+ If set to true, blank nodes will be removed. This can be useful for maintaining + backwards compatibility when upgrading from previous versions of PHP. +
+--# vim: et sw=4 sts=4 diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php index b82c6bb20..bfad967fb 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php @@ -287,13 +287,14 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac } elseif (filegroup($dir) === posix_getgid()) { $chmod = $chmod | 0070; } else { - // PHP's probably running as nobody, so we'll - // need to give global permissions - $chmod = $chmod | 0777; + // PHP's probably running as nobody, it is + // not obvious how to fix this (777 is probably + // bad if you are multi-user), let the user figure it out + $chmod = null; } trigger_error( - 'Directory ' . $dir . ' not writable, ' . - 'please chmod to ' . decoct($chmod), + 'Directory ' . $dir . ' not writable. ' . + ($chmod === null ? '' : 'Please chmod to ' . decoct($chmod)), E_USER_WARNING ); } else { diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCacheFactory.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCacheFactory.php index fd1cc9be4..3a0f4616a 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCacheFactory.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCacheFactory.php @@ -71,7 +71,7 @@ class HTMLPurifier_DefinitionCacheFactory return $this->caches[$method][$type]; } if (isset($this->implementations[$method]) && - class_exists($class = $this->implementations[$method], false)) { + class_exists($class = $this->implementations[$method])) { $cache = new $class($type); } else { if ($method != 'Serializer') { diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/EntityParser.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/EntityParser.php index 3ef2d09ec..0f2b83dc8 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/EntityParser.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/EntityParser.php @@ -116,8 +116,8 @@ class HTMLPurifier_EntityParser protected function entityCallback($matches) { $entity = $matches[0]; - $hex_part = @$matches[1]; - $dec_part = @$matches[2]; + $hex_part = isset($matches[1]) ? $matches[1] : null; + $dec_part = isset($matches[2]) ? $matches[2] : null; $named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3]; if ($hex_part !== NULL && $hex_part !== "") { return HTMLPurifier_Encoder::unichr(hexdec($hex_part)); diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php index 66f70b0fc..e7e3cac1a 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php @@ -54,6 +54,11 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter */ private $_enum_attrdef; + /** + * @type HTMLPurifier_AttrDef_Enum + */ + private $_universal_attrdef; + public function __construct() { $this->_tidy = new csstidy(); @@ -70,6 +75,13 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter 'focus' ) ); + $this->_universal_attrdef = new HTMLPurifier_AttrDef_Enum( + array( + 'initial', + 'inherit', + 'unset', + ) + ); } /** @@ -146,175 +158,184 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter foreach ($this->_tidy->css as $k => $decls) { // $decls are all CSS declarations inside an @ selector $new_decls = array(); - foreach ($decls as $selector => $style) { - $selector = trim($selector); - if ($selector === '') { - continue; - } // should not happen - // Parse the selector - // Here is the relevant part of the CSS grammar: - // - // ruleset - // : selector [ ',' S* selector ]* '{' ... - // selector - // : simple_selector [ combinator selector | S+ [ combinator? selector ]? ]? - // combinator - // : '+' S* - // : '>' S* - // simple_selector - // : element_name [ HASH | class | attrib | pseudo ]* - // | [ HASH | class | attrib | pseudo ]+ - // element_name - // : IDENT | '*' - // ; - // class - // : '.' IDENT - // ; - // attrib - // : '[' S* IDENT S* [ [ '=' | INCLUDES | DASHMATCH ] S* - // [ IDENT | STRING ] S* ]? ']' - // ; - // pseudo - // : ':' [ IDENT | FUNCTION S* [IDENT S*]? ')' ] - // ; - // - // For reference, here are the relevant tokens: - // - // HASH #{name} - // IDENT {ident} - // INCLUDES == - // DASHMATCH |= - // STRING {string} - // FUNCTION {ident}\( - // - // And the lexical scanner tokens - // - // name {nmchar}+ - // nmchar [_a-z0-9-]|{nonascii}|{escape} - // nonascii [\240-\377] - // escape {unicode}|\\[^\r\n\f0-9a-f] - // unicode \\{h}}{1,6}(\r\n|[ \t\r\n\f])? - // ident -?{nmstart}{nmchar*} - // nmstart [_a-z]|{nonascii}|{escape} - // string {string1}|{string2} - // string1 \"([^\n\r\f\\"]|\\{nl}|{escape})*\" - // string2 \'([^\n\r\f\\"]|\\{nl}|{escape})*\' - // - // We'll implement a subset (in order to reduce attack - // surface); in particular: - // - // - No Unicode support - // - No escapes support - // - No string support (by proxy no attrib support) - // - element_name is matched against allowed - // elements (some people might find this - // annoying...) - // - Pseudo-elements one of :first-child, :link, - // :visited, :active, :hover, :focus + if (is_array($decls)) { + foreach ($decls as $selector => $style) { + $selector = trim($selector); + if ($selector === '') { + continue; + } // should not happen + // Parse the selector + // Here is the relevant part of the CSS grammar: + // + // ruleset + // : selector [ ',' S* selector ]* '{' ... + // selector + // : simple_selector [ combinator selector | S+ [ combinator? selector ]? ]? + // combinator + // : '+' S* + // : '>' S* + // simple_selector + // : element_name [ HASH | class | attrib | pseudo ]* + // | [ HASH | class | attrib | pseudo ]+ + // element_name + // : IDENT | '*' + // ; + // class + // : '.' IDENT + // ; + // attrib + // : '[' S* IDENT S* [ [ '=' | INCLUDES | DASHMATCH ] S* + // [ IDENT | STRING ] S* ]? ']' + // ; + // pseudo + // : ':' [ IDENT | FUNCTION S* [IDENT S*]? ')' ] + // ; + // + // For reference, here are the relevant tokens: + // + // HASH #{name} + // IDENT {ident} + // INCLUDES == + // DASHMATCH |= + // STRING {string} + // FUNCTION {ident}\( + // + // And the lexical scanner tokens + // + // name {nmchar}+ + // nmchar [_a-z0-9-]|{nonascii}|{escape} + // nonascii [\240-\377] + // escape {unicode}|\\[^\r\n\f0-9a-f] + // unicode \\{h}}{1,6}(\r\n|[ \t\r\n\f])? + // ident -?{nmstart}{nmchar*} + // nmstart [_a-z]|{nonascii}|{escape} + // string {string1}|{string2} + // string1 \"([^\n\r\f\\"]|\\{nl}|{escape})*\" + // string2 \'([^\n\r\f\\"]|\\{nl}|{escape})*\' + // + // We'll implement a subset (in order to reduce attack + // surface); in particular: + // + // - No Unicode support + // - No escapes support + // - No string support (by proxy no attrib support) + // - element_name is matched against allowed + // elements (some people might find this + // annoying...) + // - Pseudo-elements one of :first-child, :link, + // :visited, :active, :hover, :focus - // handle ruleset - $selectors = array_map('trim', explode(',', $selector)); - $new_selectors = array(); - foreach ($selectors as $sel) { - // split on +, > and spaces - $basic_selectors = preg_split('/\s*([+> ])\s*/', $sel, -1, PREG_SPLIT_DELIM_CAPTURE); - // even indices are chunks, odd indices are - // delimiters - $nsel = null; - $delim = null; // guaranteed to be non-null after - // two loop iterations - for ($i = 0, $c = count($basic_selectors); $i < $c; $i++) { - $x = $basic_selectors[$i]; - if ($i % 2) { - // delimiter - if ($x === ' ') { - $delim = ' '; - } else { - $delim = ' ' . $x . ' '; - } - } else { - // simple selector - $components = preg_split('/([#.:])/', $x, -1, PREG_SPLIT_DELIM_CAPTURE); - $sdelim = null; - $nx = null; - for ($j = 0, $cc = count($components); $j < $cc; $j++) { - $y = $components[$j]; - if ($j === 0) { - if ($y === '*' || isset($html_definition->info[$y = strtolower($y)])) { - $nx = $y; - } else { - // $nx stays null; this matters - // if we don't manage to find - // any valid selector content, - // in which case we ignore the - // outer $delim - } - } elseif ($j % 2) { - // set delimiter - $sdelim = $y; + // handle ruleset + $selectors = array_map('trim', explode(',', $selector)); + $new_selectors = array(); + foreach ($selectors as $sel) { + // split on +, > and spaces + $basic_selectors = preg_split('/\s*([+> ])\s*/', $sel, -1, PREG_SPLIT_DELIM_CAPTURE); + // even indices are chunks, odd indices are + // delimiters + $nsel = null; + $delim = null; // guaranteed to be non-null after + // two loop iterations + for ($i = 0, $c = count($basic_selectors); $i < $c; $i++) { + $x = $basic_selectors[$i]; + if ($i % 2) { + // delimiter + if ($x === ' ') { + $delim = ' '; } else { - $attrdef = null; - if ($sdelim === '#') { - $attrdef = $this->_id_attrdef; - } elseif ($sdelim === '.') { - $attrdef = $this->_class_attrdef; - } elseif ($sdelim === ':') { - $attrdef = $this->_enum_attrdef; - } else { - throw new HTMLPurifier_Exception('broken invariant sdelim and preg_split'); - } - $r = $attrdef->validate($y, $config, $context); - if ($r !== false) { - if ($r !== true) { - $y = $r; - } - if ($nx === null) { - $nx = ''; - } - $nx .= $sdelim . $y; - } - } - } - if ($nx !== null) { - if ($nsel === null) { - $nsel = $nx; - } else { - $nsel .= $delim . $nx; + $delim = ' ' . $x . ' '; } } else { - // delimiters to the left of invalid - // basic selector ignored + // simple selector + $components = preg_split('/([#.:])/', $x, -1, PREG_SPLIT_DELIM_CAPTURE); + $sdelim = null; + $nx = null; + for ($j = 0, $cc = count($components); $j < $cc; $j++) { + $y = $components[$j]; + if ($j === 0) { + if ($y === '*' || isset($html_definition->info[$y = strtolower($y)])) { + $nx = $y; + } else { + // $nx stays null; this matters + // if we don't manage to find + // any valid selector content, + // in which case we ignore the + // outer $delim + } + } elseif ($j % 2) { + // set delimiter + $sdelim = $y; + } else { + $attrdef = null; + if ($sdelim === '#') { + $attrdef = $this->_id_attrdef; + } elseif ($sdelim === '.') { + $attrdef = $this->_class_attrdef; + } elseif ($sdelim === ':') { + $attrdef = $this->_enum_attrdef; + } else { + throw new HTMLPurifier_Exception('broken invariant sdelim and preg_split'); + } + $r = $attrdef->validate($y, $config, $context); + if ($r !== false) { + if ($r !== true) { + $y = $r; + } + if ($nx === null) { + $nx = ''; + } + $nx .= $sdelim . $y; + } + } + } + if ($nx !== null) { + if ($nsel === null) { + $nsel = $nx; + } else { + $nsel .= $delim . $nx; + } + } else { + // delimiters to the left of invalid + // basic selector ignored + } + } + } + if ($nsel !== null) { + if (!empty($scopes)) { + foreach ($scopes as $s) { + $new_selectors[] = "$s $nsel"; + } + } else { + $new_selectors[] = $nsel; } } } - if ($nsel !== null) { - if (!empty($scopes)) { - foreach ($scopes as $s) { - $new_selectors[] = "$s $nsel"; - } - } else { - $new_selectors[] = $nsel; - } - } - } - if (empty($new_selectors)) { - continue; - } - $selector = implode(', ', $new_selectors); - foreach ($style as $name => $value) { - if (!isset($css_definition->info[$name])) { - unset($style[$name]); + if (empty($new_selectors)) { continue; } - $def = $css_definition->info[$name]; - $ret = $def->validate($value, $config, $context); - if ($ret === false) { - unset($style[$name]); - } else { - $style[$name] = $ret; + $selector = implode(', ', $new_selectors); + foreach ($style as $name => $value) { + if (!isset($css_definition->info[$name])) { + unset($style[$name]); + continue; + } + $uni_ret = $this->_universal_attrdef->validate($value, $config, $context); + if ($uni_ret !== false) { + $style[$name] = $uni_ret; + continue; + } + $def = $css_definition->info[$name]; + $ret = $def->validate($value, $config, $context); + if ($ret === false) { + unset($style[$name]); + } else { + $style[$name] = $ret; + } } + $new_decls[$selector] = $style; } - $new_decls[$selector] = $style; + } else { + continue; } $new_css[$k] = $new_decls; } diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Iframe.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Iframe.php index f7e7c91c0..71dfc7744 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Iframe.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Iframe.php @@ -28,22 +28,28 @@ class HTMLPurifier_HTMLModule_Iframe extends HTMLPurifier_HTMLModule if ($config->get('HTML.SafeIframe')) { $this->safe = true; } + $attrs = array( + 'src' => 'URI#embedded', + 'width' => 'Length', + 'height' => 'Length', + 'name' => 'ID', + 'scrolling' => 'Enum#yes,no,auto', + 'frameborder' => 'Enum#0,1', + 'longdesc' => 'URI', + 'marginheight' => 'Pixels', + 'marginwidth' => 'Pixels', + ); + + if ($config->get('HTML.Trusted')) { + $attrs['allowfullscreen'] = 'Bool#allowfullscreen'; + } + $this->addElement( 'iframe', 'Inline', 'Flow', 'Common', - array( - 'src' => 'URI#embedded', - 'width' => 'Length', - 'height' => 'Length', - 'name' => 'ID', - 'scrolling' => 'Enum#yes,no,auto', - 'frameborder' => 'Enum#0,1', - 'longdesc' => 'URI', - 'marginheight' => 'Pixels', - 'marginwidth' => 'Pixels', - ) + $attrs ); } } diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Tidy.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Tidy.php index 12173ba70..76fd93a6c 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Tidy.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/HTMLModule/Tidy.php @@ -221,6 +221,7 @@ class HTMLPurifier_HTMLModule_Tidy extends HTMLPurifier_HTMLModule */ public function makeFixes() { + return array(); } } diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/LanguageFactory.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/LanguageFactory.php index 4e35272d8..16a4f6932 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/LanguageFactory.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/LanguageFactory.php @@ -109,7 +109,7 @@ class HTMLPurifier_LanguageFactory } else { $class = 'HTMLPurifier_Language_' . $pcode; $file = $this->dir . '/Language/classes/' . $code . '.php'; - if (file_exists($file) || class_exists($class, false)) { + if (file_exists($file) || class_exists($class)) { $lang = new $class($config, $context); } else { // Go fallback diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php index c21f36491..fe87fa4ba 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php @@ -101,7 +101,7 @@ class HTMLPurifier_Lexer break; } - if (class_exists('DOMDocument', false) && + if (class_exists('DOMDocument') && method_exists('DOMDocument', 'loadHTML') && !extension_loaded('domxml') ) { @@ -269,20 +269,6 @@ class HTMLPurifier_Lexer ); } - /** - * Special Internet Explorer conditional comments should be removed. - * @param string $string HTML string to process. - * @return string HTML with conditional comments removed. - */ - protected static function removeIEConditional($string) - { - return preg_replace( - '##si', // probably should generalize for all strings - '', - $string - ); - } - /** * Callback function for escapeCDATA() that does the work. * @@ -323,8 +309,6 @@ class HTMLPurifier_Lexer // escape CDATA $html = $this->escapeCDATA($html); - $html = $this->removeIEConditional($html); - // extract body from document if applicable if ($config->get('Core.ConvertDocumentToFragment')) { $e = false; diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer/DOMLex.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer/DOMLex.php index ca5f25b84..7d579837c 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer/DOMLex.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer/DOMLex.php @@ -72,6 +72,9 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer if ($config->get('Core.AllowParseManyTags') && defined('LIBXML_PARSEHUGE')) { $options |= LIBXML_PARSEHUGE; } + if ($config->get('Core.RemoveBlanks') && defined('LIBXML_NOBLANKS')) { + $options |= LIBXML_NOBLANKS; + } set_error_handler(array($this, 'muteErrorHandler')); // loadHTML() fails on PHP 5.3 when second parameter is given @@ -104,7 +107,6 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer * To iterate is human, to recurse divine - L. Peter Deutsch * @param DOMNode $node DOMNode to be tokenized. * @param HTMLPurifier_Token[] $tokens Array-list of already tokenized tokens. - * @return HTMLPurifier_Token of node appended to previously passed tokens. */ protected function tokenizeDOM($node, &$tokens, $config) { diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Printer/ConfigForm.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Printer/ConfigForm.php index 33ae11397..4c3ce1758 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Printer/ConfigForm.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Printer/ConfigForm.php @@ -32,6 +32,11 @@ class HTMLPurifier_Printer_ConfigForm extends HTMLPurifier_Printer */ protected $compress = false; + /** + * @var HTMLPurifier_Config + */ + protected $genConfig; + /** * @param string $name Form element name for directives to be stuffed into * @param string $doc_url String documentation URL, will have fragment tagged on diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Token/Tag.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Token/Tag.php index d643fa64e..dcf365589 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Token/Tag.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Token/Tag.php @@ -44,7 +44,7 @@ abstract class HTMLPurifier_Token_Tag extends HTMLPurifier_Token $this->name = ctype_lower($name) ? $name : strtolower($name); foreach ($attr as $key => $value) { // normalization only necessary when key is not lowercase - if (!ctype_lower($key)) { + if (!ctype_lower((string)$key)) { $new_key = strtolower($key); if (!isset($attr[$new_key])) { $attr[$new_key] = $attr[$key]; diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/tel.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/tel.php index 8cd193352..dfad8efcf 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/tel.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/tel.php @@ -33,11 +33,11 @@ class HTMLPurifier_URIScheme_tel extends HTMLPurifier_URIScheme $uri->host = null; $uri->port = null; - // Delete all non-numeric characters, non-x characters + // Delete all non-numeric characters, commas, and non-x characters // from phone number, EXCEPT for a leading plus sign. - $uri->path = preg_replace('/(?!^\+)[^\dx]/', '', + $uri->path = preg_replace('/(?!^\+)[^\dx,]/', '', // Normalize e(x)tension to lower-case - str_replace('X', 'x', $uri->path)); + str_replace('X', 'x', rawurldecode($uri->path))); return true; } diff --git a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/UnitConverter.php b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/UnitConverter.php index 166f3bf30..b5a1eab5c 100644 --- a/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/UnitConverter.php +++ b/common/vendor/ezyang/htmlpurifier/library/HTMLPurifier/UnitConverter.php @@ -261,7 +261,7 @@ class HTMLPurifier_UnitConverter */ private function round($n, $sigfigs) { - $new_log = (int)floor(log(abs($n), 10)); // Number of digits left of decimal - 1 + $new_log = (int)floor(log(abs((float)$n), 10)); // Number of digits left of decimal - 1 $rp = $sigfigs - $new_log - 1; // Number of decimal places needed $neg = $n < 0 ? '-' : ''; // Negative sign if ($this->bcmath) { @@ -276,7 +276,7 @@ class HTMLPurifier_UnitConverter } return $n; } else { - return $this->scale(round($n, $sigfigs - $new_log - 1), $rp + 1); + return $this->scale(round((float)$n, $sigfigs - $new_log - 1), $rp + 1); } } @@ -300,7 +300,7 @@ class HTMLPurifier_UnitConverter // Now we return it, truncating the zero that was rounded off. return substr($precise, 0, -1) . str_repeat('0', -$scale + 1); } - return sprintf('%.' . $scale . 'f', (float)$r); + return number_format((float)$r, $scale, '.', ''); } } diff --git a/common/vendor/guzzlehttp/guzzle/CHANGELOG.md b/common/vendor/guzzlehttp/guzzle/CHANGELOG.md index 13709d1b8..e0b621659 100644 --- a/common/vendor/guzzlehttp/guzzle/CHANGELOG.md +++ b/common/vendor/guzzlehttp/guzzle/CHANGELOG.md @@ -3,6 +3,37 @@ Please refer to [UPGRADING](UPGRADING.md) guide for upgrading to a major version. +## 7.9.2 - 2024-07-24 + +### Fixed + +- Adjusted handler selection to use cURL if its version is 7.21.2 or higher, rather than 7.34.0 + + +## 7.9.1 - 2024-07-19 + +### Fixed + +- Fix TLS 1.3 check for HTTP/2 requests + + +## 7.9.0 - 2024-07-18 + +### Changed + +- Improve protocol version checks to provide feedback around unsupported protocols +- Only select the cURL handler by default if 7.34.0 or higher is linked +- Improved `CurlMultiHandler` to avoid busy wait if possible +- Dropped support for EOL `guzzlehttp/psr7` v1 +- Improved URI user info redaction in errors + +## 7.8.2 - 2024-07-18 + +### Added + +- Support for PHP 8.4 + + ## 7.8.1 - 2023-12-03 ### Changed diff --git a/common/vendor/guzzlehttp/guzzle/README.md b/common/vendor/guzzlehttp/guzzle/README.md index 6d78a9309..cdaebee3f 100644 --- a/common/vendor/guzzlehttp/guzzle/README.md +++ b/common/vendor/guzzlehttp/guzzle/README.md @@ -62,11 +62,11 @@ composer require guzzlehttp/guzzle | Version | Status | Packagist | Namespace | Repo | Docs | PSR-7 | PHP Version | |---------|---------------------|---------------------|--------------|---------------------|---------------------|-------|--------------| -| 3.x | EOL | `guzzle/guzzle` | `Guzzle` | [v3][guzzle-3-repo] | [v3][guzzle-3-docs] | No | >=5.3.3,<7.0 | -| 4.x | EOL | `guzzlehttp/guzzle` | `GuzzleHttp` | [v4][guzzle-4-repo] | N/A | No | >=5.4,<7.0 | -| 5.x | EOL | `guzzlehttp/guzzle` | `GuzzleHttp` | [v5][guzzle-5-repo] | [v5][guzzle-5-docs] | No | >=5.4,<7.4 | -| 6.x | Security fixes only | `guzzlehttp/guzzle` | `GuzzleHttp` | [v6][guzzle-6-repo] | [v6][guzzle-6-docs] | Yes | >=5.5,<8.0 | -| 7.x | Latest | `guzzlehttp/guzzle` | `GuzzleHttp` | [v7][guzzle-7-repo] | [v7][guzzle-7-docs] | Yes | >=7.2.5,<8.4 | +| 3.x | EOL (2016-10-31) | `guzzle/guzzle` | `Guzzle` | [v3][guzzle-3-repo] | [v3][guzzle-3-docs] | No | >=5.3.3,<7.0 | +| 4.x | EOL (2016-10-31) | `guzzlehttp/guzzle` | `GuzzleHttp` | [v4][guzzle-4-repo] | N/A | No | >=5.4,<7.0 | +| 5.x | EOL (2019-10-31) | `guzzlehttp/guzzle` | `GuzzleHttp` | [v5][guzzle-5-repo] | [v5][guzzle-5-docs] | No | >=5.4,<7.4 | +| 6.x | EOL (2023-10-31) | `guzzlehttp/guzzle` | `GuzzleHttp` | [v6][guzzle-6-repo] | [v6][guzzle-6-docs] | Yes | >=5.5,<8.0 | +| 7.x | Latest | `guzzlehttp/guzzle` | `GuzzleHttp` | [v7][guzzle-7-repo] | [v7][guzzle-7-docs] | Yes | >=7.2.5,<8.5 | [guzzle-3-repo]: https://github.com/guzzle/guzzle3 [guzzle-4-repo]: https://github.com/guzzle/guzzle/tree/4.x diff --git a/common/vendor/guzzlehttp/guzzle/composer.json b/common/vendor/guzzlehttp/guzzle/composer.json index 69583d7cc..cbede149a 100644 --- a/common/vendor/guzzlehttp/guzzle/composer.json +++ b/common/vendor/guzzlehttp/guzzle/composer.json @@ -50,11 +50,39 @@ "homepage": "https://github.com/Tobion" } ], + "repositories": [ + { + "type": "package", + "package": { + "name": "guzzle/client-integration-tests", + "version": "v3.0.2", + "dist": { + "url": "https://codeload.github.com/guzzle/client-integration-tests/zip/2c025848417c1135031fdf9c728ee53d0a7ceaee", + "type": "zip" + }, + "require": { + "php": "^7.2.5 || ^8.0", + "phpunit/phpunit": "^7.5.20 || ^8.5.8 || ^9.3.11", + "php-http/message": "^1.0 || ^2.0", + "guzzlehttp/psr7": "^1.7 || ^2.0", + "th3n3rd/cartesian-product": "^0.3" + }, + "autoload": { + "psr-4": { + "Http\\Client\\Tests\\": "src/" + } + }, + "bin": [ + "bin/http_test_server" + ] + } + } + ], "require": { "php": "^7.2.5 || ^8.0", "ext-json": "*", - "guzzlehttp/promises": "^1.5.3 || ^2.0.1", - "guzzlehttp/psr7": "^1.9.1 || ^2.5.1", + "guzzlehttp/promises": "^1.5.3 || ^2.0.3", + "guzzlehttp/psr7": "^2.7.0", "psr/http-client": "^1.0", "symfony/deprecation-contracts": "^2.2 || ^3.0" }, @@ -64,9 +92,9 @@ "require-dev": { "ext-curl": "*", "bamarni/composer-bin-plugin": "^1.8.2", - "php-http/client-integration-tests": "dev-master#2c025848417c1135031fdf9c728ee53d0a7ceaee as 3.0.999", + "guzzle/client-integration-tests": "3.0.2", "php-http/message-factory": "^1.1", - "phpunit/phpunit": "^8.5.36 || ^9.6.15", + "phpunit/phpunit": "^8.5.39 || ^9.6.20", "psr/log": "^1.1 || ^2.0 || ^3.0" }, "suggest": { diff --git a/common/vendor/guzzlehttp/guzzle/src/BodySummarizer.php b/common/vendor/guzzlehttp/guzzle/src/BodySummarizer.php index 6eca94ef9..761506dd0 100644 --- a/common/vendor/guzzlehttp/guzzle/src/BodySummarizer.php +++ b/common/vendor/guzzlehttp/guzzle/src/BodySummarizer.php @@ -11,7 +11,7 @@ final class BodySummarizer implements BodySummarizerInterface */ private $truncateAt; - public function __construct(int $truncateAt = null) + public function __construct(?int $truncateAt = null) { $this->truncateAt = $truncateAt; } @@ -22,7 +22,7 @@ final class BodySummarizer implements BodySummarizerInterface public function summarize(MessageInterface $message): ?string { return $this->truncateAt === null - ? \GuzzleHttp\Psr7\Message::bodySummary($message) - : \GuzzleHttp\Psr7\Message::bodySummary($message, $this->truncateAt); + ? Psr7\Message::bodySummary($message) + : Psr7\Message::bodySummary($message, $this->truncateAt); } } diff --git a/common/vendor/guzzlehttp/guzzle/src/Client.php b/common/vendor/guzzlehttp/guzzle/src/Client.php index bc6efc90f..c78919a4f 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Client.php +++ b/common/vendor/guzzlehttp/guzzle/src/Client.php @@ -52,7 +52,7 @@ class Client implements ClientInterface, \Psr\Http\Client\ClientInterface * * @param array $config Client configuration settings. * - * @see \GuzzleHttp\RequestOptions for a list of available request options. + * @see RequestOptions for a list of available request options. */ public function __construct(array $config = []) { @@ -202,7 +202,7 @@ class Client implements ClientInterface, \Psr\Http\Client\ClientInterface * * @deprecated Client::getConfig will be removed in guzzlehttp/guzzle:8.0. */ - public function getConfig(string $option = null) + public function getConfig(?string $option = null) { return $option === null ? $this->config diff --git a/common/vendor/guzzlehttp/guzzle/src/ClientInterface.php b/common/vendor/guzzlehttp/guzzle/src/ClientInterface.php index 1788e16ab..6aaee61af 100644 --- a/common/vendor/guzzlehttp/guzzle/src/ClientInterface.php +++ b/common/vendor/guzzlehttp/guzzle/src/ClientInterface.php @@ -80,5 +80,5 @@ interface ClientInterface * * @deprecated ClientInterface::getConfig will be removed in guzzlehttp/guzzle:8.0. */ - public function getConfig(string $option = null); + public function getConfig(?string $option = null); } diff --git a/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJar.php b/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJar.php index c29b4b7e9..b616cf2ed 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJar.php +++ b/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJar.php @@ -103,7 +103,7 @@ class CookieJar implements CookieJarInterface }, $this->getIterator()->getArrayCopy()); } - public function clear(string $domain = null, string $path = null, string $name = null): void + public function clear(?string $domain = null, ?string $path = null, ?string $name = null): void { if (!$domain) { $this->cookies = []; diff --git a/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJarInterface.php b/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJarInterface.php index 8c55cc6f7..93ada58d2 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJarInterface.php +++ b/common/vendor/guzzlehttp/guzzle/src/Cookie/CookieJarInterface.php @@ -62,7 +62,7 @@ interface CookieJarInterface extends \Countable, \IteratorAggregate * @param string|null $path Clears cookies matching a domain and path * @param string|null $name Clears cookies matching a domain, path, and name */ - public function clear(string $domain = null, string $path = null, string $name = null): void; + public function clear(?string $domain = null, ?string $path = null, ?string $name = null): void; /** * Discard all sessions cookies. diff --git a/common/vendor/guzzlehttp/guzzle/src/Exception/BadResponseException.php b/common/vendor/guzzlehttp/guzzle/src/Exception/BadResponseException.php index a80956c9d..ba67ad498 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Exception/BadResponseException.php +++ b/common/vendor/guzzlehttp/guzzle/src/Exception/BadResponseException.php @@ -14,7 +14,7 @@ class BadResponseException extends RequestException string $message, RequestInterface $request, ResponseInterface $response, - \Throwable $previous = null, + ?\Throwable $previous = null, array $handlerContext = [] ) { parent::__construct($message, $request, $response, $previous, $handlerContext); diff --git a/common/vendor/guzzlehttp/guzzle/src/Exception/ConnectException.php b/common/vendor/guzzlehttp/guzzle/src/Exception/ConnectException.php index e1a31519c..eab51ca17 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Exception/ConnectException.php +++ b/common/vendor/guzzlehttp/guzzle/src/Exception/ConnectException.php @@ -25,7 +25,7 @@ class ConnectException extends TransferException implements NetworkExceptionInte public function __construct( string $message, RequestInterface $request, - \Throwable $previous = null, + ?\Throwable $previous = null, array $handlerContext = [] ) { parent::__construct($message, 0, $previous); diff --git a/common/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php b/common/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php index c2d0a9ccc..b42c88abf 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php +++ b/common/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php @@ -7,7 +7,6 @@ use GuzzleHttp\BodySummarizerInterface; use Psr\Http\Client\RequestExceptionInterface; use Psr\Http\Message\RequestInterface; use Psr\Http\Message\ResponseInterface; -use Psr\Http\Message\UriInterface; /** * HTTP Request exception @@ -32,8 +31,8 @@ class RequestException extends TransferException implements RequestExceptionInte public function __construct( string $message, RequestInterface $request, - ResponseInterface $response = null, - \Throwable $previous = null, + ?ResponseInterface $response = null, + ?\Throwable $previous = null, array $handlerContext = [] ) { // Set the code of the exception if the response is set and not future. @@ -63,10 +62,10 @@ class RequestException extends TransferException implements RequestExceptionInte */ public static function create( RequestInterface $request, - ResponseInterface $response = null, - \Throwable $previous = null, + ?ResponseInterface $response = null, + ?\Throwable $previous = null, array $handlerContext = [], - BodySummarizerInterface $bodySummarizer = null + ?BodySummarizerInterface $bodySummarizer = null ): self { if (!$response) { return new self( @@ -90,8 +89,7 @@ class RequestException extends TransferException implements RequestExceptionInte $className = __CLASS__; } - $uri = $request->getUri(); - $uri = static::obfuscateUri($uri); + $uri = \GuzzleHttp\Psr7\Utils::redactUserInfo($request->getUri()); // Client Error: `GET /` resulted in a `404 Not Found` response: // ... (truncated) @@ -113,20 +111,6 @@ class RequestException extends TransferException implements RequestExceptionInte return new $className($message, $request, $response, $previous, $handlerContext); } - /** - * Obfuscates URI if there is a username and a password present - */ - private static function obfuscateUri(UriInterface $uri): UriInterface - { - $userInfo = $uri->getUserInfo(); - - if (false !== ($pos = \strpos($userInfo, ':'))) { - return $uri->withUserInfo(\substr($userInfo, 0, $pos), '***'); - } - - return $uri; - } - /** * Get the request that caused the exception */ diff --git a/common/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php b/common/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php index 16a942232..fe3613751 100644 --- a/common/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php +++ b/common/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php @@ -11,6 +11,7 @@ use GuzzleHttp\Psr7\LazyOpenStream; use GuzzleHttp\TransferStats; use GuzzleHttp\Utils; use Psr\Http\Message\RequestInterface; +use Psr\Http\Message\UriInterface; /** * Creates curl resources from a request @@ -46,6 +47,16 @@ class CurlFactory implements CurlFactoryInterface public function create(RequestInterface $request, array $options): EasyHandle { + $protocolVersion = $request->getProtocolVersion(); + + if ('2' === $protocolVersion || '2.0' === $protocolVersion) { + if (!self::supportsHttp2()) { + throw new ConnectException('HTTP/2 is supported by the cURL handler, however libcurl is built without HTTP/2 support.', $request); + } + } elseif ('1.0' !== $protocolVersion && '1.1' !== $protocolVersion) { + throw new ConnectException(sprintf('HTTP/%s is not supported by the cURL handler.', $protocolVersion), $request); + } + if (isset($options['curl']['body_as_string'])) { $options['_body_as_string'] = $options['curl']['body_as_string']; unset($options['curl']['body_as_string']); @@ -72,6 +83,42 @@ class CurlFactory implements CurlFactoryInterface return $easy; } + private static function supportsHttp2(): bool + { + static $supportsHttp2 = null; + + if (null === $supportsHttp2) { + $supportsHttp2 = self::supportsTls12() + && defined('CURL_VERSION_HTTP2') + && (\CURL_VERSION_HTTP2 & \curl_version()['features']); + } + + return $supportsHttp2; + } + + private static function supportsTls12(): bool + { + static $supportsTls12 = null; + + if (null === $supportsTls12) { + $supportsTls12 = \CURL_SSLVERSION_TLSv1_2 & \curl_version()['features']; + } + + return $supportsTls12; + } + + private static function supportsTls13(): bool + { + static $supportsTls13 = null; + + if (null === $supportsTls13) { + $supportsTls13 = defined('CURL_SSLVERSION_TLSv1_3') + && (\CURL_SSLVERSION_TLSv1_3 & \curl_version()['features']); + } + + return $supportsTls13; + } + public function release(EasyHandle $easy): void { $resource = $easy->handle; @@ -147,7 +194,7 @@ class CurlFactory implements CurlFactoryInterface 'error' => \curl_error($easy->handle), 'appconnect_time' => \curl_getinfo($easy->handle, \CURLINFO_APPCONNECT_TIME), ] + \curl_getinfo($easy->handle); - $ctx[self::CURL_VERSION_STR] = \curl_version()['version']; + $ctx[self::CURL_VERSION_STR] = self::getCurlVersion(); $factory->release($easy); // Retry when nothing is present or when curl failed to rewind. @@ -158,6 +205,17 @@ class CurlFactory implements CurlFactoryInterface return self::createRejection($easy, $ctx); } + private static function getCurlVersion(): string + { + static $curlVersion = null; + + if (null === $curlVersion) { + $curlVersion = \curl_version()['version']; + } + + return $curlVersion; + } + private static function createRejection(EasyHandle $easy, array $ctx): PromiseInterface { static $connectionErrors = [ @@ -194,15 +252,22 @@ class CurlFactory implements CurlFactoryInterface ); } + $uri = $easy->request->getUri(); + + $sanitizedError = self::sanitizeCurlError($ctx['error'] ?? '', $uri); + $message = \sprintf( 'cURL error %s: %s (%s)', $ctx['errno'], - $ctx['error'], + $sanitizedError, 'see https://curl.haxx.se/libcurl/c/libcurl-errors.html' ); - $uriString = (string) $easy->request->getUri(); - if ($uriString !== '' && false === \strpos($ctx['error'], $uriString)) { - $message .= \sprintf(' for %s', $uriString); + + if ('' !== $sanitizedError) { + $redactedUriString = \GuzzleHttp\Psr7\Utils::redactUserInfo($uri)->__toString(); + if ($redactedUriString !== '' && false === \strpos($sanitizedError, $redactedUriString)) { + $message .= \sprintf(' for %s', $redactedUriString); + } } // Create a connection exception if it was a specific error code. @@ -213,6 +278,24 @@ class CurlFactory implements CurlFactoryInterface return P\Create::rejectionFor($error); } + private static function sanitizeCurlError(string $error, UriInterface $uri): string + { + if ('' === $error) { + return $error; + } + + $baseUri = $uri->withQuery('')->withFragment(''); + $baseUriString = $baseUri->__toString(); + + if ('' === $baseUriString) { + return $error; + } + + $redactedUriString = \GuzzleHttp\Psr7\Utils::redactUserInfo($baseUri)->__toString(); + + return str_replace($baseUriString, $redactedUriString, $error); + } + /** * @return array