ContentPreprocessor.php
2 years ago
FontFamilyValidator.php
11 months ago
Renderer.php
11 months ago
Template.php
2 years ago
index.php
3 years ago
FontFamilyValidator.php
50 lines
| 1 | <?php declare(strict_types = 1); |
| 2 | |
| 3 | namespace MailPoet\WooCommerce\TransactionalEmails; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | /** |
| 9 | * Validator for font family values in CSS styles. |
| 10 | */ |
| 11 | class FontFamilyValidator { |
| 12 | |
| 13 | const DEFAULT_FONT_FAMILY = 'Arial, sans-serif'; |
| 14 | |
| 15 | public function validateFontFamily(?string $fontFamily): string { |
| 16 | if (empty($fontFamily)) { |
| 17 | return self::DEFAULT_FONT_FAMILY; |
| 18 | } |
| 19 | |
| 20 | $sanitized = $this->sanitizeFontFamily($fontFamily); |
| 21 | |
| 22 | if (empty($sanitized)) { |
| 23 | return self::DEFAULT_FONT_FAMILY; |
| 24 | } |
| 25 | |
| 26 | return $sanitized; |
| 27 | } |
| 28 | |
| 29 | private function sanitizeFontFamily(string $fontFamily): string { |
| 30 | // Remove characters that could break CSS context |
| 31 | $sanitized = str_replace([ |
| 32 | '"', "'", ';', '<', '>', '\\', '/', '(', ')', '{', '}', '[', ']', |
| 33 | '=', '+', '*', '^', '$', '@', '!', '~', '`', '|', '#', '%', '&', '?', ':', |
| 34 | ], '', $fontFamily); |
| 35 | |
| 36 | // Normalize whitespace |
| 37 | $sanitized = preg_replace('/\s+/u', ' ', $sanitized); |
| 38 | if ($sanitized === null) { |
| 39 | return ''; |
| 40 | } |
| 41 | |
| 42 | $sanitized = preg_replace('/\s*,\s*/u', ', ', $sanitized); |
| 43 | if ($sanitized === null) { |
| 44 | return ''; |
| 45 | } |
| 46 | |
| 47 | return trim($sanitized); |
| 48 | } |
| 49 | } |
| 50 |