/**
  * @param HTMLPurifier_URI $uri
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool
  */
 public function filter(&$uri, $config, $context)
 {
     // check if filter not applicable
     if (!$config->get('HTML.SafeIframe')) {
         return true;
     }
     // check if the filter should actually trigger
     if (!$context->get('EmbeddedURI', true)) {
         return true;
     }
     $token = $context->get('CurrentToken', true);
     if (!($token && $token->name == 'iframe')) {
         return true;
     }
     // check if we actually have some whitelists enabled
     if ($this->regexp === null) {
         return false;
     }
     // actually check the whitelists
     if (!preg_match($this->regexp, $uri->toString())) {
         return false;
     }
     // Make sure that if we're an HTTPS site, the iframe is also HTTPS
     if (is_https() && $uri->scheme == 'http') {
         // Convert it to a protocol-relative URL
         $uri->scheme = null;
     }
     return $uri;
 }

 /**
  * @param HTMLPurifier_URI $uri
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool
  */
 public function filter(&$uri, $config, $context)
 {
     if (!$context->get('EmbeddedURI', true)) {
         return true;
     }
     return parent::filter($uri, $config, $context);
 }

 /**
  * @param HTMLPurifier_Context $context
  */
 public function __construct($context)
 {
     $this->locale =& $context->get('Locale');
     $this->context = $context;
     $this->_current =& $this->_stacks[0];
     $this->errors =& $this->_stacks[0];
 }

 public function testNull()
 {
     $context = new HTMLPurifier_Context();
     $var = NULL;
     $context->register('var', $var);
     $this->assertNull($context->get('var'));
     $context->destroy('var');
 }

 /**
  * @param HTMLPurifier_Node[] $children
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool
  */
 public function validateChildren($children, $config, $context)
 {
     if ($context->get('IsInline') === false) {
         return $this->block->validateChildren($children, $config, $context);
     } else {
         return $this->inline->validateChildren($children, $config, $context);
     }
 }

 /**
  * Checks if CurrentToken is set and equal to $this->element
  * @param string $string
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool|string
  */
 public function validate($string, $config, $context)
 {
     $token = $context->get('CurrentToken', true);
     if ($token && $token->name == $this->element) {
         return false;
     }
     return $this->def->validate($string, $config, $context);
 }

 /**
  * Filters an HTML snippet/document to be XSS-free and standards-compliant.
  *
  * @param $html String of HTML to purify
  * @param $config HTMLPurifier_Config object for this operation, if omitted,
  *                defaults to the config object specified during this
  *                object's construction. The parameter can also be any type
  *                that HTMLPurifier_Config::create() supports.
  * @return Purified HTML
  */
 public function purify($html, $config = null)
 {
     // :TODO: make the config merge in, instead of replace
     $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
     // implementation is partially environment dependant, partially
     // configuration dependant
     $lexer = HTMLPurifier_Lexer::create($config);
     $context = new HTMLPurifier_Context();
     // setup HTML generator
     $this->generator = new HTMLPurifier_Generator($config, $context);
     $context->register('Generator', $this->generator);
     // set up global context variables
     if ($config->get('Core.CollectErrors')) {
         // may get moved out if other facilities use it
         $language_factory = HTMLPurifier_LanguageFactory::instance();
         $language = $language_factory->create($config, $context);
         $context->register('Locale', $language);
         $error_collector = new HTMLPurifier_ErrorCollector($context);
         $context->register('ErrorCollector', $error_collector);
     }
     // setup id_accumulator context, necessary due to the fact that
     // AttrValidator can be called from many places
     $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
     $context->register('IDAccumulator', $id_accumulator);
     $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
     // setup filters
     $filter_flags = $config->getBatch('Filter');
     $custom_filters = $filter_flags['Custom'];
     unset($filter_flags['Custom']);
     $filters = array();
     foreach ($filter_flags as $filter => $flag) {
         if (!$flag) {
             continue;
         }
         if (strpos($filter, '.') !== false) {
             continue;
         }
         $class = "HTMLPurifier_Filter_{$filter}";
         $filters[] = new $class();
     }
     foreach ($custom_filters as $filter) {
         // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat
         $filters[] = $filter;
     }
     $filters = array_merge($filters, $this->filters);
     // maybe prepare(), but later
     for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
         $html = $filters[$i]->preFilter($html, $config, $context);
     }
     // purified HTML
     $html = $this->generator->generateFromTokens($this->strategy->execute($lexer->tokenizeHTML($html, $config, $context), $config, $context));
     for ($i = $filter_size - 1; $i >= 0; $i--) {
         $html = $filters[$i]->postFilter($html, $config, $context);
     }
     $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
     $this->context =& $context;
     return $html;
 }

 /**
  * @param string $id
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool|string
  */
 public function validate($id, $config, $context)
 {
     if (!$this->selector && !$config->get('Attr.EnableID')) {
         return false;
     }
     $id = trim($id);
     // trim it first
     if ($id === '') {
         return false;
     }
     $prefix = $config->get('Attr.IDPrefix');
     if ($prefix !== '') {
         $prefix .= $config->get('Attr.IDPrefixLocal');
         // prevent re-appending the prefix
         if (strpos($id, $prefix) !== 0) {
             $id = $prefix . $id;
         }
     } elseif ($config->get('Attr.IDPrefixLocal') !== '') {
         trigger_error('%Attr.IDPrefixLocal cannot be used unless ' . '%Attr.IDPrefix is set', E_USER_WARNING);
     }
     if (!$this->selector) {
         $id_accumulator =& $context->get('IDAccumulator');
         if (isset($id_accumulator->ids[$id])) {
             return false;
         }
     }
     // we purposely avoid using regex, hopefully this is faster
     if ($config->get('Attr.ID.HTML5') === true) {
         if (preg_match('/[\\t\\n\\x0b\\x0c ]/', $id)) {
             return false;
         }
     } else {
         if (ctype_alpha($id)) {
             // OK
         } else {
             if (!ctype_alpha(@$id[0])) {
                 return false;
             }
             // primitive style of regexps, I suppose
             $trim = trim($id, 'A..Za..z0..9:-._');
             if ($trim !== '') {
                 return false;
             }
         }
     }
     $regexp = $config->get('Attr.IDBlacklistRegexp');
     if ($regexp && preg_match($regexp, $id)) {
         return false;
     }
     if (!$this->selector) {
         $id_accumulator->add($id);
     }
     // if no change was made to the ID, return the result
     // else, return the new id if stripping whitespace made it
     //     valid, or return false.
     return $id;
 }

 /**
  * @param string $string
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool|string
  */
 public function validate($string, $config, $context)
 {
     $token = $context->get('CurrentToken', true);
     if (!$token || $token->name !== $this->tag) {
         return $this->withoutTag->validate($string, $config, $context);
     } else {
         return $this->withTag->validate($string, $config, $context);
     }
 }

 /**
  * filter
  * 
  * @param HTMLPurifier_URI $uri
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return boolean
  */
 public function filter(&$uri, $config, $context)
 {
     $result = TRUE;
     $token = $context->get('CurrentToken', true);
     if (Tinebase_Core::isLogLevel(Zend_Log::TRACE)) {
         Tinebase_Core::getLogger()->trace(__METHOD__ . '::' . __LINE__ . ' URI: ' . var_export($uri, TRUE) . ' ' . ' TOKEN: ' . var_export($token, TRUE));
     }
     if ($uri->host) {
         $result = $this->_checkExternalUrl($uri, $token);
     }
     return $result;
 }

 /**
  * @param string $uri
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool|string
  */
 public function validate($uri, $config, $context)
 {
     if ($config->get('URI.Disable')) {
         return false;
     }
     $uri = $this->parseCDATA($uri);
     // parse the URI
     $uri = $this->parser->parse($uri);
     if ($uri === false) {
         return false;
     }
     // add embedded flag to context for validators
     $context->register('EmbeddedURI', $this->embedsResource);
     $ok = false;
     do {
         // generic validation
         $result = $uri->validate($config, $context);
         if (!$result) {
             break;
         }
         // chained filtering
         $uri_def = $config->getDefinition('URI');
         $result = $uri_def->filter($uri, $config, $context);
         if (!$result) {
             break;
         }
         // scheme-specific validation
         $scheme_obj = $uri->getSchemeObj($config, $context);
         if (!$scheme_obj) {
             break;
         }
         if ($this->embedsResource && !$scheme_obj->browsable) {
             break;
         }
         $result = $scheme_obj->validate($uri, $config, $context);
         if (!$result) {
             break;
         }
         // Post chained filtering
         $result = $uri_def->postFilter($uri, $config, $context);
         if (!$result) {
             break;
         }
         // survived gauntlet
         $ok = true;
     } while (false);
     $context->destroy('EmbeddedURI');
     if (!$ok) {
         return false;
     }
     // back to string
     return $uri->toString();
 }

 public function test_formatMessage_tokenParameter()
 {
     $config = HTMLPurifier_Config::createDefault();
     $context = new HTMLPurifier_Context();
     $generator = new HTMLPurifier_Generator($config, $context);
     // replace with mock if this gets icky
     $context->register('Generator', $generator);
     $lang = new HTMLPurifier_Language($config, $context);
     $lang->_loaded = true;
     $lang->messages['LanguageTest: Element info'] = 'Element Token: $1.Name, $1.Serialized, $1.Compact, $1.Line';
     $lang->messages['LanguageTest: Data info'] = 'Data Token: $1.Data, $1.Serialized, $1.Compact, $1.Line';
     $this->assertIdentical($lang->formatMessage('LanguageTest: Element info', array(1 => new HTMLPurifier_Token_Start('a', array('href' => 'http://example.com'), 18))), 'Element Token: a, <a href="http://example.com">, <a>, 18');
     $this->assertIdentical($lang->formatMessage('LanguageTest: Data info', array(1 => new HTMLPurifier_Token_Text('data>', 23))), 'Data Token: data>, data&gt;, data&gt;, 23');
 }

 /**
  * Asserts that a transformation happens
  *
  * This assertion performs several tests on the transform:
  *
  * -# Transforms a start tag with only $name and no attributes
  * -# Transforms a start tag with $name and $attributes
  * -# Transform an end tag
  * -# Transform an empty tag with only $name and no attributes
  * -# Transform an empty tag with $name and $attributes
  *
  * In its current form, it assumes that start and empty tags would be
  * treated the same, and is really ensuring that the tag transform doesn't
  * do anything wonky to the tag type.
  *
  * @param $transformer      HTMLPurifier_TagTransform class to test
  * @param $name             Name of the original tag
  * @param $attributes       Attributes of the original tag
  * @param $expect_name      Name of output tag
  * @param $expect_attributes Attributes of output tag when $attributes
  *                          is included.
  * @param $expect_added_attributes Attributes of output tag when $attributes
  *                          are omitted.
  * @param $config_array     Configuration array for HTMLPurifier_Config
  * @param $context_array    Context array for HTMLPurifier_Context
  */
 protected function assertTransformation($transformer, $name, $attributes, $expect_name, $expect_attributes, $expect_added_attributes = array(), $config_array = array(), $context_array = array())
 {
     $config = HTMLPurifier_Config::createDefault();
     $config->loadArray($config_array);
     $context = new HTMLPurifier_Context();
     $context->loadArray($context_array);
     // start tag transform
     $this->assertIdentical(new HTMLPurifier_Token_Start($expect_name, $expect_added_attributes), $transformer->transform(new HTMLPurifier_Token_Start($name), $config, $context));
     // start tag transform with attributes
     $this->assertIdentical(new HTMLPurifier_Token_Start($expect_name, $expect_attributes), $transformer->transform(new HTMLPurifier_Token_Start($name, $attributes), $config, $context));
     // end tag transform
     $this->assertIdentical(new HTMLPurifier_Token_End($expect_name), $transformer->transform(new HTMLPurifier_Token_End($name), $config, $context));
     // empty tag transform
     $this->assertIdentical(new HTMLPurifier_Token_Empty($expect_name, $expect_added_attributes), $transformer->transform(new HTMLPurifier_Token_Empty($name), $config, $context));
     // empty tag transform with attributes
     $this->assertIdentical(new HTMLPurifier_Token_Empty($expect_name, $expect_attributes), $transformer->transform(new HTMLPurifier_Token_Empty($name, $attributes), $config, $context));
 }

 public function purify($html, $config = null)
 {
     $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
     $lexer = HTMLPurifier_Lexer::create($config);
     $context = new HTMLPurifier_Context();
     $this->generator = new HTMLPurifier_Generator($config, $context);
     $context->register('Generator', $this->generator);
     if ($config->get('Core.CollectErrors')) {
         $language_factory = HTMLPurifier_LanguageFactory::instance();
         $language = $language_factory->create($config, $context);
         $context->register('Locale', $language);
         $error_collector = new HTMLPurifier_ErrorCollector($context);
         $context->register('ErrorCollector', $error_collector);
     }
     $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
     $context->register('IDAccumulator', $id_accumulator);
     $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
     $filter_flags = $config->getBatch('Filter');
     $custom_filters = $filter_flags['Custom'];
     unset($filter_flags['Custom']);
     $filters = array();
     foreach ($filter_flags as $filter => $flag) {
         if (!$flag) {
             continue;
         }
         if (strpos($filter, '.') !== false) {
             continue;
         }
         $class = "HTMLPurifier_Filter_{$filter}";
         $filters[] = new $class();
     }
     foreach ($custom_filters as $filter) {
         $filters[] = $filter;
     }
     $filters = array_merge($filters, $this->filters);
     for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
         $html = $filters[$i]->preFilter($html, $config, $context);
     }
     $html = $this->generator->generateFromTokens($this->strategy->execute($lexer->tokenizeHTML($html, $config, $context), $config, $context));
     for ($i = $filter_size - 1; $i >= 0; $i--) {
         $html = $filters[$i]->postFilter($html, $config, $context);
     }
     $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
     $this->context =& $context;
     return $html;
 }

 function test_loadArray()
 {
     // references can be *really* wonky!
     $context_manual = new HTMLPurifier_Context();
     $context_load = new HTMLPurifier_Context();
     $var1 = 1;
     $var2 = 2;
     $context_manual->register('var1', $var1);
     $context_manual->register('var2', $var2);
     // you MUST set up the references when constructing the array,
     // otherwise the registered version will be a copy
     $array = array('var1' => &$var1, 'var2' => &$var2);
     $context_load->loadArray($array);
     $this->assertIdentical($context_manual, $context_load);
     $var1 = 10;
     $var2 = 20;
     $this->assertIdentical($context_manual, $context_load);
 }

 /**
  * Removes inline <style> tags from HTML, saves them for later use
  * @param string $html
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return string
  * @todo Extend to indicate non-text/css style blocks
  */
 public function preFilter($html, $config, $context)
 {
     $tidy = $config->get('Filter.ExtractStyleBlocks.TidyImpl');
     if ($tidy !== null) {
         $this->_tidy = $tidy;
     }
     $html = preg_replace_callback('#<style(?:\\s.*)?>(.+)</style>#isU', array($this, 'styleCallback'), $html);
     $style_blocks = $this->_styleMatches;
     $this->_styleMatches = array();
     // reset
     $context->register('StyleBlocks', $style_blocks);
     // $context must not be reused
     if ($this->_tidy) {
         foreach ($style_blocks as &$style) {
             $style = $this->cleanCSS($style, $config, $context);
         }
     }
     return $html;
 }

 /**
  * @param HTMLPurifier_URI $uri
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return bool
  */
 public function filter(&$uri, $config, $context)
 {
     // check if filter not applicable
     if (!$config->get('HTML.SafeIframe')) {
         return true;
     }
     // check if the filter should actually trigger
     if (!$context->get('EmbeddedURI', true)) {
         return true;
     }
     $token = $context->get('CurrentToken', true);
     if (!($token && $token->name == 'iframe')) {
         return true;
     }
     // check if we actually have some whitelists enabled
     if ($this->regexp === null) {
         return false;
     }
     // actually check the whitelists
     return preg_match($this->regexp, $uri->toString());
 }

 /**
  * @param HTMLPurifier_Token[] $tokens
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return HTMLPurifier_Token[]
  */
 public function execute($tokens, $config, $context)
 {
     // setup validator
     $validator = new HTMLPurifier_AttrValidator();
     $token = false;
     $context->register('CurrentToken', $token);
     foreach ($tokens as $key => $token) {
         // only process tokens that have attributes,
         //   namely start and empty tags
         if (!$token instanceof HTMLPurifier_Token_Start && !$token instanceof HTMLPurifier_Token_Empty) {
             continue;
         }
         // skip tokens that are armored
         if (!empty($token->armor['ValidateAttributes'])) {
             continue;
         }
         // note that we have no facilities here for removing tokens
         $validator->validateToken($token, $config, $context);
     }
     $context->destroy('CurrentToken');
     return $tokens;
 }

 /**
  * @param HTMLPurifier_URI     $uri
  * @param HTMLPurifier_Config  $config
  * @param HTMLPurifier_Context $context
  *
  * @return bool
  */
 public function filter(&$uri, $config, $context)
 {
     // skip non-resource URIs
     if (!$context->get('EmbeddedURI', true)) {
         return true;
     }
     //if(empty($this->allowed)) return false;
     if (!empty($uri->scheme) && strtolower($uri->scheme) != 'http' && strtolower($uri->scheme) != 'https') {
         // do not touch non-HTTP URLs
         return true;
     }
     // relative URLs permitted since email templates use it
     // if(empty($uri->host)) return false;
     // allow URLs with no query
     if (empty($uri->query)) {
         return true;
     }
     // allow URLs for known good hosts
     foreach ($this->allowed as $allow) {
         // must be equal to our domain or subdomain of our domain
         if ($uri->host == $allow || substr($uri->host, -(strlen($allow) + 1)) == ".{$allow}") {
             return true;
         }
     }
     // Here we try to block URLs that may be used for nasty XSRF stuff by
     // referring back to Sugar URLs
     // allow URLs that don't start with /? or /index.php?
     if (!empty($uri->path) && $uri->path != '/') {
         $lpath = strtolower($uri->path);
         if (substr($lpath, -10) != '/index.php' && $lpath != 'index.php') {
             return true;
         }
     }
     $query_items = [];
     parse_str(from_html($uri->query), $query_items);
     // weird query, probably harmless
     if (empty($query_items)) {
         return true;
     }
     // suspiciously like SugarCRM query, reject
     if (!empty($query_items['module']) && !empty($query_items['action'])) {
         return false;
     }
     // looks like non-download entry point - allow only specific entry points
     if (!empty($query_items['entryPoint']) && !in_array($query_items['entryPoint'], ['download', 'image', 'getImage'])) {
         return false;
     }
     return true;
 }

 /**
  * @param HTMLPurifier_Token[] $tokens
  * @param HTMLPurifier_Config $config
  * @param HTMLPurifier_Context $context
  * @return array|HTMLPurifier_Token[]
  */
 public function execute($tokens, $config, $context)
 {
     $definition = $config->getHTMLDefinition();
     $generator = new HTMLPurifier_Generator($config, $context);
     $result = array();
     $escape_invalid_tags = $config->get('Core.EscapeInvalidTags');
     $remove_invalid_img = $config->get('Core.RemoveInvalidImg');
     // currently only used to determine if comments should be kept
     $trusted = $config->get('HTML.Trusted');
     $comment_lookup = $config->get('HTML.AllowedComments');
     $comment_regexp = $config->get('HTML.AllowedCommentsRegexp');
     $check_comments = $comment_lookup !== array() || $comment_regexp !== null;
     $remove_script_contents = $config->get('Core.RemoveScriptContents');
     $hidden_elements = $config->get('Core.HiddenElements');
     // remove script contents compatibility
     if ($remove_script_contents === true) {
         $hidden_elements['script'] = true;
     } elseif ($remove_script_contents === false && isset($hidden_elements['script'])) {
         unset($hidden_elements['script']);
     }
     $attr_validator = new HTMLPurifier_AttrValidator();
     // removes tokens until it reaches a closing tag with its value
     $remove_until = false;
     // converts comments into text tokens when this is equal to a tag name
     $textify_comments = false;
     $token = false;
     $context->register('CurrentToken', $token);
     $e = false;
     if ($config->get('Core.CollectErrors')) {
         $e =& $context->get('ErrorCollector');
     }
     foreach ($tokens as $token) {
         if ($remove_until) {
             if (empty($token->is_tag) || $token->name !== $remove_until) {
                 continue;
             }
         }
         if (!empty($token->is_tag)) {
             // DEFINITION CALL
             // before any processing, try to transform the element
             if (isset($definition->info_tag_transform[$token->name])) {
                 $original_name = $token->name;
                 // there is a transformation for this tag
                 // DEFINITION CALL
                 $token = $definition->info_tag_transform[$token->name]->transform($token, $config, $context);
                 if ($e) {
                     $e->send(E_NOTICE, 'Strategy_RemoveForeignElements: Tag transform', $original_name);
                 }
             }
             if (isset($definition->info[$token->name])) {
                 // mostly everything's good, but
                 // we need to make sure required attributes are in order
                 if (($token instanceof HTMLPurifier_Token_Start || $token instanceof HTMLPurifier_Token_Empty) && $definition->info[$token->name]->required_attr && ($token->name != 'img' || $remove_invalid_img)) {
                     $attr_validator->validateToken($token, $config, $context);
                     $ok = true;
                     foreach ($definition->info[$token->name]->required_attr as $name) {
                         if (!isset($token->attr[$name])) {
                             $ok = false;
                             break;
                         }
                     }
                     if (!$ok) {
                         if ($e) {
                             $e->send(E_ERROR, 'Strategy_RemoveForeignElements: Missing required attribute', $name);
                         }
                         continue;
                     }
                     $token->armor['ValidateAttributes'] = true;
                 }
                 if (isset($hidden_elements[$token->name]) && $token instanceof HTMLPurifier_Token_Start) {
                     $textify_comments = $token->name;
                 } elseif ($token->name === $textify_comments && $token instanceof HTMLPurifier_Token_End) {
                     $textify_comments = false;
                 }
             } elseif ($escape_invalid_tags) {
                 // invalid tag, generate HTML representation and insert in
                 if ($e) {
                     $e->send(E_WARNING, 'Strategy_RemoveForeignElements: Foreign element to text');
                 }
                 $token = new HTMLPurifier_Token_Text($generator->generateFromToken($token));
             } else {
                 // check if we need to destroy all of the tag's children
                 // CAN BE GENERICIZED
                 if (isset($hidden_elements[$token->name])) {
                     if ($token instanceof HTMLPurifier_Token_Start) {
                         $remove_until = $token->name;
                     } elseif ($token instanceof HTMLPurifier_Token_Empty) {
                         // do nothing: we're still looking
                     } else {
                         $remove_until = false;
                     }
                     if ($e) {
                         $e->send(E_ERROR, 'Strategy_RemoveForeignElements: Foreign meta element removed');
                     }
//.........这里部分代码省略.........