Horde 3.1.3 : /lib/Horde/Text/Filter/xss.php source

[Sommaire] [Imprimer]
   1  <?php
   2  /**
   3   * This filter attempts to make HTML safe for viewing. IT IS NOT PERFECT. If
   4   * you enable HTML viewing, you are opening a security hole. With the current
   5   * state of the web, I believe that the best we can do is to make sure that
   6   * people *KNOW* HTML is a security hole, clean up what we can, and leave it
   7   * at that.
   8   *
   9   * $Horde: framework/Text_Filter/Filter/xss.php,v 1.1.2.3 2006/02/09 16:40:41 jan Exp $
  10   *
  11   * Copyright 2004-2006 Jan Schneider <jan@horde.org>
  12   *
  13   * See the enclosed file COPYING for license information (LGPL). If you
  14   * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html.
  15   *
  16   * @author  Jan Schneider <jan@horde.org>
  17   * @since   Horde 3.1
  18   * @package Horde_Text
  19   */
  20  class Text_Filter_xss extends Text_Filter {
  21  
  22      /**
  23       * Filter parameters.
  24       *
  25       * @var array
  26       */
  27      var $_params = array('body_only' => true,
  28                           'replace' => 'XSSCleaned',
  29                           'strip_styles' => true);
  30  
  31      /**
  32       * Returns a hash with replace patterns.
  33       *
  34       * @return array  Patterns hash.
  35       */
  36      function getPatterns()
  37      {
  38          $patterns = array();
  39  
  40          /* Removes HTML comments (including some scripts & styles). */
  41          if ($this->_params['strip_styles']) {
  42              $patterns['/<!--.*?-->/s'] = '';
  43          }
  44  
  45          /* Change space entities to space characters. */
  46          $patterns['/&#(x0*20|0*32);?/i'] = ' ';
  47  
  48          /* Nuke non-printable characters (a play in three acts). */
  49  
  50          /* Rule 1). Remove all control characters. */
  51          //$data = preg_replace('/[\x00-\x08\x0e-\x1f]/', '', $data);
  52  
  53          /* Rule 1). If we have a semicolon, it is deterministically detectable
  54           * and fixable, without introducing collateral damage. */
  55          $patterns['/&#x?0*([9A-D]|1[0-3]);/i'] = '&nbsp;';
  56  
  57          /* Rule 2). Hex numbers (usually having an x prefix) are also
  58           * deterministic, even if we don't have the semi. Note that some
  59           * browsers will treat &#a or &#0a as a hex number even without the x
  60           * prefix; hence /x?/ which will cover those cases in this rule. */
  61          $patterns['/&#x?0*[9A-D]([^0-9A-F]|$)/i'] = '&nbsp\\1';
  62  
  63          /* Rule 3). Decimal numbers without trailing semicolons. The problem
  64           * is that some browsers will interpret &#10a as "\na", some as
  65           * "&#x10a" so we have to clean the &#10 to be safe for the "\na" case
  66           * at the expense of mangling a valid entity in other cases. (Solution
  67           * for valid HTML authors: always use the semicolon.) */
  68          $patterns['/&#0*(9|1[0-3])([^0-9]|$)/i'] = '&nbsp\\2';
  69  
  70          /* Remove overly long numeric entities. */
  71          $patterns['/&#x?0*[0-9A-F]{6,};?/i'] = '&nbsp;';
  72  
  73          /* Remove everything outside of and including the <body> tag. */
  74          if ($this->_params['body_only']) {
  75              $patterns['/.*<body[^>]*>/si'] = '';
  76              $patterns['/<\/body>.*/si'] = '';
  77          }
  78  
  79          /* Get all attribute="javascript:foo()" tags. This is essentially the
  80           * regex /(=|url\()("?)[^>]*script:/ but expanded to catch camouflage
  81           * with spaces and entities. */
  82          $preg = '/((&#0*61;?|&#x0*3D;?|=)|' .
  83                  '((u|&#0*85;?|&#x0*55;?|&#0*117;?|&#x0*75;?)\s*' .
  84                  '(r|&#0*82;?|&#x0*52;?|&#0*114;?|&#x0*72;?)\s*' .
  85                  '(l|&#0*76;?|&#x0*4c;?|&#0*108;?|&#x0*6c;?)\s*' .
  86                  '(\()))\s*' .
  87                  '(&#0*34;?|&#x0*22;?|"|&#0*39;?|&#x0*27;?|\')?' .
  88                  '[^>]*\s*' .
  89                  '(s|&#0*83;?|&#x0*53;?|&#0*115;?|&#x0*73;?)\s*' .
  90                  '(c|&#0*67;?|&#x0*43;?|&#0*99;?|&#x0*63;?)\s*' .
  91                  '(r|&#0*82;?|&#x0*52;?|&#0*114;?|&#x0*72;?)\s*' .
  92                  '(i|&#0*73;?|&#x0*49;?|&#0*105;?|&#x0*69;?)\s*' .
  93                  '(p|&#0*80;?|&#x0*50;?|&#0*112;?|&#x0*70;?)\s*' .
  94                  '(t|&#0*84;?|&#x0*54;?|&#0*116;?|&#x0*74;?)\s*' .
  95                  '(:|&#0*58;?|&#x0*3a;?)/i';
  96          $patterns[$preg] = '\1\8' . $this->_params['replace'];
  97  
  98          /* Get all on<foo>="bar()". NEVER allow these. */
  99          $patterns['/([\s"\']+' .
 100                    '(o|&#0*79;?|&#0*4f;?|&#0*111;?|&#0*6f;?)' .
 101                    '(n|&#0*78;?|&#0*4e;?|&#0*110;?|&#0*6e;?)' .
 102                    '\w+)\s*=/i'] = '\1' . $this->_params['replace'] . '=';
 103  
 104          /* Remove all scripts since they might introduce garbage if they are
 105           * not quoted properly. */
 106          $patterns['|<script[^>]*>.*?</script>|is'] = '<' . $this->_params['replace'] . '_script />';
 107  
 108          /* Get all tags that might cause trouble - <object>, <embed>, <base>,
 109           * etc. Meta refreshes and iframes, too. */
 110          $malicious = array(
 111              '/<([^>a-z]*)' .
 112              '(s|&#0*83;?|&#x0*53;?|&#0*115;?|&#x0*73;?)\s*' .
 113              '(c|&#0*67;?|&#x0*43;?|&#0*99;?|&#x0*63;?)\s*' .
 114              '(r|&#0*82;?|&#x0*52;?|&#0*114;?|&#x0*72;?)\s*' .
 115              '(i|&#0*73;?|&#x0*49;?|&#0*105;?|&#x0*69;?)\s*' .
 116              '(p|&#0*80;?|&#x0*50;?|&#0*112;?|&#x0*70;?)\s*' .
 117              '(t|&#0*84;?|&#x0*54;?|&#0*116;?|&#x0*74;?)\s*/i',
 118  
 119              '/<([^>a-z]*)' .
 120              '(e|&#0*69;?|&#0*45;?|&#0*101;?|&#0*65;?)\s*' .
 121              '(m|&#0*77;?|&#0*4d;?|&#0*109;?|&#0*6d;?)\s*' .
 122              '(b|&#0*66;?|&#0*42;?|&#0*98;?|&#0*62;?)\s*' .
 123              '(e|&#0*69;?|&#0*45;?|&#0*101;?|&#0*65;?)\s*' .
 124              '(d|&#0*68;?|&#0*44;?|&#0*100;?|&#0*64;?)\s*/i',
 125  
 126              '/<([^>a-z]*)' .
 127              '(x|&#0*88;?|&#0*58;?|&#0*120;?|&#0*78;?)\s*' .
 128              '(m|&#0*77;?|&#0*4d;?|&#0*109;?|&#0*6d;?)\s*' .
 129              '(l|&#0*76;?|&#x0*4c;?|&#0*108;?|&#x0*6c;?)\s*/i',
 130  
 131              '/<([^>a-z]*)' .
 132              '(b|&#0*66;?|&#0*42;?|&#0*98;?|&#0*62;?)\s*' .
 133              '(a|&#0*65;?|&#0*41;?|&#0*97;?|&#0*61;?)\s*' .
 134              '(s|&#0*83;?|&#x0*53;?|&#0*115;?|&#x0*73;?)\s*' .
 135              '(e|&#0*69;?|&#0*45;?|&#0*101;?|&#0*65;?)\s*' .
 136              '[^line]/i',
 137  
 138              '/<([^>a-z]*)' .
 139              '(m|&#0*77;?|&#0*4d;?|&#0*109;?|&#0*6d;?)\s*' .
 140              '(e|&#0*69;?|&#0*45;?|&#0*101;?|&#0*65;?)\s*' .
 141              '(t|&#0*84;?|&#x0*54;?|&#0*116;?|&#x0*74;?)\s*' .
 142              '(a|&#0*65;?|&#0*41;?|&#0*97;?|&#0*61;?)\s*/i',
 143  
 144              '/<([^>a-z]*)' .
 145              '(j|&#0*74;?|&#0*4a;?|&#0*106;?|&#0*6a;?)\s*' .
 146              '(a|&#0*65;?|&#0*41;?|&#0*97;?|&#0*61;?)\s*' .
 147              '(v|&#0*86;?|&#0*56;?|&#0*118;?|&#0*76;?)\s*' .
 148              '(a|&#0*65;?|&#0*41;?|&#0*97;?|&#0*61;?)\s*/i',
 149  
 150              '/<([^>a-z]*)' .
 151              '(o|&#0*79;?|&#0*4f;?|&#0*111;?|&#0*6f;?)\s*' .
 152              '(b|&#0*66;?|&#0*42;?|&#0*98;?|&#0*62;?)\s*' .
 153              '(j|&#0*74;?|&#0*4a;?|&#0*106;?|&#0*6a;?)\s*' .
 154              '(e|&#0*69;?|&#0*45;?|&#0*101;?|&#0*65;?)\s*' .
 155              '(c|&#0*67;?|&#x0*43;?|&#0*99;?|&#x0*63;?)\s*' .
 156              '(t|&#0*84;?|&#x0*54;?|&#0*116;?|&#x0*74;?)\s*/i',
 157  
 158              '/<([^>a-z]*)' .
 159              '(i|&#0*73;?|&#x0*49;?|&#0*105;?|&#x0*69;?)\s*' .
 160              '(f|&#0*70;?|&#0*46;?|&#0*102;?|&#0*66;?)\s*' .
 161              '(r|&#0*82;?|&#x0*52;?|&#0*114;?|&#x0*72;?)\s*' .
 162              '(a|&#0*65;?|&#0*41;?|&#0*97;?|&#0*61;?)\s*' .
 163              '(m|&#0*77;?|&#0*4d;?|&#0*109;?|&#0*6d;?)\s*' .
 164              '(e|&#0*69;?|&#0*45;?|&#0*101;?|&#0*65;?)\s*/i');
 165  
 166          foreach ($malicious as $pattern) {
 167              $patterns[$pattern] = '<' . $this->_params['replace'] . '_tag';
 168          }
 169  
 170          /* Comment out style/link tags. */
 171          if ($this->_params['strip_styles']) {
 172              $patterns['/\s+style\s*=/i'] = ' ' . $this->_params['replace'] . '=';
 173              $patterns['|<style[^>]*>(?:\s*<\!--)*|i'] = '<!--';
 174              $patterns['|(?:-->\s*)*</style>|i'] = '-->';
 175              $patterns['|(<link[^>]*>)|i'] = '<!-- $1 -->';
 176          }
 177  
 178          /* A few other matches. */
 179          $patterns['|<([^>]*)&{.*}([^>]*)>|'] = '<&{;}\3>';
 180          $patterns['|<([^>]*)mocha:([^>]*)>|i'] = '<\1' . $this->_params['replace'] . ':\2>';
 181          $patterns['|<([^>]*)binding:([^>]*)>|i'] = '<\1' . $this->_params['replace'] . ':\2>';
 182  
 183          return array('regexp' => $patterns);
 184      }
 185  
 186  }
Code source de Horde 3.1.3

/lib/Horde/Text/Filter/ -> xss.php (source)
