As of writing,
  31. * 'file' is the only scheme that browsers support his properly.
  32. */
  33. public $may_omit_host = false;
  34. /**
  35. * Validates the components of a URI for a specific scheme.
  36. * @param $uri Reference to a HTMLPurifier_URI object
  37. * @param $config HTMLPurifier_Config object
  38. * @param $context HTMLPurifier_Context object
  39. * @return Bool success or failure
  40. */
  41. public abstract function doValidate(&$uri, $config, $context);
  42. /**
  43. * Public interface for validating components of a URI. Performs a
  44. * bunch of default actions. Don't overload this method.
  45. * @param $uri Reference to a HTMLPurifier_URI object
  46. * @param $config HTMLPurifier_Config object
  47. * @param $context HTMLPurifier_Context object
  48. * @return Bool success or failure
  49. */
  50. public function validate(&$uri, $config, $context) {
  51. if ($this->default_port == $uri->port) $uri->port = null;
  52. // kludge: browsers do funny things when the scheme but not the
  53. // authority is set
  54. if (!$this->may_omit_host &&
  55. // if the scheme is present, a missing host is always in error
  56. (!is_null($uri->scheme) && ($uri->host === '' || is_null($uri->host))) ||
  57. // if the scheme is not present, a *blank* host is in error,
  58. // since this translates into '///path' which most browsers
  59. // interpret as being 'http://path'.
  60. (is_null($uri->scheme) && $uri->host === '')
  61. ) {
  62. do {
  63. if (is_null($uri->scheme)) {
  64. if (substr($uri->path, 0, 2) != '//') {
  65. $uri->host = null;
  66. break;
  67. }
  68. // URI is '////path', so we cannot nullify the
  69. // host to preserve semantics. Try expanding the
  70. // hostname instead (fall through)
  71. }
  72. // first see if we can manually insert a hostname
  73. $host = $config->get('URI.Host');
  74. if (!is_null($host)) {
  75. $uri->host = $host;
  76. } else {
  77. // we can't do anything sensible, reject the URL.
  78. return false;
  79. }
  80. } while (false);
  81. }
  82. return $this->doValidate($uri, $config, $context);
  83. }
  84. }
  85. // vim: et sw=4 sts=4