activitypub / includes / class-sanitize.php

class-sanitize.php in ActivityPub 7.7.0, at includes/class-sanitize.php

205 lines 4.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Sanitization file.
4	*
5	* @package Activitypub
6	*/
7
8	namespace Activitypub;
9
10	use Activitypub\Collection\Remote_Actors;
11	use Activitypub\Model\Blog;
12
13	/**
14	* Sanitization class.
15	*/
16	class Sanitize {
17	/**
18	* Sanitize a list of URLs.
19	*
20	* @param string\|array $value The value to sanitize.
21	* @return array The sanitized list of URLs.
22	*/
23	public static function url_list( $value ) {
24	if ( ! \is_array( $value ) ) {
25	$value = \explode( PHP_EOL, (string) $value );
26	}
27
28	$value = \array_filter( $value );
29	$value = \array_map( 'trim', $value );
30	$value = \array_map( 'sanitize_url', $value );
31	$value = \array_unique( $value );
32
33	return \array_values( $value );
34	}
35
36	/**
37	* Sanitize and normalize a list of account identifiers to ActivityPub IDs.
38	*
39	* This function processes various identifier formats, such as URLs and
40	* webfinger identifiers, and normalizes them into a consistent format.
41	*
42	* @param string\|array $value The value to sanitize.
43	*
44	* @return array The sanitized and normalized list of account identifiers.
45	*/
46	public static function identifier_list( $value ) {
47	if ( ! \is_array( $value ) ) {
48	$value = \explode( PHP_EOL, (string) $value );
49	}
50
51	$value = \array_filter( $value );
52	$uris = array();
53
54	foreach ( $value as $uri ) {
55	$uri = \trim( $uri );
56	$uri = \ltrim( $uri, '@' );
57
58	if ( \is_email( $uri ) ) {
59	$_uri = Webfinger::resolve( $uri );
60	if ( \is_wp_error( $_uri ) ) {
61	$uris[] = $uri;
62	continue;
63	}
64
65	$uri = $_uri;
66	}
67
68	$uri = \sanitize_url( $uri );
69	$actor = Remote_Actors::fetch_by_uri( $uri );
70	if ( \is_wp_error( $actor ) ) {
71	$uris[] = $uri;
72	} else {
73	$uris[] = \sanitize_url( $actor->guid );
74	}
75	}
76
77	return \array_values( \array_unique( $uris ) );
78	}
79
80	/**
81	* Sanitize a list of hosts.
82	*
83	* @param string $value The value to sanitize.
84	* @return string The sanitized list of hosts.
85	*/
86	public static function host_list( $value ) {
87	$value = \explode( PHP_EOL, (string) $value );
88	$value = \array_map(
89	function ( $host ) {
90	$host = \trim( $host );
91	$host = \strtolower( $host );
92	$host = \set_url_scheme( $host );
93	$host = \sanitize_url( $host, array( 'http', 'https' ) );
94
95	// Remove protocol.
96	if ( \str_contains( $host, 'http' ) ) {
97	$host = \wp_parse_url( $host, PHP_URL_HOST );
98	}
99
100	return \filter_var( $host, FILTER_VALIDATE_DOMAIN );
101	},
102	$value
103	);
104
105	return \implode( PHP_EOL, \array_filter( $value ) );
106	}
107
108	/**
109	* Sanitize a blog identifier.
110	*
111	* @param string $value The value to sanitize.
112	* @return string The sanitized blog identifier.
113	*/
114	public static function blog_identifier( $value ) {
115	// Hack to allow dots in the username.
116	$parts = \explode( '.', (string) $value );
117	$sanitized = \array_map( 'sanitize_title', $parts );
118	$sanitized = \implode( '.', $sanitized );
119
120	if ( empty( $sanitized ) ) {
121	return Blog::get_default_username();
122	}
123
124	// Check for login or nicename.
125	$user = new \WP_User_Query(
126	array(
127	'search' => $sanitized,
128	'search_columns' => array( 'user_login', 'user_nicename' ),
129	'number' => 1,
130	'hide_empty' => true,
131	'fields' => 'ID',
132	)
133	);
134
135	if ( $user->get_results() ) {
136	\add_settings_error(
137	'activitypub_blog_identifier',
138	'activitypub_blog_identifier',
139	\esc_html__( 'You cannot use an existing author’s name for the blog profile ID.', 'activitypub' )
140	);
141
142	return Blog::get_default_username();
143	}
144
145	return $sanitized;
146	}
147
148	/**
149	* Get the sanitized value of a constant.
150	*
151	* @param mixed $value The constant value.
152	*
153	* @return string The sanitized value.
154	*/
155	public static function constant_value( $value ) {
156	if ( is_bool( $value ) ) {
157	return $value ? 'true' : 'false';
158	}
159
160	if ( is_string( $value ) ) {
161	return esc_attr( $value );
162	}
163
164	if ( is_array( $value ) ) {
165	// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
166	return print_r( $value, true );
167	}
168
169	return $value;
170	}
171
172	/**
173	* Sanitize a webfinger identifier.
174	*
175	* @param string $value The value to sanitize.
176	*
177	* @return string The sanitized webfinger identifier.
178	*/
179	public static function webfinger( $value ) {
180	$value = \str_replace( 'acct:', '', $value );
181	$value = \trim( $value, '@' );
182
183	return $value;
184	}
185
186	/**
187	* Sanitize content for ActivityPub.
188	*
189	* @param string $content The content to convert.
190	*
191	* @return string The converted content.
192	*/
193	public static function content( $content ) {
194	// Only make URLs clickable if no anchor tags exist, to avoid corrupting existing links.
195	if ( false === \strpos( $content, '<a ' ) ) {
196	$content = \make_clickable( $content );
197	}
198
199	$content = \wpautop( $content );
200	$content = \wp_kses_post( $content );
201
202	return $content;
203	}
204	}
205