1 /*
2 +----------------------------------------------------------------------+
3 | PHP Version 7 |
4 +----------------------------------------------------------------------+
5 | Copyright (c) 1997-2018 The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Rasmus Lerdorf <rasmus@php.net> |
16 | Jaakko Hyvätti <jaakko.hyvatti@iki.fi> |
17 | Wez Furlong <wez@thebrainroom.com> |
18 | Gustavo Lopes <cataphract@php.net> |
19 +----------------------------------------------------------------------+
20 */
21
22 /*
23 * HTML entity resources:
24 *
25 * http://www.unicode.org/Public/MAPPINGS/OBSOLETE/UNI2SGML.TXT
26 *
27 * XHTML 1.0 DTD
28 * http://www.w3.org/TR/2002/REC-xhtml1-20020801/dtds.html#h-A2
29 *
30 * From HTML 4.01 strict DTD:
31 * http://www.w3.org/TR/html4/HTMLlat1.ent
32 * http://www.w3.org/TR/html4/HTMLsymbol.ent
33 * http://www.w3.org/TR/html4/HTMLspecial.ent
34 *
35 * HTML 5:
36 * http://dev.w3.org/html5/spec/Overview.html#named-character-references
37 */
38
39 #include "php.h"
40 #ifdef PHP_WIN32
41 #include "config.w32.h"
42 #else
43 #include <php_config.h>
44 #endif
45 #include "php_standard.h"
46 #include "php_string.h"
47 #include "SAPI.h"
48 #if HAVE_LOCALE_H
49 #include <locale.h>
50 #endif
51 #if HAVE_LANGINFO_H
52 #include <langinfo.h>
53 #endif
54
55 #include <zend_hash.h>
56 #include "html_tables.h"
57
58 /* Macro for disabling flag of translation of non-basic entities where this isn't supported.
59 * Not appropriate for html_entity_decode/htmlspecialchars_decode */
60 #define LIMIT_ALL(all, doctype, charset) do { \
61 (all) = (all) && !CHARSET_PARTIAL_SUPPORT((charset)) && ((doctype) != ENT_HTML_DOC_XML1); \
62 } while (0)
63
64 #define MB_FAILURE(pos, advance) do { \
65 *cursor = pos + (advance); \
66 *status = FAILURE; \
67 return 0; \
68 } while (0)
69
70 #define CHECK_LEN(pos, chars_need) ((str_len - (pos)) >= (chars_need))
71
72 /* valid as single byte character or leading byte */
73 #define utf8_lead(c) ((c) < 0x80 || ((c) >= 0xC2 && (c) <= 0xF4))
74 /* whether it's actually valid depends on other stuff;
75 * this macro cannot check for non-shortest forms, surrogates or
76 * code points above 0x10FFFF */
77 #define utf8_trail(c) ((c) >= 0x80 && (c) <= 0xBF)
78
79 #define gb2312_lead(c) ((c) != 0x8E && (c) != 0x8F && (c) != 0xA0 && (c) != 0xFF)
80 #define gb2312_trail(c) ((c) >= 0xA1 && (c) <= 0xFE)
81
82 #define sjis_lead(c) ((c) != 0x80 && (c) != 0xA0 && (c) < 0xFD)
83 #define sjis_trail(c) ((c) >= 0x40 && (c) != 0x7F && (c) < 0xFD)
84
85 /* {{{ get_default_charset
86 */
get_default_charset(void)87 static char *get_default_charset(void) {
88 if (PG(internal_encoding) && PG(internal_encoding)[0]) {
89 return PG(internal_encoding);
90 } else if (SG(default_charset) && SG(default_charset)[0] ) {
91 return SG(default_charset);
92 }
93 return NULL;
94 }
95 /* }}} */
96
97 /* {{{ get_next_char
98 */
get_next_char(enum entity_charset charset,const unsigned char * str,size_t str_len,size_t * cursor,int * status)99 static inline unsigned int get_next_char(
100 enum entity_charset charset,
101 const unsigned char *str,
102 size_t str_len,
103 size_t *cursor,
104 int *status)
105 {
106 size_t pos = *cursor;
107 unsigned int this_char = 0;
108
109 *status = SUCCESS;
110 assert(pos <= str_len);
111
112 if (!CHECK_LEN(pos, 1))
113 MB_FAILURE(pos, 1);
114
115 switch (charset) {
116 case cs_utf_8:
117 {
118 /* We'll follow strategy 2. from section 3.6.1 of UTR #36:
119 * "In a reported illegal byte sequence, do not include any
120 * non-initial byte that encodes a valid character or is a leading
121 * byte for a valid sequence." */
122 unsigned char c;
123 c = str[pos];
124 if (c < 0x80) {
125 this_char = c;
126 pos++;
127 } else if (c < 0xc2) {
128 MB_FAILURE(pos, 1);
129 } else if (c < 0xe0) {
130 if (!CHECK_LEN(pos, 2))
131 MB_FAILURE(pos, 1);
132
133 if (!utf8_trail(str[pos + 1])) {
134 MB_FAILURE(pos, utf8_lead(str[pos + 1]) ? 1 : 2);
135 }
136 this_char = ((c & 0x1f) << 6) | (str[pos + 1] & 0x3f);
137 if (this_char < 0x80) { /* non-shortest form */
138 MB_FAILURE(pos, 2);
139 }
140 pos += 2;
141 } else if (c < 0xf0) {
142 size_t avail = str_len - pos;
143
144 if (avail < 3 ||
145 !utf8_trail(str[pos + 1]) || !utf8_trail(str[pos + 2])) {
146 if (avail < 2 || utf8_lead(str[pos + 1]))
147 MB_FAILURE(pos, 1);
148 else if (avail < 3 || utf8_lead(str[pos + 2]))
149 MB_FAILURE(pos, 2);
150 else
151 MB_FAILURE(pos, 3);
152 }
153
154 this_char = ((c & 0x0f) << 12) | ((str[pos + 1] & 0x3f) << 6) | (str[pos + 2] & 0x3f);
155 if (this_char < 0x800) { /* non-shortest form */
156 MB_FAILURE(pos, 3);
157 } else if (this_char >= 0xd800 && this_char <= 0xdfff) { /* surrogate */
158 MB_FAILURE(pos, 3);
159 }
160 pos += 3;
161 } else if (c < 0xf5) {
162 size_t avail = str_len - pos;
163
164 if (avail < 4 ||
165 !utf8_trail(str[pos + 1]) || !utf8_trail(str[pos + 2]) ||
166 !utf8_trail(str[pos + 3])) {
167 if (avail < 2 || utf8_lead(str[pos + 1]))
168 MB_FAILURE(pos, 1);
169 else if (avail < 3 || utf8_lead(str[pos + 2]))
170 MB_FAILURE(pos, 2);
171 else if (avail < 4 || utf8_lead(str[pos + 3]))
172 MB_FAILURE(pos, 3);
173 else
174 MB_FAILURE(pos, 4);
175 }
176
177 this_char = ((c & 0x07) << 18) | ((str[pos + 1] & 0x3f) << 12) | ((str[pos + 2] & 0x3f) << 6) | (str[pos + 3] & 0x3f);
178 if (this_char < 0x10000 || this_char > 0x10FFFF) { /* non-shortest form or outside range */
179 MB_FAILURE(pos, 4);
180 }
181 pos += 4;
182 } else {
183 MB_FAILURE(pos, 1);
184 }
185 }
186 break;
187
188 case cs_big5:
189 /* reference http://demo.icu-project.org/icu-bin/convexp?conv=big5 */
190 {
191 unsigned char c = str[pos];
192 if (c >= 0x81 && c <= 0xFE) {
193 unsigned char next;
194 if (!CHECK_LEN(pos, 2))
195 MB_FAILURE(pos, 1);
196
197 next = str[pos + 1];
198
199 if ((next >= 0x40 && next <= 0x7E) ||
200 (next >= 0xA1 && next <= 0xFE)) {
201 this_char = (c << 8) | next;
202 } else {
203 MB_FAILURE(pos, 1);
204 }
205 pos += 2;
206 } else {
207 this_char = c;
208 pos += 1;
209 }
210 }
211 break;
212
213 case cs_big5hkscs:
214 {
215 unsigned char c = str[pos];
216 if (c >= 0x81 && c <= 0xFE) {
217 unsigned char next;
218 if (!CHECK_LEN(pos, 2))
219 MB_FAILURE(pos, 1);
220
221 next = str[pos + 1];
222
223 if ((next >= 0x40 && next <= 0x7E) ||
224 (next >= 0xA1 && next <= 0xFE)) {
225 this_char = (c << 8) | next;
226 } else if (next != 0x80 && next != 0xFF) {
227 MB_FAILURE(pos, 1);
228 } else {
229 MB_FAILURE(pos, 2);
230 }
231 pos += 2;
232 } else {
233 this_char = c;
234 pos += 1;
235 }
236 }
237 break;
238
239 case cs_gb2312: /* EUC-CN */
240 {
241 unsigned char c = str[pos];
242 if (c >= 0xA1 && c <= 0xFE) {
243 unsigned char next;
244 if (!CHECK_LEN(pos, 2))
245 MB_FAILURE(pos, 1);
246
247 next = str[pos + 1];
248
249 if (gb2312_trail(next)) {
250 this_char = (c << 8) | next;
251 } else if (gb2312_lead(next)) {
252 MB_FAILURE(pos, 1);
253 } else {
254 MB_FAILURE(pos, 2);
255 }
256 pos += 2;
257 } else if (gb2312_lead(c)) {
258 this_char = c;
259 pos += 1;
260 } else {
261 MB_FAILURE(pos, 1);
262 }
263 }
264 break;
265
266 case cs_sjis:
267 {
268 unsigned char c = str[pos];
269 if ((c >= 0x81 && c <= 0x9F) || (c >= 0xE0 && c <= 0xFC)) {
270 unsigned char next;
271 if (!CHECK_LEN(pos, 2))
272 MB_FAILURE(pos, 1);
273
274 next = str[pos + 1];
275
276 if (sjis_trail(next)) {
277 this_char = (c << 8) | next;
278 } else if (sjis_lead(next)) {
279 MB_FAILURE(pos, 1);
280 } else {
281 MB_FAILURE(pos, 2);
282 }
283 pos += 2;
284 } else if (c < 0x80 || (c >= 0xA1 && c <= 0xDF)) {
285 this_char = c;
286 pos += 1;
287 } else {
288 MB_FAILURE(pos, 1);
289 }
290 }
291 break;
292
293 case cs_eucjp:
294 {
295 unsigned char c = str[pos];
296
297 if (c >= 0xA1 && c <= 0xFE) {
298 unsigned next;
299 if (!CHECK_LEN(pos, 2))
300 MB_FAILURE(pos, 1);
301 next = str[pos + 1];
302
303 if (next >= 0xA1 && next <= 0xFE) {
304 /* this a jis kanji char */
305 this_char = (c << 8) | next;
306 } else {
307 MB_FAILURE(pos, (next != 0xA0 && next != 0xFF) ? 1 : 2);
308 }
309 pos += 2;
310 } else if (c == 0x8E) {
311 unsigned next;
312 if (!CHECK_LEN(pos, 2))
313 MB_FAILURE(pos, 1);
314
315 next = str[pos + 1];
316 if (next >= 0xA1 && next <= 0xDF) {
317 /* JIS X 0201 kana */
318 this_char = (c << 8) | next;
319 } else {
320 MB_FAILURE(pos, (next != 0xA0 && next != 0xFF) ? 1 : 2);
321 }
322 pos += 2;
323 } else if (c == 0x8F) {
324 size_t avail = str_len - pos;
325
326 if (avail < 3 || !(str[pos + 1] >= 0xA1 && str[pos + 1] <= 0xFE) ||
327 !(str[pos + 2] >= 0xA1 && str[pos + 2] <= 0xFE)) {
328 if (avail < 2 || (str[pos + 1] != 0xA0 && str[pos + 1] != 0xFF))
329 MB_FAILURE(pos, 1);
330 else if (avail < 3 || (str[pos + 2] != 0xA0 && str[pos + 2] != 0xFF))
331 MB_FAILURE(pos, 2);
332 else
333 MB_FAILURE(pos, 3);
334 } else {
335 /* JIS X 0212 hojo-kanji */
336 this_char = (c << 16) | (str[pos + 1] << 8) | str[pos + 2];
337 }
338 pos += 3;
339 } else if (c != 0xA0 && c != 0xFF) {
340 /* character encoded in 1 code unit */
341 this_char = c;
342 pos += 1;
343 } else {
344 MB_FAILURE(pos, 1);
345 }
346 }
347 break;
348 default:
349 /* single-byte charsets */
350 this_char = str[pos++];
351 break;
352 }
353
354 *cursor = pos;
355 return this_char;
356 }
357 /* }}} */
358
359 /* {{{ php_next_utf8_char
360 * Public interface for get_next_char used with UTF-8 */
php_next_utf8_char(const unsigned char * str,size_t str_len,size_t * cursor,int * status)361 PHPAPI unsigned int php_next_utf8_char(
362 const unsigned char *str,
363 size_t str_len,
364 size_t *cursor,
365 int *status)
366 {
367 return get_next_char(cs_utf_8, str, str_len, cursor, status);
368 }
369 /* }}} */
370
371 /* {{{ entity_charset determine_charset
372 * returns the charset identifier based on current locale or a hint.
373 * defaults to UTF-8 */
determine_charset(char * charset_hint)374 static enum entity_charset determine_charset(char *charset_hint)
375 {
376 size_t i;
377 enum entity_charset charset = cs_utf_8;
378 size_t len = 0;
379 const zend_encoding *zenc;
380
381 /* Default is now UTF-8 */
382 if (charset_hint == NULL)
383 return cs_utf_8;
384
385 if ((len = strlen(charset_hint)) != 0) {
386 goto det_charset;
387 }
388
389 zenc = zend_multibyte_get_internal_encoding();
390 if (zenc != NULL) {
391 charset_hint = (char *)zend_multibyte_get_encoding_name(zenc);
392 if (charset_hint != NULL && (len=strlen(charset_hint)) != 0) {
393 if ((len == 4) /* sizeof (auto|pass) */ &&
394 /* XXX should the "wchar" be ignored as well?? */
395 (!memcmp("pass", charset_hint, 4) ||
396 !memcmp("auto", charset_hint, 4))) {
397 charset_hint = NULL;
398 len = 0;
399 } else {
400 goto det_charset;
401 }
402 }
403 }
404
405 charset_hint = SG(default_charset);
406 if (charset_hint != NULL && (len=strlen(charset_hint)) != 0) {
407 goto det_charset;
408 }
409
410 /* try to detect the charset for the locale */
411 #if HAVE_NL_LANGINFO && HAVE_LOCALE_H && defined(CODESET)
412 charset_hint = nl_langinfo(CODESET);
413 if (charset_hint != NULL && (len=strlen(charset_hint)) != 0) {
414 goto det_charset;
415 }
416 #endif
417
418 #if HAVE_LOCALE_H
419 /* try to figure out the charset from the locale */
420 {
421 char *localename;
422 char *dot, *at;
423
424 /* lang[_territory][.codeset][@modifier] */
425 localename = setlocale(LC_CTYPE, NULL);
426
427 dot = strchr(localename, '.');
428 if (dot) {
429 dot++;
430 /* locale specifies a codeset */
431 at = strchr(dot, '@');
432 if (at)
433 len = at - dot;
434 else
435 len = strlen(dot);
436 charset_hint = dot;
437 } else {
438 /* no explicit name; see if the name itself
439 * is the charset */
440 charset_hint = localename;
441 len = strlen(charset_hint);
442 }
443 }
444 #endif
445
446 det_charset:
447
448 if (charset_hint) {
449 int found = 0;
450
451 /* now walk the charset map and look for the codeset */
452 for (i = 0; i < sizeof(charset_map)/sizeof(charset_map[0]); i++) {
453 if (len == charset_map[i].codeset_len &&
454 zend_binary_strcasecmp(charset_hint, len, charset_map[i].codeset, len) == 0) {
455 charset = charset_map[i].charset;
456 found = 1;
457 break;
458 }
459 }
460 if (!found) {
461 php_error_docref(NULL, E_WARNING, "charset `%s' not supported, assuming utf-8",
462 charset_hint);
463 }
464 }
465 return charset;
466 }
467 /* }}} */
468
469 /* {{{ php_utf32_utf8 */
php_utf32_utf8(unsigned char * buf,unsigned k)470 static inline size_t php_utf32_utf8(unsigned char *buf, unsigned k)
471 {
472 size_t retval = 0;
473
474 /* assert(0x0 <= k <= 0x10FFFF); */
475
476 if (k < 0x80) {
477 buf[0] = k;
478 retval = 1;
479 } else if (k < 0x800) {
480 buf[0] = 0xc0 | (k >> 6);
481 buf[1] = 0x80 | (k & 0x3f);
482 retval = 2;
483 } else if (k < 0x10000) {
484 buf[0] = 0xe0 | (k >> 12);
485 buf[1] = 0x80 | ((k >> 6) & 0x3f);
486 buf[2] = 0x80 | (k & 0x3f);
487 retval = 3;
488 } else {
489 buf[0] = 0xf0 | (k >> 18);
490 buf[1] = 0x80 | ((k >> 12) & 0x3f);
491 buf[2] = 0x80 | ((k >> 6) & 0x3f);
492 buf[3] = 0x80 | (k & 0x3f);
493 retval = 4;
494 }
495 /* UTF-8 has been restricted to max 4 bytes since RFC 3629 */
496
497 return retval;
498 }
499 /* }}} */
500
501 /* {{{ php_mb2_int_to_char
502 * Convert back big endian int representation of sequence of one or two 8-bit code units. */
php_mb2_int_to_char(unsigned char * buf,unsigned k)503 static inline size_t php_mb2_int_to_char(unsigned char *buf, unsigned k)
504 {
505 assert(k <= 0xFFFFU);
506 /* one or two bytes */
507 if (k <= 0xFFU) { /* 1 */
508 buf[0] = k;
509 return 1U;
510 } else { /* 2 */
511 buf[0] = k >> 8;
512 buf[1] = k & 0xFFU;
513 return 2U;
514 }
515 }
516 /* }}} */
517
518 /* {{{ php_mb3_int_to_char
519 * Convert back big endian int representation of sequence of one to three 8-bit code units.
520 * For EUC-JP. */
php_mb3_int_to_char(unsigned char * buf,unsigned k)521 static inline size_t php_mb3_int_to_char(unsigned char *buf, unsigned k)
522 {
523 assert(k <= 0xFFFFFFU);
524 /* one to three bytes */
525 if (k <= 0xFFU) { /* 1 */
526 buf[0] = k;
527 return 1U;
528 } else if (k <= 0xFFFFU) { /* 2 */
529 buf[0] = k >> 8;
530 buf[1] = k & 0xFFU;
531 return 2U;
532 } else {
533 buf[0] = k >> 16;
534 buf[1] = (k >> 8) & 0xFFU;
535 buf[2] = k & 0xFFU;
536 return 3U;
537 }
538 }
539 /* }}} */
540
541
542 /* {{{ unimap_bsearc_cmp
543 * Binary search of unicode code points in unicode <--> charset mapping.
544 * Returns the code point in the target charset (whose mapping table was given) or 0 if
545 * the unicode code point is not in the table.
546 */
unimap_bsearch(const uni_to_enc * table,unsigned code_key_a,size_t num)547 static inline unsigned char unimap_bsearch(const uni_to_enc *table, unsigned code_key_a, size_t num)
548 {
549 const uni_to_enc *l = table,
550 *h = &table[num-1],
551 *m;
552 unsigned short code_key;
553
554 /* we have no mappings outside the BMP */
555 if (code_key_a > 0xFFFFU)
556 return 0;
557
558 code_key = (unsigned short) code_key_a;
559
560 while (l <= h) {
561 m = l + (h - l) / 2;
562 if (code_key < m->un_code_point)
563 h = m - 1;
564 else if (code_key > m->un_code_point)
565 l = m + 1;
566 else
567 return m->cs_code;
568 }
569 return 0;
570 }
571 /* }}} */
572
573 /* {{{ map_from_unicode */
map_from_unicode(unsigned code,enum entity_charset charset,unsigned * res)574 static inline int map_from_unicode(unsigned code, enum entity_charset charset, unsigned *res)
575 {
576 unsigned char found;
577 const uni_to_enc *table;
578 size_t table_size;
579
580 switch (charset) {
581 case cs_8859_1:
582 /* identity mapping of code points to unicode */
583 if (code > 0xFF) {
584 return FAILURE;
585 }
586 *res = code;
587 break;
588
589 case cs_8859_5:
590 if (code <= 0xA0 || code == 0xAD /* soft hyphen */) {
591 *res = code;
592 } else if (code == 0x2116) {
593 *res = 0xF0; /* numero sign */
594 } else if (code == 0xA7) {
595 *res = 0xFD; /* section sign */
596 } else if (code >= 0x0401 && code <= 0x044F) {
597 if (code == 0x040D || code == 0x0450 || code == 0x045D)
598 return FAILURE;
599 *res = code - 0x360;
600 } else {
601 return FAILURE;
602 }
603 break;
604
605 case cs_8859_15:
606 if (code < 0xA4 || (code > 0xBE && code <= 0xFF)) {
607 *res = code;
608 } else { /* between A4 and 0xBE */
609 found = unimap_bsearch(unimap_iso885915,
610 code, sizeof(unimap_iso885915) / sizeof(*unimap_iso885915));
611 if (found)
612 *res = found;
613 else
614 return FAILURE;
615 }
616 break;
617
618 case cs_cp1252:
619 if (code <= 0x7F || (code >= 0xA0 && code <= 0xFF)) {
620 *res = code;
621 } else {
622 found = unimap_bsearch(unimap_win1252,
623 code, sizeof(unimap_win1252) / sizeof(*unimap_win1252));
624 if (found)
625 *res = found;
626 else
627 return FAILURE;
628 }
629 break;
630
631 case cs_macroman:
632 if (code == 0x7F)
633 return FAILURE;
634 table = unimap_macroman;
635 table_size = sizeof(unimap_macroman) / sizeof(*unimap_macroman);
636 goto table_over_7F;
637 case cs_cp1251:
638 table = unimap_win1251;
639 table_size = sizeof(unimap_win1251) / sizeof(*unimap_win1251);
640 goto table_over_7F;
641 case cs_koi8r:
642 table = unimap_koi8r;
643 table_size = sizeof(unimap_koi8r) / sizeof(*unimap_koi8r);
644 goto table_over_7F;
645 case cs_cp866:
646 table = unimap_cp866;
647 table_size = sizeof(unimap_cp866) / sizeof(*unimap_cp866);
648
649 table_over_7F:
650 if (code <= 0x7F) {
651 *res = code;
652 } else {
653 found = unimap_bsearch(table, code, table_size);
654 if (found)
655 *res = found;
656 else
657 return FAILURE;
658 }
659 break;
660
661 /* from here on, only map the possible characters in the ASCII range.
662 * to improve support here, it's a matter of building the unicode mappings.
663 * See <http://www.unicode.org/Public/6.0.0/ucd/Unihan.zip> */
664 case cs_sjis:
665 case cs_eucjp:
666 /* we interpret 0x5C as the Yen symbol. This is not universal.
667 * See <http://www.w3.org/Submission/japanese-xml/#ambiguity_of_yen> */
668 if (code >= 0x20 && code <= 0x7D) {
669 if (code == 0x5C)
670 return FAILURE;
671 *res = code;
672 } else {
673 return FAILURE;
674 }
675 break;
676
677 case cs_big5:
678 case cs_big5hkscs:
679 case cs_gb2312:
680 if (code >= 0x20 && code <= 0x7D) {
681 *res = code;
682 } else {
683 return FAILURE;
684 }
685 break;
686
687 default:
688 return FAILURE;
689 }
690
691 return SUCCESS;
692 }
693 /* }}} */
694
695 /* {{{ */
map_to_unicode(unsigned code,const enc_to_uni * table,unsigned * res)696 static inline void map_to_unicode(unsigned code, const enc_to_uni *table, unsigned *res)
697 {
698 /* only single byte encodings are currently supported; assumed code <= 0xFF */
699 *res = table->inner[ENT_ENC_TO_UNI_STAGE1(code)]->uni_cp[ENT_ENC_TO_UNI_STAGE2(code)];
700 }
701 /* }}} */
702
703 /* {{{ unicode_cp_is_allowed */
unicode_cp_is_allowed(unsigned uni_cp,int document_type)704 static inline int unicode_cp_is_allowed(unsigned uni_cp, int document_type)
705 {
706 /* XML 1.0 HTML 4.01 HTML 5
707 * 0x09..0x0A 0x09..0x0A 0x09..0x0A
708 * 0x0D 0x0D 0x0C..0x0D
709 * 0x0020..0xD7FF 0x20..0x7E 0x20..0x7E
710 * 0x00A0..0xD7FF 0x00A0..0xD7FF
711 * 0xE000..0xFFFD 0xE000..0x10FFFF 0xE000..0xFDCF
712 * 0x010000..0x10FFFF 0xFDF0..0x10FFFF (*)
713 *
714 * (*) exclude code points where ((code & 0xFFFF) >= 0xFFFE)
715 *
716 * References:
717 * XML 1.0: <http://www.w3.org/TR/REC-xml/#charsets>
718 * HTML 4.01: <http://www.w3.org/TR/1999/PR-html40-19990824/sgml/sgmldecl.html>
719 * HTML 5: <http://dev.w3.org/html5/spec/Overview.html#preprocessing-the-input-stream>
720 *
721 * Not sure this is the relevant part for HTML 5, though. I opted to
722 * disallow the characters that would result in a parse error when
723 * preprocessing of the input stream. See also section 8.1.3.
724 *
725 * It's unclear if XHTML 1.0 allows C1 characters. I'll opt to apply to
726 * XHTML 1.0 the same rules as for XML 1.0.
727 * See <http://cmsmcq.com/2007/C1.xml>.
728 */
729
730 switch (document_type) {
731 case ENT_HTML_DOC_HTML401:
732 return (uni_cp >= 0x20 && uni_cp <= 0x7E) ||
733 (uni_cp == 0x0A || uni_cp == 0x09 || uni_cp == 0x0D) ||
734 (uni_cp >= 0xA0 && uni_cp <= 0xD7FF) ||
735 (uni_cp >= 0xE000 && uni_cp <= 0x10FFFF);
736 case ENT_HTML_DOC_HTML5:
737 return (uni_cp >= 0x20 && uni_cp <= 0x7E) ||
738 (uni_cp >= 0x09 && uni_cp <= 0x0D && uni_cp != 0x0B) || /* form feed U+0C allowed */
739 (uni_cp >= 0xA0 && uni_cp <= 0xD7FF) ||
740 (uni_cp >= 0xE000 && uni_cp <= 0x10FFFF &&
741 ((uni_cp & 0xFFFF) < 0xFFFE) && /* last two of each plane (nonchars) disallowed */
742 (uni_cp < 0xFDD0 || uni_cp > 0xFDEF)); /* U+FDD0-U+FDEF (nonchars) disallowed */
743 case ENT_HTML_DOC_XHTML:
744 case ENT_HTML_DOC_XML1:
745 return (uni_cp >= 0x20 && uni_cp <= 0xD7FF) ||
746 (uni_cp == 0x0A || uni_cp == 0x09 || uni_cp == 0x0D) ||
747 (uni_cp >= 0xE000 && uni_cp <= 0x10FFFF && uni_cp != 0xFFFE && uni_cp != 0xFFFF);
748 default:
749 return 1;
750 }
751 }
752 /* }}} */
753
754 /* {{{ unicode_cp_is_allowed */
numeric_entity_is_allowed(unsigned uni_cp,int document_type)755 static inline int numeric_entity_is_allowed(unsigned uni_cp, int document_type)
756 {
757 /* less restrictive than unicode_cp_is_allowed */
758 switch (document_type) {
759 case ENT_HTML_DOC_HTML401:
760 /* all non-SGML characters (those marked with UNUSED in DESCSET) should be
761 * representable with numeric entities */
762 return uni_cp <= 0x10FFFF;
763 case ENT_HTML_DOC_HTML5:
764 /* 8.1.4. The numeric character reference forms described above are allowed to
765 * reference any Unicode code point other than U+0000, U+000D, permanently
766 * undefined Unicode characters (noncharacters), and control characters other
767 * than space characters (U+0009, U+000A, U+000C and U+000D) */
768 /* seems to allow surrogate characters, then */
769 return (uni_cp >= 0x20 && uni_cp <= 0x7E) ||
770 (uni_cp >= 0x09 && uni_cp <= 0x0C && uni_cp != 0x0B) || /* form feed U+0C allowed, but not U+0D */
771 (uni_cp >= 0xA0 && uni_cp <= 0x10FFFF &&
772 ((uni_cp & 0xFFFF) < 0xFFFE) && /* last two of each plane (nonchars) disallowed */
773 (uni_cp < 0xFDD0 || uni_cp > 0xFDEF)); /* U+FDD0-U+FDEF (nonchars) disallowed */
774 case ENT_HTML_DOC_XHTML:
775 case ENT_HTML_DOC_XML1:
776 /* OTOH, XML 1.0 requires "character references to match the production for Char
777 * See <http://www.w3.org/TR/REC-xml/#NT-CharRef> */
778 return unicode_cp_is_allowed(uni_cp, document_type);
779 default:
780 return 1;
781 }
782 }
783 /* }}} */
784
785 /* {{{ process_numeric_entity
786 * Auxiliary function to traverse_for_entities.
787 * On input, *buf should point to the first character after # and on output, it's the last
788 * byte read, no matter if there was success or insuccess.
789 */
process_numeric_entity(const char ** buf,unsigned * code_point)790 static inline int process_numeric_entity(const char **buf, unsigned *code_point)
791 {
792 zend_long code_l;
793 int hexadecimal = (**buf == 'x' || **buf == 'X'); /* TODO: XML apparently disallows "X" */
794 char *endptr;
795
796 if (hexadecimal && (**buf != '\0'))
797 (*buf)++;
798
799 /* strtol allows whitespace and other stuff in the beginning
800 * we're not interested */
801 if ((hexadecimal && !isxdigit(**buf)) ||
802 (!hexadecimal && !isdigit(**buf))) {
803 return FAILURE;
804 }
805
806 code_l = ZEND_STRTOL(*buf, &endptr, hexadecimal ? 16 : 10);
807 /* we're guaranteed there were valid digits, so *endptr > buf */
808 *buf = endptr;
809
810 if (**buf != ';')
811 return FAILURE;
812
813 /* many more are invalid, but that depends on whether it's HTML
814 * (and which version) or XML. */
815 if (code_l > Z_L(0x10FFFF))
816 return FAILURE;
817
818 if (code_point != NULL)
819 *code_point = (unsigned)code_l;
820
821 return SUCCESS;
822 }
823 /* }}} */
824
825 /* {{{ process_named_entity */
process_named_entity_html(const char ** buf,const char ** start,size_t * length)826 static inline int process_named_entity_html(const char **buf, const char **start, size_t *length)
827 {
828 *start = *buf;
829
830 /* "&" is represented by a 0x26 in all supported encodings. That means
831 * the byte after represents a character or is the leading byte of an
832 * sequence of 8-bit code units. If in the ranges below, it represents
833 * necessarily a alpha character because none of the supported encodings
834 * has an overlap with ASCII in the leading byte (only on the second one) */
835 while ((**buf >= 'a' && **buf <= 'z') ||
836 (**buf >= 'A' && **buf <= 'Z') ||
837 (**buf >= '0' && **buf <= '9')) {
838 (*buf)++;
839 }
840
841 if (**buf != ';')
842 return FAILURE;
843
844 /* cast to size_t OK as the quantity is always non-negative */
845 *length = *buf - *start;
846
847 if (*length == 0)
848 return FAILURE;
849
850 return SUCCESS;
851 }
852 /* }}} */
853
854 /* {{{ resolve_named_entity_html */
resolve_named_entity_html(const char * start,size_t length,const entity_ht * ht,unsigned * uni_cp1,unsigned * uni_cp2)855 static inline int resolve_named_entity_html(const char *start, size_t length, const entity_ht *ht, unsigned *uni_cp1, unsigned *uni_cp2)
856 {
857 const entity_cp_map *s;
858 zend_ulong hash = zend_inline_hash_func(start, length);
859
860 s = ht->buckets[hash % ht->num_elems];
861 while (s->entity) {
862 if (s->entity_len == length) {
863 if (memcmp(start, s->entity, length) == 0) {
864 *uni_cp1 = s->codepoint1;
865 *uni_cp2 = s->codepoint2;
866 return SUCCESS;
867 }
868 }
869 s++;
870 }
871 return FAILURE;
872 }
873 /* }}} */
874
write_octet_sequence(unsigned char * buf,enum entity_charset charset,unsigned code)875 static inline size_t write_octet_sequence(unsigned char *buf, enum entity_charset charset, unsigned code) {
876 /* code is not necessarily a unicode code point */
877 switch (charset) {
878 case cs_utf_8:
879 return php_utf32_utf8(buf, code);
880
881 case cs_8859_1:
882 case cs_cp1252:
883 case cs_8859_15:
884 case cs_koi8r:
885 case cs_cp1251:
886 case cs_8859_5:
887 case cs_cp866:
888 case cs_macroman:
889 /* single byte stuff */
890 *buf = code;
891 return 1;
892
893 case cs_big5:
894 case cs_big5hkscs:
895 case cs_sjis:
896 case cs_gb2312:
897 /* we don't have complete unicode mappings for these yet in entity_decode,
898 * and we opt to pass through the octet sequences for these in htmlentities
899 * instead of converting to an int and then converting back. */
900 #if 0
901 return php_mb2_int_to_char(buf, code);
902 #else
903 #if ZEND_DEBUG
904 assert(code <= 0xFFU);
905 #endif
906 *buf = code;
907 return 1;
908 #endif
909
910 case cs_eucjp:
911 #if 0 /* idem */
912 return php_mb2_int_to_char(buf, code);
913 #else
914 #if ZEND_DEBUG
915 assert(code <= 0xFFU);
916 #endif
917 *buf = code;
918 return 1;
919 #endif
920
921 default:
922 assert(0);
923 return 0;
924 }
925 }
926
927 /* {{{ traverse_for_entities
928 * Auxiliary function to php_unescape_html_entities().
929 * - The argument "all" determines if all numeric entities are decode or only those
930 * that correspond to quotes (depending on quote_style).
931 */
932 /* maximum expansion (factor 1.2) for HTML 5 with ≫⃒ and ≪⃒ */
933 /* +2 is 1 because of rest (probably unnecessary), 1 because of terminating 0 */
934 #define TRAVERSE_FOR_ENTITIES_EXPAND_SIZE(oldlen) ((oldlen) + (oldlen) / 5 + 2)
traverse_for_entities(const char * old,size_t oldlen,zend_string * ret,int all,int flags,const entity_ht * inv_map,enum entity_charset charset)935 static void traverse_for_entities(
936 const char *old,
937 size_t oldlen,
938 zend_string *ret, /* should have allocated TRAVERSE_FOR_ENTITIES_EXPAND_SIZE(olden) */
939 int all,
940 int flags,
941 const entity_ht *inv_map,
942 enum entity_charset charset)
943 {
944 const char *p,
945 *lim;
946 char *q;
947 int doctype = flags & ENT_HTML_DOC_TYPE_MASK;
948
949 lim = old + oldlen; /* terminator address */
950 assert(*lim == '\0');
951
952 for (p = old, q = ZSTR_VAL(ret); p < lim;) {
953 unsigned code, code2 = 0;
954 const char *next = NULL; /* when set, next > p, otherwise possible inf loop */
955
956 /* Shift JIS, Big5 and HKSCS use multi-byte encodings where an
957 * ASCII range byte can be part of a multi-byte sequence.
958 * However, they start at 0x40, therefore if we find a 0x26 byte,
959 * we're sure it represents the '&' character. */
960
961 /* assumes there are no single-char entities */
962 if (p[0] != '&' || (p + 3 >= lim)) {
963 *(q++) = *(p++);
964 continue;
965 }
966
967 /* now p[3] is surely valid and is no terminator */
968
969 /* numerical entity */
970 if (p[1] == '#') {
971 next = &p[2];
972 if (process_numeric_entity(&next, &code) == FAILURE)
973 goto invalid_code;
974
975 /* If we're in htmlspecialchars_decode, we're only decoding entities
976 * that represent &, <, >, " and '. Is this one of them? */
977 if (!all && (code > 63U ||
978 stage3_table_be_apos_00000[code].data.ent.entity == NULL))
979 goto invalid_code;
980
981 /* are we allowed to decode this entity in this document type?
982 * HTML 5 is the only that has a character that cannot be used in
983 * a numeric entity but is allowed literally (U+000D). The
984 * unoptimized version would be ... || !numeric_entity_is_allowed(code) */
985 if (!unicode_cp_is_allowed(code, doctype) ||
986 (doctype == ENT_HTML_DOC_HTML5 && code == 0x0D))
987 goto invalid_code;
988 } else {
989 const char *start;
990 size_t ent_len;
991
992 next = &p[1];
993 start = next;
994
995 if (process_named_entity_html(&next, &start, &ent_len) == FAILURE)
996 goto invalid_code;
997
998 if (resolve_named_entity_html(start, ent_len, inv_map, &code, &code2) == FAILURE) {
999 if (doctype == ENT_HTML_DOC_XHTML && ent_len == 4 && start[0] == 'a'
1000 && start[1] == 'p' && start[2] == 'o' && start[3] == 's') {
1001 /* uses html4 inv_map, which doesn't include apos;. This is a
1002 * hack to support it */
1003 code = (unsigned) '\'';
1004 } else {
1005 goto invalid_code;
1006 }
1007 }
1008 }
1009
1010 assert(*next == ';');
1011
1012 if (((code == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1013 (code == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE)))
1014 /* && code2 == '\0' always true for current maps */)
1015 goto invalid_code;
1016
1017 /* UTF-8 doesn't need mapping (ISO-8859-1 doesn't either, but
1018 * the call is needed to ensure the codepoint <= U+00FF) */
1019 if (charset != cs_utf_8) {
1020 /* replace unicode code point */
1021 if (map_from_unicode(code, charset, &code) == FAILURE || code2 != 0)
1022 goto invalid_code; /* not representable in target charset */
1023 }
1024
1025 q += write_octet_sequence((unsigned char*)q, charset, code);
1026 if (code2) {
1027 q += write_octet_sequence((unsigned char*)q, charset, code2);
1028 }
1029
1030 /* jump over the valid entity; may go beyond size of buffer; np */
1031 p = next + 1;
1032 continue;
1033
1034 invalid_code:
1035 for (; p < next; p++) {
1036 *(q++) = *p;
1037 }
1038 }
1039
1040 *q = '\0';
1041 ZSTR_LEN(ret) = (size_t)(q - ZSTR_VAL(ret));
1042 }
1043 /* }}} */
1044
1045 /* {{{ unescape_inverse_map */
unescape_inverse_map(int all,int flags)1046 static const entity_ht *unescape_inverse_map(int all, int flags)
1047 {
1048 int document_type = flags & ENT_HTML_DOC_TYPE_MASK;
1049
1050 if (all) {
1051 switch (document_type) {
1052 case ENT_HTML_DOC_HTML401:
1053 case ENT_HTML_DOC_XHTML: /* but watch out for '...*/
1054 return &ent_ht_html4;
1055 case ENT_HTML_DOC_HTML5:
1056 return &ent_ht_html5;
1057 default:
1058 return &ent_ht_be_apos;
1059 }
1060 } else {
1061 switch (document_type) {
1062 case ENT_HTML_DOC_HTML401:
1063 return &ent_ht_be_noapos;
1064 default:
1065 return &ent_ht_be_apos;
1066 }
1067 }
1068 }
1069 /* }}} */
1070
1071 /* {{{ determine_entity_table
1072 * Entity table to use. Note that entity tables are defined in terms of
1073 * unicode code points */
determine_entity_table(int all,int doctype)1074 static entity_table_opt determine_entity_table(int all, int doctype)
1075 {
1076 entity_table_opt retval = {NULL};
1077
1078 assert(!(doctype == ENT_HTML_DOC_XML1 && all));
1079
1080 if (all) {
1081 retval.ms_table = (doctype == ENT_HTML_DOC_HTML5) ?
1082 entity_ms_table_html5 : entity_ms_table_html4;
1083 } else {
1084 retval.table = (doctype == ENT_HTML_DOC_HTML401) ?
1085 stage3_table_be_noapos_00000 : stage3_table_be_apos_00000;
1086 }
1087 return retval;
1088 }
1089 /* }}} */
1090
1091 /* {{{ php_unescape_html_entities
1092 * The parameter "all" should be true to decode all possible entities, false to decode
1093 * only the basic ones, i.e., those in basic_entities_ex + the numeric entities
1094 * that correspond to quotes.
1095 */
php_unescape_html_entities(zend_string * str,int all,int flags,char * hint_charset)1096 PHPAPI zend_string *php_unescape_html_entities(zend_string *str, int all, int flags, char *hint_charset)
1097 {
1098 zend_string *ret;
1099 enum entity_charset charset;
1100 const entity_ht *inverse_map;
1101 size_t new_size;
1102
1103 if (!memchr(ZSTR_VAL(str), '&', ZSTR_LEN(str))) {
1104 return zend_string_copy(str);
1105 }
1106
1107 if (all) {
1108 charset = determine_charset(hint_charset);
1109 } else {
1110 charset = cs_8859_1; /* charset shouldn't matter, use ISO-8859-1 for performance */
1111 }
1112
1113 /* don't use LIMIT_ALL! */
1114
1115 new_size = TRAVERSE_FOR_ENTITIES_EXPAND_SIZE(ZSTR_LEN(str));
1116 if (ZSTR_LEN(str) > new_size) {
1117 /* overflow, refuse to do anything */
1118 return zend_string_copy(str);
1119 }
1120
1121 ret = zend_string_alloc(new_size, 0);
1122
1123 inverse_map = unescape_inverse_map(all, flags);
1124
1125 /* replace numeric entities */
1126 traverse_for_entities(ZSTR_VAL(str), ZSTR_LEN(str), ret, all, flags, inverse_map, charset);
1127
1128 return ret;
1129 }
1130 /* }}} */
1131
php_escape_html_entities(unsigned char * old,size_t oldlen,int all,int flags,char * hint_charset)1132 PHPAPI zend_string *php_escape_html_entities(unsigned char *old, size_t oldlen, int all, int flags, char *hint_charset)
1133 {
1134 return php_escape_html_entities_ex(old, oldlen, all, flags, hint_charset, 1);
1135 }
1136
1137 /* {{{ find_entity_for_char */
find_entity_for_char(unsigned int k,enum entity_charset charset,const entity_stage1_row * table,const unsigned char ** entity,size_t * entity_len,unsigned char * old,size_t oldlen,size_t * cursor)1138 static inline void find_entity_for_char(
1139 unsigned int k,
1140 enum entity_charset charset,
1141 const entity_stage1_row *table,
1142 const unsigned char **entity,
1143 size_t *entity_len,
1144 unsigned char *old,
1145 size_t oldlen,
1146 size_t *cursor)
1147 {
1148 unsigned stage1_idx = ENT_STAGE1_INDEX(k);
1149 const entity_stage3_row *c;
1150
1151 if (stage1_idx > 0x1D) {
1152 *entity = NULL;
1153 *entity_len = 0;
1154 return;
1155 }
1156
1157 c = &table[stage1_idx][ENT_STAGE2_INDEX(k)][ENT_STAGE3_INDEX(k)];
1158
1159 if (!c->ambiguous) {
1160 *entity = (const unsigned char *)c->data.ent.entity;
1161 *entity_len = c->data.ent.entity_len;
1162 } else {
1163 /* peek at next char */
1164 size_t cursor_before = *cursor;
1165 int status = SUCCESS;
1166 unsigned next_char;
1167
1168 if (!(*cursor < oldlen))
1169 goto no_suitable_2nd;
1170
1171 next_char = get_next_char(charset, old, oldlen, cursor, &status);
1172
1173 if (status == FAILURE)
1174 goto no_suitable_2nd;
1175
1176 {
1177 const entity_multicodepoint_row *s, *e;
1178
1179 s = &c->data.multicodepoint_table[1];
1180 e = s - 1 + c->data.multicodepoint_table[0].leading_entry.size;
1181 /* we could do a binary search but it's not worth it since we have
1182 * at most two entries... */
1183 for ( ; s <= e; s++) {
1184 if (s->normal_entry.second_cp == next_char) {
1185 *entity = (const unsigned char *) s->normal_entry.entity;
1186 *entity_len = s->normal_entry.entity_len;
1187 return;
1188 }
1189 }
1190 }
1191 no_suitable_2nd:
1192 *cursor = cursor_before;
1193 *entity = (const unsigned char *)
1194 c->data.multicodepoint_table[0].leading_entry.default_entity;
1195 *entity_len = c->data.multicodepoint_table[0].leading_entry.default_entity_len;
1196 }
1197 }
1198 /* }}} */
1199
1200 /* {{{ find_entity_for_char_basic */
find_entity_for_char_basic(unsigned int k,const entity_stage3_row * table,const unsigned char ** entity,size_t * entity_len)1201 static inline void find_entity_for_char_basic(
1202 unsigned int k,
1203 const entity_stage3_row *table,
1204 const unsigned char **entity,
1205 size_t *entity_len)
1206 {
1207 if (k >= 64U) {
1208 *entity = NULL;
1209 *entity_len = 0;
1210 return;
1211 }
1212
1213 *entity = (const unsigned char *) table[k].data.ent.entity;
1214 *entity_len = table[k].data.ent.entity_len;
1215 }
1216 /* }}} */
1217
1218 /* {{{ php_escape_html_entities
1219 */
php_escape_html_entities_ex(unsigned char * old,size_t oldlen,int all,int flags,char * hint_charset,zend_bool double_encode)1220 PHPAPI zend_string *php_escape_html_entities_ex(unsigned char *old, size_t oldlen, int all, int flags, char *hint_charset, zend_bool double_encode)
1221 {
1222 size_t cursor, maxlen, len;
1223 zend_string *replaced;
1224 enum entity_charset charset = determine_charset(hint_charset);
1225 int doctype = flags & ENT_HTML_DOC_TYPE_MASK;
1226 entity_table_opt entity_table;
1227 const enc_to_uni *to_uni_table = NULL;
1228 const entity_ht *inv_map = NULL; /* used for !double_encode */
1229 /* only used if flags includes ENT_HTML_IGNORE_ERRORS or ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS */
1230 const unsigned char *replacement = NULL;
1231 size_t replacement_len = 0;
1232
1233 if (all) { /* replace with all named entities */
1234 if (CHARSET_PARTIAL_SUPPORT(charset)) {
1235 php_error_docref0(NULL, E_STRICT, "Only basic entities "
1236 "substitution is supported for multi-byte encodings other than UTF-8; "
1237 "functionality is equivalent to htmlspecialchars");
1238 }
1239 LIMIT_ALL(all, doctype, charset);
1240 }
1241 entity_table = determine_entity_table(all, doctype);
1242 if (all && !CHARSET_UNICODE_COMPAT(charset)) {
1243 to_uni_table = enc_to_uni_index[charset];
1244 }
1245
1246 if (!double_encode) {
1247 /* first arg is 1 because we want to identify valid named entities
1248 * even if we are only encoding the basic ones */
1249 inv_map = unescape_inverse_map(1, flags);
1250 }
1251
1252 if (flags & (ENT_HTML_SUBSTITUTE_ERRORS | ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS)) {
1253 if (charset == cs_utf_8) {
1254 replacement = (const unsigned char*)"\xEF\xBF\xBD";
1255 replacement_len = sizeof("\xEF\xBF\xBD") - 1;
1256 } else {
1257 replacement = (const unsigned char*)"�";
1258 replacement_len = sizeof("�") - 1;
1259 }
1260 }
1261
1262 /* initial estimate */
1263 if (oldlen < 64) {
1264 maxlen = 128;
1265 } else {
1266 maxlen = zend_safe_addmult(oldlen, 2, 0, "html_entities");
1267 }
1268
1269 replaced = zend_string_alloc(maxlen, 0);
1270 len = 0;
1271 cursor = 0;
1272 while (cursor < oldlen) {
1273 const unsigned char *mbsequence = NULL;
1274 size_t mbseqlen = 0,
1275 cursor_before = cursor;
1276 int status = SUCCESS;
1277 unsigned int this_char = get_next_char(charset, old, oldlen, &cursor, &status);
1278
1279 /* guarantee we have at least 40 bytes to write.
1280 * In HTML5, entities may take up to 33 bytes */
1281 if (len > maxlen - 40) { /* maxlen can never be smaller than 128 */
1282 replaced = zend_string_safe_realloc(replaced, maxlen, 1, 128, 0);
1283 maxlen += 128;
1284 }
1285
1286 if (status == FAILURE) {
1287 /* invalid MB sequence */
1288 if (flags & ENT_HTML_IGNORE_ERRORS) {
1289 continue;
1290 } else if (flags & ENT_HTML_SUBSTITUTE_ERRORS) {
1291 memcpy(&ZSTR_VAL(replaced)[len], replacement, replacement_len);
1292 len += replacement_len;
1293 continue;
1294 } else {
1295 zend_string_efree(replaced);
1296 return ZSTR_EMPTY_ALLOC();
1297 }
1298 } else { /* SUCCESS */
1299 mbsequence = &old[cursor_before];
1300 mbseqlen = cursor - cursor_before;
1301 }
1302
1303 if (this_char != '&') { /* no entity on this position */
1304 const unsigned char *rep = NULL;
1305 size_t rep_len = 0;
1306
1307 if (((this_char == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1308 (this_char == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1309 goto pass_char_through;
1310
1311 if (all) { /* false that CHARSET_PARTIAL_SUPPORT(charset) */
1312 if (to_uni_table != NULL) {
1313 /* !CHARSET_UNICODE_COMPAT therefore not UTF-8; since UTF-8
1314 * is the only multibyte encoding with !CHARSET_PARTIAL_SUPPORT,
1315 * we're using a single byte encoding */
1316 map_to_unicode(this_char, to_uni_table, &this_char);
1317 if (this_char == 0xFFFF) /* no mapping; pass through */
1318 goto pass_char_through;
1319 }
1320 /* the cursor may advance */
1321 find_entity_for_char(this_char, charset, entity_table.ms_table, &rep,
1322 &rep_len, old, oldlen, &cursor);
1323 } else {
1324 find_entity_for_char_basic(this_char, entity_table.table, &rep, &rep_len);
1325 }
1326
1327 if (rep != NULL) {
1328 ZSTR_VAL(replaced)[len++] = '&';
1329 memcpy(&ZSTR_VAL(replaced)[len], rep, rep_len);
1330 len += rep_len;
1331 ZSTR_VAL(replaced)[len++] = ';';
1332 } else {
1333 /* we did not find an entity for this char.
1334 * check for its validity, if its valid pass it unchanged */
1335 if (flags & ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS) {
1336 if (CHARSET_UNICODE_COMPAT(charset)) {
1337 if (!unicode_cp_is_allowed(this_char, doctype)) {
1338 mbsequence = replacement;
1339 mbseqlen = replacement_len;
1340 }
1341 } else if (to_uni_table) {
1342 if (!all) /* otherwise we already did this */
1343 map_to_unicode(this_char, to_uni_table, &this_char);
1344 if (!unicode_cp_is_allowed(this_char, doctype)) {
1345 mbsequence = replacement;
1346 mbseqlen = replacement_len;
1347 }
1348 } else {
1349 /* not a unicode code point, unless, coincidentally, it's in
1350 * the 0x20..0x7D range (except 0x5C in sjis). We know nothing
1351 * about other code points, because we have no tables. Since
1352 * Unicode code points in that range are not disallowed in any
1353 * document type, we could do nothing. However, conversion
1354 * tables frequently map 0x00-0x1F to the respective C0 code
1355 * points. Let's play it safe and admit that's the case */
1356 if (this_char <= 0x7D &&
1357 !unicode_cp_is_allowed(this_char, doctype)) {
1358 mbsequence = replacement;
1359 mbseqlen = replacement_len;
1360 }
1361 }
1362 }
1363 pass_char_through:
1364 if (mbseqlen > 1) {
1365 memcpy(ZSTR_VAL(replaced) + len, mbsequence, mbseqlen);
1366 len += mbseqlen;
1367 } else {
1368 ZSTR_VAL(replaced)[len++] = mbsequence[0];
1369 }
1370 }
1371 } else { /* this_char == '&' */
1372 if (double_encode) {
1373 encode_amp:
1374 memcpy(&ZSTR_VAL(replaced)[len], "&", sizeof("&") - 1);
1375 len += sizeof("&") - 1;
1376 } else { /* no double encode */
1377 /* check if entity is valid */
1378 size_t ent_len; /* not counting & or ; */
1379 /* peek at next char */
1380 if (old[cursor] == '#') { /* numeric entity */
1381 unsigned code_point;
1382 int valid;
1383 char *pos = (char*)&old[cursor+1];
1384 valid = process_numeric_entity((const char **)&pos, &code_point);
1385 if (valid == FAILURE)
1386 goto encode_amp;
1387 if (flags & ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS) {
1388 if (!numeric_entity_is_allowed(code_point, doctype))
1389 goto encode_amp;
1390 }
1391 ent_len = pos - (char*)&old[cursor];
1392 } else { /* named entity */
1393 /* check for vality of named entity */
1394 const char *start = (const char *) &old[cursor],
1395 *next = start;
1396 unsigned dummy1, dummy2;
1397
1398 if (process_named_entity_html(&next, &start, &ent_len) == FAILURE)
1399 goto encode_amp;
1400 if (resolve_named_entity_html(start, ent_len, inv_map, &dummy1, &dummy2) == FAILURE) {
1401 if (!(doctype == ENT_HTML_DOC_XHTML && ent_len == 4 && start[0] == 'a'
1402 && start[1] == 'p' && start[2] == 'o' && start[3] == 's')) {
1403 /* uses html4 inv_map, which doesn't include apos;. This is a
1404 * hack to support it */
1405 goto encode_amp;
1406 }
1407 }
1408 }
1409 /* checks passed; copy entity to result */
1410 /* entity size is unbounded, we may need more memory */
1411 /* at this point maxlen - len >= 40 */
1412 if (maxlen - len < ent_len + 2 /* & and ; */) {
1413 /* ent_len < oldlen, which is certainly <= SIZE_MAX/2 */
1414 replaced = zend_string_safe_realloc(replaced, maxlen, 1, ent_len + 128, 0);
1415 maxlen += ent_len + 128;
1416 }
1417 ZSTR_VAL(replaced)[len++] = '&';
1418 memcpy(&ZSTR_VAL(replaced)[len], &old[cursor], ent_len);
1419 len += ent_len;
1420 ZSTR_VAL(replaced)[len++] = ';';
1421 cursor += ent_len + 1;
1422 }
1423 }
1424 }
1425 ZSTR_VAL(replaced)[len] = '\0';
1426 ZSTR_LEN(replaced) = len;
1427
1428 return replaced;
1429 }
1430 /* }}} */
1431
1432 /* {{{ php_html_entities
1433 */
php_html_entities(INTERNAL_FUNCTION_PARAMETERS,int all)1434 static void php_html_entities(INTERNAL_FUNCTION_PARAMETERS, int all)
1435 {
1436 zend_string *str, *hint_charset = NULL;
1437 char *default_charset;
1438 zend_long flags = ENT_COMPAT;
1439 zend_string *replaced;
1440 zend_bool double_encode = 1;
1441
1442 ZEND_PARSE_PARAMETERS_START(1, 4)
1443 Z_PARAM_STR(str)
1444 Z_PARAM_OPTIONAL
1445 Z_PARAM_LONG(flags)
1446 Z_PARAM_STR_EX(hint_charset, 1, 0)
1447 Z_PARAM_BOOL(double_encode);
1448 ZEND_PARSE_PARAMETERS_END();
1449
1450 if (!hint_charset) {
1451 default_charset = get_default_charset();
1452 }
1453 replaced = php_escape_html_entities_ex((unsigned char*)ZSTR_VAL(str), ZSTR_LEN(str), all, (int) flags, (hint_charset ? ZSTR_VAL(hint_charset) : default_charset), double_encode);
1454 RETVAL_STR(replaced);
1455 }
1456 /* }}} */
1457
1458 #define HTML_SPECIALCHARS 0
1459 #define HTML_ENTITIES 1
1460
1461 /* {{{ register_html_constants
1462 */
register_html_constants(INIT_FUNC_ARGS)1463 void register_html_constants(INIT_FUNC_ARGS)
1464 {
1465 REGISTER_LONG_CONSTANT("HTML_SPECIALCHARS", HTML_SPECIALCHARS, CONST_PERSISTENT|CONST_CS);
1466 REGISTER_LONG_CONSTANT("HTML_ENTITIES", HTML_ENTITIES, CONST_PERSISTENT|CONST_CS);
1467 REGISTER_LONG_CONSTANT("ENT_COMPAT", ENT_COMPAT, CONST_PERSISTENT|CONST_CS);
1468 REGISTER_LONG_CONSTANT("ENT_QUOTES", ENT_QUOTES, CONST_PERSISTENT|CONST_CS);
1469 REGISTER_LONG_CONSTANT("ENT_NOQUOTES", ENT_NOQUOTES, CONST_PERSISTENT|CONST_CS);
1470 REGISTER_LONG_CONSTANT("ENT_IGNORE", ENT_IGNORE, CONST_PERSISTENT|CONST_CS);
1471 REGISTER_LONG_CONSTANT("ENT_SUBSTITUTE", ENT_SUBSTITUTE, CONST_PERSISTENT|CONST_CS);
1472 REGISTER_LONG_CONSTANT("ENT_DISALLOWED", ENT_DISALLOWED, CONST_PERSISTENT|CONST_CS);
1473 REGISTER_LONG_CONSTANT("ENT_HTML401", ENT_HTML401, CONST_PERSISTENT|CONST_CS);
1474 REGISTER_LONG_CONSTANT("ENT_XML1", ENT_XML1, CONST_PERSISTENT|CONST_CS);
1475 REGISTER_LONG_CONSTANT("ENT_XHTML", ENT_XHTML, CONST_PERSISTENT|CONST_CS);
1476 REGISTER_LONG_CONSTANT("ENT_HTML5", ENT_HTML5, CONST_PERSISTENT|CONST_CS);
1477 }
1478 /* }}} */
1479
1480 /* {{{ proto string htmlspecialchars(string string [, int quote_style[, string encoding[, bool double_encode]]])
1481 Convert special characters to HTML entities */
PHP_FUNCTION(htmlspecialchars)1482 PHP_FUNCTION(htmlspecialchars)
1483 {
1484 php_html_entities(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0);
1485 }
1486 /* }}} */
1487
1488 /* {{{ proto string htmlspecialchars_decode(string string [, int quote_style])
1489 Convert special HTML entities back to characters */
PHP_FUNCTION(htmlspecialchars_decode)1490 PHP_FUNCTION(htmlspecialchars_decode)
1491 {
1492 zend_string *str;
1493 zend_long quote_style = ENT_COMPAT;
1494 zend_string *replaced;
1495
1496 ZEND_PARSE_PARAMETERS_START(1, 2)
1497 Z_PARAM_STR(str)
1498 Z_PARAM_OPTIONAL
1499 Z_PARAM_LONG(quote_style)
1500 ZEND_PARSE_PARAMETERS_END();
1501
1502 replaced = php_unescape_html_entities(str, 0 /*!all*/, (int)quote_style, NULL);
1503 if (replaced) {
1504 RETURN_STR(replaced);
1505 }
1506 RETURN_FALSE;
1507 }
1508 /* }}} */
1509
1510 /* {{{ proto string html_entity_decode(string string [, int quote_style][, string encoding])
1511 Convert all HTML entities to their applicable characters */
PHP_FUNCTION(html_entity_decode)1512 PHP_FUNCTION(html_entity_decode)
1513 {
1514 zend_string *str, *hint_charset = NULL;
1515 char *default_charset;
1516 zend_long quote_style = ENT_COMPAT;
1517 zend_string *replaced;
1518
1519 ZEND_PARSE_PARAMETERS_START(1, 3)
1520 Z_PARAM_STR(str)
1521 Z_PARAM_OPTIONAL
1522 Z_PARAM_LONG(quote_style)
1523 Z_PARAM_STR(hint_charset)
1524 ZEND_PARSE_PARAMETERS_END();
1525
1526 if (!hint_charset) {
1527 default_charset = get_default_charset();
1528 }
1529 replaced = php_unescape_html_entities(str, 1 /*all*/, (int)quote_style, (hint_charset ? ZSTR_VAL(hint_charset) : default_charset));
1530
1531 if (replaced) {
1532 RETURN_STR(replaced);
1533 }
1534 RETURN_FALSE;
1535 }
1536 /* }}} */
1537
1538
1539 /* {{{ proto string htmlentities(string string [, int quote_style[, string encoding[, bool double_encode]]])
1540 Convert all applicable characters to HTML entities */
PHP_FUNCTION(htmlentities)1541 PHP_FUNCTION(htmlentities)
1542 {
1543 php_html_entities(INTERNAL_FUNCTION_PARAM_PASSTHRU, 1);
1544 }
1545 /* }}} */
1546
1547 /* {{{ write_s3row_data */
write_s3row_data(const entity_stage3_row * r,unsigned orig_cp,enum entity_charset charset,zval * arr)1548 static inline void write_s3row_data(
1549 const entity_stage3_row *r,
1550 unsigned orig_cp,
1551 enum entity_charset charset,
1552 zval *arr)
1553 {
1554 char key[9] = ""; /* two unicode code points in UTF-8 */
1555 char entity[LONGEST_ENTITY_LENGTH + 2] = {'&'};
1556 size_t written_k1;
1557
1558 written_k1 = write_octet_sequence((unsigned char*)key, charset, orig_cp);
1559
1560 if (!r->ambiguous) {
1561 size_t l = r->data.ent.entity_len;
1562 memcpy(&entity[1], r->data.ent.entity, l);
1563 entity[l + 1] = ';';
1564 add_assoc_stringl_ex(arr, key, written_k1, entity, l + 2);
1565 } else {
1566 unsigned i,
1567 num_entries;
1568 const entity_multicodepoint_row *mcpr = r->data.multicodepoint_table;
1569
1570 if (mcpr[0].leading_entry.default_entity != NULL) {
1571 size_t l = mcpr[0].leading_entry.default_entity_len;
1572 memcpy(&entity[1], mcpr[0].leading_entry.default_entity, l);
1573 entity[l + 1] = ';';
1574 add_assoc_stringl_ex(arr, key, written_k1, entity, l + 2);
1575 }
1576 num_entries = mcpr[0].leading_entry.size;
1577 for (i = 1; i <= num_entries; i++) {
1578 size_t l,
1579 written_k2;
1580 unsigned uni_cp,
1581 spe_cp;
1582
1583 uni_cp = mcpr[i].normal_entry.second_cp;
1584 l = mcpr[i].normal_entry.entity_len;
1585
1586 if (!CHARSET_UNICODE_COMPAT(charset)) {
1587 if (map_from_unicode(uni_cp, charset, &spe_cp) == FAILURE)
1588 continue; /* non representable in this charset */
1589 } else {
1590 spe_cp = uni_cp;
1591 }
1592
1593 written_k2 = write_octet_sequence((unsigned char*)&key[written_k1], charset, spe_cp);
1594 memcpy(&entity[1], mcpr[i].normal_entry.entity, l);
1595 entity[l + 1] = ';';
1596 add_assoc_stringl_ex(arr, key, written_k1 + written_k2, entity, l + 2);
1597 }
1598 }
1599 }
1600 /* }}} */
1601
1602 /* {{{ proto array get_html_translation_table([int table [, int flags [, string encoding]]])
1603 Returns the internal translation table used by htmlspecialchars and htmlentities */
PHP_FUNCTION(get_html_translation_table)1604 PHP_FUNCTION(get_html_translation_table)
1605 {
1606 zend_long all = HTML_SPECIALCHARS,
1607 flags = ENT_COMPAT;
1608 int doctype;
1609 entity_table_opt entity_table;
1610 const enc_to_uni *to_uni_table = NULL;
1611 char *charset_hint = NULL;
1612 size_t charset_hint_len;
1613 enum entity_charset charset;
1614
1615 /* in this function we have to jump through some loops because we're
1616 * getting the translated table from data structures that are optimized for
1617 * random access, not traversal */
1618
1619 ZEND_PARSE_PARAMETERS_START(0, 3)
1620 Z_PARAM_OPTIONAL
1621 Z_PARAM_LONG(all)
1622 Z_PARAM_LONG(flags)
1623 Z_PARAM_STRING(charset_hint, charset_hint_len)
1624 ZEND_PARSE_PARAMETERS_END();
1625
1626 charset = determine_charset(charset_hint);
1627 doctype = flags & ENT_HTML_DOC_TYPE_MASK;
1628 LIMIT_ALL(all, doctype, charset);
1629
1630 array_init(return_value);
1631
1632 entity_table = determine_entity_table((int)all, doctype);
1633 if (all && !CHARSET_UNICODE_COMPAT(charset)) {
1634 to_uni_table = enc_to_uni_index[charset];
1635 }
1636
1637 if (all) { /* HTML_ENTITIES (actually, any non-zero value for 1st param) */
1638 const entity_stage1_row *ms_table = entity_table.ms_table;
1639
1640 if (CHARSET_UNICODE_COMPAT(charset)) {
1641 unsigned i, j, k,
1642 max_i, max_j, max_k;
1643 /* no mapping to unicode required */
1644 if (CHARSET_SINGLE_BYTE(charset)) { /* ISO-8859-1 */
1645 max_i = 1; max_j = 4; max_k = 64;
1646 } else {
1647 max_i = 0x1E; max_j = 64; max_k = 64;
1648 }
1649
1650 for (i = 0; i < max_i; i++) {
1651 if (ms_table[i] == empty_stage2_table)
1652 continue;
1653 for (j = 0; j < max_j; j++) {
1654 if (ms_table[i][j] == empty_stage3_table)
1655 continue;
1656 for (k = 0; k < max_k; k++) {
1657 const entity_stage3_row *r = &ms_table[i][j][k];
1658 unsigned code;
1659
1660 if (r->data.ent.entity == NULL)
1661 continue;
1662
1663 code = ENT_CODE_POINT_FROM_STAGES(i, j, k);
1664 if (((code == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1665 (code == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1666 continue;
1667 write_s3row_data(r, code, charset, return_value);
1668 }
1669 }
1670 }
1671 } else {
1672 /* we have to iterate through the set of code points for this
1673 * encoding and map them to unicode code points */
1674 unsigned i;
1675 for (i = 0; i <= 0xFF; i++) {
1676 const entity_stage3_row *r;
1677 unsigned uni_cp;
1678
1679 /* can be done before mapping, they're invariant */
1680 if (((i == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1681 (i == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1682 continue;
1683
1684 map_to_unicode(i, to_uni_table, &uni_cp);
1685 r = &ms_table[ENT_STAGE1_INDEX(uni_cp)][ENT_STAGE2_INDEX(uni_cp)][ENT_STAGE3_INDEX(uni_cp)];
1686 if (r->data.ent.entity == NULL)
1687 continue;
1688
1689 write_s3row_data(r, i, charset, return_value);
1690 }
1691 }
1692 } else {
1693 /* we could use sizeof(stage3_table_be_apos_00000) as well */
1694 unsigned j,
1695 numelems = sizeof(stage3_table_be_noapos_00000) /
1696 sizeof(*stage3_table_be_noapos_00000);
1697
1698 for (j = 0; j < numelems; j++) {
1699 const entity_stage3_row *r = &entity_table.table[j];
1700 if (r->data.ent.entity == NULL)
1701 continue;
1702
1703 if (((j == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1704 (j == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1705 continue;
1706
1707 /* charset is indifferent, used cs_8859_1 for efficiency */
1708 write_s3row_data(r, j, cs_8859_1, return_value);
1709 }
1710 }
1711 }
1712 /* }}} */
1713
1714 /*
1715 * Local variables:
1716 * tab-width: 4
1717 * c-basic-offset: 4
1718 * End:
1719 * vim600: sw=4 ts=4 fdm=marker
1720 * vim<600: sw=4 ts=4
1721 */
1722
