mirror of
https://github.com/Lastorder-DC/rhymix.git
synced 2026-01-03 16:51:40 +09:00
Add composer/ca-bundle and enshrined/svg-sanitize
This commit is contained in:
Kijin Sung
parent
735d3dd97c
commit
e86894c697
28 changed files with 6903 additions and 42 deletions
|
|
@ -1,40 +1,42 @@
|
|||
{
|
||||
"name": "rhymix/rhymix",
|
||||
"description": "Rhymix",
|
||||
"homepage": "https://www.rhymix.org",
|
||||
"license": "GPL-2.0+",
|
||||
"type": "project",
|
||||
"authors": [
|
||||
{ "name": "Rhymix Developers and Contributors", "email": "devops@rhymix.org" },
|
||||
{ "name": "NAVER", "email": "developers@xpressengine.com" }
|
||||
],
|
||||
"require": {
|
||||
"php": ">=7.2.5",
|
||||
"ext-curl": "*",
|
||||
"ext-gd": "*",
|
||||
"ext-iconv": "*",
|
||||
"ext-json": "*",
|
||||
"ext-mbstring": "*",
|
||||
"ext-openssl": "*",
|
||||
"ext-pcre": "*",
|
||||
"ext-xml": "*",
|
||||
"bordoni/phpass": "0.3.6",
|
||||
"coolsms/php-sdk": "2.*",
|
||||
"doctrine/lexer": "1.*",
|
||||
"egulias/email-validator": "3.2.*",
|
||||
"ezyang/htmlpurifier": "4.16.*",
|
||||
"guzzlehttp/guzzle": "7.5.*",
|
||||
"jbbcode/jbbcode": "1.4.*",
|
||||
"leafo/lessphp": "dev-master",
|
||||
"league/html-to-markdown": "5.*",
|
||||
"matthiasmullie/minify": "1.3.*",
|
||||
"matthiasmullie/path-converter": "1.1.*",
|
||||
"michelf/php-markdown": "1.9.*",
|
||||
"michelf/php-smartypants": "1.8.*",
|
||||
"rmccue/requests": "1.8.*",
|
||||
"scssphp/scssphp": "1.11.*",
|
||||
"swiftmailer/swiftmailer": "6.3.0",
|
||||
"name": "rhymix/rhymix",
|
||||
"description": "Rhymix",
|
||||
"homepage": "https://www.rhymix.org",
|
||||
"license": "GPL-2.0+",
|
||||
"type": "project",
|
||||
"authors": [
|
||||
{ "name": "Rhymix Developers and Contributors", "email": "devops@rhymix.org" },
|
||||
{ "name": "NAVER", "email": "developers@xpressengine.com" }
|
||||
],
|
||||
"require": {
|
||||
"php": ">=7.2.5",
|
||||
"ext-curl": "*",
|
||||
"ext-gd": "*",
|
||||
"ext-iconv": "*",
|
||||
"ext-json": "*",
|
||||
"ext-mbstring": "*",
|
||||
"ext-openssl": "*",
|
||||
"ext-pcre": "*",
|
||||
"ext-xml": "*",
|
||||
"bordoni/phpass": "0.3.6",
|
||||
"composer/ca-bundle": "*",
|
||||
"coolsms/php-sdk": "2.*",
|
||||
"doctrine/lexer": "1.*",
|
||||
"egulias/email-validator": "3.2.*",
|
||||
"enshrined/svg-sanitize": "0.*",
|
||||
"ezyang/htmlpurifier": "4.16.*",
|
||||
"guzzlehttp/guzzle": "7.5.*",
|
||||
"jbbcode/jbbcode": "1.4.*",
|
||||
"leafo/lessphp": "dev-master",
|
||||
"league/html-to-markdown": "5.*",
|
||||
"matthiasmullie/minify": "1.3.*",
|
||||
"matthiasmullie/path-converter": "1.1.*",
|
||||
"michelf/php-markdown": "1.9.*",
|
||||
"michelf/php-smartypants": "1.8.*",
|
||||
"rmccue/requests": "1.8.*",
|
||||
"scssphp/scssphp": "1.11.*",
|
||||
"swiftmailer/swiftmailer": "6.3.0",
|
||||
"symfony/deprecation-contracts": "2.5.*",
|
||||
"true/punycode": "2.*"
|
||||
}
|
||||
"true/punycode": "2.*"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
123
composer.lock
generated
123
composer.lock
generated
|
|
@ -4,7 +4,7 @@
|
|||
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
|
||||
"This file is @generated automatically"
|
||||
],
|
||||
"content-hash": "11b902a36970df1d0f394cd94ad16cb7",
|
||||
"content-hash": "e26a63ac7dd69995f36b22fd491b44f8",
|
||||
"packages": [
|
||||
{
|
||||
"name": "bordoni/phpass",
|
||||
|
|
@ -62,6 +62,82 @@
|
|||
},
|
||||
"time": "2012-08-31T00:00:00+00:00"
|
||||
},
|
||||
{
|
||||
"name": "composer/ca-bundle",
|
||||
"version": "1.3.4",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/composer/ca-bundle.git",
|
||||
"reference": "69098eca243998b53eed7a48d82dedd28b447cd5"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/composer/ca-bundle/zipball/69098eca243998b53eed7a48d82dedd28b447cd5",
|
||||
"reference": "69098eca243998b53eed7a48d82dedd28b447cd5",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"ext-openssl": "*",
|
||||
"ext-pcre": "*",
|
||||
"php": "^5.3.2 || ^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpstan/phpstan": "^0.12.55",
|
||||
"psr/log": "^1.0",
|
||||
"symfony/phpunit-bridge": "^4.2 || ^5",
|
||||
"symfony/process": "^2.5 || ^3.0 || ^4.0 || ^5.0 || ^6.0"
|
||||
},
|
||||
"type": "library",
|
||||
"extra": {
|
||||
"branch-alias": {
|
||||
"dev-main": "1.x-dev"
|
||||
}
|
||||
},
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"Composer\\CaBundle\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"MIT"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Jordi Boggiano",
|
||||
"email": "j.boggiano@seld.be",
|
||||
"homepage": "http://seld.be"
|
||||
}
|
||||
],
|
||||
"description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.",
|
||||
"keywords": [
|
||||
"cabundle",
|
||||
"cacert",
|
||||
"certificate",
|
||||
"ssl",
|
||||
"tls"
|
||||
],
|
||||
"support": {
|
||||
"irc": "irc://irc.freenode.org/composer",
|
||||
"issues": "https://github.com/composer/ca-bundle/issues",
|
||||
"source": "https://github.com/composer/ca-bundle/tree/1.3.4"
|
||||
},
|
||||
"funding": [
|
||||
{
|
||||
"url": "https://packagist.com",
|
||||
"type": "custom"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/composer",
|
||||
"type": "github"
|
||||
},
|
||||
{
|
||||
"url": "https://tidelift.com/funding/github/packagist/composer/composer",
|
||||
"type": "tidelift"
|
||||
}
|
||||
],
|
||||
"time": "2022-10-12T12:08:29+00:00"
|
||||
},
|
||||
{
|
||||
"name": "coolsms/php-sdk",
|
||||
"version": "v2.0",
|
||||
|
|
@ -264,6 +340,51 @@
|
|||
],
|
||||
"time": "2022-06-18T20:57:19+00:00"
|
||||
},
|
||||
{
|
||||
"name": "enshrined/svg-sanitize",
|
||||
"version": "0.15.4",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/darylldoyle/svg-sanitizer.git",
|
||||
"reference": "e50b83a2f1f296ca61394fe88fbfe3e896a84cf4"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/e50b83a2f1f296ca61394fe88fbfe3e896a84cf4",
|
||||
"reference": "e50b83a2f1f296ca61394fe88fbfe3e896a84cf4",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"ext-dom": "*",
|
||||
"ext-libxml": "*",
|
||||
"php": "^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": "^6.5 || ^8.5"
|
||||
},
|
||||
"type": "library",
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"enshrined\\svgSanitize\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"GPL-2.0-or-later"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Daryll Doyle",
|
||||
"email": "daryll@enshrined.co.uk"
|
||||
}
|
||||
],
|
||||
"description": "An SVG sanitizer for PHP",
|
||||
"support": {
|
||||
"issues": "https://github.com/darylldoyle/svg-sanitizer/issues",
|
||||
"source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.15.4"
|
||||
},
|
||||
"time": "2022-02-21T09:13:59+00:00"
|
||||
},
|
||||
{
|
||||
"name": "ezyang/htmlpurifier",
|
||||
"version": "v4.16.0",
|
||||
|
|
|
|||
22
vendor/composer/InstalledVersions.php
vendored
22
vendor/composer/InstalledVersions.php
vendored
|
|
@ -29,7 +29,7 @@ private static $installed = array (
|
|||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => '35a93f3928d626386609cb278a6a1ed70886096f',
|
||||
'reference' => '735d3dd97cb734f22b76ffef1857523b7e918d6a',
|
||||
'name' => 'rhymix/rhymix',
|
||||
),
|
||||
'versions' =>
|
||||
|
|
@ -43,6 +43,15 @@ private static $installed = array (
|
|||
),
|
||||
'reference' => '12f8f5cc03ebb7efd69554f104afe9aa1aa46e1a',
|
||||
),
|
||||
'composer/ca-bundle' =>
|
||||
array (
|
||||
'pretty_version' => '1.3.4',
|
||||
'version' => '1.3.4.0',
|
||||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => '69098eca243998b53eed7a48d82dedd28b447cd5',
|
||||
),
|
||||
'coolsms/php-sdk' =>
|
||||
array (
|
||||
'pretty_version' => 'v2.0',
|
||||
|
|
@ -70,6 +79,15 @@ private static $installed = array (
|
|||
),
|
||||
'reference' => 'f88dcf4b14af14a98ad96b14b2b317969eab6715',
|
||||
),
|
||||
'enshrined/svg-sanitize' =>
|
||||
array (
|
||||
'pretty_version' => '0.15.4',
|
||||
'version' => '0.15.4.0',
|
||||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => 'e50b83a2f1f296ca61394fe88fbfe3e896a84cf4',
|
||||
),
|
||||
'ezyang/htmlpurifier' =>
|
||||
array (
|
||||
'pretty_version' => 'v4.16.0',
|
||||
|
|
@ -241,7 +259,7 @@ private static $installed = array (
|
|||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => '35a93f3928d626386609cb278a6a1ed70886096f',
|
||||
'reference' => '735d3dd97cb734f22b76ffef1857523b7e918d6a',
|
||||
),
|
||||
'rmccue/requests' =>
|
||||
array (
|
||||
|
|
|
|||
12
vendor/composer/autoload_classmap.php
vendored
12
vendor/composer/autoload_classmap.php
vendored
|
|
@ -6,6 +6,7 @@ $vendorDir = dirname(dirname(__FILE__));
|
|||
$baseDir = dirname($vendorDir);
|
||||
|
||||
return array(
|
||||
'Composer\\CaBundle\\CaBundle' => $vendorDir . '/composer/ca-bundle/src/CaBundle.php',
|
||||
'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
|
||||
'Doctrine\\Common\\Lexer\\AbstractLexer' => $vendorDir . '/doctrine/lexer/lib/Doctrine/Common/Lexer/AbstractLexer.php',
|
||||
'Egulias\\EmailValidator\\EmailLexer' => $vendorDir . '/egulias/email-validator/src/EmailLexer.php',
|
||||
|
|
@ -620,6 +621,17 @@ return array(
|
|||
'TrueBV\\Exception\\LabelOutOfBoundsException' => $vendorDir . '/true/punycode/src/Exception/LabelOutOfBoundsException.php',
|
||||
'TrueBV\\Exception\\OutOfBoundsException' => $vendorDir . '/true/punycode/src/Exception/OutOfBoundsException.php',
|
||||
'TrueBV\\Punycode' => $vendorDir . '/true/punycode/src/Punycode.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Resolver' => $vendorDir . '/enshrined/svg-sanitize/src/ElementReference/Resolver.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Subject' => $vendorDir . '/enshrined/svg-sanitize/src/ElementReference/Subject.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Usage' => $vendorDir . '/enshrined/svg-sanitize/src/ElementReference/Usage.php',
|
||||
'enshrined\\svgSanitize\\Exceptions\\NestingException' => $vendorDir . '/enshrined/svg-sanitize/src/Exceptions/NestingException.php',
|
||||
'enshrined\\svgSanitize\\Helper' => $vendorDir . '/enshrined/svg-sanitize/src/Helper.php',
|
||||
'enshrined\\svgSanitize\\Sanitizer' => $vendorDir . '/enshrined/svg-sanitize/src/Sanitizer.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedAttributes' => $vendorDir . '/enshrined/svg-sanitize/src/data/AllowedAttributes.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedTags' => $vendorDir . '/enshrined/svg-sanitize/src/data/AllowedTags.php',
|
||||
'enshrined\\svgSanitize\\data\\AttributeInterface' => $vendorDir . '/enshrined/svg-sanitize/src/data/AttributeInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\TagInterface' => $vendorDir . '/enshrined/svg-sanitize/src/data/TagInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\XPath' => $vendorDir . '/enshrined/svg-sanitize/src/data/XPath.php',
|
||||
'lessc' => $vendorDir . '/leafo/lessphp/lessc.inc.php',
|
||||
'lessc_formatter_classic' => $vendorDir . '/leafo/lessphp/lessc.inc.php',
|
||||
'lessc_formatter_compressed' => $vendorDir . '/leafo/lessphp/lessc.inc.php',
|
||||
|
|
|
|||
2
vendor/composer/autoload_psr4.php
vendored
2
vendor/composer/autoload_psr4.php
vendored
|
|
@ -6,6 +6,7 @@ $vendorDir = dirname(dirname(__FILE__));
|
|||
$baseDir = dirname($vendorDir);
|
||||
|
||||
return array(
|
||||
'enshrined\\svgSanitize\\' => array($vendorDir . '/enshrined/svg-sanitize/src'),
|
||||
'TrueBV\\' => array($vendorDir . '/true/punycode/src'),
|
||||
'Symfony\\Polyfill\\Php72\\' => array($vendorDir . '/symfony/polyfill-php72'),
|
||||
'Symfony\\Polyfill\\Mbstring\\' => array($vendorDir . '/symfony/polyfill-mbstring'),
|
||||
|
|
@ -25,4 +26,5 @@ return array(
|
|||
'GuzzleHttp\\' => array($vendorDir . '/guzzlehttp/guzzle/src'),
|
||||
'Egulias\\EmailValidator\\' => array($vendorDir . '/egulias/email-validator/src'),
|
||||
'Doctrine\\Common\\Lexer\\' => array($vendorDir . '/doctrine/lexer/lib/Doctrine/Common/Lexer'),
|
||||
'Composer\\CaBundle\\' => array($vendorDir . '/composer/ca-bundle/src'),
|
||||
);
|
||||
|
|
|
|||
28
vendor/composer/autoload_static.php
vendored
28
vendor/composer/autoload_static.php
vendored
|
|
@ -21,6 +21,10 @@ class ComposerStaticInit1e37ff09eb6590c7436f139ffd9070de
|
|||
);
|
||||
|
||||
public static $prefixLengthsPsr4 = array (
|
||||
'e' =>
|
||||
array (
|
||||
'enshrined\\svgSanitize\\' => 22,
|
||||
),
|
||||
'T' =>
|
||||
array (
|
||||
'TrueBV\\' => 7,
|
||||
|
|
@ -67,9 +71,17 @@ class ComposerStaticInit1e37ff09eb6590c7436f139ffd9070de
|
|||
array (
|
||||
'Doctrine\\Common\\Lexer\\' => 22,
|
||||
),
|
||||
'C' =>
|
||||
array (
|
||||
'Composer\\CaBundle\\' => 18,
|
||||
),
|
||||
);
|
||||
|
||||
public static $prefixDirsPsr4 = array (
|
||||
'enshrined\\svgSanitize\\' =>
|
||||
array (
|
||||
0 => __DIR__ . '/..' . '/enshrined/svg-sanitize/src',
|
||||
),
|
||||
'TrueBV\\' =>
|
||||
array (
|
||||
0 => __DIR__ . '/..' . '/true/punycode/src',
|
||||
|
|
@ -147,6 +159,10 @@ class ComposerStaticInit1e37ff09eb6590c7436f139ffd9070de
|
|||
array (
|
||||
0 => __DIR__ . '/..' . '/doctrine/lexer/lib/Doctrine/Common/Lexer',
|
||||
),
|
||||
'Composer\\CaBundle\\' =>
|
||||
array (
|
||||
0 => __DIR__ . '/..' . '/composer/ca-bundle/src',
|
||||
),
|
||||
);
|
||||
|
||||
public static $prefixesPsr0 = array (
|
||||
|
|
@ -185,6 +201,7 @@ class ComposerStaticInit1e37ff09eb6590c7436f139ffd9070de
|
|||
);
|
||||
|
||||
public static $classMap = array (
|
||||
'Composer\\CaBundle\\CaBundle' => __DIR__ . '/..' . '/composer/ca-bundle/src/CaBundle.php',
|
||||
'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
|
||||
'Doctrine\\Common\\Lexer\\AbstractLexer' => __DIR__ . '/..' . '/doctrine/lexer/lib/Doctrine/Common/Lexer/AbstractLexer.php',
|
||||
'Egulias\\EmailValidator\\EmailLexer' => __DIR__ . '/..' . '/egulias/email-validator/src/EmailLexer.php',
|
||||
|
|
@ -799,6 +816,17 @@ class ComposerStaticInit1e37ff09eb6590c7436f139ffd9070de
|
|||
'TrueBV\\Exception\\LabelOutOfBoundsException' => __DIR__ . '/..' . '/true/punycode/src/Exception/LabelOutOfBoundsException.php',
|
||||
'TrueBV\\Exception\\OutOfBoundsException' => __DIR__ . '/..' . '/true/punycode/src/Exception/OutOfBoundsException.php',
|
||||
'TrueBV\\Punycode' => __DIR__ . '/..' . '/true/punycode/src/Punycode.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Resolver' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/ElementReference/Resolver.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Subject' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/ElementReference/Subject.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Usage' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/ElementReference/Usage.php',
|
||||
'enshrined\\svgSanitize\\Exceptions\\NestingException' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/Exceptions/NestingException.php',
|
||||
'enshrined\\svgSanitize\\Helper' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/Helper.php',
|
||||
'enshrined\\svgSanitize\\Sanitizer' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/Sanitizer.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedAttributes' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/AllowedAttributes.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedTags' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/AllowedTags.php',
|
||||
'enshrined\\svgSanitize\\data\\AttributeInterface' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/AttributeInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\TagInterface' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/TagInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\XPath' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/XPath.php',
|
||||
'lessc' => __DIR__ . '/..' . '/leafo/lessphp/lessc.inc.php',
|
||||
'lessc_formatter_classic' => __DIR__ . '/..' . '/leafo/lessphp/lessc.inc.php',
|
||||
'lessc_formatter_compressed' => __DIR__ . '/..' . '/leafo/lessphp/lessc.inc.php',
|
||||
|
|
|
|||
19
vendor/composer/ca-bundle/LICENSE
vendored
Normal file
19
vendor/composer/ca-bundle/LICENSE
vendored
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
Copyright (C) 2016 Composer
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
this software and associated documentation files (the "Software"), to deal in
|
||||
the Software without restriction, including without limitation the rights to
|
||||
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
|
||||
of the Software, and to permit persons to whom the Software is furnished to do
|
||||
so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
85
vendor/composer/ca-bundle/README.md
vendored
Normal file
85
vendor/composer/ca-bundle/README.md
vendored
Normal file
|
|
@ -0,0 +1,85 @@
|
|||
composer/ca-bundle
|
||||
==================
|
||||
|
||||
Small utility library that lets you find a path to the system CA bundle,
|
||||
and includes a fallback to the Mozilla CA bundle.
|
||||
|
||||
Originally written as part of [composer/composer](https://github.com/composer/composer),
|
||||
now extracted and made available as a stand-alone library.
|
||||
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
||||
Install the latest version with:
|
||||
|
||||
```bash
|
||||
$ composer require composer/ca-bundle
|
||||
```
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
* PHP 5.3.2 is required but using the latest version of PHP is highly recommended.
|
||||
|
||||
|
||||
Basic usage
|
||||
-----------
|
||||
|
||||
### `Composer\CaBundle\CaBundle`
|
||||
|
||||
- `CaBundle::getSystemCaRootBundlePath()`: Returns the system CA bundle path, or a path to the bundled one as fallback
|
||||
- `CaBundle::getBundledCaBundlePath()`: Returns the path to the bundled CA file
|
||||
- `CaBundle::validateCaFile($filename)`: Validates a CA file using openssl_x509_parse only if it is safe to use
|
||||
- `CaBundle::isOpensslParseSafe()`: Test if it is safe to use the PHP function openssl_x509_parse()
|
||||
- `CaBundle::reset()`: Resets the static caches
|
||||
|
||||
|
||||
#### To use with curl
|
||||
|
||||
```php
|
||||
$curl = curl_init("https://example.org/");
|
||||
|
||||
$caPathOrFile = \Composer\CaBundle\CaBundle::getSystemCaRootBundlePath();
|
||||
if (is_dir($caPathOrFile)) {
|
||||
curl_setopt($curl, CURLOPT_CAPATH, $caPathOrFile);
|
||||
} else {
|
||||
curl_setopt($curl, CURLOPT_CAINFO, $caPathOrFile);
|
||||
}
|
||||
|
||||
$result = curl_exec($curl);
|
||||
```
|
||||
|
||||
#### To use with php streams
|
||||
|
||||
```php
|
||||
$opts = array(
|
||||
'http' => array(
|
||||
'method' => "GET"
|
||||
)
|
||||
);
|
||||
|
||||
$caPathOrFile = \Composer\CaBundle\CaBundle::getSystemCaRootBundlePath();
|
||||
if (is_dir($caPathOrFile)) {
|
||||
$opts['ssl']['capath'] = $caPathOrFile;
|
||||
} else {
|
||||
$opts['ssl']['cafile'] = $caPathOrFile;
|
||||
}
|
||||
|
||||
$context = stream_context_create($opts);
|
||||
$result = file_get_contents('https://example.com', false, $context);
|
||||
```
|
||||
|
||||
#### To use with Guzzle
|
||||
|
||||
```php
|
||||
$client = new \GuzzleHttp\Client([
|
||||
\GuzzleHttp\RequestOptions::VERIFY => \Composer\CaBundle\CaBundle::getSystemCaRootBundlePath()
|
||||
]);
|
||||
```
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
composer/ca-bundle is licensed under the MIT License, see the LICENSE file for details.
|
||||
54
vendor/composer/ca-bundle/composer.json
vendored
Normal file
54
vendor/composer/ca-bundle/composer.json
vendored
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
{
|
||||
"name": "composer/ca-bundle",
|
||||
"description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.",
|
||||
"type": "library",
|
||||
"license": "MIT",
|
||||
"keywords": [
|
||||
"cabundle",
|
||||
"cacert",
|
||||
"certificate",
|
||||
"ssl",
|
||||
"tls"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Jordi Boggiano",
|
||||
"email": "j.boggiano@seld.be",
|
||||
"homepage": "http://seld.be"
|
||||
}
|
||||
],
|
||||
"support": {
|
||||
"irc": "irc://irc.freenode.org/composer",
|
||||
"issues": "https://github.com/composer/ca-bundle/issues"
|
||||
},
|
||||
"require": {
|
||||
"ext-openssl": "*",
|
||||
"ext-pcre": "*",
|
||||
"php": "^5.3.2 || ^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"symfony/phpunit-bridge": "^4.2 || ^5",
|
||||
"phpstan/phpstan": "^0.12.55",
|
||||
"psr/log": "^1.0",
|
||||
"symfony/process": "^2.5 || ^3.0 || ^4.0 || ^5.0 || ^6.0"
|
||||
},
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"Composer\\CaBundle\\": "src"
|
||||
}
|
||||
},
|
||||
"autoload-dev": {
|
||||
"psr-4": {
|
||||
"Composer\\CaBundle\\": "tests"
|
||||
}
|
||||
},
|
||||
"extra": {
|
||||
"branch-alias": {
|
||||
"dev-main": "1.x-dev"
|
||||
}
|
||||
},
|
||||
"scripts": {
|
||||
"test": "SYMFONY_PHPUNIT_REMOVE_RETURN_TYPEHINT=1 vendor/bin/simple-phpunit",
|
||||
"phpstan": "vendor/bin/phpstan analyse"
|
||||
}
|
||||
}
|
||||
3506
vendor/composer/ca-bundle/res/cacert.pem
vendored
Normal file
3506
vendor/composer/ca-bundle/res/cacert.pem
vendored
Normal file
File diff suppressed because it is too large
Load diff
431
vendor/composer/ca-bundle/src/CaBundle.php
vendored
Normal file
431
vendor/composer/ca-bundle/src/CaBundle.php
vendored
Normal file
|
|
@ -0,0 +1,431 @@
|
|||
<?php
|
||||
|
||||
/*
|
||||
* This file is part of composer/ca-bundle.
|
||||
*
|
||||
* (c) Composer <https://github.com/composer>
|
||||
*
|
||||
* For the full copyright and license information, please view
|
||||
* the LICENSE file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Composer\CaBundle;
|
||||
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Component\Process\PhpProcess;
|
||||
|
||||
/**
|
||||
* @author Chris Smith <chris@cs278.org>
|
||||
* @author Jordi Boggiano <j.boggiano@seld.be>
|
||||
*/
|
||||
class CaBundle
|
||||
{
|
||||
/** @var string|null */
|
||||
private static $caPath;
|
||||
/** @var array<string, bool> */
|
||||
private static $caFileValidity = array();
|
||||
/** @var bool|null */
|
||||
private static $useOpensslParse;
|
||||
|
||||
/**
|
||||
* Returns the system CA bundle path, or a path to the bundled one
|
||||
*
|
||||
* This method was adapted from Sslurp.
|
||||
* https://github.com/EvanDotPro/Sslurp
|
||||
*
|
||||
* (c) Evan Coury <me@evancoury.com>
|
||||
*
|
||||
* For the full copyright and license information, please see below:
|
||||
*
|
||||
* Copyright (c) 2013, Evan Coury
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without modification,
|
||||
* are permitted provided that the following conditions are met:
|
||||
*
|
||||
* * Redistributions of source code must retain the above copyright notice,
|
||||
* this list of conditions and the following disclaimer.
|
||||
*
|
||||
* * Redistributions in binary form must reproduce the above copyright notice,
|
||||
* this list of conditions and the following disclaimer in the documentation
|
||||
* and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
|
||||
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
|
||||
* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* @param LoggerInterface $logger optional logger for information about which CA files were loaded
|
||||
* @return string path to a CA bundle file or directory
|
||||
*/
|
||||
public static function getSystemCaRootBundlePath(LoggerInterface $logger = null)
|
||||
{
|
||||
if (self::$caPath !== null) {
|
||||
return self::$caPath;
|
||||
}
|
||||
$caBundlePaths = array();
|
||||
|
||||
// If SSL_CERT_FILE env variable points to a valid certificate/bundle, use that.
|
||||
// This mimics how OpenSSL uses the SSL_CERT_FILE env variable.
|
||||
$caBundlePaths[] = self::getEnvVariable('SSL_CERT_FILE');
|
||||
|
||||
// If SSL_CERT_DIR env variable points to a valid certificate/bundle, use that.
|
||||
// This mimics how OpenSSL uses the SSL_CERT_FILE env variable.
|
||||
$caBundlePaths[] = self::getEnvVariable('SSL_CERT_DIR');
|
||||
|
||||
$caBundlePaths[] = ini_get('openssl.cafile');
|
||||
$caBundlePaths[] = ini_get('openssl.capath');
|
||||
|
||||
$otherLocations = array(
|
||||
'/etc/pki/tls/certs/ca-bundle.crt', // Fedora, RHEL, CentOS (ca-certificates package)
|
||||
'/etc/ssl/certs/ca-certificates.crt', // Debian, Ubuntu, Gentoo, Arch Linux (ca-certificates package)
|
||||
'/etc/ssl/ca-bundle.pem', // SUSE, openSUSE (ca-certificates package)
|
||||
'/usr/local/share/certs/ca-root-nss.crt', // FreeBSD (ca_root_nss_package)
|
||||
'/usr/ssl/certs/ca-bundle.crt', // Cygwin
|
||||
'/opt/local/share/curl/curl-ca-bundle.crt', // OS X macports, curl-ca-bundle package
|
||||
'/usr/local/share/curl/curl-ca-bundle.crt', // Default cURL CA bunde path (without --with-ca-bundle option)
|
||||
'/usr/share/ssl/certs/ca-bundle.crt', // Really old RedHat?
|
||||
'/etc/ssl/cert.pem', // OpenBSD
|
||||
'/usr/local/etc/ssl/cert.pem', // FreeBSD 10.x
|
||||
'/usr/local/etc/openssl/cert.pem', // OS X homebrew, openssl package
|
||||
'/usr/local/etc/openssl@1.1/cert.pem', // OS X homebrew, openssl@1.1 package
|
||||
);
|
||||
|
||||
foreach($otherLocations as $location) {
|
||||
$otherLocations[] = dirname($location);
|
||||
}
|
||||
|
||||
$caBundlePaths = array_merge($caBundlePaths, $otherLocations);
|
||||
|
||||
foreach ($caBundlePaths as $caBundle) {
|
||||
if ($caBundle && self::caFileUsable($caBundle, $logger)) {
|
||||
return self::$caPath = $caBundle;
|
||||
}
|
||||
|
||||
if ($caBundle && self::caDirUsable($caBundle, $logger)) {
|
||||
return self::$caPath = $caBundle;
|
||||
}
|
||||
}
|
||||
|
||||
return self::$caPath = static::getBundledCaBundlePath(); // Bundled CA file, last resort
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the path to the bundled CA file
|
||||
*
|
||||
* In case you don't want to trust the user or the system, you can use this directly
|
||||
*
|
||||
* @return string path to a CA bundle file
|
||||
*/
|
||||
public static function getBundledCaBundlePath()
|
||||
{
|
||||
$caBundleFile = __DIR__.'/../res/cacert.pem';
|
||||
|
||||
// cURL does not understand 'phar://' paths
|
||||
// see https://github.com/composer/ca-bundle/issues/10
|
||||
if (0 === strpos($caBundleFile, 'phar://')) {
|
||||
$tempCaBundleFile = tempnam(sys_get_temp_dir(), 'openssl-ca-bundle-');
|
||||
if (false === $tempCaBundleFile) {
|
||||
throw new \RuntimeException('Could not create a temporary file to store the bundled CA file');
|
||||
}
|
||||
|
||||
file_put_contents(
|
||||
$tempCaBundleFile,
|
||||
file_get_contents($caBundleFile)
|
||||
);
|
||||
|
||||
register_shutdown_function(function() use ($tempCaBundleFile) {
|
||||
@unlink($tempCaBundleFile);
|
||||
});
|
||||
|
||||
$caBundleFile = $tempCaBundleFile;
|
||||
}
|
||||
|
||||
return $caBundleFile;
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates a CA file using opensl_x509_parse only if it is safe to use
|
||||
*
|
||||
* @param string $filename
|
||||
* @param LoggerInterface $logger optional logger for information about which CA files were loaded
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
public static function validateCaFile($filename, LoggerInterface $logger = null)
|
||||
{
|
||||
static $warned = false;
|
||||
|
||||
if (isset(self::$caFileValidity[$filename])) {
|
||||
return self::$caFileValidity[$filename];
|
||||
}
|
||||
|
||||
$contents = file_get_contents($filename);
|
||||
|
||||
// assume the CA is valid if php is vulnerable to
|
||||
// https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html
|
||||
if (!static::isOpensslParseSafe()) {
|
||||
if (!$warned && $logger) {
|
||||
$logger->warning(sprintf(
|
||||
'Your version of PHP, %s, is affected by CVE-2013-6420 and cannot safely perform certificate validation, we strongly suggest you upgrade.',
|
||||
PHP_VERSION
|
||||
));
|
||||
$warned = true;
|
||||
}
|
||||
|
||||
$isValid = !empty($contents);
|
||||
} elseif (is_string($contents) && strlen($contents) > 0) {
|
||||
$contents = preg_replace("/^(\\-+(?:BEGIN|END))\\s+TRUSTED\\s+(CERTIFICATE\\-+)\$/m", '$1 $2', $contents);
|
||||
if (null === $contents) {
|
||||
// regex extraction failed
|
||||
$isValid = false;
|
||||
} else {
|
||||
$isValid = (bool) openssl_x509_parse($contents);
|
||||
}
|
||||
} else {
|
||||
$isValid = false;
|
||||
}
|
||||
|
||||
if ($logger) {
|
||||
$logger->debug('Checked CA file '.realpath($filename).': '.($isValid ? 'valid' : 'invalid'));
|
||||
}
|
||||
|
||||
return self::$caFileValidity[$filename] = $isValid;
|
||||
}
|
||||
|
||||
/**
|
||||
* Test if it is safe to use the PHP function openssl_x509_parse().
|
||||
*
|
||||
* This checks if OpenSSL extensions is vulnerable to remote code execution
|
||||
* via the exploit documented as CVE-2013-6420.
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
public static function isOpensslParseSafe()
|
||||
{
|
||||
if (null !== self::$useOpensslParse) {
|
||||
return self::$useOpensslParse;
|
||||
}
|
||||
|
||||
if (PHP_VERSION_ID >= 50600) {
|
||||
return self::$useOpensslParse = true;
|
||||
}
|
||||
|
||||
// Vulnerable:
|
||||
// PHP 5.3.0 - PHP 5.3.27
|
||||
// PHP 5.4.0 - PHP 5.4.22
|
||||
// PHP 5.5.0 - PHP 5.5.6
|
||||
if (
|
||||
(PHP_VERSION_ID < 50400 && PHP_VERSION_ID >= 50328)
|
||||
|| (PHP_VERSION_ID < 50500 && PHP_VERSION_ID >= 50423)
|
||||
|| PHP_VERSION_ID >= 50507
|
||||
) {
|
||||
// This version of PHP has the fix for CVE-2013-6420 applied.
|
||||
return self::$useOpensslParse = true;
|
||||
}
|
||||
|
||||
if (defined('PHP_WINDOWS_VERSION_BUILD')) {
|
||||
// Windows is probably insecure in this case.
|
||||
return self::$useOpensslParse = false;
|
||||
}
|
||||
|
||||
$compareDistroVersionPrefix = function ($prefix, $fixedVersion) {
|
||||
$regex = '{^'.preg_quote($prefix).'([0-9]+)$}';
|
||||
|
||||
if (preg_match($regex, PHP_VERSION, $m)) {
|
||||
return ((int) $m[1]) >= $fixedVersion;
|
||||
}
|
||||
|
||||
return false;
|
||||
};
|
||||
|
||||
// Hard coded list of PHP distributions with the fix backported.
|
||||
if (
|
||||
$compareDistroVersionPrefix('5.3.3-7+squeeze', 18) // Debian 6 (Squeeze)
|
||||
|| $compareDistroVersionPrefix('5.4.4-14+deb7u', 7) // Debian 7 (Wheezy)
|
||||
|| $compareDistroVersionPrefix('5.3.10-1ubuntu3.', 9) // Ubuntu 12.04 (Precise)
|
||||
) {
|
||||
return self::$useOpensslParse = true;
|
||||
}
|
||||
|
||||
// Symfony Process component is missing so we assume it is unsafe at this point
|
||||
if (!class_exists('Symfony\Component\Process\PhpProcess')) {
|
||||
return self::$useOpensslParse = false;
|
||||
}
|
||||
|
||||
// This is where things get crazy, because distros backport security
|
||||
// fixes the chances are on NIX systems the fix has been applied but
|
||||
// it's not possible to verify that from the PHP version.
|
||||
//
|
||||
// To verify exec a new PHP process and run the issue testcase with
|
||||
// known safe input that replicates the bug.
|
||||
|
||||
// Based on testcase in https://github.com/php/php-src/commit/c1224573c773b6845e83505f717fbf820fc18415
|
||||
// changes in https://github.com/php/php-src/commit/76a7fd893b7d6101300cc656058704a73254d593
|
||||
$cert = 'LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVwRENDQTR5Z0F3SUJBZ0lKQUp6dThyNnU2ZUJjTUEwR0NTcUdTSWIzRFFFQkJRVUFNSUhETVFzd0NRWUQKVlFRR0V3SkVSVEVjTUJvR0ExVUVDQXdUVG05eVpISm9aV2x1TFZkbGMzUm1ZV3hsYmpFUU1BNEdBMVVFQnd3SApTOE9Ed3Jac2JqRVVNQklHQTFVRUNnd0xVMlZyZEdsdmJrVnBibk14SHpBZEJnTlZCQXNNRmsxaGJHbGphVzkxCmN5QkRaWEowSUZObFkzUnBiMjR4SVRBZkJnTlZCQU1NR0cxaGJHbGphVzkxY3k1elpXdDBhVzl1WldsdWN5NWsKWlRFcU1DZ0dDU3FHU0liM0RRRUpBUlliYzNSbFptRnVMbVZ6YzJWeVFITmxhM1JwYjI1bGFXNXpMbVJsTUhVWQpaREU1TnpBd01UQXhNREF3TURBd1dnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBCkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEKQUFBQUFBQVhEVEUwTVRFeU9ERXhNemt6TlZvd2djTXhDekFKQmdOVkJBWVRBa1JGTVJ3d0dnWURWUVFJREJOTwpiM0prY21obGFXNHRWMlZ6ZEdaaGJHVnVNUkF3RGdZRFZRUUhEQWRMdzRQQ3RteHVNUlF3RWdZRFZRUUtEQXRUClpXdDBhVzl1UldsdWN6RWZNQjBHQTFVRUN3d1dUV0ZzYVdOcGIzVnpJRU5sY25RZ1UyVmpkR2x2YmpFaE1COEcKQTFVRUF3d1liV0ZzYVdOcGIzVnpMbk5sYTNScGIyNWxhVzV6TG1SbE1Tb3dLQVlKS29aSWh2Y05BUWtCRmh0egpkR1ZtWVc0dVpYTnpaWEpBYzJWcmRHbHZibVZwYm5NdVpHVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRERBZjNobDdKWTBYY0ZuaXlFSnBTU0RxbjBPcUJyNlFQNjV1c0pQUnQvOFBhRG9xQnUKd0VZVC9OYSs2ZnNnUGpDMHVLOURaZ1dnMnRIV1dvYW5TYmxBTW96NVBINlorUzRTSFJaN2UyZERJalBqZGhqaAowbUxnMlVNTzV5cDBWNzk3R2dzOWxOdDZKUmZIODFNTjJvYlhXczROdHp0TE11RDZlZ3FwcjhkRGJyMzRhT3M4CnBrZHVpNVVhd1Raa3N5NXBMUEhxNWNNaEZHbTA2djY1Q0xvMFYyUGQ5K0tBb2tQclBjTjVLTEtlYno3bUxwazYKU01lRVhPS1A0aWRFcXh5UTdPN2ZCdUhNZWRzUWh1K3ByWTNzaTNCVXlLZlF0UDVDWm5YMmJwMHdLSHhYMTJEWAoxbmZGSXQ5RGJHdkhUY3lPdU4rblpMUEJtM3ZXeG50eUlJdlZBZ01CQUFHalFqQkFNQWtHQTFVZEV3UUNNQUF3CkVRWUpZSVpJQVliNFFnRUJCQVFEQWdlQU1Bc0dBMVVkRHdRRUF3SUZvREFUQmdOVkhTVUVEREFLQmdnckJnRUYKQlFjREFqQU5CZ2txaGtpRzl3MEJBUVVGQUFPQ0FRRUFHMGZaWVlDVGJkajFYWWMrMVNub2FQUit2SThDOENhRAo4KzBVWWhkbnlVNGdnYTBCQWNEclk5ZTk0ZUVBdTZacXljRjZGakxxWFhkQWJvcHBXb2NyNlQ2R0QxeDMzQ2tsClZBcnpHL0t4UW9oR0QySmVxa2hJTWxEb214SE83a2EzOStPYThpMnZXTFZ5alU4QVp2V01BcnVIYTRFRU55RzcKbFcyQWFnYUZLRkNyOVRuWFRmcmR4R1ZFYnY3S1ZRNmJkaGc1cDVTanBXSDErTXEwM3VSM1pYUEJZZHlWODMxOQpvMGxWajFLRkkyRENML2xpV2lzSlJvb2YrMWNSMzVDdGQwd1lCY3BCNlRac2xNY09QbDc2ZHdLd0pnZUpvMlFnClpzZm1jMnZDMS9xT2xOdU5xLzBUenprVkd2OEVUVDNDZ2FVK1VYZTRYT1Z2a2NjZWJKbjJkZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K';
|
||||
$script = <<<'EOT'
|
||||
|
||||
error_reporting(-1);
|
||||
$info = openssl_x509_parse(base64_decode('%s'));
|
||||
var_dump(PHP_VERSION, $info['issuer']['emailAddress'], $info['validFrom_time_t']);
|
||||
|
||||
EOT;
|
||||
$script = '<'."?php\n".sprintf($script, $cert);
|
||||
|
||||
try {
|
||||
$process = new PhpProcess($script);
|
||||
$process->mustRun();
|
||||
} catch (\Exception $e) {
|
||||
// In the case of any exceptions just accept it is not possible to
|
||||
// determine the safety of openssl_x509_parse and bail out.
|
||||
return self::$useOpensslParse = false;
|
||||
}
|
||||
|
||||
$output = preg_split('{\r?\n}', trim($process->getOutput()));
|
||||
$errorOutput = trim($process->getErrorOutput());
|
||||
|
||||
if (
|
||||
is_array($output)
|
||||
&& count($output) === 3
|
||||
&& $output[0] === sprintf('string(%d) "%s"', strlen(PHP_VERSION), PHP_VERSION)
|
||||
&& $output[1] === 'string(27) "stefan.esser@sektioneins.de"'
|
||||
&& $output[2] === 'int(-1)'
|
||||
&& preg_match('{openssl_x509_parse\(\): illegal (?:ASN1 data type for|length in) timestamp in - on line \d+}', $errorOutput)
|
||||
) {
|
||||
// This PHP has the fix backported probably by a distro security team.
|
||||
return self::$useOpensslParse = true;
|
||||
}
|
||||
|
||||
return self::$useOpensslParse = false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resets the static caches
|
||||
* @return void
|
||||
*/
|
||||
public static function reset()
|
||||
{
|
||||
self::$caFileValidity = array();
|
||||
self::$caPath = null;
|
||||
self::$useOpensslParse = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $name
|
||||
* @return string|false
|
||||
*/
|
||||
private static function getEnvVariable($name)
|
||||
{
|
||||
if (isset($_SERVER[$name])) {
|
||||
return (string) $_SERVER[$name];
|
||||
}
|
||||
|
||||
if (PHP_SAPI === 'cli' && ($value = getenv($name)) !== false && $value !== null) {
|
||||
return (string) $value;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string|false $certFile
|
||||
* @param LoggerInterface|null $logger
|
||||
* @return bool
|
||||
*/
|
||||
private static function caFileUsable($certFile, LoggerInterface $logger = null)
|
||||
{
|
||||
return $certFile
|
||||
&& static::isFile($certFile, $logger)
|
||||
&& static::isReadable($certFile, $logger)
|
||||
&& static::validateCaFile($certFile, $logger);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string|false $certDir
|
||||
* @param LoggerInterface|null $logger
|
||||
* @return bool
|
||||
*/
|
||||
private static function caDirUsable($certDir, LoggerInterface $logger = null)
|
||||
{
|
||||
return $certDir
|
||||
&& static::isDir($certDir, $logger)
|
||||
&& static::isReadable($certDir, $logger)
|
||||
&& static::glob($certDir . '/*', $logger);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $certFile
|
||||
* @param LoggerInterface|null $logger
|
||||
* @return bool
|
||||
*/
|
||||
private static function isFile($certFile, LoggerInterface $logger = null)
|
||||
{
|
||||
$isFile = @is_file($certFile);
|
||||
if (!$isFile && $logger) {
|
||||
$logger->debug(sprintf('Checked CA file %s does not exist or it is not a file.', $certFile));
|
||||
}
|
||||
|
||||
return $isFile;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $certDir
|
||||
* @param LoggerInterface|null $logger
|
||||
* @return bool
|
||||
*/
|
||||
private static function isDir($certDir, LoggerInterface $logger = null)
|
||||
{
|
||||
$isDir = @is_dir($certDir);
|
||||
if (!$isDir && $logger) {
|
||||
$logger->debug(sprintf('Checked directory %s does not exist or it is not a directory.', $certDir));
|
||||
}
|
||||
|
||||
return $isDir;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $certFileOrDir
|
||||
* @param LoggerInterface|null $logger
|
||||
* @return bool
|
||||
*/
|
||||
private static function isReadable($certFileOrDir, LoggerInterface $logger = null)
|
||||
{
|
||||
$isReadable = @is_readable($certFileOrDir);
|
||||
if (!$isReadable && $logger) {
|
||||
$logger->debug(sprintf('Checked file or directory %s is not readable.', $certFileOrDir));
|
||||
}
|
||||
|
||||
return $isReadable;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $pattern
|
||||
* @param LoggerInterface|null $logger
|
||||
* @return bool
|
||||
*/
|
||||
private static function glob($pattern, LoggerInterface $logger = null)
|
||||
{
|
||||
$certs = glob($pattern);
|
||||
if ($certs === false) {
|
||||
if ($logger) {
|
||||
$logger->debug(sprintf("An error occurred while trying to find certificates for pattern: %s", $pattern));
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
if (count($certs) === 0) {
|
||||
if ($logger) {
|
||||
$logger->debug(sprintf("No CA files found for pattern: %s", $pattern));
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
}
|
||||
127
vendor/composer/installed.json
vendored
127
vendor/composer/installed.json
vendored
|
|
@ -59,6 +59,85 @@
|
|||
},
|
||||
"install-path": "../bordoni/phpass"
|
||||
},
|
||||
{
|
||||
"name": "composer/ca-bundle",
|
||||
"version": "1.3.4",
|
||||
"version_normalized": "1.3.4.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/composer/ca-bundle.git",
|
||||
"reference": "69098eca243998b53eed7a48d82dedd28b447cd5"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/composer/ca-bundle/zipball/69098eca243998b53eed7a48d82dedd28b447cd5",
|
||||
"reference": "69098eca243998b53eed7a48d82dedd28b447cd5",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"ext-openssl": "*",
|
||||
"ext-pcre": "*",
|
||||
"php": "^5.3.2 || ^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpstan/phpstan": "^0.12.55",
|
||||
"psr/log": "^1.0",
|
||||
"symfony/phpunit-bridge": "^4.2 || ^5",
|
||||
"symfony/process": "^2.5 || ^3.0 || ^4.0 || ^5.0 || ^6.0"
|
||||
},
|
||||
"time": "2022-10-12T12:08:29+00:00",
|
||||
"type": "library",
|
||||
"extra": {
|
||||
"branch-alias": {
|
||||
"dev-main": "1.x-dev"
|
||||
}
|
||||
},
|
||||
"installation-source": "dist",
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"Composer\\CaBundle\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"MIT"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Jordi Boggiano",
|
||||
"email": "j.boggiano@seld.be",
|
||||
"homepage": "http://seld.be"
|
||||
}
|
||||
],
|
||||
"description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.",
|
||||
"keywords": [
|
||||
"cabundle",
|
||||
"cacert",
|
||||
"certificate",
|
||||
"ssl",
|
||||
"tls"
|
||||
],
|
||||
"support": {
|
||||
"irc": "irc://irc.freenode.org/composer",
|
||||
"issues": "https://github.com/composer/ca-bundle/issues",
|
||||
"source": "https://github.com/composer/ca-bundle/tree/1.3.4"
|
||||
},
|
||||
"funding": [
|
||||
{
|
||||
"url": "https://packagist.com",
|
||||
"type": "custom"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/composer",
|
||||
"type": "github"
|
||||
},
|
||||
{
|
||||
"url": "https://tidelift.com/funding/github/packagist/composer/composer",
|
||||
"type": "tidelift"
|
||||
}
|
||||
],
|
||||
"install-path": "./ca-bundle"
|
||||
},
|
||||
{
|
||||
"name": "coolsms/php-sdk",
|
||||
"version": "v2.0",
|
||||
|
|
@ -266,6 +345,54 @@
|
|||
],
|
||||
"install-path": "../egulias/email-validator"
|
||||
},
|
||||
{
|
||||
"name": "enshrined/svg-sanitize",
|
||||
"version": "0.15.4",
|
||||
"version_normalized": "0.15.4.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/darylldoyle/svg-sanitizer.git",
|
||||
"reference": "e50b83a2f1f296ca61394fe88fbfe3e896a84cf4"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/e50b83a2f1f296ca61394fe88fbfe3e896a84cf4",
|
||||
"reference": "e50b83a2f1f296ca61394fe88fbfe3e896a84cf4",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"ext-dom": "*",
|
||||
"ext-libxml": "*",
|
||||
"php": "^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": "^6.5 || ^8.5"
|
||||
},
|
||||
"time": "2022-02-21T09:13:59+00:00",
|
||||
"type": "library",
|
||||
"installation-source": "dist",
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"enshrined\\svgSanitize\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"GPL-2.0-or-later"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Daryll Doyle",
|
||||
"email": "daryll@enshrined.co.uk"
|
||||
}
|
||||
],
|
||||
"description": "An SVG sanitizer for PHP",
|
||||
"support": {
|
||||
"issues": "https://github.com/darylldoyle/svg-sanitizer/issues",
|
||||
"source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.15.4"
|
||||
},
|
||||
"install-path": "../enshrined/svg-sanitize"
|
||||
},
|
||||
{
|
||||
"name": "ezyang/htmlpurifier",
|
||||
"version": "v4.16.0",
|
||||
|
|
|
|||
22
vendor/composer/installed.php
vendored
22
vendor/composer/installed.php
vendored
|
|
@ -6,7 +6,7 @@
|
|||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => '35a93f3928d626386609cb278a6a1ed70886096f',
|
||||
'reference' => '735d3dd97cb734f22b76ffef1857523b7e918d6a',
|
||||
'name' => 'rhymix/rhymix',
|
||||
),
|
||||
'versions' =>
|
||||
|
|
@ -20,6 +20,15 @@
|
|||
),
|
||||
'reference' => '12f8f5cc03ebb7efd69554f104afe9aa1aa46e1a',
|
||||
),
|
||||
'composer/ca-bundle' =>
|
||||
array (
|
||||
'pretty_version' => '1.3.4',
|
||||
'version' => '1.3.4.0',
|
||||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => '69098eca243998b53eed7a48d82dedd28b447cd5',
|
||||
),
|
||||
'coolsms/php-sdk' =>
|
||||
array (
|
||||
'pretty_version' => 'v2.0',
|
||||
|
|
@ -47,6 +56,15 @@
|
|||
),
|
||||
'reference' => 'f88dcf4b14af14a98ad96b14b2b317969eab6715',
|
||||
),
|
||||
'enshrined/svg-sanitize' =>
|
||||
array (
|
||||
'pretty_version' => '0.15.4',
|
||||
'version' => '0.15.4.0',
|
||||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => 'e50b83a2f1f296ca61394fe88fbfe3e896a84cf4',
|
||||
),
|
||||
'ezyang/htmlpurifier' =>
|
||||
array (
|
||||
'pretty_version' => 'v4.16.0',
|
||||
|
|
@ -218,7 +236,7 @@
|
|||
'aliases' =>
|
||||
array (
|
||||
),
|
||||
'reference' => '35a93f3928d626386609cb278a6a1ed70886096f',
|
||||
'reference' => '735d3dd97cb734f22b76ffef1857523b7e918d6a',
|
||||
),
|
||||
'rmccue/requests' =>
|
||||
array (
|
||||
|
|
|
|||
340
vendor/enshrined/svg-sanitize/LICENSE
vendored
Normal file
340
vendor/enshrined/svg-sanitize/LICENSE
vendored
Normal file
|
|
@ -0,0 +1,340 @@
|
|||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/>
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
{description}
|
||||
Copyright (C) {year} {fullname}
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
{signature of Ty Coon}, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
|
||||
92
vendor/enshrined/svg-sanitize/README.md
vendored
Normal file
92
vendor/enshrined/svg-sanitize/README.md
vendored
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
# svg-sanitizer
|
||||
|
||||
[](https://travis-ci.org/darylldoyle/svg-sanitizer) [](https://codeclimate.com/github/darylldoyle/svg-sanitizer/coverage)
|
||||
|
||||
This is my attempt at building a decent SVG sanitizer in PHP. The work is laregely borrowed from [DOMPurify](https://github.com/cure53/DOMPurify).
|
||||
|
||||
## Installation
|
||||
|
||||
Either require `enshrined/svg-sanitize` through composer or download the repo and include the old way!
|
||||
|
||||
## Usage
|
||||
|
||||
Using this is fairly easy. Create a new instance of `enshrined\svgSanitize\Sanitizer` and then call the `sanitize` whilst passing in your dirty SVG/XML
|
||||
|
||||
**Basic Example**
|
||||
|
||||
```php
|
||||
use enshrined\svgSanitize\Sanitizer;
|
||||
|
||||
// Create a new sanitizer instance
|
||||
$sanitizer = new Sanitizer();
|
||||
|
||||
// Load the dirty svg
|
||||
$dirtySVG = file_get_contents('filthy.svg');
|
||||
|
||||
// Pass it to the sanitizer and get it back clean
|
||||
$cleanSVG = $sanitizer->sanitize($dirtySVG);
|
||||
|
||||
// Now do what you want with your clean SVG/XML data
|
||||
|
||||
```
|
||||
|
||||
## Output
|
||||
|
||||
This will either return a sanitized SVG/XML string or boolean `false` if XML parsing failed (usually due to a badly formatted file).
|
||||
|
||||
## Options
|
||||
|
||||
You may pass your own whitelist of tags and attributes by using the `Sanitizer::setAllowedTags` and `Sanitizer::setAllowedAttrs` methods respectively.
|
||||
|
||||
These methods require that you implement the `enshrined\svgSanitize\data\TagInterface` or `enshrined\svgSanitize\data\AttributeInterface`.
|
||||
|
||||
## Remove remote references
|
||||
|
||||
You have the option to remove attributes that reference remote files, this will stop HTTP leaks but will add an overhead to the sanitizer.
|
||||
|
||||
This defaults to false, set to true to remove references.
|
||||
|
||||
`$sanitizer->removeRemoteReferences(true);`
|
||||
|
||||
## Viewing Sanitization Issues
|
||||
|
||||
You may use the `getXmlIssues()` method to return an array of issues that occurred during sanitization.
|
||||
|
||||
This may be useful for logging or providing feedback to the user on why an SVG was refused.
|
||||
|
||||
`$issues = $sanitizer->getXmlIssues();`
|
||||
|
||||
## Minification
|
||||
|
||||
You can minify the XML output by calling `$sanitizer->minify(true);`.
|
||||
|
||||
## Demo
|
||||
There is a demo available at: [http://svg.enshrined.co.uk/](http://svg.enshrined.co.uk/)
|
||||
|
||||
## WordPress
|
||||
|
||||
I've just released a WordPress plugin containing this code so you can sanitize your WordPress uploads. It's available from the WordPress plugin directory: [https://wordpress.org/plugins/safe-svg/](https://wordpress.org/plugins/safe-svg/)
|
||||
|
||||
## Drupal
|
||||
|
||||
[Michael Potter](https://github.com/heyMP) has kindly created a Drupal module for this library which is available at: [https://www.drupal.org/project/svg_sanitizer](https://www.drupal.org/project/svg_sanitizer)
|
||||
|
||||
## TYPO3
|
||||
|
||||
An integration for TYPO3 CMS of this library is available as composer package `t3g/svg-sanitizer` at [https://github.com/TYPO3GmbH/svg_sanitizer](https://github.com/TYPO3GmbH/svg_sanitizer)
|
||||
|
||||
## Tests
|
||||
|
||||
You can run these by running `vendor/bin/phpunit` from the base directory of this package.
|
||||
|
||||
## Standalone scanning of files via CLI
|
||||
|
||||
Thanks to the work by [gudmdharalds](https://github.com/gudmdharalds) there's now a standalone scanner that can be used via the CLI.
|
||||
|
||||
Any errors will be output in JSON format. See [the PR](https://github.com/darylldoyle/svg-sanitizer/pull/25) for an example.
|
||||
|
||||
Use it as follows: `php svg-scanner.php ~/svgs/myfile.svg`
|
||||
|
||||
## To-Do
|
||||
|
||||
More extensive testing for the SVGs/XML would be lovely, I'll try and add these soon. If you feel like doing it for me, please do and make a PR!
|
||||
33
vendor/enshrined/svg-sanitize/composer.json
vendored
Normal file
33
vendor/enshrined/svg-sanitize/composer.json
vendored
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"name": "enshrined/svg-sanitize",
|
||||
"description": "An SVG sanitizer for PHP",
|
||||
"license": "GPL-2.0-or-later",
|
||||
"authors": [
|
||||
{
|
||||
"name": "Daryll Doyle",
|
||||
"email": "daryll@enshrined.co.uk"
|
||||
}
|
||||
],
|
||||
"scripts": {
|
||||
"test": "phpunit --no-coverage",
|
||||
"test:coverage": "phpunit"
|
||||
},
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"enshrined\\svgSanitize\\": "src"
|
||||
}
|
||||
},
|
||||
"autoload-dev": {
|
||||
"psr-4": {
|
||||
"enshrined\\svgSanitize\\Tests\\": "tests"
|
||||
}
|
||||
},
|
||||
"require": {
|
||||
"ext-dom": "*",
|
||||
"ext-libxml": "*",
|
||||
"php": "^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": "^6.5 || ^8.5"
|
||||
}
|
||||
}
|
||||
169
vendor/enshrined/svg-sanitize/src/ElementReference/Resolver.php
vendored
Normal file
169
vendor/enshrined/svg-sanitize/src/ElementReference/Resolver.php
vendored
Normal file
|
|
@ -0,0 +1,169 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\ElementReference;
|
||||
|
||||
use enshrined\svgSanitize\data\XPath;
|
||||
use enshrined\svgSanitize\Exceptions\NestingException;
|
||||
use enshrined\svgSanitize\Helper;
|
||||
|
||||
class Resolver
|
||||
{
|
||||
/**
|
||||
* @var XPath
|
||||
*/
|
||||
protected $xPath;
|
||||
|
||||
/**
|
||||
* @var Subject[]
|
||||
*/
|
||||
protected $subjects = [];
|
||||
|
||||
/**
|
||||
* @var array DOMElement[]
|
||||
*/
|
||||
protected $elementsToRemove = [];
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useNestingLimit;
|
||||
|
||||
public function __construct(XPath $xPath, $useNestingLimit)
|
||||
{
|
||||
$this->xPath = $xPath;
|
||||
$this->useNestingLimit = $useNestingLimit;
|
||||
}
|
||||
|
||||
public function collect()
|
||||
{
|
||||
$this->collectIdentifiedElements();
|
||||
$this->processReferences();
|
||||
$this->determineInvalidSubjects();
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolves one subject by element.
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @param bool $considerChildren Whether to search in Subject's children as well
|
||||
* @return Subject|null
|
||||
*/
|
||||
public function findByElement(\DOMElement $element, $considerChildren = false)
|
||||
{
|
||||
foreach ($this->subjects as $subject) {
|
||||
if (
|
||||
$element === $subject->getElement()
|
||||
|| $considerChildren && Helper::isElementContainedIn($element, $subject->getElement())
|
||||
) {
|
||||
return $subject;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolves subjects (plural!) by element id - in theory malformed
|
||||
* DOM might have same ids assigned to different elements and leaving
|
||||
* it to client/browser implementation which element to actually use.
|
||||
*
|
||||
* @param string $elementId
|
||||
* @return Subject[]
|
||||
*/
|
||||
public function findByElementId($elementId)
|
||||
{
|
||||
return array_filter(
|
||||
$this->subjects,
|
||||
function (Subject $subject) use ($elementId) {
|
||||
return $elementId === $subject->getElementId();
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Collects elements having `id` attribute (those that can be referenced).
|
||||
*/
|
||||
protected function collectIdentifiedElements()
|
||||
{
|
||||
/** @var \DOMNodeList|\DOMElement[] $elements */
|
||||
$elements = $this->xPath->query('//*[@id]');
|
||||
foreach ($elements as $element) {
|
||||
$this->subjects[$element->getAttribute('id')] = new Subject($element, $this->useNestingLimit);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Processes references from and to elements having `id` attribute concerning
|
||||
* their occurrence in `<use ... xlink:href="#identifier">` statements.
|
||||
*/
|
||||
protected function processReferences()
|
||||
{
|
||||
$useNodeName = $this->xPath->createNodeName('use');
|
||||
foreach ($this->subjects as $subject) {
|
||||
$useElements = $this->xPath->query(
|
||||
$useNodeName . '[@href or @xlink:href]',
|
||||
$subject->getElement()
|
||||
);
|
||||
|
||||
/** @var \DOMElement $useElement */
|
||||
foreach ($useElements as $useElement) {
|
||||
$useId = Helper::extractIdReferenceFromHref(
|
||||
Helper::getElementHref($useElement)
|
||||
);
|
||||
if ($useId === null || !isset($this->subjects[$useId])) {
|
||||
continue;
|
||||
}
|
||||
$subject->addUse($this->subjects[$useId]);
|
||||
$this->subjects[$useId]->addUsedIn($subject);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines and tags infinite loops.
|
||||
*/
|
||||
protected function determineInvalidSubjects()
|
||||
{
|
||||
foreach ($this->subjects as $subject) {
|
||||
|
||||
if (in_array($subject->getElement(), $this->elementsToRemove)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$useId = Helper::extractIdReferenceFromHref(
|
||||
Helper::getElementHref($subject->getElement())
|
||||
);
|
||||
|
||||
try {
|
||||
if ($useId === $subject->getElementId()) {
|
||||
$this->markSubjectAsInvalid($subject);
|
||||
} elseif ($subject->hasInfiniteLoop()) {
|
||||
$this->markSubjectAsInvalid($subject);
|
||||
}
|
||||
} catch (NestingException $e) {
|
||||
$this->elementsToRemove[] = $e->getElement();
|
||||
$this->markSubjectAsInvalid($subject);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all the elements that caused a nesting exception.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getElementsToRemove() {
|
||||
return $this->elementsToRemove;
|
||||
}
|
||||
|
||||
/**
|
||||
* The Subject is invalid for some reason, therefore we should
|
||||
* remove it and all it's child usages.
|
||||
*
|
||||
* @param Subject $subject
|
||||
*/
|
||||
protected function markSubjectAsInvalid(Subject $subject) {
|
||||
$this->elementsToRemove = array_merge(
|
||||
$this->elementsToRemove,
|
||||
$subject->clearInternalAndGetAffectedElements()
|
||||
);
|
||||
}
|
||||
}
|
||||
153
vendor/enshrined/svg-sanitize/src/ElementReference/Subject.php
vendored
Normal file
153
vendor/enshrined/svg-sanitize/src/ElementReference/Subject.php
vendored
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\ElementReference;
|
||||
|
||||
class Subject
|
||||
{
|
||||
/**
|
||||
* @var \DOMElement
|
||||
*/
|
||||
protected $element;
|
||||
|
||||
/**
|
||||
* @var Usage[]
|
||||
*/
|
||||
protected $useCollection = [];
|
||||
|
||||
/**
|
||||
* @var Usage[]
|
||||
*/
|
||||
protected $usedInCollection = [];
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useNestingLimit;
|
||||
|
||||
/**
|
||||
* Subject constructor.
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @param int $useNestingLimit
|
||||
*/
|
||||
public function __construct(\DOMElement $element, $useNestingLimit)
|
||||
{
|
||||
$this->element = $element;
|
||||
$this->useNestingLimit = $useNestingLimit;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return \DOMElement
|
||||
*/
|
||||
public function getElement()
|
||||
{
|
||||
return $this->element;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getElementId()
|
||||
{
|
||||
return $this->element->getAttribute('id');
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $subjects Previously processed subjects
|
||||
* @param int $level The current level of nesting.
|
||||
* @return bool
|
||||
* @throws \enshrined\svgSanitize\Exceptions\NestingException
|
||||
*/
|
||||
public function hasInfiniteLoop(array $subjects = [], $level = 1)
|
||||
{
|
||||
if ($level > $this->useNestingLimit) {
|
||||
throw new \enshrined\svgSanitize\Exceptions\NestingException('Nesting level too high, aborting', 1570713498, null, $this->getElement());
|
||||
}
|
||||
|
||||
if (in_array($this, $subjects, true)) {
|
||||
return true;
|
||||
}
|
||||
$subjects[] = $this;
|
||||
foreach ($this->useCollection as $usage) {
|
||||
if ($usage->getSubject()->hasInfiniteLoop($subjects, $level + 1)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param Subject $subject
|
||||
*/
|
||||
public function addUse(Subject $subject)
|
||||
{
|
||||
if ($subject === $this) {
|
||||
throw new \LogicException('Cannot add self usage', 1570713416);
|
||||
}
|
||||
$identifier = $subject->getElementId();
|
||||
if (isset($this->useCollection[$identifier])) {
|
||||
$this->useCollection[$identifier]->increment();
|
||||
return;
|
||||
}
|
||||
$this->useCollection[$identifier] = new Usage($subject);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param Subject $subject
|
||||
*/
|
||||
public function addUsedIn(Subject $subject)
|
||||
{
|
||||
if ($subject === $this) {
|
||||
throw new \LogicException('Cannot add self as usage', 1570713417);
|
||||
}
|
||||
$identifier = $subject->getElementId();
|
||||
if (isset($this->usedInCollection[$identifier])) {
|
||||
$this->usedInCollection[$identifier]->increment();
|
||||
return;
|
||||
}
|
||||
$this->usedInCollection[$identifier] = new Usage($subject);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param bool $accumulated
|
||||
* @return int
|
||||
*/
|
||||
public function countUse($accumulated = false)
|
||||
{
|
||||
$count = 0;
|
||||
foreach ($this->useCollection as $use) {
|
||||
$useCount = $use->getSubject()->countUse();
|
||||
$count += $use->getCount() * ($accumulated ? 1 + $useCount : max(1, $useCount));
|
||||
}
|
||||
return $count;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return int
|
||||
*/
|
||||
public function countUsedIn()
|
||||
{
|
||||
$count = 0;
|
||||
foreach ($this->usedInCollection as $usedIn) {
|
||||
$count += $usedIn->getCount() * max(1, $usedIn->getSubject()->countUsedIn());
|
||||
}
|
||||
return $count;
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear the internal arrays (to free up memory as they can get big)
|
||||
* and return all the child usages DOMElement's
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function clearInternalAndGetAffectedElements()
|
||||
{
|
||||
$elements = array_map(function(Usage $usage) {
|
||||
return $usage->getSubject()->getElement();
|
||||
}, $this->useCollection);
|
||||
|
||||
$this->usedInCollection = [];
|
||||
$this->useCollection = [];
|
||||
|
||||
return $elements;
|
||||
}
|
||||
}
|
||||
49
vendor/enshrined/svg-sanitize/src/ElementReference/Usage.php
vendored
Normal file
49
vendor/enshrined/svg-sanitize/src/ElementReference/Usage.php
vendored
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\ElementReference;
|
||||
|
||||
class Usage
|
||||
{
|
||||
/**
|
||||
* @var Subject
|
||||
*/
|
||||
protected $subject;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $count;
|
||||
|
||||
/**
|
||||
* @param Subject $subject
|
||||
* @param int $count
|
||||
*/
|
||||
public function __construct(Subject $subject, $count = 1)
|
||||
{
|
||||
$this->subject = $subject;
|
||||
$this->count = (int)$count;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param int $by
|
||||
*/
|
||||
public function increment($by = 1)
|
||||
{
|
||||
$this->count += (int)$by;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return Subject
|
||||
*/
|
||||
public function getSubject()
|
||||
{
|
||||
return $this->subject;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return int
|
||||
*/
|
||||
public function getCount()
|
||||
{
|
||||
return $this->count;
|
||||
}
|
||||
}
|
||||
36
vendor/enshrined/svg-sanitize/src/Exceptions/NestingException.php
vendored
Normal file
36
vendor/enshrined/svg-sanitize/src/Exceptions/NestingException.php
vendored
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\Exceptions;
|
||||
|
||||
use Exception;
|
||||
|
||||
class NestingException extends \Exception
|
||||
{
|
||||
/**
|
||||
* @var \DOMElement
|
||||
*/
|
||||
protected $element;
|
||||
|
||||
/**
|
||||
* NestingException constructor.
|
||||
*
|
||||
* @param string $message
|
||||
* @param int $code
|
||||
* @param Exception|null $previous
|
||||
* @param \DOMElement|null $element
|
||||
*/
|
||||
public function __construct($message = "", $code = 0, Exception $previous = null, \DOMElement $element = null)
|
||||
{
|
||||
$this->element = $element;
|
||||
parent::__construct($message, $code, $previous);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the element that caused the exception.
|
||||
*
|
||||
* @return \DOMElement
|
||||
*/
|
||||
public function getElement()
|
||||
{
|
||||
return $this->element;
|
||||
}
|
||||
}
|
||||
53
vendor/enshrined/svg-sanitize/src/Helper.php
vendored
Normal file
53
vendor/enshrined/svg-sanitize/src/Helper.php
vendored
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize;
|
||||
|
||||
class Helper
|
||||
{
|
||||
/**
|
||||
* @param \DOMElement $element
|
||||
* @return string|null
|
||||
*/
|
||||
public static function getElementHref(\DOMElement $element)
|
||||
{
|
||||
if ($element->hasAttribute('href')) {
|
||||
return $element->getAttribute('href');
|
||||
}
|
||||
if ($element->hasAttributeNS('http://www.w3.org/1999/xlink', 'href')) {
|
||||
return $element->getAttributeNS('http://www.w3.org/1999/xlink', 'href');
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $href
|
||||
* @return string|null
|
||||
*/
|
||||
public static function extractIdReferenceFromHref($href)
|
||||
{
|
||||
if (!is_string($href) || strpos($href, '#') !== 0) {
|
||||
return null;
|
||||
}
|
||||
return substr($href, 1);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param \DOMElement $needle
|
||||
* @param \DOMElement $haystack
|
||||
* @return bool
|
||||
*/
|
||||
public static function isElementContainedIn(\DOMElement $needle, \DOMElement $haystack)
|
||||
{
|
||||
if ($needle === $haystack) {
|
||||
return true;
|
||||
}
|
||||
foreach ($haystack->childNodes as $childNode) {
|
||||
if (!$childNode instanceof \DOMElement) {
|
||||
continue;
|
||||
}
|
||||
if (self::isElementContainedIn($needle, $childNode)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
669
vendor/enshrined/svg-sanitize/src/Sanitizer.php
vendored
Normal file
669
vendor/enshrined/svg-sanitize/src/Sanitizer.php
vendored
Normal file
|
|
@ -0,0 +1,669 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize;
|
||||
|
||||
use enshrined\svgSanitize\data\AllowedAttributes;
|
||||
use enshrined\svgSanitize\data\AllowedTags;
|
||||
use enshrined\svgSanitize\data\AttributeInterface;
|
||||
use enshrined\svgSanitize\data\TagInterface;
|
||||
use enshrined\svgSanitize\data\XPath;
|
||||
use enshrined\svgSanitize\ElementReference\Resolver;
|
||||
|
||||
/**
|
||||
* Class Sanitizer
|
||||
*
|
||||
* @package enshrined\svgSanitize
|
||||
*/
|
||||
class Sanitizer
|
||||
{
|
||||
|
||||
/**
|
||||
* @var \DOMDocument
|
||||
*/
|
||||
protected $xmlDocument;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
protected $allowedTags;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
protected $allowedAttrs;
|
||||
|
||||
/**
|
||||
* @var
|
||||
*/
|
||||
protected $xmlLoaderValue;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $minifyXML = false;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $removeRemoteReferences = false;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useThreshold = 1000;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $removeXMLTag = false;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $xmlOptions = LIBXML_NOEMPTYTAG;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
protected $xmlIssues = array();
|
||||
|
||||
/**
|
||||
* @var Resolver
|
||||
*/
|
||||
protected $elementReferenceResolver;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useNestingLimit = 15;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
function __construct()
|
||||
{
|
||||
// Load default tags/attributes
|
||||
$this->allowedAttrs = array_map('strtolower', AllowedAttributes::getAttributes());
|
||||
$this->allowedTags = array_map('strtolower', AllowedTags::getTags());
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up the DOMDocument
|
||||
*/
|
||||
protected function resetInternal()
|
||||
{
|
||||
$this->xmlDocument = new \DOMDocument();
|
||||
$this->xmlDocument->preserveWhiteSpace = false;
|
||||
$this->xmlDocument->strictErrorChecking = false;
|
||||
$this->xmlDocument->formatOutput = !$this->minifyXML;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set XML options to use when saving XML
|
||||
* See: DOMDocument::saveXML
|
||||
*
|
||||
* @param int $xmlOptions
|
||||
*/
|
||||
public function setXMLOptions($xmlOptions)
|
||||
{
|
||||
$this->xmlOptions = $xmlOptions;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get XML options to use when saving XML
|
||||
* See: DOMDocument::saveXML
|
||||
*
|
||||
* @return int
|
||||
*/
|
||||
public function getXMLOptions()
|
||||
{
|
||||
return $this->xmlOptions;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the array of allowed tags
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getAllowedTags()
|
||||
{
|
||||
return $this->allowedTags;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set custom allowed tags
|
||||
*
|
||||
* @param TagInterface $allowedTags
|
||||
*/
|
||||
public function setAllowedTags(TagInterface $allowedTags)
|
||||
{
|
||||
$this->allowedTags = array_map('strtolower', $allowedTags::getTags());
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the array of allowed attributes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getAllowedAttrs()
|
||||
{
|
||||
return $this->allowedAttrs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set custom allowed attributes
|
||||
*
|
||||
* @param AttributeInterface $allowedAttrs
|
||||
*/
|
||||
public function setAllowedAttrs(AttributeInterface $allowedAttrs)
|
||||
{
|
||||
$this->allowedAttrs = array_map('strtolower', $allowedAttrs::getAttributes());
|
||||
}
|
||||
|
||||
/**
|
||||
* Should we remove references to remote files?
|
||||
*
|
||||
* @param bool $removeRemoteRefs
|
||||
*/
|
||||
public function removeRemoteReferences($removeRemoteRefs = false)
|
||||
{
|
||||
$this->removeRemoteReferences = $removeRemoteRefs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get XML issues.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getXmlIssues() {
|
||||
return $this->xmlIssues;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Sanitize the passed string
|
||||
*
|
||||
* @param string $dirty
|
||||
* @return string
|
||||
*/
|
||||
public function sanitize($dirty)
|
||||
{
|
||||
// Don't run on an empty string
|
||||
if (empty($dirty)) {
|
||||
return '';
|
||||
}
|
||||
|
||||
// Strip php tags
|
||||
$dirty = preg_replace('/<\?(=|php)(.+?)\?>/i', '', $dirty);
|
||||
|
||||
$this->resetInternal();
|
||||
$this->setUpBefore();
|
||||
|
||||
$loaded = $this->xmlDocument->loadXML($dirty);
|
||||
|
||||
// If we couldn't parse the XML then we go no further. Reset and return false
|
||||
if (!$loaded) {
|
||||
$this->resetAfter();
|
||||
return false;
|
||||
}
|
||||
|
||||
// Pre-process all identified elements
|
||||
$xPath = new XPath($this->xmlDocument);
|
||||
$this->elementReferenceResolver = new Resolver($xPath, $this->useNestingLimit);
|
||||
$this->elementReferenceResolver->collect();
|
||||
$elementsToRemove = $this->elementReferenceResolver->getElementsToRemove();
|
||||
|
||||
// Start the cleaning proccess
|
||||
$this->startClean($this->xmlDocument->childNodes, $elementsToRemove);
|
||||
|
||||
// Save cleaned XML to a variable
|
||||
if ($this->removeXMLTag) {
|
||||
$clean = $this->xmlDocument->saveXML($this->xmlDocument->documentElement, $this->xmlOptions);
|
||||
} else {
|
||||
$clean = $this->xmlDocument->saveXML($this->xmlDocument, $this->xmlOptions);
|
||||
}
|
||||
|
||||
$this->resetAfter();
|
||||
|
||||
// Remove any extra whitespaces when minifying
|
||||
if ($this->minifyXML) {
|
||||
$clean = preg_replace('/\s+/', ' ', $clean);
|
||||
}
|
||||
|
||||
// Return result
|
||||
return $clean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up libXML before we start
|
||||
*/
|
||||
protected function setUpBefore()
|
||||
{
|
||||
// This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is
|
||||
// disabled by default, so this function is no longer needed to protect against XXE attacks.
|
||||
if (\LIBXML_VERSION < 20900) {
|
||||
// Turn off the entity loader
|
||||
$this->xmlLoaderValue = libxml_disable_entity_loader(true);
|
||||
}
|
||||
|
||||
// Suppress the errors because we don't really have to worry about formation before cleansing
|
||||
libxml_use_internal_errors(true);
|
||||
|
||||
// Reset array of altered XML
|
||||
$this->xmlIssues = array();
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset the class after use
|
||||
*/
|
||||
protected function resetAfter()
|
||||
{
|
||||
// This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is
|
||||
// disabled by default, so this function is no longer needed to protect against XXE attacks.
|
||||
if (\LIBXML_VERSION < 20900) {
|
||||
// Reset the entity loader
|
||||
libxml_disable_entity_loader($this->xmlLoaderValue);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the cleaning with tags, then we move onto attributes and hrefs later
|
||||
*
|
||||
* @param \DOMNodeList $elements
|
||||
* @param array $elementsToRemove
|
||||
*/
|
||||
protected function startClean(\DOMNodeList $elements, array $elementsToRemove)
|
||||
{
|
||||
// loop through all elements
|
||||
// we do this backwards so we don't skip anything if we delete a node
|
||||
// see comments at: http://php.net/manual/en/class.domnamednodemap.php
|
||||
for ($i = $elements->length - 1; $i >= 0; $i--) {
|
||||
/** @var \DOMElement $currentElement */
|
||||
$currentElement = $elements->item($i);
|
||||
|
||||
/**
|
||||
* If the element has exceeded the nesting limit, we should remove it.
|
||||
*
|
||||
* As it's only <use> elements that cause us issues with nesting DOS attacks
|
||||
* we should check what the element is before removing it. For now we'll only
|
||||
* remove <use> elements.
|
||||
*/
|
||||
if (in_array($currentElement, $elementsToRemove) && 'use' === $currentElement->nodeName) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Invalid \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
|
||||
if ($currentElement instanceof \DOMElement) {
|
||||
// If the tag isn't in the whitelist, remove it and continue with next iteration
|
||||
if (!in_array(strtolower($currentElement->tagName), $this->allowedTags)) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious tag \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->cleanHrefs( $currentElement );
|
||||
|
||||
$this->cleanXlinkHrefs( $currentElement );
|
||||
|
||||
$this->cleanAttributesOnWhitelist($currentElement);
|
||||
|
||||
if (strtolower($currentElement->tagName) === 'use') {
|
||||
if ($this->isUseTagDirty($currentElement)
|
||||
|| $this->isUseTagExceedingThreshold($currentElement)
|
||||
) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
// Strip out font elements that will break out of foreign content.
|
||||
if (strtolower($currentElement->tagName) === 'font') {
|
||||
$breaksOutOfForeignContent = false;
|
||||
for ($x = $currentElement->attributes->length - 1; $x >= 0; $x--) {
|
||||
// get attribute name
|
||||
$attrName = $currentElement->attributes->item( $x )->name;
|
||||
|
||||
if (in_array(strtolower($attrName), ['face', 'color', 'size'])) {
|
||||
$breaksOutOfForeignContent = true;
|
||||
}
|
||||
}
|
||||
|
||||
if ($breaksOutOfForeignContent) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious tag \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$this->cleanUnsafeNodes($currentElement);
|
||||
|
||||
if ($currentElement->hasChildNodes()) {
|
||||
$this->startClean($currentElement->childNodes, $elementsToRemove);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Only allow attributes that are on the whitelist
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
*/
|
||||
protected function cleanAttributesOnWhitelist(\DOMElement $element)
|
||||
{
|
||||
for ($x = $element->attributes->length - 1; $x >= 0; $x--) {
|
||||
// get attribute name
|
||||
$attrName = $element->attributes->item($x)->name;
|
||||
|
||||
// Remove attribute if not in whitelist
|
||||
if (!in_array(strtolower($attrName), $this->allowedAttrs) && !$this->isAriaAttribute(strtolower($attrName)) && !$this->isDataAttribute(strtolower($attrName))) {
|
||||
|
||||
$element->removeAttribute($attrName);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'' . $attrName . '\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* This is used for when a namespace isn't imported properly.
|
||||
* Such as xlink:href when the xlink namespace isn't imported.
|
||||
* We have to do this as the link is still ran in this case.
|
||||
*/
|
||||
if (false !== strpos($attrName, 'href')) {
|
||||
$href = $element->getAttribute($attrName);
|
||||
if (false === $this->isHrefSafeValue($href)) {
|
||||
$element->removeAttribute($attrName);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'href\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Do we want to strip remote references?
|
||||
if($this->removeRemoteReferences) {
|
||||
// Remove attribute if it has a remote reference
|
||||
if (isset($element->attributes->item($x)->value) && $this->hasRemoteReference($element->attributes->item($x)->value)) {
|
||||
$element->removeAttribute($attrName);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'' . $attrName . '\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean the xlink:hrefs of script and data embeds
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
*/
|
||||
protected function cleanXlinkHrefs(\DOMElement $element)
|
||||
{
|
||||
$xlinks = $element->getAttributeNS('http://www.w3.org/1999/xlink', 'href');
|
||||
if (false === $this->isHrefSafeValue($xlinks)) {
|
||||
$element->removeAttributeNS( 'http://www.w3.org/1999/xlink', 'href' );
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'href\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean the hrefs of script and data embeds
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
*/
|
||||
protected function cleanHrefs(\DOMElement $element)
|
||||
{
|
||||
$href = $element->getAttribute('href');
|
||||
if (false === $this->isHrefSafeValue($href)) {
|
||||
$element->removeAttribute('href');
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'href\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Only allow whitelisted starts to be within the href.
|
||||
*
|
||||
* This will stop scripts etc from being passed through, with or without attempting to hide bypasses.
|
||||
* This stops the need for us to use a complicated script regex.
|
||||
*
|
||||
* @param $value
|
||||
* @return bool
|
||||
*/
|
||||
protected function isHrefSafeValue($value) {
|
||||
|
||||
// Allow empty values
|
||||
if (empty($value)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow fragment identifiers.
|
||||
if ('#' === substr($value, 0, 1)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow relative URIs.
|
||||
if ('/' === substr($value, 0, 1)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow HTTPS domains.
|
||||
if ('https://' === substr($value, 0, 8)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow HTTP domains.
|
||||
if ('http://' === substr($value, 0, 7)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow known data URIs.
|
||||
if (in_array(substr($value, 0, 14), array(
|
||||
'data:image/png', // PNG
|
||||
'data:image/gif', // GIF
|
||||
'data:image/jpg', // JPG
|
||||
'data:image/jpe', // JPEG
|
||||
'data:image/pjp', // PJPEG
|
||||
))) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow known short data URIs.
|
||||
if (in_array(substr($value, 0, 12), array(
|
||||
'data:img/png', // PNG
|
||||
'data:img/gif', // GIF
|
||||
'data:img/jpg', // JPG
|
||||
'data:img/jpe', // JPEG
|
||||
'data:img/pjp', // PJPEG
|
||||
))) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Removes non-printable ASCII characters from string & trims it
|
||||
*
|
||||
* @param string $value
|
||||
* @return bool
|
||||
*/
|
||||
protected function removeNonPrintableCharacters($value)
|
||||
{
|
||||
return trim(preg_replace('/[^ -~]/xu','',$value));
|
||||
}
|
||||
|
||||
/**
|
||||
* Does this attribute value have a remote reference?
|
||||
*
|
||||
* @param $value
|
||||
* @return bool
|
||||
*/
|
||||
protected function hasRemoteReference($value)
|
||||
{
|
||||
$value = $this->removeNonPrintableCharacters($value);
|
||||
|
||||
$wrapped_in_url = preg_match('~^url\(\s*[\'"]\s*(.*)\s*[\'"]\s*\)$~xi', $value, $match);
|
||||
if (!$wrapped_in_url){
|
||||
return false;
|
||||
}
|
||||
|
||||
$value = trim($match[1], '\'"');
|
||||
|
||||
return preg_match('~^((https?|ftp|file):)?//~xi', $value);
|
||||
}
|
||||
|
||||
/**
|
||||
* Should we minify the output?
|
||||
*
|
||||
* @param bool $shouldMinify
|
||||
*/
|
||||
public function minify($shouldMinify = false)
|
||||
{
|
||||
$this->minifyXML = (bool) $shouldMinify;
|
||||
}
|
||||
|
||||
/**
|
||||
* Should we remove the XML tag in the header?
|
||||
*
|
||||
* @param bool $removeXMLTag
|
||||
*/
|
||||
public function removeXMLTag($removeXMLTag = false)
|
||||
{
|
||||
$this->removeXMLTag = (bool) $removeXMLTag;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether `<use ... xlink:href="#identifier">` elements shall be
|
||||
* removed in case expansion would exceed this threshold.
|
||||
*
|
||||
* @param int $useThreshold
|
||||
*/
|
||||
public function useThreshold($useThreshold = 1000)
|
||||
{
|
||||
$this->useThreshold = (int)$useThreshold;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check to see if an attribute is an aria attribute or not
|
||||
*
|
||||
* @param $attributeName
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
protected function isAriaAttribute($attributeName)
|
||||
{
|
||||
return strpos($attributeName, 'aria-') === 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check to see if an attribute is an data attribute or not
|
||||
*
|
||||
* @param $attributeName
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
protected function isDataAttribute($attributeName)
|
||||
{
|
||||
return strpos($attributeName, 'data-') === 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Make sure our use tag is only referencing internal resources
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @return bool
|
||||
*/
|
||||
protected function isUseTagDirty(\DOMElement $element)
|
||||
{
|
||||
$href = Helper::getElementHref($element);
|
||||
return $href && strpos($href, '#') !== 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines whether `<use ... xlink:href="#identifier">` is expanded
|
||||
* recursively in order to create DoS scenarios. The amount of a actually
|
||||
* used element needs to be below `$this->useThreshold`.
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @return bool
|
||||
*/
|
||||
protected function isUseTagExceedingThreshold(\DOMElement $element)
|
||||
{
|
||||
if ($this->useThreshold <= 0) {
|
||||
return false;
|
||||
}
|
||||
$useId = Helper::extractIdReferenceFromHref(
|
||||
Helper::getElementHref($element)
|
||||
);
|
||||
if ($useId === null) {
|
||||
return false;
|
||||
}
|
||||
foreach ($this->elementReferenceResolver->findByElementId($useId) as $subject) {
|
||||
if ($subject->countUse() >= $this->useThreshold) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the nesting limit for <use> tags.
|
||||
*
|
||||
* @param $limit
|
||||
*/
|
||||
public function setUseNestingLimit($limit)
|
||||
{
|
||||
$this->useNestingLimit = (int) $limit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove nodes that are either invalid or malformed.
|
||||
*
|
||||
* @param \DOMNode $currentElement The current element.
|
||||
*/
|
||||
protected function cleanUnsafeNodes(\DOMNode $currentElement) {
|
||||
// Replace CDATA node with encoded text node
|
||||
if ($currentElement instanceof \DOMCdataSection) {
|
||||
$textNode = $currentElement->ownerDocument->createTextNode($currentElement->nodeValue);
|
||||
$currentElement->parentNode->replaceChild($textNode, $currentElement);
|
||||
// If the element doesn't have a tagname, remove it and continue with next iteration
|
||||
} elseif (!$currentElement instanceof \DOMElement && !$currentElement instanceof \DOMText) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious node \'' . $currentElement->nodeName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
if ( $currentElement->childNodes && $currentElement->childNodes->length > 0 ) {
|
||||
for ($j = $currentElement->childNodes->length - 1; $j >= 0; $j--) {
|
||||
/** @var \DOMElement $childElement */
|
||||
$childElement = $currentElement->childNodes->item($j);
|
||||
$this->cleanUnsafeNodes($childElement);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
355
vendor/enshrined/svg-sanitize/src/data/AllowedAttributes.php
vendored
Normal file
355
vendor/enshrined/svg-sanitize/src/data/AllowedAttributes.php
vendored
Normal file
|
|
@ -0,0 +1,355 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Class AllowedAttributes
|
||||
*
|
||||
* @package enshrined\svgSanitize\data
|
||||
*/
|
||||
class AllowedAttributes implements AttributeInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of attributes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getAttributes()
|
||||
{
|
||||
return array(
|
||||
// HTML
|
||||
'about',
|
||||
'accept',
|
||||
'action',
|
||||
'align',
|
||||
'alt',
|
||||
'autocomplete',
|
||||
'background',
|
||||
'bgcolor',
|
||||
'border',
|
||||
'cellpadding',
|
||||
'cellspacing',
|
||||
'checked',
|
||||
'cite',
|
||||
'class',
|
||||
'clear',
|
||||
'color',
|
||||
'cols',
|
||||
'colspan',
|
||||
'coords',
|
||||
'crossorigin',
|
||||
'datetime',
|
||||
'default',
|
||||
'dir',
|
||||
'disabled',
|
||||
'download',
|
||||
'enctype',
|
||||
'encoding',
|
||||
'face',
|
||||
'for',
|
||||
'headers',
|
||||
'height',
|
||||
'hidden',
|
||||
'high',
|
||||
'href',
|
||||
'hreflang',
|
||||
'id',
|
||||
'integrity',
|
||||
'ismap',
|
||||
'label',
|
||||
'lang',
|
||||
'list',
|
||||
'loop',
|
||||
'low',
|
||||
'max',
|
||||
'maxlength',
|
||||
'media',
|
||||
'method',
|
||||
'min',
|
||||
'multiple',
|
||||
'name',
|
||||
'noshade',
|
||||
'novalidate',
|
||||
'nowrap',
|
||||
'open',
|
||||
'optimum',
|
||||
'pattern',
|
||||
'placeholder',
|
||||
'poster',
|
||||
'preload',
|
||||
'pubdate',
|
||||
'radiogroup',
|
||||
'readonly',
|
||||
'rel',
|
||||
'required',
|
||||
'rev',
|
||||
'reversed',
|
||||
'role',
|
||||
'rows',
|
||||
'rowspan',
|
||||
'spellcheck',
|
||||
'scope',
|
||||
'selected',
|
||||
'shape',
|
||||
'size',
|
||||
'sizes',
|
||||
'span',
|
||||
'srclang',
|
||||
'start',
|
||||
'src',
|
||||
'srcset',
|
||||
'step',
|
||||
'style',
|
||||
'summary',
|
||||
'tabindex',
|
||||
'title',
|
||||
'type',
|
||||
'usemap',
|
||||
'valign',
|
||||
'value',
|
||||
'version',
|
||||
'width',
|
||||
'xmlns',
|
||||
|
||||
// SVG
|
||||
'accent-height',
|
||||
'accumulate',
|
||||
'additivive',
|
||||
'alignment-baseline',
|
||||
'ascent',
|
||||
'attributename',
|
||||
'attributetype',
|
||||
'azimuth',
|
||||
'basefrequency',
|
||||
'baseline-shift',
|
||||
'begin',
|
||||
'bias',
|
||||
'by',
|
||||
'class',
|
||||
'clip',
|
||||
'clip-path',
|
||||
'clip-rule',
|
||||
'color',
|
||||
'color-interpolation',
|
||||
'color-interpolation-filters',
|
||||
'color-profile',
|
||||
'color-rendering',
|
||||
'cx',
|
||||
'cy',
|
||||
'd',
|
||||
'dx',
|
||||
'dy',
|
||||
'diffuseconstant',
|
||||
'direction',
|
||||
'display',
|
||||
'divisor',
|
||||
'dur',
|
||||
'edgemode',
|
||||
'elevation',
|
||||
'end',
|
||||
'fill',
|
||||
'fill-opacity',
|
||||
'fill-rule',
|
||||
'filter',
|
||||
'filterUnits',
|
||||
'flood-color',
|
||||
'flood-opacity',
|
||||
'font-family',
|
||||
'font-size',
|
||||
'font-size-adjust',
|
||||
'font-stretch',
|
||||
'font-style',
|
||||
'font-variant',
|
||||
'font-weight',
|
||||
'fx',
|
||||
'fy',
|
||||
'g1',
|
||||
'g2',
|
||||
'glyph-name',
|
||||
'glyphref',
|
||||
'gradientunits',
|
||||
'gradienttransform',
|
||||
'height',
|
||||
'href',
|
||||
'id',
|
||||
'image-rendering',
|
||||
'in',
|
||||
'in2',
|
||||
'k',
|
||||
'k1',
|
||||
'k2',
|
||||
'k3',
|
||||
'k4',
|
||||
'kerning',
|
||||
'keypoints',
|
||||
'keysplines',
|
||||
'keytimes',
|
||||
'lang',
|
||||
'lengthadjust',
|
||||
'letter-spacing',
|
||||
'kernelmatrix',
|
||||
'kernelunitlength',
|
||||
'lighting-color',
|
||||
'local',
|
||||
'marker-end',
|
||||
'marker-mid',
|
||||
'marker-start',
|
||||
'markerheight',
|
||||
'markerunits',
|
||||
'markerwidth',
|
||||
'maskcontentunits',
|
||||
'maskunits',
|
||||
'max',
|
||||
'mask',
|
||||
'media',
|
||||
'method',
|
||||
'mode',
|
||||
'min',
|
||||
'name',
|
||||
'numoctaves',
|
||||
'offset',
|
||||
'operator',
|
||||
'opacity',
|
||||
'order',
|
||||
'orient',
|
||||
'orientation',
|
||||
'origin',
|
||||
'overflow',
|
||||
'paint-order',
|
||||
'path',
|
||||
'pathlength',
|
||||
'patterncontentunits',
|
||||
'patterntransform',
|
||||
'patternunits',
|
||||
'points',
|
||||
'preservealpha',
|
||||
'preserveaspectratio',
|
||||
'r',
|
||||
'rx',
|
||||
'ry',
|
||||
'radius',
|
||||
'refx',
|
||||
'refy',
|
||||
'repeatcount',
|
||||
'repeatdur',
|
||||
'restart',
|
||||
'result',
|
||||
'rotate',
|
||||
'scale',
|
||||
'seed',
|
||||
'shape-rendering',
|
||||
'specularconstant',
|
||||
'specularexponent',
|
||||
'spreadmethod',
|
||||
'stddeviation',
|
||||
'stitchtiles',
|
||||
'stop-color',
|
||||
'stop-opacity',
|
||||
'stroke-dasharray',
|
||||
'stroke-dashoffset',
|
||||
'stroke-linecap',
|
||||
'stroke-linejoin',
|
||||
'stroke-miterlimit',
|
||||
'stroke-opacity',
|
||||
'stroke',
|
||||
'stroke-width',
|
||||
'style',
|
||||
'surfacescale',
|
||||
'tabindex',
|
||||
'targetx',
|
||||
'targety',
|
||||
'transform',
|
||||
'text-anchor',
|
||||
'text-decoration',
|
||||
'text-rendering',
|
||||
'textlength',
|
||||
'type',
|
||||
'u1',
|
||||
'u2',
|
||||
'unicode',
|
||||
'values',
|
||||
'viewbox',
|
||||
'visibility',
|
||||
'vert-adv-y',
|
||||
'vert-origin-x',
|
||||
'vert-origin-y',
|
||||
'width',
|
||||
'word-spacing',
|
||||
'wrap',
|
||||
'writing-mode',
|
||||
'xchannelselector',
|
||||
'ychannelselector',
|
||||
'x',
|
||||
'x1',
|
||||
'x2',
|
||||
'xmlns',
|
||||
'y',
|
||||
'y1',
|
||||
'y2',
|
||||
'z',
|
||||
'zoomandpan',
|
||||
|
||||
// MathML
|
||||
'accent',
|
||||
'accentunder',
|
||||
'align',
|
||||
'bevelled',
|
||||
'close',
|
||||
'columnsalign',
|
||||
'columnlines',
|
||||
'columnspan',
|
||||
'denomalign',
|
||||
'depth',
|
||||
'dir',
|
||||
'display',
|
||||
'displaystyle',
|
||||
'fence',
|
||||
'frame',
|
||||
'height',
|
||||
'href',
|
||||
'id',
|
||||
'largeop',
|
||||
'length',
|
||||
'linethickness',
|
||||
'lspace',
|
||||
'lquote',
|
||||
'mathbackground',
|
||||
'mathcolor',
|
||||
'mathsize',
|
||||
'mathvariant',
|
||||
'maxsize',
|
||||
'minsize',
|
||||
'movablelimits',
|
||||
'notation',
|
||||
'numalign',
|
||||
'open',
|
||||
'rowalign',
|
||||
'rowlines',
|
||||
'rowspacing',
|
||||
'rowspan',
|
||||
'rspace',
|
||||
'rquote',
|
||||
'scriptlevel',
|
||||
'scriptminsize',
|
||||
'scriptsizemultiplier',
|
||||
'selection',
|
||||
'separator',
|
||||
'separators',
|
||||
'slope',
|
||||
'stretchy',
|
||||
'subscriptshift',
|
||||
'supscriptshift',
|
||||
'symmetric',
|
||||
'voffset',
|
||||
'width',
|
||||
'xmlns',
|
||||
|
||||
// XML
|
||||
'xlink:href',
|
||||
'xml:id',
|
||||
'xlink:title',
|
||||
'xml:space',
|
||||
'xmlns:xlink',
|
||||
);
|
||||
}
|
||||
}
|
||||
196
vendor/enshrined/svg-sanitize/src/data/AllowedTags.php
vendored
Normal file
196
vendor/enshrined/svg-sanitize/src/data/AllowedTags.php
vendored
Normal file
|
|
@ -0,0 +1,196 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Class AllowedTags
|
||||
*
|
||||
* @package enshrined\svgSanitize\data
|
||||
*/
|
||||
class AllowedTags implements TagInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of tags
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getTags()
|
||||
{
|
||||
return array (
|
||||
// HTML
|
||||
'a',
|
||||
'abbr',
|
||||
'acronym',
|
||||
'address',
|
||||
'area',
|
||||
'article',
|
||||
'aside',
|
||||
'audio',
|
||||
'bdi',
|
||||
'bdo',
|
||||
'blink',
|
||||
'button',
|
||||
'canvas',
|
||||
'caption',
|
||||
'cite',
|
||||
'col',
|
||||
'colgroup',
|
||||
'content',
|
||||
'data',
|
||||
'datalist',
|
||||
'decorator',
|
||||
'del',
|
||||
'details',
|
||||
'dfn',
|
||||
'dir',
|
||||
'div',
|
||||
'element',
|
||||
'fieldset',
|
||||
'figcaption',
|
||||
'figure',
|
||||
'font',
|
||||
'footer',
|
||||
'form',
|
||||
'header',
|
||||
'hgroup',
|
||||
'html',
|
||||
'image',
|
||||
'input',
|
||||
'ins',
|
||||
'kbd',
|
||||
'label',
|
||||
'legend',
|
||||
'li',
|
||||
'main',
|
||||
'map',
|
||||
'mark',
|
||||
'marquee',
|
||||
'meter',
|
||||
'nav',
|
||||
'optgroup',
|
||||
'option',
|
||||
'output',
|
||||
'progress',
|
||||
'q',
|
||||
'rp',
|
||||
'rt',
|
||||
'samp',
|
||||
'section',
|
||||
'select',
|
||||
'shadow',
|
||||
'source',
|
||||
'spacer',
|
||||
'style',
|
||||
'summary',
|
||||
'template',
|
||||
'textarea',
|
||||
'time',
|
||||
'track',
|
||||
'video',
|
||||
'wbr',
|
||||
|
||||
// SVG
|
||||
'svg',
|
||||
'altglyph',
|
||||
'altglyphdef',
|
||||
'altglyphitem',
|
||||
'animatecolor',
|
||||
'animatemotion',
|
||||
'animatetransform',
|
||||
'circle',
|
||||
'clippath',
|
||||
'defs',
|
||||
'desc',
|
||||
'ellipse',
|
||||
'filter',
|
||||
'font',
|
||||
'g',
|
||||
'glyph',
|
||||
'glyphref',
|
||||
'hkern',
|
||||
'image',
|
||||
'line',
|
||||
'lineargradient',
|
||||
'marker',
|
||||
'mask',
|
||||
'metadata',
|
||||
'mpath',
|
||||
'path',
|
||||
'pattern',
|
||||
'polygon',
|
||||
'polyline',
|
||||
'radialgradient',
|
||||
'rect',
|
||||
'stop',
|
||||
'switch',
|
||||
'symbol',
|
||||
'text',
|
||||
'textpath',
|
||||
'title',
|
||||
'tref',
|
||||
'tspan',
|
||||
'use',
|
||||
'view',
|
||||
'vkern',
|
||||
|
||||
// SVG Filters
|
||||
'feBlend',
|
||||
'feColorMatrix',
|
||||
'feComponentTransfer',
|
||||
'feComposite',
|
||||
'feConvolveMatrix',
|
||||
'feDiffuseLighting',
|
||||
'feDisplacementMap',
|
||||
'feDistantLight',
|
||||
'feFlood',
|
||||
'feFuncA',
|
||||
'feFuncB',
|
||||
'feFuncG',
|
||||
'feFuncR',
|
||||
'feGaussianBlur',
|
||||
'feMerge',
|
||||
'feMergeNode',
|
||||
'feMorphology',
|
||||
'feOffset',
|
||||
'fePointLight',
|
||||
'feSpecularLighting',
|
||||
'feSpotLight',
|
||||
'feTile',
|
||||
'feTurbulence',
|
||||
|
||||
//MathML
|
||||
'math',
|
||||
'menclose',
|
||||
'merror',
|
||||
'mfenced',
|
||||
'mfrac',
|
||||
'mglyph',
|
||||
'mi',
|
||||
'mlabeledtr',
|
||||
'mmuliscripts',
|
||||
'mn',
|
||||
'mo',
|
||||
'mover',
|
||||
'mpadded',
|
||||
'mphantom',
|
||||
'mroot',
|
||||
'mrow',
|
||||
'ms',
|
||||
'mpspace',
|
||||
'msqrt',
|
||||
'mystyle',
|
||||
'msub',
|
||||
'msup',
|
||||
'msubsup',
|
||||
'mtable',
|
||||
'mtd',
|
||||
'mtext',
|
||||
'mtr',
|
||||
'munder',
|
||||
'munderover',
|
||||
|
||||
//text
|
||||
'#text'
|
||||
);
|
||||
}
|
||||
}
|
||||
18
vendor/enshrined/svg-sanitize/src/data/AttributeInterface.php
vendored
Normal file
18
vendor/enshrined/svg-sanitize/src/data/AttributeInterface.php
vendored
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Class AttributeInterface
|
||||
*
|
||||
* @package enshrined\svgSanitize\data
|
||||
*/
|
||||
interface AttributeInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of attributes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getAttributes();
|
||||
}
|
||||
19
vendor/enshrined/svg-sanitize/src/data/TagInterface.php
vendored
Normal file
19
vendor/enshrined/svg-sanitize/src/data/TagInterface.php
vendored
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Interface TagInterface
|
||||
*
|
||||
* @package enshrined\svgSanitize\tags
|
||||
*/
|
||||
interface TagInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of tags
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getTags();
|
||||
|
||||
}
|
||||
64
vendor/enshrined/svg-sanitize/src/data/XPath.php
vendored
Normal file
64
vendor/enshrined/svg-sanitize/src/data/XPath.php
vendored
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
class XPath extends \DOMXPath
|
||||
{
|
||||
const DEFAULT_NAMESPACE_PREFIX = 'svg';
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $defaultNamespaceURI;
|
||||
|
||||
public function __construct(\DOMDocument $doc)
|
||||
{
|
||||
parent::__construct($doc);
|
||||
$this->handleDefaultNamespace();
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $nodeName
|
||||
* @return string
|
||||
*/
|
||||
public function createNodeName($nodeName)
|
||||
{
|
||||
if (empty($this->defaultNamespaceURI)) {
|
||||
return $nodeName;
|
||||
}
|
||||
return self::DEFAULT_NAMESPACE_PREFIX . ':' . $nodeName;
|
||||
}
|
||||
|
||||
protected function handleDefaultNamespace()
|
||||
{
|
||||
$rootElements = $this->getRootElements();
|
||||
|
||||
if (count($rootElements) !== 1) {
|
||||
throw new \LogicException(
|
||||
sprintf('Got %d svg elements, expected exactly one', count($rootElements)),
|
||||
1570870568
|
||||
);
|
||||
}
|
||||
$this->defaultNamespaceURI = (string)$rootElements[0]->namespaceURI;
|
||||
|
||||
if ($this->defaultNamespaceURI !== '') {
|
||||
$this->registerNamespace(self::DEFAULT_NAMESPACE_PREFIX, $this->defaultNamespaceURI);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return \DOMElement[]
|
||||
*/
|
||||
protected function getRootElements()
|
||||
{
|
||||
$rootElements = [];
|
||||
$elements = $this->document->getElementsByTagName('svg');
|
||||
/** @var \DOMElement $element */
|
||||
foreach ($elements as $element) {
|
||||
if ($element->parentNode !== $this->document) {
|
||||
continue;
|
||||
}
|
||||
$rootElements[] = $element;
|
||||
}
|
||||
return $rootElements;
|
||||
}
|
||||
}
|
||||
192
vendor/enshrined/svg-sanitize/src/svg-scanner.php
vendored
Normal file
192
vendor/enshrined/svg-sanitize/src/svg-scanner.php
vendored
Normal file
|
|
@ -0,0 +1,192 @@
|
|||
#!/usr/bin/env php
|
||||
<?php
|
||||
|
||||
/*
|
||||
* Simple program that uses svg-sanitizer
|
||||
* to find issues in files specified on the
|
||||
* command line, and prints a JSON output with
|
||||
* the issues found on exit.
|
||||
*/
|
||||
|
||||
require_once( __DIR__ . '/data/AttributeInterface.php' );
|
||||
require_once( __DIR__ . '/data/TagInterface.php' );
|
||||
require_once( __DIR__ . '/data/AllowedAttributes.php' );
|
||||
require_once( __DIR__ . '/data/AllowedTags.php' );
|
||||
require_once( __DIR__ . '/data/XPath.php' );
|
||||
require_once( __DIR__ . '/ElementReference/Resolver.php' );
|
||||
require_once( __DIR__ . '/ElementReference/Subject.php' );
|
||||
require_once( __DIR__ . '/ElementReference/Usage.php' );
|
||||
require_once( __DIR__ . '/Exceptions/NestingException.php' );
|
||||
require_once( __DIR__ . '/Helper.php' );
|
||||
require_once( __DIR__ . '/Sanitizer.php' );
|
||||
|
||||
/*
|
||||
* Print array as JSON and then
|
||||
* exit program with a particular
|
||||
* exit-code.
|
||||
*/
|
||||
|
||||
function sysexit(
|
||||
$results,
|
||||
$status
|
||||
) {
|
||||
echo json_encode(
|
||||
$results,
|
||||
JSON_PRETTY_PRINT
|
||||
);
|
||||
|
||||
exit( $status );
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Main part begins
|
||||
*/
|
||||
|
||||
global $argv;
|
||||
|
||||
/*
|
||||
* Set up results array, to
|
||||
* be printed on exit.
|
||||
*/
|
||||
$results = array(
|
||||
'totals' => array(
|
||||
'errors' => 0,
|
||||
),
|
||||
|
||||
'files' => array(
|
||||
),
|
||||
);
|
||||
|
||||
|
||||
/*
|
||||
* Catch files to scan from $argv.
|
||||
*/
|
||||
|
||||
$files_to_scan = $argv;
|
||||
unset( $files_to_scan[0] );
|
||||
|
||||
$files_to_scan = array_values(
|
||||
$files_to_scan
|
||||
);
|
||||
|
||||
/*
|
||||
* Catch no file specified.
|
||||
*/
|
||||
|
||||
if ( empty( $files_to_scan ) ) {
|
||||
$results['totals']['errors']++;
|
||||
$results['messages'] = array(
|
||||
array( 'No files to scan specified' ),
|
||||
);
|
||||
|
||||
sysexit(
|
||||
$results,
|
||||
1
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize the SVG scanner.
|
||||
*
|
||||
* Make sure to allow custom attributes,
|
||||
* and to remove remote references.
|
||||
*/
|
||||
$sanitizer = new enshrined\svgSanitize\Sanitizer();
|
||||
|
||||
$sanitizer->removeRemoteReferences( true );
|
||||
|
||||
/*
|
||||
* Scan each file specified to be scanned.
|
||||
*/
|
||||
|
||||
foreach( $files_to_scan as $file_name ) {
|
||||
/*
|
||||
* Read SVG file.
|
||||
*/
|
||||
$svg_file = @file_get_contents( $file_name );
|
||||
|
||||
/*
|
||||
* If not found, report that and continue.
|
||||
*/
|
||||
if ( false === $svg_file ) {
|
||||
$results['totals']['errors']++;
|
||||
|
||||
$results['files'][ $file_name ][] = array(
|
||||
'errors' => 1,
|
||||
'messages' => array(
|
||||
array(
|
||||
'message' => 'File specified could not be read (' . $file_name . ')',
|
||||
'line' => null,
|
||||
),
|
||||
),
|
||||
);
|
||||
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* Sanitize file and get issues found.
|
||||
*/
|
||||
$sanitize_status = $sanitizer->sanitize( $svg_file );
|
||||
|
||||
$xml_issues = $sanitizer->getXmlIssues();
|
||||
|
||||
/*
|
||||
* If we find no issues, simply note that.
|
||||
*/
|
||||
if ( empty( $xml_issues ) && ( false !== $sanitize_status ) ) {
|
||||
$results['files'][ $file_name ] = array(
|
||||
'errors' => 0,
|
||||
'messages' => array()
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* Could not sanitize the file.
|
||||
*/
|
||||
else if (
|
||||
( '' === $sanitize_status ) ||
|
||||
( false === $sanitize_status )
|
||||
) {
|
||||
$results['totals']['errors']++;
|
||||
|
||||
$results['files'][ $file_name ] = array(
|
||||
'errors' => 1,
|
||||
'messages' => array(
|
||||
array(
|
||||
'message' => 'Unable to sanitize file \'' . $file_name . '\'' ,
|
||||
'line' => null,
|
||||
)
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* If we find issues, note it and update statistics.
|
||||
*/
|
||||
|
||||
else {
|
||||
$results['totals']['errors'] += count( $xml_issues );
|
||||
|
||||
$results['files'][ $file_name ] = array(
|
||||
'errors' => count( $xml_issues ),
|
||||
'messages' => $xml_issues,
|
||||
);
|
||||
}
|
||||
|
||||
unset( $svg_file );
|
||||
unset( $xml_issues );
|
||||
unset( $sanitize_status );
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Exit with a status
|
||||
* that reflects what issues
|
||||
* we found.
|
||||
*/
|
||||
sysexit(
|
||||
$results,
|
||||
( $results['totals']['errors'] === 0 ? 0 : 1 )
|
||||
);
|
||||
Loading…
Add table
Add a link
Reference in a new issue