Editor
2 months ago
Embed
1 month ago
Links
2 months ago
Listing
9 months ago
Options
2 years ago
Preview
1 month ago
Renderer
4 days ago
RestApi
1 week ago
Scheduler
4 days ago
Segment
1 year ago
Sending
1 week ago
Sharing
1 month ago
Shortcodes
2 days ago
Statistics
1 week ago
ViewInBrowser
1 month ago
ApiDataSanitizer.php
3 years ago
AutomatedLatestContent.php
2 months ago
AutomaticEmailsRepository.php
3 years ago
BlockPostQuery.php
2 months ago
BulkActionController.php
1 month ago
BulkActionException.php
1 month ago
DynamicProducts.php
11 months ago
NewsletterCoupon.php
2 months ago
NewsletterDeleteController.php
2 years ago
NewsletterHtmlSanitizer.php
2 years ago
NewsletterPostsRepository.php
2 years ago
NewsletterResendController.php
4 days ago
NewsletterSaveController.php
1 month ago
NewsletterValidator.php
1 year ago
NewslettersRepository.php
2 weeks ago
StatusController.php
1 month ago
Url.php
2 months ago
index.php
3 years ago
NewsletterHtmlSanitizer.php
129 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\Newsletter; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\WP\Functions as WPFunctions; |
| 9 | |
| 10 | class NewsletterHtmlSanitizer { |
| 11 | /** @var WPFunctions */ |
| 12 | private $wp; |
| 13 | |
| 14 | /** |
| 15 | * @var array |
| 16 | * Configuration of allowed tags for form blocks that may contain some html. |
| 17 | * Covers all tags available in the form editor's Rich Text component |
| 18 | */ |
| 19 | private $allowedHtml = [ |
| 20 | 'p' => [ |
| 21 | 'class' => true, |
| 22 | 'style' => true, |
| 23 | ], |
| 24 | 'span' => [ |
| 25 | 'class' => true, |
| 26 | 'style' => true, |
| 27 | ], |
| 28 | 'a' => [ |
| 29 | 'href' => true, |
| 30 | 'class' => true, |
| 31 | 'title' => true, |
| 32 | 'target' => true, |
| 33 | 'style' => true, |
| 34 | ], |
| 35 | 'h1' => [ |
| 36 | 'class' => true, |
| 37 | 'style' => true, |
| 38 | ], |
| 39 | 'h2' => [ |
| 40 | 'class' => true, |
| 41 | 'style' => true, |
| 42 | ], |
| 43 | 'h3' => [ |
| 44 | 'class' => true, |
| 45 | 'style' => true, |
| 46 | ], |
| 47 | 'ol' => [ |
| 48 | 'class' => true, |
| 49 | 'style' => true, |
| 50 | ], |
| 51 | 'ul' => [ |
| 52 | 'class' => true, |
| 53 | 'style' => true, |
| 54 | ], |
| 55 | 'li' => [ |
| 56 | 'class' => true, |
| 57 | 'style' => true, |
| 58 | ], |
| 59 | 'strong' => [ |
| 60 | 'class' => true, |
| 61 | 'style' => true, |
| 62 | ], |
| 63 | 'em' => [ |
| 64 | 'class' => true, |
| 65 | 'style' => true, |
| 66 | ], |
| 67 | 'strike' => [], |
| 68 | 'br' => [], |
| 69 | 'blockquote' => [ |
| 70 | 'class' => true, |
| 71 | 'style' => true, |
| 72 | ], |
| 73 | 'table' => [ |
| 74 | 'class' => true, |
| 75 | 'style' => true, |
| 76 | ], |
| 77 | 'tr' => [ |
| 78 | 'class' => true, |
| 79 | 'style' => true, |
| 80 | ], |
| 81 | 'th' => [ |
| 82 | 'class' => true, |
| 83 | 'style' => true, |
| 84 | ], |
| 85 | 'td' => [ |
| 86 | 'class' => true, |
| 87 | 'style' => true, |
| 88 | ], |
| 89 | 'del' => [], |
| 90 | ]; |
| 91 | |
| 92 | public function __construct( |
| 93 | WPFunctions $wp |
| 94 | ) { |
| 95 | $this->wp = $wp; |
| 96 | } |
| 97 | |
| 98 | public function sanitize(string $html): string { |
| 99 | // Because wpKses break shortcodes we prefix shortcodes with http protocol |
| 100 | $html = str_replace('href="[', 'href="http://[', $html); |
| 101 | $this->wp->addFilter('safecss_filter_attr_allow_css', [$this, 'allowRgbInCss'], 10, 2); |
| 102 | $html = $this->wp->wpKses($html, $this->allowedHtml); |
| 103 | $this->wp->removeFilter('safecss_filter_attr_allow_css', [$this, 'allowRgbInCss'], 10); |
| 104 | $html = str_replace('href="http://[', 'href="[', $html); |
| 105 | return $html; |
| 106 | } |
| 107 | |
| 108 | /** |
| 109 | * At the moment rgb() is not allowed to use in the style attribute. `style="color:rgb(0,0,0);"` gets |
| 110 | * sanitized if you use wp_kses. We hook into safecss_filter_attr_allow_css to allow for rgb. The code |
| 111 | * follows the precedent WordPress sets for the usage of var(), calc() etc. in safecss_filter_attr() |
| 112 | */ |
| 113 | public function allowRgbInCss($allowed, $cssString): bool { |
| 114 | if ($allowed) { |
| 115 | return (bool)$allowed; |
| 116 | } |
| 117 | $cssString = preg_replace( |
| 118 | '/\b(?:rgb)(\((?:[^()]|(?1))*\))/', |
| 119 | '', |
| 120 | $cssString |
| 121 | ); |
| 122 | return !preg_match('%[\\\(&=}]|/\*%', $cssString); |
| 123 | } |
| 124 | |
| 125 | public function sanitizeURL(string $url): string { |
| 126 | return $this->wp->escUrlRaw($url); |
| 127 | } |
| 128 | } |
| 129 |