{

/**

const TAGS_WHITELIST = 0;

/**

const TAGS_BLACKLIST = 1;

/**

const ATTR_WHITELIST = 0;

/**

const ATTR_BLACKLIST = 1;

/**

const ONLY_ALLOW_DEFINED_TAGS = 0;

/**

const ONLY_BLOCK_DEFINED_TAGS = 1;

/**

const ONLY_ALLOW_DEFINED_ATTRIBUTES = 0;

/**

const ONLY_BLOCK_DEFINED_ATTRIBUTES = 1;

/**

protected static $instances = array();

/**

public $tagsArray;

/**

public $attrArray;

/**

public $tagsMethod;

/**

public $attrMethod;

/**

public $xssAuto;

/**

public $tagBlacklist = array(

'applet',

'body',

'bgsound',

'base',

'basefont',

'canvas',

'embed',

'frame',

'frameset',

'head',

'html',

'id',

'iframe',

'ilayer',

'layer',

'link',

'meta',

'name',

'object',

'script',

'style',

'title',

'xml',

);

/**

public $attrBlacklist = array(

'action',

'background',

'codebase',

'dynsrc',

'formaction',

'lowsrc',

);

/**

private $blockedChars = array(

'&tab;',

'&space;',

':',

'&column;',

);

/**

public function __construct($tagsArray = array(), $attrArray = array(), $tagsMethod = self::ONLY_ALLOW_DEFINED_TAGS,

$attrMethod = self::ONLY_ALLOW_DEFINED_ATTRIBUTES, $xssAuto = 1

)

{

// Make sure user defined arrays are in lowercase

$tagsArray = array_map('strtolower', (array) $tagsArray);

$attrArray = array_map('strtolower', (array) $attrArray);

// Assign member variables

$this->tagsArray = $tagsArray;

$this->attrArray = $attrArray;

$this->tagsMethod = $tagsMethod;

$this->attrMethod = $attrMethod;

$this->xssAuto = $xssAuto;

}

/**

public function clean($source, $type = 'string')

{

$type = ucfirst(strtolower($type));

if ($type === 'Array')

{

return (array) $source;

}

if ($type === 'Raw')

{

return $source;

}

if (\is_array($source))

{

$result = array();

foreach ($source as $key => $value)

{

$result[$key] = $this->clean($value, $type);

}

return $result;

}

if (\is_object($source))

{

foreach (get_object_vars($source) as $key => $value)

{

$source->$key = $this->clean($value, $type);

}

return $source;

}

$method = 'clean' . $type;

if (method_exists($this, $method))

{

return $this->$method((string) $source);

}

// Unknown filter method

if (\is_string($source) && !empty($source))

{

// Filter source for XSS and other 'bad' code etc.

return $this->cleanString($source);

}

// Not an array or string... return the passed parameter

return $source;

}

/**

public static function checkAttribute($attrSubSet)

{

$quoteStyle = version_compare(\PHP_VERSION, '5.4', '>=') ? \ENT_QUOTES | \ENT_HTML401 : \ENT_QUOTES;

$attrSubSet[0] = strtolower($attrSubSet[0]);

$attrSubSet[1] = html_entity_decode(strtolower($attrSubSet[1]), $quoteStyle, 'UTF-8');

return (strpos($attrSubSet[1], 'expression') !== false && $attrSubSet[0] === 'style')

|| preg_match('/(?:(?:java|vb|live)script|behaviour|mocha)(?::|:|&column;)/', $attrSubSet[1]) !== 0;

}

/**

protected function remove($source)

{

// Iteration provides nested tag protection

do

{

$temp = $source;

$source = $this->cleanTags($source);

}

while ($temp !== $source);

return $source;

}

/**

protected function cleanTags($source)

{

// First, pre-process this for illegal characters inside attribute values

$source = $this->escapeAttributeValues($source);

// In the beginning we don't really have a tag, so everything is postTag

$preTag = null;

$postTag = $source;

$currentSpace = false;

// Setting to null to deal with undefined variables

$attr = '';

// Is there a tag? If so it will certainly start with a '<'.

$tagOpenStart = strpos($source, '<');

while ($tagOpenStart !== false)

{

// Get some information about the tag we are processing

$preTag .= substr($postTag, 0, $tagOpenStart);

$postTag = substr($postTag, $tagOpenStart);

$fromTagOpen = substr($postTag, 1);

$tagOpenEnd = strpos($fromTagOpen, '>');

// Check for mal-formed tag where we have a second '<' before the first '>'

$nextOpenTag = (strlen($postTag) > $tagOpenStart) ? strpos($postTag, '<', $tagOpenStart + 1) : false;

if (($nextOpenTag !== false) && ($nextOpenTag < $tagOpenEnd))

{

// At this point we have a mal-formed tag -- remove the offending open

$postTag = substr($postTag, 0, $tagOpenStart) . substr($postTag, $tagOpenStart + 1);

$tagOpenStart = strpos($postTag, '<');

continue;

}

// Let's catch any non-terminated tags and skip over them

if ($tagOpenEnd === false)

{

$postTag = substr($postTag, $tagOpenStart + 1);

$tagOpenStart = strpos($postTag, '<');

continue;

}

// Do we have a nested tag?

$tagOpenNested = strpos($fromTagOpen, '<');

if (($tagOpenNested !== false) && ($tagOpenNested < $tagOpenEnd))

{

$preTag .= substr($postTag, 1, $tagOpenNested);

$postTag = substr($postTag, ($tagOpenNested + 1));

$tagOpenStart = strpos($postTag, '<');

continue;

}

// Let's get some information about our tag and setup attribute pairs

$tagOpenNested = (strpos($fromTagOpen, '<') + $tagOpenStart + 1);

$currentTag = substr($fromTagOpen, 0, $tagOpenEnd);

$tagLength = strlen($currentTag);

$tagLeft = $currentTag;

$attrSet = array();

$currentSpace = strpos($tagLeft, ' ');

// Are we an open tag or a close tag?

if (substr($currentTag, 0, 1) === '/')

{

// Close Tag

$isCloseTag = true;

list($tagName) = explode(' ', $currentTag);

$tagName = substr($tagName, 1);

}

else

{

// Open Tag

$isCloseTag = false;

list($tagName) = explode(' ', $currentTag);

}

/*

if ((!preg_match('/^[a-z][a-z0-9]*$/i', $tagName))

|| (!$tagName)

|| ((\in_array(strtolower($tagName), $this->tagBlacklist)) && ($this->xssAuto)))

{

$postTag = substr($postTag, ($tagLength + 2));

$tagOpenStart = strpos($postTag, '<');

// Strip tag

continue;

}

/*

while ($currentSpace !== false)

{

$attr = '';

$fromSpace = substr($tagLeft, ($currentSpace + 1));

$nextEqual = strpos($fromSpace, '=');

$nextSpace = strpos($fromSpace, ' ');

$openQuotes = strpos($fromSpace, '"');

$closeQuotes = strpos(substr($fromSpace, ($openQuotes + 1)), '"') + $openQuotes + 1;

$startAtt = '';

$startAttPosition = 0;

// Find position of equal and open quotes ignoring

if (preg_match('#\s*=\s*\"#', $fromSpace, $matches, \PREG_OFFSET_CAPTURE))

{

$stringBeforeAttr = substr($fromSpace, 0, $matches[0][1]);

$startAttPosition = strlen($stringBeforeAttr);

$startAtt = $matches[0][0];

$closeQuotePos = strpos(

substr($fromSpace, ($startAttPosition + strlen($startAtt))), '"'

);

$closeQuotes = $closeQuotePos + $startAttPosition + strlen($startAtt);

$nextEqual = $startAttPosition + strpos($startAtt, '=');

$openQuotes = $startAttPosition + strpos($startAtt, '"');

$nextSpace = strpos(substr($fromSpace, $closeQuotes), ' ') + $closeQuotes;

}

// Do we have an attribute to process? [check for equal sign]

if ($fromSpace !== '/' && (($nextEqual && $nextSpace && $nextSpace < $nextEqual) || !$nextEqual))

{

if (!$nextEqual)

{

$attribEnd = strpos($fromSpace, '/') - 1;

}

else

{

$attribEnd = $nextSpace - 1;

}

// If there is an ending, use this, if not, do not worry.

if ($attribEnd > 0)

{

$fromSpace = substr($fromSpace, $attribEnd + 1);

}

}

if (strpos($fromSpace, '=') !== false)

{

/*

if (($openQuotes !== false)

&& (strpos(substr($fromSpace, ($openQuotes + 1)), '"') !== false))

{

$attr = substr($fromSpace, 0, ($closeQuotes + 1));

}

else

{

$attr = substr($fromSpace, 0, $nextSpace);

}

}

else

{

// No more equal signs so add any extra text in the tag into the attribute array [eg. checked]

if ($fromSpace !== '/')

{

$attr = substr($fromSpace, 0, $nextSpace);

}

}

// Last Attribute Pair

if (!$attr && $fromSpace !== '/')

{

$attr = $fromSpace;

}

// Add attribute pair to the attribute array

$attrSet[] = $attr;

// Move search point and continue iteration

$tagLeft = substr($fromSpace, strlen($attr));

$currentSpace = strpos($tagLeft, ' ');

}

// Is our tag in the user input array?

$tagFound = \in_array(strtolower($tagName), $this->tagsArray);

// If the tag is allowed let's append it to the output string.

if ((!$tagFound && $this->tagsMethod) || ($tagFound && !$this->tagsMethod))

{

// Reconstruct tag with allowed attributes

if (!$isCloseTag)

{

// Open or single tag

$attrSet = $this->cleanAttributes($attrSet);

$preTag .= '<' . $tagName;

for ($i = 0, $count = \count($attrSet); $i < $count; $i++)

{

$preTag .= ' ' . $attrSet[$i];

}

// Reformat single tags to XHTML

if (strpos($fromTagOpen, '</' . $tagName))

{

$preTag .= '>';

}

else

{

$preTag .= ' />';

}

}

else

{

// Closing tag

$preTag .= '</' . $tagName . '>';

}

}

// Find next tag's start and continue iteration

$postTag = substr($postTag, ($tagLength + 2));

$tagOpenStart = strpos($postTag, '<');

}

// Append any code after the end of tags and return

if ($postTag !== '<')

{

$preTag .= $postTag;

}

return $preTag;

}

/**

protected function cleanAttributes($attrSet)

{

$newSet = array();

$count = \count($attrSet);

// Iterate through attribute pairs

for ($i = 0; $i < $count; $i++)

{

// Skip blank spaces

if (!$attrSet[$i])

{

continue;

}

// Split into name/value pairs

$attrSubSet = explode('=', trim($attrSet[$i]), 2);

// Take the last attribute in case there is an attribute with no value

$attrSubSet0 = explode(' ', trim($attrSubSet[0]));

$attrSubSet[0] = array_pop($attrSubSet0);

$attrSubSet[0] = strtolower($attrSubSet[0]);

$quoteStyle = version_compare(\PHP_VERSION, '5.4', '>=') ? \ENT_QUOTES | \ENT_HTML401 : \ENT_QUOTES;

// Remove all spaces as valid attributes does not have spaces.

$attrSubSet[0] = html_entity_decode($attrSubSet[0], $quoteStyle, 'UTF-8');

$attrSubSet[0] = preg_replace('/^[\pZ\pC]+|[\pZ\pC]+$/u', '', $attrSubSet[0]);

$attrSubSet[0] = preg_replace('/\s+/u', '', $attrSubSet[0]);

// Remove blocked chars from the attribute name

foreach ($this->blockedChars as $blockedChar)

{

$attrSubSet[0] = str_ireplace($blockedChar, '', $attrSubSet[0]);

}

// Remove all symbols

$attrSubSet[0] = preg_replace('/[^\p{L}\p{N}\-\s]/u', '', $attrSubSet[0]);

// Remove all "non-regular" attribute names

// AND blocked attributes

if ((!preg_match('/[a-z]*$/i', $attrSubSet[0]))

|| (($this->xssAuto) && ((\in_array(strtolower($attrSubSet[0]), $this->attrBlacklist))

|| (substr($attrSubSet[0], 0, 2) == 'on'))))

{

continue;

}

// XSS attribute value filtering

if (!isset($attrSubSet[1]))

{

continue;

}

// Remove blocked chars from the attribute value

foreach ($this->blockedChars as $blockedChar)

{

$attrSubSet[1] = str_ireplace($blockedChar, '', $attrSubSet[1]);

}

// Trim leading and trailing spaces

$attrSubSet[1] = trim($attrSubSet[1]);

// Strips unicode, hex, etc

$attrSubSet[1] = str_replace('&#', '', $attrSubSet[1]);

// Strip normal newline within attr value

$attrSubSet[1] = preg_replace('/[\n\r]/', '', $attrSubSet[1]);

// Strip double quotes

$attrSubSet[1] = str_replace('"', '', $attrSubSet[1]);

// Convert single quotes from either side to doubles (Single quotes shouldn't be used to pad attr values)

if ((substr($attrSubSet[1], 0, 1) == "'") && (substr($attrSubSet[1], (\strlen($attrSubSet[1]) - 1), 1) == "'"))

{

$attrSubSet[1] = substr($attrSubSet[1], 1, (\strlen($attrSubSet[1]) - 2));

}

// Strip slashes

$attrSubSet[1] = stripslashes($attrSubSet[1]);

// Autostrip script tags

if (static::checkAttribute($attrSubSet))

{

continue;

}

// Is our attribute in the user input array?

$attrFound = \in_array(strtolower($attrSubSet[0]), $this->attrArray);

// If the tag is allowed lets keep it

if ((!$attrFound && $this->attrMethod) || ($attrFound && !$this->attrMethod))

{

// Does the attribute have a value?

if (empty($attrSubSet[1]) === false)

{

$newSet[] = $attrSubSet[0] . '="' . $attrSubSet[1] . '"';

}

elseif ($attrSubSet[1] === '0')

{

// Special Case

// Is the value 0?

$newSet[] = $attrSubSet[0] . '="0"';

}

else

{

// Leave empty attributes alone

$newSet[] = $attrSubSet[0] . '=""';

}

}

}

return $newSet;

}

/**

protected function decode($source)

{

return html_entity_decode($source, \ENT_QUOTES, 'UTF-8');

}

/**

protected function escapeAttributeValues($source)

{

$alreadyFiltered = '';

$remainder = $source;

$badChars = array('<', '"', '>');

$escapedChars = array('&lt;', '&quot;', '&gt;');

// Process each portion based on presence of =" and "<space>, "/>, or ">

// See if there are any more attributes to process

while (preg_match('#<[^>]*?=\s*?(\"|\')#s', $remainder, $matches, \PREG_OFFSET_CAPTURE))

{

$stringBeforeTag = substr($remainder, 0, $matches[0][1]);

$tagPosition = strlen($stringBeforeTag);

// Get the character length before the attribute value

$nextBefore = $tagPosition + strlen($matches[0][0]);

// Figure out if we have a single or double quote and look for the matching closing quote

// Closing quote should be "/>, ">, "<space>, or " at the end of the string

$quote = substr($matches[0][0], -1);

$pregMatch = ($quote == '"') ? '#(\"\s*/\s*>|\"\s*>|\"\s+|\"$)#' : "#(\'\s*/\s*>|\'\s*>|\'\s+|\'$)#";

// Get the portion after attribute value

$attributeValueRemainder = substr($remainder, $nextBefore);

if (preg_match($pregMatch, $attributeValueRemainder, $matches, \PREG_OFFSET_CAPTURE))

{

$stringBeforeQuote = substr($attributeValueRemainder, 0, $matches[0][1]);

$closeQuoteChars = strlen($stringBeforeQuote);

$nextAfter = $nextBefore + $matches[0][1];

}

else

{

// No closing quote

$nextAfter = strlen($remainder);

}

// Get the actual attribute value

$attributeValue = substr($remainder, $nextBefore, $nextAfter - $nextBefore);

// Escape bad chars

$attributeValue = str_replace($badChars, $escapedChars, $attributeValue);

$attributeValue = $this->stripCssExpressions($attributeValue);

$alreadyFiltered .= substr($remainder, 0, $nextBefore) . $attributeValue . $quote;

$remainder = substr($remainder, $nextAfter + 1);

}

// At this point, we just have to return the $alreadyFiltered and the $remainder

return $alreadyFiltered . $remainder;

}

/**

protected function stripCssExpressions($source)

{

// Strip any comments out (in the form of /*...*/)

$test = preg_replace('#\/\*.*\*\/#U', '', $source);

// Test for :expression

if (!stripos($test, ':expression'))

{

// Not found, so we are done

return $source;

}

// At this point, we have stripped out the comments and have found :expression

// Test stripped string for :expression followed by a '('

if (preg_match_all('#:expression\s*\(#', $test, $matches))

{

// If found, remove :expression

return str_ireplace(':expression', '', $test);

}

return $source;

}

/**

private function cleanInt($source)

{

$pattern = '/[-+]?[0-9]+/';

preg_match($pattern, $source, $matches);

return isset($matches[0]) ? (int) $matches[0] : 0;

}

/**

private function cleanInteger($source)

{

return $this->cleanInt($source);

}

/**

private function cleanUint($source)

{

$pattern = '/[-+]?[0-9]+/';

preg_match($pattern, $source, $matches);

return isset($matches[0]) ? abs((int) $matches[0]) : 0;

}

/**

private function cleanFloat($source)

{

$pattern = '/[-+]?[0-9]+(\.[0-9]+)?([eE][-+]?[0-9]+)?/';

preg_match($pattern, $source, $matches);

return isset($matches[0]) ? (float) $matches[0] : 0.0;

}

/**

private function cleanDouble($source)

{

return $this->cleanFloat($source);

}

/**

private function cleanBool($source)

{

return (bool) $source;

}

/**

private function cleanBoolean($source)

{

return $this->cleanBool($source);

}

/**

private function cleanWord($source)

{

$pattern = '/[^A-Z_]/i';

return preg_replace($pattern, '', $source);

}

/**

private function cleanAlnum($source)

{

$pattern = '/[^A-Z0-9]/i';

return preg_replace($pattern, '', $source);

}

/**

private function cleanCmd($source)

{

$pattern = '/[^A-Z0-9_\.-]/i';

$result = preg_replace($pattern, '', $source);

$result = ltrim($result, '.');

return $result;

}

/**

private function cleanBase64($source)

{

$pattern = '/[^A-Z0-9\/+=]/i';

return preg_replace($pattern, '', $source);

}

/**

private function cleanString($source)

{

return $this->remove($this->decode($source));

}

/**