$attachments * @return array{html: string, css: string, js: string} */ public function sanitize(string $html, string $css, string $js, array $attachments = []): array { [$html, $cssFromHtml] = $this->extractStyleTags($html); $html = $this->sanitizeHtml($html); $css = $this->sanitizeCss(trim($css."\n".$cssFromHtml)); $js = $this->sanitizeJs($js); return [ 'html' => $this->attachmentSanitizer->sanitize($html, $attachments), 'css' => $this->attachmentSanitizer->sanitize($css, $attachments), 'js' => $this->attachmentSanitizer->sanitize($js, $attachments), ]; } /** * @return array{0: string, 1: string} */ private function extractStyleTags(string $html): array { $extraCss = ''; $rewritten = preg_replace_callback( '#]*>.*?#is', function (array $matches) use (&$extraCss): string { if ($this->isEditorChromeCss($matches[0])) { return ''; } if (preg_match('#]*>(.*?)#is', $matches[0], $inner) === 1) { $extraCss .= trim($inner[1])."\n"; } return ''; }, $html, ); return [is_string($rewritten) ? $rewritten : $html, $extraCss]; } private function sanitizeHtml(string $html): string { $html = $this->stripScripts($html); $html = (string) preg_replace('#]*>#i', '', $html); $html = (string) preg_replace('#]*http-equiv=(["\']?)refresh\1[^>]*>#i', '', $html); $html = $this->stripEventHandlers($html); // srcdoc is a whole document in an attribute, so nothing below reaches // inside it: scripts, handlers and javascript: URLs all survive there. $html = (string) preg_replace('/\ssrcdoc\s*=\s*("[^"]*"|\'[^\']*\'|[^\s>]*)/i', '', $html); $html = (string) preg_replace('/\sdata-gjs-[a-z0-9-]+="[^"]*"/i', '', $html); $html = (string) preg_replace("/\sdata-gjs-[a-z0-9-]+='[^']*'/i", '', $html); $html = (string) preg_replace('/\sdraggable="true"/i', '', $html); $html = $this->stripGrapesCssRuleNodes($html); return $this->neutraliseUrlAttributes($html); } /** * Remove every script, whether or not it is closed the way a regex expects. * * This required a literal ``. A browser does not: it ends a script * at `` or any `alert(1)` passed * through untouched and ran, and so did a `