Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Add possibility to declare and apply presets to behavior #93

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/Behavior.php
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

use LogicException;
use TYPO3\HtmlSanitizer\Behavior\Tag;
use TYPO3\HtmlSanitizer\Builder\Preset\PresetInterface;

/**
* Declares behavior used by node visitors
Expand Down Expand Up @@ -65,6 +66,11 @@ class Behavior
*/
protected $tags = [];

public function withPreset(PresetInterface $preset, int $flags = 0): self
{
return $preset->applyTo($this, $flags);
}

public function withFlags(int $flags): self
{
if ($flags === $this->flags) {
Expand Down
53 changes: 53 additions & 0 deletions src/Builder/Preset/IframePreset.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
<?php

declare(strict_types=1);

/*
* This file is part of the TYPO3 project.
*
* It is free software; you can redistribute it and/or modify it under the terms
* of the MIT License (MIT). For the full copyright and license information,
* please read the LICENSE file that was distributed with this source code.
*
* The TYPO3 project - inspiring people to share!
*/

namespace TYPO3\HtmlSanitizer\Builder\Preset;

use TYPO3\HtmlSanitizer\Behavior;

/**
* Preset for `<iframe>` element.
*/
class IframePreset implements PresetInterface
{
public function applyTo(Behavior $behavior, int $flags = 0): Behavior
{
return $behavior->withTags(
(new Behavior\Tag('iframe'))->addAttrs(
(new Behavior\Attr('id')),
// https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-allow
(new Behavior\Attr('allow'))->withValues(
new Behavior\MultiTokenAttrValue(' ', 'fullscreen')
),
// https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox
(new Behavior\Attr('sandbox', Behavior\Attr::MANDATORY))->withValues(
new Behavior\EmptyAttrValue(),
new Behavior\MultiTokenAttrValue(
' ',
'allow-downloads',
'allow-modals',
'allow-orientation-lock',
'allow-pointer-lock',
'allow-popups',
'allow-scripts'
)
),
(new Behavior\Attr('src'))->withValues(
...(new Behavior\Attr\UriAttrValueBuilder())
->allowSchemes('http', 'https')->getValues()
)
)
);
}
}
30 changes: 30 additions & 0 deletions src/Builder/Preset/PresetInterface.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
<?php

declare(strict_types=1);

/*
* This file is part of the TYPO3 project.
*
* It is free software; you can redistribute it and/or modify it under the terms
* of the MIT License (MIT). For the full copyright and license information,
* please read the LICENSE file that was distributed with this source code.
*
* The TYPO3 project - inspiring people to share!
*/

namespace TYPO3\HtmlSanitizer\Builder\Preset;

use TYPO3\HtmlSanitizer\Behavior;

/**
* Interface for applying a preset declaration to an existing behavior.
*/
interface PresetInterface
{
/**
* @param Behavior $behavior to be modified
* @param int $flags (currently not used, future topics such as `override`)
* @return Behavior having the preset applied
*/
public function applyTo(Behavior $behavior, int $flags): Behavior;
}
29 changes: 2 additions & 27 deletions tests/ScenarioTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

use PHPUnit\Framework\TestCase;
use TYPO3\HtmlSanitizer\Behavior;
use TYPO3\HtmlSanitizer\Behavior\Attr\UriAttrValueBuilder;
use TYPO3\HtmlSanitizer\Builder\Preset\IframePreset;
use TYPO3\HtmlSanitizer\Sanitizer;
use TYPO3\HtmlSanitizer\Visitor\CommonVisitor;

Expand Down Expand Up @@ -185,32 +185,7 @@ public function iframeSandboxIsAllowed(): void
$behavior = (new Behavior())
->withFlags(Behavior::ENCODE_INVALID_TAG | Behavior::REMOVE_UNEXPECTED_CHILDREN)
->withName('scenario-test')
->withTags(
(new Behavior\Tag('iframe'))->addAttrs(
(new Behavior\Attr('id')),
// https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-allow
(new Behavior\Attr('allow'))->withValues(
new Behavior\MultiTokenAttrValue(' ', 'fullscreen')
),
// https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox
(new Behavior\Attr('sandbox', Behavior\Attr::MANDATORY))->withValues(
new Behavior\EmptyAttrValue(),
new Behavior\MultiTokenAttrValue(
' ',
'allow-downloads',
'allow-modals',
'allow-orientation-lock',
'allow-pointer-lock',
'allow-popups',
'allow-scripts'
)
),
(new Behavior\Attr('src'))->withValues(
...(new UriAttrValueBuilder())->allowSchemes('http', 'https')->getValues()
)
)
);

->withPreset(new IframePreset());
$sanitizer = new Sanitizer(
new CommonVisitor($behavior)
);
Expand Down