v1.2.1
This commit is contained in:
parent
7d3fc1969d
commit
3a25585090
42 changed files with 1124 additions and 711 deletions
|
|
@ -24,7 +24,14 @@ use League\CommonMark\Util\RegexHelper;
|
|||
final class AttributesHelper
|
||||
{
|
||||
private const SINGLE_ATTRIBUTE = '\s*([.]-?[_a-z][^\s.}]*|[#][^\s}]+|' . RegexHelper::PARTIAL_ATTRIBUTENAME . RegexHelper::PARTIAL_ATTRIBUTEVALUESPEC . ')\s*';
|
||||
private const ATTRIBUTE_LIST = '/^{:?(' . self::SINGLE_ATTRIBUTE . ')+}/i';
|
||||
private const ATTRIBUTE_LIST = '/\G{:?(' . self::SINGLE_ATTRIBUTE . ')+}/i';
|
||||
|
||||
/**
|
||||
* PCRE's `\s` matches the form feed that PHP's default trim charlist omits, so the
|
||||
* separators SINGLE_ATTRIBUTE accepts must be trimmed with this list instead - otherwise
|
||||
* that byte survives inside an attribute name, where a browser reads it as a separator.
|
||||
*/
|
||||
private const WHITESPACE = " \t\n\r\0\x0B\x0C";
|
||||
|
||||
/**
|
||||
* @return array<string, mixed>
|
||||
|
|
@ -46,7 +53,7 @@ final class AttributesHelper
|
|||
// matching individual attributes since they won't need to look ahead for the closing '}'
|
||||
// while dealing with the fact that attributes can technically contain curly braces.
|
||||
// So we'll just match the start and end braces up front.
|
||||
$attributeExpression = $cursor->match(self::ATTRIBUTE_LIST);
|
||||
$attributeExpression = $cursor->matchInPlace(self::ATTRIBUTE_LIST);
|
||||
if ($attributeExpression === null) {
|
||||
$cursor->restoreState($state);
|
||||
|
||||
|
|
@ -59,7 +66,7 @@ final class AttributesHelper
|
|||
|
||||
/** @var array<string, mixed> $attributes */
|
||||
$attributes = [];
|
||||
while ($attribute = \trim((string) $attributeCursor->match('/^' . self::SINGLE_ATTRIBUTE . '/i'))) {
|
||||
while ($attribute = \trim((string) $attributeCursor->matchInPlace('/\G' . self::SINGLE_ATTRIBUTE . '/i'), self::WHITESPACE)) {
|
||||
if ($attribute[0] === '#') {
|
||||
$attributes['id'] = \substr($attribute, 1);
|
||||
|
||||
|
|
@ -86,12 +93,12 @@ final class AttributesHelper
|
|||
$value = \substr($value, 1, -1);
|
||||
}
|
||||
|
||||
if (\strtolower(\trim($name)) === 'class') {
|
||||
foreach (\array_filter(\explode(' ', \trim($value))) as $class) {
|
||||
if (\strtolower(\trim($name, self::WHITESPACE)) === 'class') {
|
||||
foreach (\array_filter(\explode(' ', \trim($value, self::WHITESPACE))) as $class) {
|
||||
$attributes['class'][] = $class;
|
||||
}
|
||||
} else {
|
||||
$attributes[\trim($name)] = \trim($value);
|
||||
$attributes[\trim($name, self::WHITESPACE)] = \trim($value, self::WHITESPACE);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -119,11 +126,7 @@ final class AttributesHelper
|
|||
/** @var array<string, mixed> $arg */
|
||||
$arg = (array) $arg;
|
||||
if (isset($arg['class'])) {
|
||||
if (\is_string($arg['class'])) {
|
||||
$arg['class'] = \array_filter(\explode(' ', \trim($arg['class'])));
|
||||
}
|
||||
|
||||
foreach ($arg['class'] as $class) {
|
||||
foreach (self::classList($arg['class']) as $class) {
|
||||
$attributes['class'][] = $class;
|
||||
}
|
||||
|
||||
|
|
@ -140,6 +143,22 @@ final class AttributesHelper
|
|||
return $attributes;
|
||||
}
|
||||
|
||||
/**
|
||||
* Split a `class` attribute value into the individual classes it contributes to a merge
|
||||
*
|
||||
* @param mixed $class
|
||||
*
|
||||
* @return list<string>
|
||||
*/
|
||||
public static function classList($class): array
|
||||
{
|
||||
if (\is_string($class)) {
|
||||
return \array_values(\array_filter(\explode(' ', \trim($class))));
|
||||
}
|
||||
|
||||
return \array_values((array) $class);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array<string, mixed> $attributes
|
||||
* @param list<string> $allowList
|
||||
|
|
@ -151,7 +170,15 @@ final class AttributesHelper
|
|||
$allowList = \array_fill_keys($allowList, true);
|
||||
|
||||
foreach ($attributes as $name => $value) {
|
||||
$attrNameLower = \strtolower($name);
|
||||
// The checks below compare against literal names, and the renderer emits names
|
||||
// without escaping them, so anything that isn't a well-formed attribute name
|
||||
// would slip past both
|
||||
if (\preg_match('/^' . RegexHelper::PARTIAL_ATTRIBUTENAME . '$/i', (string) $name) !== 1) {
|
||||
unset($attributes[$name]);
|
||||
continue;
|
||||
}
|
||||
|
||||
$attrNameLower = \strtolower((string) $name);
|
||||
|
||||
// Remove any unsafe links
|
||||
if (! $allowUnsafeLinks && ($attrNameLower === 'href' || $attrNameLower === 'src') && \is_string($value) && RegexHelper::isLinkPotentiallyUnsafe($value)) {
|
||||
|
|
|
|||
Loading…
Reference in a new issue