/**
* Internal method to strip a tag of certain attributes
*
* @access protected
* @param array $attrSet Array of attribute pairs to filter
* @return array Filtered array of attribute pairs
*/
function _cleanAttributes($attrSet)
{
// Initialize variables
$newSet = array();
// Iterate through attribute pairs
for ($i = 0; $i < count($attrSet); $i++) {
// Skip blank spaces
if (!$attrSet[$i]) {
continue;
}
// Split into name/value pairs
$attrSubSet = explode('=', trim($attrSet[$i]), 2);
list($attrSubSet[0]) = explode(' ', $attrSubSet[0]);
/*
* Remove all "non-regular" attribute names
* AND blacklisted attributes
*/
if (!preg_match('/[a-z]*$/i', $attrSubSet[0]) || $this->xssAuto && (in_array(strtolower($attrSubSet[0]), $this->attrBlacklist) || substr($attrSubSet[0], 0, 2) == 'on')) {
continue;
}
// XSS attribute value filtering
if ($attrSubSet[1]) {
// strips unicode, hex, etc
$attrSubSet[1] = str_replace('&#', '', $attrSubSet[1]);
// strip normal newline within attr value
$attrSubSet[1] = preg_replace('/[\\n\\r]/', '', $attrSubSet[1]);
// strip double quotes
$attrSubSet[1] = str_replace('"', '', $attrSubSet[1]);
// convert single quotes from either side to doubles (Single quotes shouldn't be used to pad attr value)
if (substr($attrSubSet[1], 0, 1) == "'" && substr($attrSubSet[1], strlen($attrSubSet[1]) - 1, 1) == "'") {
$attrSubSet[1] = substr($attrSubSet[1], 1, strlen($attrSubSet[1]) - 2);
}
// strip slashes
$attrSubSet[1] = stripslashes($attrSubSet[1]);
}
// Autostrip script tags
if (Xmf_Filter_Input::checkAttribute($attrSubSet)) {
continue;
}
// Is our attribute in the user input array?
$attrFound = in_array(strtolower($attrSubSet[0]), $this->attrArray);
// If the tag is allowed lets keep it
if (!$attrFound && $this->attrMethod || $attrFound && !$this->attrMethod) {
// Does the attribute have a value?
if ($attrSubSet[1]) {
$newSet[] = $attrSubSet[0] . '="' . $attrSubSet[1] . '"';
} elseif ($attrSubSet[1] == "0") {
/*
* Special Case
* Is the value 0?
*/
$newSet[] = $attrSubSet[0] . '="0"';
} else {
$newSet[] = $attrSubSet[0] . '="' . $attrSubSet[0] . '"';
}
}
}
return $newSet;
}
