ArrayUtil.php
7 months ago
BlocksUtil.php
5 months ago
COTMigrationUtil.php
1 year ago
DatabaseUtil.php
1 year ago
FilesystemUtil.php
3 months ago
HtmlSanitizer.php
2 years ago
LegacyRestApiStub.php
4 weeks ago
PluginInstaller.php
1 year ago
ProductUtil.php
9 months ago
Types.php
1 year ago
URL.php
1 year ago
URLException.php
4 years ago
Users.php
4 months ago
WebhookUtil.php
4 weeks ago
HtmlSanitizer.php
103 lines
| 1 | <?php |
| 2 | |
| 3 | namespace Automattic\WooCommerce\Internal\Utilities; |
| 4 | |
| 5 | /** |
| 6 | * Utility for re-using WP Kses-based sanitization rules. |
| 7 | */ |
| 8 | class HtmlSanitizer { |
| 9 | /** |
| 10 | * Rules for allowing minimal HTML (breaks, images, paragraphs and spans) without any links. |
| 11 | */ |
| 12 | public const LOW_HTML_BALANCED_TAGS_NO_LINKS = array( |
| 13 | 'pre_processors' => array( |
| 14 | 'stripslashes', |
| 15 | 'force_balance_tags', |
| 16 | ), |
| 17 | 'wp_kses_rules' => array( |
| 18 | 'br' => true, |
| 19 | 'img' => array( |
| 20 | 'alt' => true, |
| 21 | 'class' => true, |
| 22 | 'src' => true, |
| 23 | 'title' => true, |
| 24 | ), |
| 25 | 'p' => array( |
| 26 | 'class' => true, |
| 27 | ), |
| 28 | 'span' => array( |
| 29 | 'class' => true, |
| 30 | 'title' => true, |
| 31 | ), |
| 32 | ), |
| 33 | ); |
| 34 | |
| 35 | /** |
| 36 | * Sanitizes a chunk of HTML, by following the same rules as `wp_kses_post()` but also allowing |
| 37 | * the style element to be supplied. |
| 38 | * |
| 39 | * @param string $html The HTML to be sanitized. |
| 40 | * |
| 41 | * @return string |
| 42 | */ |
| 43 | public function styled_post_content( string $html ): string { |
| 44 | $rules = wp_kses_allowed_html( 'post' ); |
| 45 | $rules['style'] = true; |
| 46 | return wp_kses( $html, $rules ); |
| 47 | } |
| 48 | |
| 49 | /** |
| 50 | * Sanitizes the HTML according to the provided rules. |
| 51 | * |
| 52 | * @see wp_kses() |
| 53 | * |
| 54 | * @param string $html HTML string to be sanitized. |
| 55 | * @param array $sanitizer_rules { |
| 56 | * Optional and defaults to self::TRIMMED_BALANCED_LOW_HTML_NO_LINKS. Otherwise, one or more of the following |
| 57 | * keys should be set. |
| 58 | * |
| 59 | * @type array $pre_processors Callbacks to run before invoking `wp_kses()`. |
| 60 | * @type array $wp_kses_rules Element names and attributes to allow, per `wp_kses()`. |
| 61 | * } |
| 62 | * |
| 63 | * @return string |
| 64 | */ |
| 65 | public function sanitize( string $html, array $sanitizer_rules = self::LOW_HTML_BALANCED_TAGS_NO_LINKS ): string { |
| 66 | if ( isset( $sanitizer_rules['pre_processors'] ) && is_array( $sanitizer_rules['pre_processors'] ) ) { |
| 67 | $html = $this->apply_string_callbacks( $sanitizer_rules['pre_processors'], $html ); |
| 68 | } |
| 69 | |
| 70 | // If no KSES rules are specified, assume all HTML should be stripped. |
| 71 | $kses_rules = isset( $sanitizer_rules['wp_kses_rules'] ) && is_array( $sanitizer_rules['wp_kses_rules'] ) |
| 72 | ? $sanitizer_rules['wp_kses_rules'] |
| 73 | : array(); |
| 74 | |
| 75 | return wp_kses( $html, $kses_rules ); |
| 76 | } |
| 77 | |
| 78 | /** |
| 79 | * Applies callbacks used to process the string before and after wp_kses(). |
| 80 | * |
| 81 | * If a callback is invalid we will short-circuit and return an empty string, on the grounds that it is better to |
| 82 | * output nothing than risky HTML. We also call the problem out via _doing_it_wrong() to highlight the problem (and |
| 83 | * increase the chances of this being caught during development). |
| 84 | * |
| 85 | * @param callable[] $callbacks The callbacks used to mutate the string. |
| 86 | * @param string $string The string being processed. |
| 87 | * |
| 88 | * @return string |
| 89 | */ |
| 90 | private function apply_string_callbacks( array $callbacks, string $string ): string { |
| 91 | foreach ( $callbacks as $callback ) { |
| 92 | if ( ! is_callable( $callback ) ) { |
| 93 | _doing_it_wrong( __CLASS__ . '::apply', esc_html__( 'String processors must be an array of valid callbacks.', 'woocommerce' ), esc_html( WC()->version ) ); |
| 94 | return ''; |
| 95 | } |
| 96 | |
| 97 | $string = (string) $callback( $string ); |
| 98 | } |
| 99 | |
| 100 | return $string; |
| 101 | } |
| 102 | } |
| 103 |