OpenXE/classes/Components/Sanitizer/SanitizerConfig.php

<?php

namespace Xentral\Components\Sanitizer;

use Xentral\Components\Sanitizer\Helper\InternalUriWhitelistChecker;
use Xentral\Components\Sanitizer\Helper\UriParser;
use Xentral\Components\Sanitizer\HtmlPurifier\InternalUrlWhitelist;

final class SanitizerConfig
{
    /** @var bool $disableExternal */
    private $disableExternal;

    /** @var bool $disableExternalResources */
    private $disableExternalResources;

    /** @var string|null $hostname */
    private $hostname;

    /** @var string|null $redirectUrl */
    private $redirectUrl;

    /** @var array $moduleActionWhitelist */
    private $moduleActionWhitelist;

    /** @var string|null $tempDir */
    private $tempDir;

    /**
     * @param bool        $disableExternal          Removes all external links and resources
     * @param bool        $disableExternalResources Removes only external resources; external links are allowed
     * @param string|null $hostname                 Domain name of the server; without http/https
     * @param string|null $redirectUrl              Munges all browsable (usually http, https and ftp) absolute URIs
     *                                              into another URI; example `http://my-redirect-service.com/?url=%s`
     * @param array $moduleActionWhitelist          Example `[ ['module' => 'welcome', 'action' => 'redirect'] ]`
     */
    public function __construct(
        $disableExternal = false,
        $disableExternalResources = false,
        $hostname = null,
        $redirectUrl = null,
        $moduleActionWhitelist = []
    ) {
        $this->disableExternal = (bool)$disableExternal;
        $this->disableExternalResources = (bool)$disableExternalResources;
        $this->moduleActionWhitelist = (array)$moduleActionWhitelist;
        if (is_string($hostname) && !empty($hostname)) {
            $this->hostname = $hostname;
        }
        if (is_string($redirectUrl) && !empty($redirectUrl)) {
            $this->redirectUrl = $redirectUrl;
        }
    }

    /**
     * @param string $tempDir
     *
     * @return void
     */
    public function setTempDir($tempDir)
    {
        $this->tempDir = $tempDir;
    }

    /**
     * @return array
     */
    public function toHtmlPurifierConfig()
    {
        $config = $this->getPurifierDefaults();
        $config['URI']['DisableExternal'] = $this->disableExternal;
        $config['URI']['DisableExternalResources'] = $this->disableExternalResources;

        if ($this->redirectUrl !== null) {
            $config['URI']['Munge'] = $this->redirectUrl;
        }
        if ($this->hostname !== null) {
            $config['URI']['Host'] = $this->hostname;
        }
        if ($this->tempDir !== null && is_dir($this->tempDir)) {
            $config['Cache'] = [
                'DefinitionImpl' => 'Serializer',
                'SerializerPath' => $this->tempDir,
            ];
        }

        // Nur bestimmte interne URLs zulassen; alle anderen entfernen
        if (!empty($this->hostname) && !empty($this->moduleActionWhitelist)) {
            $checker = new InternalUriWhitelistChecker($this->hostname, $this->moduleActionWhitelist);
            $autoFormatter = new InternalUrlWhitelist(new UriParser(), $checker);

            if (!isset($config['AutoFormat']['Custom'])) {
                $config['AutoFormat']['Custom'] = [];
            }
            $config['AutoFormat']['Custom'][] = $autoFormatter;
        }

        return $config;
    }

    /**
     * @see http://htmlpurifier.org/live/configdoc/plain.html
     *
     * @return array
     */
    private function getPurifierDefaults()
    {
        return [
            'URI'  => [
                'DisableExternal'          => false,
                'DisableExternalResources' => false,
                'Munge'                    => null,
                'Host'                     => null,
            ],
            'HTML' => [
                'TidyLevel'        => 'medium',
                'TargetBlank'      => true,
                'TargetNoopener'   => true,
                'TargetNoreferrer' => true,
            ],
        ];
    }
}