vendor/contao/core-bundle/src/Resources/contao/library/Contao/Input.php line 1027

Open in your IDE?
  1. <?php
  3. /*
  4. * This file is part of Contao.
  5. *
  6. * (c) Leo Feyer
  7. *
  8. * @license LGPL-3.0-or-later
  9. */
  11. namespace Contao;
  13. /**
  14. * Safely read the user input
  15. *
  16. * The class functions as an adapter for the global input arrays ($_GET, $_POST,
  17. * $_COOKIE) and safely returns their values. To prevent XSS vulnerabilities,
  18. * you should always use the class when reading user input.
  19. *
  20. * Usage:
  21. *
  22. * if (Input::get('action') == 'register')
  23. * {
  24. * $username = Input::post('username');
  25. * $password = Input::post('password');
  26. * }
  27. */
  28. class Input
  29. {
  30. /**
  31. * Object instance (Singleton)
  32. * @var Input
  33. */
  34. protected static $objInstance;
  36. /**
  37. * Cache
  38. * @var array
  39. */
  40. protected static $arrCache = array();
  42. /**
  43. * Unused $_GET parameters
  44. * @var array
  45. */
  46. protected static $arrUnusedGet = array();
  48. /**
  49. * Magic quotes setting
  50. * @var boolean
  51. */
  52. protected static $blnMagicQuotes = false;
  54. /**
  55. * Clean the global GPC arrays
  56. */
  57. public static function initialize()
  58. {
  59. $_GET = static::cleanKey($_GET);
  60. $_POST = static::cleanKey($_POST);
  61. $_COOKIE = static::cleanKey($_COOKIE);
  62. }
  64. /**
  65. * Return a $_GET variable
  66. *
  67. * @param string $strKey The variable name
  68. * @param boolean $blnDecodeEntities If true, all entities will be decoded
  69. * @param boolean $blnKeepUnused If true, the parameter will not be marked as used (see #4277)
  70. *
  71. * @return mixed The cleaned variable value
  72. */
  73. public static function get($strKey, $blnDecodeEntities=false, $blnKeepUnused=false)
  74. {
  75. if (!isset($_GET[$strKey]))
  76. {
  77. return null;
  78. }
  80. $strCacheKey = $blnDecodeEntities ? 'getDecoded' : 'getEncoded';
  82. if (!isset(static::$arrCache[$strCacheKey][$strKey]))
  83. {
  84. $varValue = $_GET[$strKey];
  86. $varValue = static::decodeEntities($varValue);
  87. $varValue = static::xssClean($varValue, true);
  88. $varValue = static::stripTags($varValue);
  90. if (!$blnDecodeEntities)
  91. {
  92. $varValue = static::encodeSpecialChars($varValue);
  93. }
  95. $varValue = static::encodeInsertTags($varValue);
  97. static::$arrCache[$strCacheKey][$strKey] = $varValue;
  98. }
  100. // Mark the parameter as used (see #4277)
  101. if (!$blnKeepUnused)
  102. {
  103. unset(static::$arrUnusedGet[$strKey]);
  104. }
  106. return static::$arrCache[$strCacheKey][$strKey];
  107. }
  109. /**
  110. * Return a $_POST variable
  111. *
  112. * @param string $strKey The variable name
  113. * @param boolean $blnDecodeEntities If true, all entities will be decoded
  114. *
  115. * @return mixed The cleaned variable value
  116. */
  117. public static function post($strKey, $blnDecodeEntities=false)
  118. {
  119. $strCacheKey = $blnDecodeEntities ? 'postDecoded' : 'postEncoded';
  121. if (!isset(static::$arrCache[$strCacheKey][$strKey]))
  122. {
  123. $varValue = static::findPost($strKey);
  125. if ($varValue === null)
  126. {
  127. return null;
  128. }
  130. $varValue = static::decodeEntities($varValue);
  131. $varValue = static::xssClean($varValue, true);
  132. $varValue = static::stripTags($varValue);
  134. if (!$blnDecodeEntities)
  135. {
  136. $varValue = static::encodeSpecialChars($varValue);
  137. }
  139. if (!\defined('TL_MODE') || TL_MODE != 'BE')
  140. {
  141. $varValue = static::encodeInsertTags($varValue);
  142. }
  144. static::$arrCache[$strCacheKey][$strKey] = $varValue;
  145. }
  147. return static::$arrCache[$strCacheKey][$strKey];
  148. }
  150. /**
  151. * Return a $_POST variable preserving allowed HTML tags
  152. *
  153. * @param string $strKey The variable name
  154. * @param boolean $blnDecodeEntities If true, all entities will be decoded
  155. *
  156. * @return mixed The cleaned variable value
  157. */
  158. public static function postHtml($strKey, $blnDecodeEntities=false)
  159. {
  160. $strCacheKey = $blnDecodeEntities ? 'postHtmlDecoded' : 'postHtmlEncoded';
  162. if (!isset(static::$arrCache[$strCacheKey][$strKey]))
  163. {
  164. $varValue = static::findPost($strKey);
  166. if ($varValue === null)
  167. {
  168. return null;
  169. }
  171. $varValue = static::decodeEntities($varValue);
  172. $varValue = static::xssClean($varValue);
  173. $varValue = static::stripTags($varValue, Config::get('allowedTags'), Config::get('allowedAttributes'));
  175. if (!$blnDecodeEntities)
  176. {
  177. $varValue = static::encodeSpecialChars($varValue);
  178. }
  180. if (!\defined('TL_MODE') || TL_MODE != 'BE')
  181. {
  182. $varValue = static::encodeInsertTags($varValue);
  183. }
  185. static::$arrCache[$strCacheKey][$strKey] = $varValue;
  186. }
  188. return static::$arrCache[$strCacheKey][$strKey];
  189. }
  191. /**
  192. * Return a raw, unsafe $_POST variable
  193. *
  194. * @param string $strKey The variable name
  195. *
  196. * @return mixed The raw variable value
  197. */
  198. public static function postRaw($strKey)
  199. {
  200. $strCacheKey = 'postRaw';
  202. if (!isset(static::$arrCache[$strCacheKey][$strKey]))
  203. {
  204. $varValue = static::findPost($strKey);
  206. if ($varValue === null)
  207. {
  208. return null;
  209. }
  211. $varValue = static::preserveBasicEntities($varValue);
  212. $varValue = static::xssClean($varValue);
  214. if (!\defined('TL_MODE') || TL_MODE != 'BE')
  215. {
  216. $varValue = static::encodeInsertTags($varValue);
  217. }
  219. static::$arrCache[$strCacheKey][$strKey] = $varValue;
  220. }
  222. return static::$arrCache[$strCacheKey][$strKey];
  223. }
  225. /**
  226. * Return a raw, unsafe and unfiltered $_POST variable
  227. *
  228. * @param string $strKey The variable name
  229. *
  230. * @return mixed The raw variable value
  231. */
  232. public static function postUnsafeRaw($strKey)
  233. {
  234. $strCacheKey = 'postUnsafeRaw';
  236. if (!isset(static::$arrCache[$strCacheKey][$strKey]))
  237. {
  238. $varValue = static::findPost($strKey);
  240. if ($varValue === null)
  241. {
  242. return null;
  243. }
  245. static::$arrCache[$strCacheKey][$strKey] = $varValue;
  246. }
  248. return static::$arrCache[$strCacheKey][$strKey];
  249. }
  251. /**
  252. * Return a $_COOKIE variable
  253. *
  254. * @param string $strKey The variable name
  255. * @param boolean $blnDecodeEntities If true, all entities will be decoded
  256. *
  257. * @return mixed The cleaned variable value
  258. */
  259. public static function cookie($strKey, $blnDecodeEntities=false)
  260. {
  261. if (!isset($_COOKIE[$strKey]))
  262. {
  263. return null;
  264. }
  266. $strCacheKey = $blnDecodeEntities ? 'cookieDecoded' : 'cookieEncoded';
  268. if (!isset(static::$arrCache[$strCacheKey][$strKey]))
  269. {
  270. $varValue = $_COOKIE[$strKey];
  272. $varValue = static::decodeEntities($varValue);
  273. $varValue = static::xssClean($varValue, true);
  274. $varValue = static::stripTags($varValue);
  276. if (!$blnDecodeEntities)
  277. {
  278. $varValue = static::encodeSpecialChars($varValue);
  279. }
  281. $varValue = static::encodeInsertTags($varValue);
  283. static::$arrCache[$strCacheKey][$strKey] = $varValue;
  284. }
  286. return static::$arrCache[$strCacheKey][$strKey];
  287. }
  289. /**
  290. * Set a $_GET variable
  291. *
  292. * @param string $strKey The variable name
  293. * @param mixed $varValue The variable value
  294. * @param boolean $blnAddUnused If true, the value usage will be checked
  295. */
  296. public static function setGet($strKey, $varValue, $blnAddUnused=false)
  297. {
  298. // Convert special characters (see #7829)
  299. $strKey = str_replace(array(' ', '.', '['), '_', $strKey);
  301. $strKey = static::cleanKey($strKey);
  303. unset(static::$arrCache['getEncoded'][$strKey], static::$arrCache['getDecoded'][$strKey]);
  305. if ($varValue === null)
  306. {
  307. unset($_GET[$strKey]);
  308. }
  309. else
  310. {
  311. $_GET[$strKey] = $varValue;
  313. if ($blnAddUnused)
  314. {
  315. static::setUnusedGet($strKey, $varValue); // see #4277
  316. }
  317. }
  318. }
  320. /**
  321. * Set a $_POST variable
  322. *
  323. * @param string $strKey The variable name
  324. * @param mixed $varValue The variable value
  325. */
  326. public static function setPost($strKey, $varValue)
  327. {
  328. $strKey = static::cleanKey($strKey);
  330. unset(
  331. static::$arrCache['postEncoded'][$strKey],
  332. static::$arrCache['postDecoded'][$strKey],
  333. static::$arrCache['postHtmlEncoded'][$strKey],
  334. static::$arrCache['postHtmlDecoded'][$strKey],
  335. static::$arrCache['postRaw'][$strKey],
  336. static::$arrCache['postUnsafeRaw'][$strKey]
  337. );
  339. if ($varValue === null)
  340. {
  341. unset($_POST[$strKey]);
  342. }
  343. else
  344. {
  345. $_POST[$strKey] = $varValue;
  346. }
  347. }
  349. /**
  350. * Set a $_COOKIE variable
  351. *
  352. * @param string $strKey The variable name
  353. * @param mixed $varValue The variable value
  354. */
  355. public static function setCookie($strKey, $varValue)
  356. {
  357. $strKey = static::cleanKey($strKey);
  359. unset(static::$arrCache['cookieEncoded'][$strKey], static::$arrCache['cookieDecoded'][$strKey]);
  361. if ($varValue === null)
  362. {
  363. unset($_COOKIE[$strKey]);
  364. }
  365. else
  366. {
  367. $_COOKIE[$strKey] = $varValue;
  368. }
  369. }
  371. /**
  372. * Reset the internal cache
  373. */
  374. public static function resetCache()
  375. {
  376. static::$arrCache = array();
  377. }
  379. /**
  380. * Return whether there are unused GET parameters
  381. *
  382. * @return boolean True if there are unused GET parameters
  383. */
  384. public static function hasUnusedGet()
  385. {
  386. return \count(static::$arrUnusedGet) > 0;
  387. }
  389. /**
  390. * Return the unused GET parameters as array
  391. *
  392. * @return array The unused GET parameter array
  393. */
  394. public static function getUnusedGet()
  395. {
  396. return array_keys(static::$arrUnusedGet);
  397. }
  399. /**
  400. * Set an unused GET parameter
  401. *
  402. * @param string $strKey The array key
  403. * @param mixed $varValue The array value
  404. */
  405. public static function setUnusedGet($strKey, $varValue)
  406. {
  407. static::$arrUnusedGet[$strKey] = $varValue;
  408. }
  410. /**
  411. * Reset the unused GET parameters
  412. */
  413. public static function resetUnusedGet()
  414. {
  415. static::$arrUnusedGet = array();
  416. }
  418. /**
  419. * Sanitize the variable names (thanks to Andreas Schempp)
  420. *
  421. * @param mixed $varValue A variable name or an array of variable names
  422. *
  423. * @return mixed The clean name or array of names
  424. */
  425. public static function cleanKey($varValue)
  426. {
  427. // Recursively clean arrays
  428. if (\is_array($varValue))
  429. {
  430. $return = array();
  432. foreach ($varValue as $k=>$v)
  433. {
  434. $k = static::cleanKey($k);
  436. if (\is_array($v))
  437. {
  438. $v = static::cleanKey($v);
  439. }
  441. $return[$k] = $v;
  442. }
  444. return $return;
  445. }
  447. $varValue = static::decodeEntities($varValue);
  448. $varValue = static::xssClean($varValue, true);
  449. $varValue = static::stripTags($varValue);
  451. return $varValue;
  452. }
  454. /**
  455. * Strip slashes
  456. *
  457. * @param mixed $varValue A string or array
  458. *
  459. * @return mixed The string or array without slashes
  460. *
  461. * @deprecated Deprecated since Contao 3.5, to be removed in Contao 5.
  462. * Since get_magic_quotes_gpc() always returns false in PHP 5.4+, the method was never actually executed.
  463. */
  464. public static function stripSlashes($varValue)
  465. {
  466. return $varValue;
  467. }
  469. /**
  470. * Strip HTML and PHP tags preserving HTML comments
  471. *
  472. * @param mixed $varValue A string or array
  473. * @param string $strAllowedTags A string of tags to preserve
  474. * @param string $strAllowedAttributes A serialized string of attributes to preserve
  475. *
  476. * @return mixed The cleaned string or array
  477. */
  478. public static function stripTags($varValue, $strAllowedTags='', $strAllowedAttributes='')
  479. {
  480. if ($strAllowedTags !== '' && \func_num_args() < 3)
  481. {
  482. trigger_deprecation('contao/core-bundle', '4.4', 'Using %s() with $strAllowedTags but without $strAllowedAttributes has been deprecated and will no longer work in Contao 5.0.', __METHOD__);
  483. $strAllowedAttributes = Config::get('allowedAttributes');
  484. }
  486. if (!$varValue)
  487. {
  488. return $varValue;
  489. }
  491. // Recursively clean arrays
  492. if (\is_array($varValue))
  493. {
  494. foreach ($varValue as $k=>$v)
  495. {
  496. $varValue[$k] = static::stripTags($v, $strAllowedTags, $strAllowedAttributes);
  497. }
  499. return $varValue;
  500. }
  502. $arrAllowedAttributes = array();
  504. foreach (StringUtil::deserialize($strAllowedAttributes, true) as $arrRow)
  505. {
  506. if (!empty($arrRow['key']) && !empty($arrRow['value']))
  507. {
  508. $arrAllowedAttributes[trim($arrRow['key'])] = StringUtil::trimsplit(',', $arrRow['value']);
  509. }
  510. }
  512. // Encode opening arrow brackets (see #3998)
  513. $varValue = preg_replace_callback(
  514. '@</?([^\s<>/]*)@',
  515. static function ($matches) use ($strAllowedTags)
  516. {
  517. if (!$matches[1] || stripos($strAllowedTags, '<' . strtolower($matches[1]) . '>') === false)
  518. {
  519. $matches[0] = str_replace('<', '&lt;', $matches[0]);
  520. }
  522. return $matches[0];
  523. },
  524. $varValue
  525. );
  527. // Strip the tags
  528. $varValue = strip_tags($varValue, $strAllowedTags);
  530. // Restore HTML comments and recheck for encoded null bytes
  531. $varValue = str_replace(array('&lt;!--', '&lt;![', '\\0'), array('<!--', '<![', '&#92;0'), $varValue);
  533. // Strip attributes
  534. if ($strAllowedTags)
  535. {
  536. $varValue = self::stripAttributes($varValue, $strAllowedTags, $arrAllowedAttributes);
  537. }
  539. return $varValue;
  540. }
  542. /**
  543. * Strip HTML attributes and normalize them to lowercase and double quotes
  544. *
  545. * @param string $strHtml
  546. * @param string $strAllowedTags
  547. * @param array $arrAllowedAttributes
  548. *
  549. * @return string
  550. */
  551. private static function stripAttributes($strHtml, $strAllowedTags, $arrAllowedAttributes)
  552. {
  553. // Skip if all attributes are allowed on all tags
  554. if (\in_array('*', $arrAllowedAttributes['*'] ?? array(), true))
  555. {
  556. return $strHtml;
  557. }
  559. $blnCommentOpen = false;
  560. $strOpenRawtext = null;
  562. // Match every single starting and closing tag or special characters outside of tags
  563. return preg_replace_callback(
  564. '@</?([^\s<>/]*)([^<>]*)>?|-->|[>"\'=]+@',
  565. static function ($matches) use ($strAllowedTags, $arrAllowedAttributes, &$blnCommentOpen, &$strOpenRawtext)
  566. {
  567. $strTagName = strtolower($matches[1] ?? '');
  569. if ($strOpenRawtext === $strTagName && '/' === $matches[0][1])
  570. {
  571. $strOpenRawtext = null;
  573. return '</' . $strTagName . '>';
  574. }
  576. if (null !== $strOpenRawtext)
  577. {
  578. return $matches[0];
  579. }
  581. if ($blnCommentOpen && substr($matches[0], -3) === '-->')
  582. {
  583. $blnCommentOpen = false;
  585. return static::encodeSpecialChars(substr($matches[0], 0, -3)) . '-->';
  586. }
  588. if (!$blnCommentOpen && 0 === strncmp($matches[0], '<!--', 4))
  589. {
  590. if (substr($matches[0], -3) === '-->')
  591. {
  592. return '<!--' . static::encodeSpecialChars(substr($matches[0], 4, -3)) . '-->';
  593. }
  595. $blnCommentOpen = true;
  597. return '<!--' . static::encodeSpecialChars(substr($matches[0], 4));
  598. }
  600. // Matched special characters or tag is invalid or not allowed, return everything encoded
  601. if ($strTagName == '' || stripos($strAllowedTags, '<' . $strTagName . '>') === false)
  602. {
  603. return static::encodeSpecialChars($matches[0]);
  604. }
  606. // Closing tags have no attributes
  607. if ('/' === substr($matches[0], 1, 1))
  608. {
  609. return '</' . $strTagName . '>';
  610. }
  612. // Special parsing for RCDATA and RAWTEXT elements https://html.spec.whatwg.org/#rcdata-state
  613. if (!$blnCommentOpen && \in_array($strTagName, array('script', 'title', 'textarea', 'style', 'xmp', 'iframe', 'noembed', 'noframes', 'noscript')))
  614. {
  615. $strOpenRawtext = $strTagName;
  616. }
  618. $arrAttributes = self::getAttributesFromTag($matches[2]);
  620. // Only keep allowed attributes
  621. $arrAttributes = array_filter(
  622. $arrAttributes,
  623. static function ($strAttribute) use ($strTagName, $arrAllowedAttributes)
  624. {
  625. // Skip if all attributes are allowed
  626. if (\in_array('*', $arrAllowedAttributes[$strTagName] ?? array(), true))
  627. {
  628. return true;
  629. }
  631. $arrCandidates = array($strAttribute);
  633. // Check for wildcard attributes like data-*
  634. if (false !== $intDashPosition = strpos($strAttribute, '-'))
  635. {
  636. $arrCandidates[] = substr($strAttribute, 0, $intDashPosition + 1) . '*';
  637. }
  639. foreach ($arrCandidates as $strCandidate)
  640. {
  641. if (
  642. \in_array($strCandidate, $arrAllowedAttributes['*'] ?? array(), true)
  643. || \in_array($strCandidate, $arrAllowedAttributes[$strTagName] ?? array(), true)
  644. ) {
  645. return true;
  646. }
  647. }
  649. return false;
  650. },
  651. ARRAY_FILTER_USE_KEY
  652. );
  654. // Build the tag in its normalized form
  655. $strReturn = '<' . $strTagName;
  657. foreach ($arrAttributes as $strAttributeName => $strAttributeValue)
  658. {
  659. // The value was already encoded by the getAttributesFromTag() method
  660. $strReturn .= ' ' . $strAttributeName . '="' . $strAttributeValue . '"';
  661. }
  663. $strReturn .= '>';
  665. return $strReturn;
  666. },
  667. $strHtml
  668. );
  669. }
  671. /**
  672. * Get the attributes as key/value pairs with the values already encoded for HTML
  673. *
  674. * @param string $strAttributes
  675. *
  676. * @return array
  677. */
  678. private static function getAttributesFromTag($strAttributes)
  679. {
  680. // Match every attribute name value pair
  681. if (!preg_match_all('@\s+([a-z][a-z0-9_:-]*)(?:\s*=\s*("[^"]*"|\'[^\']*\'|[^\s>]*))?@i', $strAttributes, $matches, PREG_SET_ORDER))
  682. {
  683. return array();
  684. }
  686. $arrAttributes = array();
  688. foreach ($matches as $arrMatch)
  689. {
  690. $strAttribute = strtolower($arrMatch[1]);
  692. // Skip attributes that end with dashes or use a double dash
  693. if (substr($strAttribute, -1) === '-' || false !== strpos($strAttribute, '--'))
  694. {
  695. continue;
  696. }
  698. // Default to empty string for the value
  699. $strValue = $arrMatch[2] ?? '';
  701. // Remove the quotes if matched by the regular expression
  702. if (
  703. (strpos($strValue, '"') === 0 && substr($strValue, -1) === '"')
  704. || (strpos($strValue, "'") === 0 && substr($strValue, -1) === "'")
  705. ) {
  706. $strValue = substr($strValue, 1, -1);
  707. }
  709. // Encode all special characters and insert tags that are not encoded yet
  710. if (1 === preg_match('((?:^|:)(?:src|srcset|href|action|formaction|codebase|cite|background|longdesc|profile|usemap|classid|data|icon|manifest|poster|archive)$)', $strAttribute))
  711. {
  712. $strValue = StringUtil::specialcharsUrl($strValue);
  713. }
  714. else
  715. {
  716. $strValue = StringUtil::specialcharsAttribute($strValue);
  717. }
  719. $arrAttributes[$strAttribute] = $strValue;
  720. }
  722. return $arrAttributes;
  723. }
  725. /**
  726. * Clean a value and try to prevent XSS attacks
  727. *
  728. * @param mixed $varValue A string or array
  729. * @param boolean $blnStrictMode If true, the function removes also JavaScript event handlers
  730. *
  731. * @return mixed The cleaned string or array
  732. */
  733. public static function xssClean($varValue, $blnStrictMode=false)
  734. {
  735. if (!$varValue)
  736. {
  737. return $varValue;
  738. }
  740. // Recursively clean arrays
  741. if (\is_array($varValue))
  742. {
  743. foreach ($varValue as $k=>$v)
  744. {
  745. $varValue[$k] = static::xssClean($v);
  746. }
  748. return $varValue;
  749. }
  751. // Return if the value is not a string
  752. if (\is_bool($varValue) || is_numeric($varValue))
  753. {
  754. return $varValue;
  755. }
  757. // Validate standard character entities and UTF16 two byte encoding
  758. $varValue = preg_replace('/(&#*\w+)[\x00-\x20]+;/i', '$1;', $varValue);
  760. // Remove carriage returns
  761. $varValue = preg_replace('/\r+/', '', $varValue);
  763. // Replace unicode entities
  764. $varValue = preg_replace_callback('~&#x([0-9a-f]+);~i', static function ($matches) { return mb_chr(hexdec($matches[1])); }, $varValue);
  765. $varValue = preg_replace_callback('~&#([0-9]+);~', static function ($matches) { return mb_chr($matches[1]); }, $varValue);
  767. // Remove null bytes
  768. $varValue = str_replace(array(\chr(0), '\\0'), array('', '&#92;0'), $varValue);
  770. // Define a list of keywords
  771. $arrKeywords = array
  772. (
  773. '/\bj\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\b/is', // javascript
  774. '/\bv\s*b\s*s\s*c\s*r\s*i\s*p\s*t\b/is', // vbscript
  775. '/\bv\s*b\s*s\s*c\s*r\s*p\s*t\b/is', // vbscrpt
  776. '/\bs\s*c\s*r\s*i\s*p\s*t\b/is', //script
  777. '/\ba\s*p\s*p\s*l\s*e\s*t\b/is', // applet
  778. '/\ba\s*l\s*e\s*r\s*t\b/is', // alert
  779. '/\bd\s*o\s*c\s*u\s*m\s*e\s*n\s*t\b/is', // document
  780. '/\bw\s*r\s*i\s*t\s*e\b/is', // write
  781. '/\bc\s*o\s*o\s*k\s*i\s*e\b/is', // cookie
  782. '/\bw\s*i\s*n\s*d\s*o\s*w\b/is' // window
  783. );
  785. // Compact exploded keywords like "j a v a s c r i p t"
  786. foreach ($arrKeywords as $strKeyword)
  787. {
  788. $arrMatches = array();
  789. preg_match_all($strKeyword, $varValue, $arrMatches);
  791. foreach ($arrMatches[0] as $strMatch)
  792. {
  793. $varValue = str_replace($strMatch, preg_replace('/\s*/', '', $strMatch), $varValue);
  794. }
  795. }
  797. $arrRegexp[] = '/<(a|img)[^>]*[^a-z](<script|<xss)[^>]*>/is';
  798. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]document\.cookie[^>]*>/is';
  799. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]vbscri?pt\s*:[^>]*>/is';
  800. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]expression\s*\([^>]*>/is';
  802. // Also remove event handlers and JavaScript in strict mode
  803. if ($blnStrictMode)
  804. {
  805. $arrRegexp[] = '/vbscri?pt\s*:/is';
  806. $arrRegexp[] = '/javascript\s*:/is';
  807. $arrRegexp[] = '/<\s*embed.*swf/is';
  808. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]alert\s*\([^>]*>/is';
  809. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]javascript\s*:[^>]*>/is';
  810. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]window\.[^>]*>/is';
  811. $arrRegexp[] = '/<(a|img)[^>]*[^a-z]document\.[^>]*>/is';
  812. $arrRegexp[] = '/<[^>]*[^a-z]onabort\s*=[^>]*>/is';
  813. $arrRegexp[] = '/<[^>]*[^a-z]onblur\s*=[^>]*>/is';
  814. $arrRegexp[] = '/<[^>]*[^a-z]onchange\s*=[^>]*>/is';
  815. $arrRegexp[] = '/<[^>]*[^a-z]onclick\s*=[^>]*>/is';
  816. $arrRegexp[] = '/<[^>]*[^a-z]onerror\s*=[^>]*>/is';
  817. $arrRegexp[] = '/<[^>]*[^a-z]onfocus\s*=[^>]*>/is';
  818. $arrRegexp[] = '/<[^>]*[^a-z]onkeypress\s*=[^>]*>/is';
  819. $arrRegexp[] = '/<[^>]*[^a-z]onkeydown\s*=[^>]*>/is';
  820. $arrRegexp[] = '/<[^>]*[^a-z]onkeyup\s*=[^>]*>/is';
  821. $arrRegexp[] = '/<[^>]*[^a-z]onload\s*=[^>]*>/is';
  822. $arrRegexp[] = '/<[^>]*[^a-z]onmouseover\s*=[^>]*>/is';
  823. $arrRegexp[] = '/<[^>]*[^a-z]onmouseup\s*=[^>]*>/is';
  824. $arrRegexp[] = '/<[^>]*[^a-z]onmousedown\s*=[^>]*>/is';
  825. $arrRegexp[] = '/<[^>]*[^a-z]onmouseout\s*=[^>]*>/is';
  826. $arrRegexp[] = '/<[^>]*[^a-z]onreset\s*=[^>]*>/is';
  827. $arrRegexp[] = '/<[^>]*[^a-z]onselect\s*=[^>]*>/is';
  828. $arrRegexp[] = '/<[^>]*[^a-z]onsubmit\s*=[^>]*>/is';
  829. $arrRegexp[] = '/<[^>]*[^a-z]onunload\s*=[^>]*>/is';
  830. $arrRegexp[] = '/<[^>]*[^a-z]onresize\s*=[^>]*>/is';
  831. }
  833. $varValue = preg_replace($arrRegexp, '', $varValue);
  835. // Recheck for encoded null bytes
  836. $varValue = str_replace('\\0', '&#92;0', $varValue);
  838. return $varValue;
  839. }
  841. /**
  842. * Decode HTML entities
  843. *
  844. * @param mixed $varValue A string or array
  845. *
  846. * @return mixed The decoded string or array
  847. */
  848. public static function decodeEntities($varValue)
  849. {
  850. if (!$varValue)
  851. {
  852. return $varValue;
  853. }
  855. // Recursively clean arrays
  856. if (\is_array($varValue))
  857. {
  858. foreach ($varValue as $k=>$v)
  859. {
  860. $varValue[$k] = static::decodeEntities($v);
  861. }
  863. return $varValue;
  864. }
  866. // Preserve basic entities
  867. $varValue = static::preserveBasicEntities($varValue);
  868. $varValue = html_entity_decode($varValue, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, System::getContainer()->getParameter('kernel.charset'));
  870. return $varValue;
  871. }
  873. /**
  874. * Preserve basic entities by replacing them with square brackets (e.g. &amp; becomes [amp])
  875. *
  876. * @param mixed $varValue A string or array
  877. *
  878. * @return mixed The string or array with the converted entities
  879. */
  880. public static function preserveBasicEntities($varValue)
  881. {
  882. if (!$varValue)
  883. {
  884. return $varValue;
  885. }
  887. // Recursively clean arrays
  888. if (\is_array($varValue))
  889. {
  890. foreach ($varValue as $k=>$v)
  891. {
  892. $varValue[$k] = static::preserveBasicEntities($v);
  893. }
  895. return $varValue;
  896. }
  898. $varValue = str_replace
  899. (
  900. array('[&amp;]', '&amp;', '[&lt;]', '&lt;', '[&gt;]', '&gt;', '[&nbsp;]', '&nbsp;', '[&shy;]', '&shy;'),
  901. array('[&]', '[&]', '[lt]', '[lt]', '[gt]', '[gt]', '[nbsp]', '[nbsp]', '[-]', '[-]'),
  902. $varValue
  903. );
  905. return $varValue;
  906. }
  908. /**
  909. * Encode special characters which are potentially dangerous
  910. *
  911. * @param mixed $varValue A string or array
  912. *
  913. * @return mixed The encoded string or array
  914. */
  915. public static function encodeSpecialChars($varValue)
  916. {
  917. if (!$varValue)
  918. {
  919. return $varValue;
  920. }
  922. // Recursively clean arrays
  923. if (\is_array($varValue))
  924. {
  925. foreach ($varValue as $k=>$v)
  926. {
  927. $varValue[$k] = static::encodeSpecialChars($v);
  928. }
  930. return $varValue;
  931. }
  933. $arrSearch = array(
  934. '#', '<', '>', '(', ')', '\\', '=', '"', "'",
  935. // Revert double encoded #
  936. '&&#35;35;', '&&#35;60;', '&&#35;62;', '&&#35;40;', '&&#35;41;', '&&#35;92;', '&&#35;61;', '&&#35;34;', '&&#35;39;',
  937. );
  939. $arrReplace = array(
  940. '&#35;', '&#60;', '&#62;', '&#40;', '&#41;', '&#92;', '&#61;', '&#34;', '&#39;',
  941. '&#35;', '&#60;', '&#62;', '&#40;', '&#41;', '&#92;', '&#61;', '&#34;', '&#39;',
  942. );
  944. return str_replace($arrSearch, $arrReplace, $varValue);
  945. }
  947. /**
  948. * Encode the opening and closing delimiters of insert tags
  949. *
  950. * @param string|array $varValue The input string
  951. *
  952. * @return string|array The encoded input string
  953. */
  954. public static function encodeInsertTags($varValue)
  955. {
  956. // Recursively encode insert tags
  957. if (\is_array($varValue))
  958. {
  959. foreach ($varValue as $k=>$v)
  960. {
  961. $varValue[$k] = static::encodeInsertTags($v);
  962. }
  964. return $varValue;
  965. }
  967. $varValue = str_replace(array('{{', '}}'), array('&#123;&#123;', '&#125;&#125;'), (string) $varValue);
  969. // Encode single curly braces at the beginning and end of the string
  970. return preg_replace(array('/^(\s*)\{|\{(\s*)$/', '/^(\s*)\}|\}(\s*)$/'), array('$1&#123;$2', '$1&#125;$2'), $varValue);
  971. }
  973. /**
  974. * Fallback to the session form data if there is no post data
  975. *
  976. * @param string $strKey The variable name
  977. *
  978. * @return mixed The variable value
  979. */
  980. public static function findPost($strKey)
  981. {
  982. if (isset($_POST[$strKey]))
  983. {
  984. return $_POST[$strKey];
  985. }
  987. // Do not check for $request->hasPreviousSession() and early return here (see #3971)
  988. if (isset($_SESSION['FORM_DATA'][$strKey]))
  989. {
  990. return ($strKey == 'FORM_SUBMIT') ? preg_replace('/^auto_/i', '', $_SESSION['FORM_DATA'][$strKey]) : $_SESSION['FORM_DATA'][$strKey];
  991. }
  993. return null;
  994. }
  996. /**
  997. * Clean the keys of the request arrays
  998. *
  999. * @deprecated Deprecated since Contao 4.0, to be removed in Contao 5.0.
  1000. * The Input class is now static.
  1001. */
  1002. protected function __construct()
  1003. {
  1004. static::initialize();
  1005. }
  1007. /**
  1008. * Prevent cloning of the object (Singleton)
  1009. *
  1010. * @deprecated Deprecated since Contao 4.0, to be removed in Contao 5.0.
  1011. * The Input class is now static.
  1012. */
  1013. final public function __clone()
  1014. {
  1015. }
  1017. /**
  1018. * Return the object instance (Singleton)
  1019. *
  1020. * @return Input The object instance
  1021. *
  1022. * @deprecated Deprecated since Contao 4.0, to be removed in Contao 5.0.
  1023. * The Input class is now static.
  1024. */
  1025. public static function getInstance()
  1026. {
  1027. trigger_deprecation('contao/core-bundle', '4.0', 'Using "Contao\Input::getInstance()" has been deprecated and will no longer work in Contao 5.0. The "Contao\Input" class is now static.');
  1029. if (static::$objInstance === null)
  1030. {
  1031. static::$objInstance = new static();
  1032. }
  1034. return static::$objInstance;
  1035. }
  1036. }
  1038. class_alias(Input::class, 'Input');