This commit is contained in:
Javier Casares 2026-08-17 17:56:43 +00:00
commit 3a25585090
42 changed files with 1124 additions and 711 deletions

View file

@ -24,7 +24,14 @@ use League\CommonMark\Util\RegexHelper;
final class AttributesHelper
{
private const SINGLE_ATTRIBUTE = '\s*([.]-?[_a-z][^\s.}]*|[#][^\s}]+|' . RegexHelper::PARTIAL_ATTRIBUTENAME . RegexHelper::PARTIAL_ATTRIBUTEVALUESPEC . ')\s*';
private const ATTRIBUTE_LIST = '/^{:?(' . self::SINGLE_ATTRIBUTE . ')+}/i';
private const ATTRIBUTE_LIST = '/\G{:?(' . self::SINGLE_ATTRIBUTE . ')+}/i';
/**
* PCRE's `\s` matches the form feed that PHP's default trim charlist omits, so the
* separators SINGLE_ATTRIBUTE accepts must be trimmed with this list instead - otherwise
* that byte survives inside an attribute name, where a browser reads it as a separator.
*/
private const WHITESPACE = " \t\n\r\0\x0B\x0C";
/**
* @return array<string, mixed>
@ -46,7 +53,7 @@ final class AttributesHelper
// matching individual attributes since they won't need to look ahead for the closing '}'
// while dealing with the fact that attributes can technically contain curly braces.
// So we'll just match the start and end braces up front.
$attributeExpression = $cursor->match(self::ATTRIBUTE_LIST);
$attributeExpression = $cursor->matchInPlace(self::ATTRIBUTE_LIST);
if ($attributeExpression === null) {
$cursor->restoreState($state);
@ -59,7 +66,7 @@ final class AttributesHelper
/** @var array<string, mixed> $attributes */
$attributes = [];
while ($attribute = \trim((string) $attributeCursor->match('/^' . self::SINGLE_ATTRIBUTE . '/i'))) {
while ($attribute = \trim((string) $attributeCursor->matchInPlace('/\G' . self::SINGLE_ATTRIBUTE . '/i'), self::WHITESPACE)) {
if ($attribute[0] === '#') {
$attributes['id'] = \substr($attribute, 1);
@ -86,12 +93,12 @@ final class AttributesHelper
$value = \substr($value, 1, -1);
}
if (\strtolower(\trim($name)) === 'class') {
foreach (\array_filter(\explode(' ', \trim($value))) as $class) {
if (\strtolower(\trim($name, self::WHITESPACE)) === 'class') {
foreach (\array_filter(\explode(' ', \trim($value, self::WHITESPACE))) as $class) {
$attributes['class'][] = $class;
}
} else {
$attributes[\trim($name)] = \trim($value);
$attributes[\trim($name, self::WHITESPACE)] = \trim($value, self::WHITESPACE);
}
}
@ -119,11 +126,7 @@ final class AttributesHelper
/** @var array<string, mixed> $arg */
$arg = (array) $arg;
if (isset($arg['class'])) {
if (\is_string($arg['class'])) {
$arg['class'] = \array_filter(\explode(' ', \trim($arg['class'])));
}
foreach ($arg['class'] as $class) {
foreach (self::classList($arg['class']) as $class) {
$attributes['class'][] = $class;
}
@ -140,6 +143,22 @@ final class AttributesHelper
return $attributes;
}
/**
* Split a `class` attribute value into the individual classes it contributes to a merge
*
* @param mixed $class
*
* @return list<string>
*/
public static function classList($class): array
{
if (\is_string($class)) {
return \array_values(\array_filter(\explode(' ', \trim($class))));
}
return \array_values((array) $class);
}
/**
* @param array<string, mixed> $attributes
* @param list<string> $allowList
@ -151,7 +170,15 @@ final class AttributesHelper
$allowList = \array_fill_keys($allowList, true);
foreach ($attributes as $name => $value) {
$attrNameLower = \strtolower($name);
// The checks below compare against literal names, and the renderer emits names
// without escaping them, so anything that isn't a well-formed attribute name
// would slip past both
if (\preg_match('/^' . RegexHelper::PARTIAL_ATTRIBUTENAME . '$/i', (string) $name) !== 1) {
unset($attributes[$name]);
continue;
}
$attrNameLower = \strtolower((string) $name);
// Remove any unsafe links
if (! $allowUnsafeLinks && ($attrNameLower === 'href' || $attrNameLower === 'src') && \is_string($value) && RegexHelper::isLinkPotentiallyUnsafe($value)) {