/**
  * Retrieves an instance of the application-wide configuration definition.
  */
 public static function instance($prototype = null)
 {
     if ($prototype !== null) {
         HTMLPurifier_ConfigSchema::$singleton = $prototype;
     } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) {
         HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial();
     }
     return HTMLPurifier_ConfigSchema::$singleton;
 }

 public function register(Application $app)
 {
     parent::register($app);
     $app['form.secret'] = $app->share(function () use($app) {
         return md5('form_secret' . $app['salt']);
     });
     $app['html_purifier.allowed_elements'] = ['p', 'ul', 'ol', 'li', 'b', 'i', 'strong', 'em', 'img', 'sub', 'sup', 'blockquote', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'a', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'address', 'br', 'dl', 'dt', 'dd'];
     $app['html_purifier.allowed_attributes'] = ['*.class', 'img.src', 'img.alt', 'a.href', 'a.title', 'td.abbr', 'td.colspan', 'td.rowspan', 'th.abbr', 'th.colspan', 'th.rowspan', 'table.summary'];
     $app['html_purifier.config'] = $app->share(function () use($app) {
         $config = new \HTMLPurifier_Config(\HTMLPurifier_ConfigSchema::instance());
         $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
         $config->set('HTML.AllowedElements', implode(',', $app['html_purifier.allowed_elements']));
         $config->set('HTML.AllowedAttributes', implode(',', $app['html_purifier.allowed_attributes']));
         $config->set('AutoFormat.RemoveEmpty', true);
         $config->set('AutoFormat.AutoParagraph', true);
         $config->set('AutoFormat.RemoveEmpty.RemoveNbsp', true);
         $cachePath = $app['paths.cache'] . '/htmlpurifier';
         if (!is_dir($cachePath)) {
             mkdir($cachePath, 0777, true);
         }
         $config->set('Cache.SerializerPath', $cachePath);
         return $config;
     });
     $app['html_purifier'] = $app->share(function () use($app) {
         return new \HTMLPurifier($app['html_purifier.config']);
     });
     $app['form.html_purifier'] = $app->share(function () use($app) {
         return new HtmlPurifier($app['html_purifier']);
     });
     $app['form.html_extension'] = $app->share(function () use($app) {
         return new HtmlExtension(new HtmlType($app['form.html_purifier']), new HtmlTypeGuesser($app['annotations.reader']));
     });
     $app['form.extensions'] = $app->share($app->extend('form.extensions', function (array $extensions) use($app) {
         $extensions[] = new DoctrineOrmExtension($app['orm.manager_registry']);
         $extensions[] = $app['form.html_extension'];
         return $extensions;
     }));
     $app['form.type.extensions'] = $app->share($app->extend('form.type.extensions', function (array $extensions) use($app) {
         $extensions[] = new FormTypeExtension();
         $extensions[] = new DateTypeExtension();
         $extensions[] = new TimeTypeExtension();
         return $extensions;
     }));
 }

 public function build($interchange)
 {
     $schema = new HTMLPurifier_ConfigSchema();
     foreach ($interchange->namespaces as $n) {
         $schema->addNamespace($n->namespace);
     }
     foreach ($interchange->directives as $d) {
         $schema->add($d->id->namespace, $d->id->directive, $d->default, $d->type, $d->typeAllowsNull);
         if ($d->allowed !== null) {
             $schema->addAllowedValues($d->id->namespace, $d->id->directive, $d->allowed);
         }
         foreach ($d->aliases as $alias) {
             $schema->addAlias($alias->namespace, $alias->directive, $d->id->namespace, $d->id->directive);
         }
         if ($d->valueAliases !== null) {
             $schema->addValueAliases($d->id->namespace, $d->id->directive, $d->valueAliases);
         }
     }
     $schema->postProcess();
     return $schema;
 }

<?php

// HTMLPurifier_ChildDef and inheritance have three types of output:
// true = leave nodes as is
// false = delete parent node and all children
// array(...) = replace children nodes with these
HTMLPurifier_ConfigSchema::define('Core', 'EscapeInvalidChildren', false, 'bool', 'When true, a child is found that is not allowed in the context of the ' . 'parent element will be transformed into text as if it were ASCII. When ' . 'false, that element and all internal tags will be dropped, though text ' . 'will be preserved.  There is no option for dropping the element but ' . 'preserving child nodes.');
/**
 * Defines allowed child nodes and validates tokens against it.
 */
class HTMLPurifier_ChildDef
{
    /**
     * Type of child definition, usually right-most part of class name lowercase.
     * Used occasionally in terms of context.
     */
    public $type;
    /**
     * Bool that indicates whether or not an empty array of children is okay
     * 
     * This is necessary for redundant checking when changes affecting
     * a child node may cause a parent node to now be disallowed.
     */
    public $allow_empty;
    /**
     * Lookup array of all elements that this definition could possibly allow
     */
    public $elements = array();
    /**
     * Validates nodes according to definition and returns modification.
     * 

    <strong>Warning:</strong> If another directive conflicts with the 
    elements here, <em>that</em> directive will win and override. For 
    example, %HTML.EnableAttrID will take precedence over *.id in this 
    directive.  You must set that directive to true before you can use 
    IDs at all. This directive has been available since 1.3.0.
</p>
');
HTMLPurifier_ConfigSchema::define('HTML', 'Allowed', null, 'itext/null', '
<p>
    This is a convenience directive that rolls the functionality of
    %HTML.AllowedElements and %HTML.AllowedAttributes into one directive.
    Specify elements and attributes that are allowed using:
    <code>element1[attr1|attr2],element2...</code>. You can also use
    newlines instead of commas to separate elements.
</p>
<p>
    <strong>Warning</strong>:
    All of the constraints on the component directives are still enforced.
    The syntax is a <em>subset</em> of TinyMCE\'s <code>valid_elements</code>
    whitelist: directly copy-pasting it here will probably result in
    broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
    are set, this directive has no effect.
    This directive has been available since 2.0.0.
</p>
');
/**
 * Definition of the purified HTML that describes allowed children,
 * attributes, and many other things.
 * 
 * Conventions:
 * 
 * All member variables that are prefixed with info

<?php

// overload default configuration schema temporarily
$custom_schema = new HTMLPurifier_ConfigSchema();
$old = HTMLPurifier_ConfigSchema::instance();
$custom_schema =& HTMLPurifier_ConfigSchema::instance($custom_schema);
HTMLPurifier_ConfigSchema::defineNamespace('Element', 'Chemical substances that cannot be further decomposed');
HTMLPurifier_ConfigSchema::define('Element', 'Abbr', 'H', 'string', 'Abbreviation of element name.');
HTMLPurifier_ConfigSchema::define('Element', 'Name', 'hydrogen', 'istring', 'Full name of atoms.');
HTMLPurifier_ConfigSchema::define('Element', 'Number', 1, 'int', 'Atomic number, is identity.');
HTMLPurifier_ConfigSchema::define('Element', 'Mass', 1.00794, 'float', 'Atomic mass.');
HTMLPurifier_ConfigSchema::define('Element', 'Radioactive', false, 'bool', 'Does it have rapid decay?');
HTMLPurifier_ConfigSchema::define('Element', 'Isotopes', array('1' => true, '2' => true, '3' => true), 'lookup', 'What numbers of neutrons for this element have been observed?');
HTMLPurifier_ConfigSchema::define('Element', 'Traits', array('nonmetallic', 'odorless', 'flammable'), 'list', 'What are general properties of the element?');
HTMLPurifier_ConfigSchema::define('Element', 'IsotopeNames', array('1' => 'protium', '2' => 'deuterium', '3' => 'tritium'), 'hash', 'Lookup hash of neutron counts to formal names.');
HTMLPurifier_ConfigSchema::defineNamespace('Instrument', 'Of the musical type.');
HTMLPurifier_ConfigSchema::define('Instrument', 'Manufacturer', 'Yamaha', 'string', 'Who made it?');
HTMLPurifier_ConfigSchema::defineAllowedValues('Instrument', 'Manufacturer', array('Yamaha', 'Conn-Selmer', 'Vandoren', 'Laubin', 'Buffet', 'other'));
HTMLPurifier_ConfigSchema::defineValueAliases('Instrument', 'Manufacturer', array('Selmer' => 'Conn-Selmer'));
HTMLPurifier_ConfigSchema::define('Instrument', 'Family', 'woodwind', 'istring', 'What family is it?');
HTMLPurifier_ConfigSchema::defineAllowedValues('Instrument', 'Family', array('brass', 'woodwind', 'percussion', 'string', 'keyboard', 'electronic'));
HTMLPurifier_ConfigSchema::defineValueAliases('Instrument', 'Family', array('synth' => 'electronic'));
HTMLPurifier_ConfigSchema::defineNamespace('ReportCard', 'It is for grades.');
HTMLPurifier_ConfigSchema::define('ReportCard', 'English', null, 'string/null', 'Grade from English class.');
HTMLPurifier_ConfigSchema::define('ReportCard', 'Absences', 0, 'int', 'How many times missing from school?');
HTMLPurifier_ConfigSchema::defineNamespace('Text', 'This stuff is long, boring, and English.');
HTMLPurifier_ConfigSchema::define('Text', 'AboutUs', 'Nothing much, but this should be decently long so that a textarea would be better', 'text', 'Who are we? What are we up to?');
HTMLPurifier_ConfigSchema::define('Text', 'Hash', "not-case-sensitive\nstill-not-case-sensitive\nsuper-not-case-sensitive", 'itext', 'This is of limited utility, but of course it ends up being used.');

');
HTMLPurifier_ConfigSchema::define('Core', 'RemoveScriptContents', null, 'bool/null', '
<p>
  This directive enables HTML Purifier to remove not only script tags
  but all of their contents. This directive has been deprecated since 2.1.0,
  and when not set the value of %Core.HiddenElements will take
  precedence. This directive has been available since 2.0.0, and can be used to 
  revert to pre-2.0.0 behavior by setting it to false.
</p>
');
HTMLPurifier_ConfigSchema::define('Core', 'HiddenElements', array('script' => true, 'style' => true), 'lookup', '
<p>
  This directive is a lookup array of elements which should have their
  contents removed when they are not allowed by the HTML definition.
  For example, the contents of a <code>script</code> tag are not 
  normally shown in a document, so if script tags are to be removed,
  their contents should be removed to. This is opposed to a <code>b</code>
  tag, which defines some presentational changes but does not hide its
  contents.
</p>
');
/**
 * Removes all unrecognized tags from the list of tokens.
 * 
 * This strategy iterates through all the tokens and removes unrecognized
 * tokens. If a token is not recognized but a TagTransform is defined for
 * that element, the element will be transformed accordingly.
 */
class HTMLPurifier_Strategy_RemoveForeignElements extends HTMLPurifier_Strategy
{
    function execute($tokens, $config, &$context)

 /** @see HTMLPurifier_ConfigSchema->addAlias() */
 public static function defineAlias($namespace, $name, $new_namespace, $new_name)
 {
     HTMLPurifier_ConfigSchema::deprecated(__METHOD__);
     $def = HTMLPurifier_ConfigSchema::instance();
     $def->addAlias($namespace, $name, $new_namespace, $new_name);
 }

 /**
  * Returns a list of array(namespace, directive) for all directives
  * that are allowed in a web-form context as per an allowed
  * namespaces/directives list.
  * @param $allowed List of allowed namespaces/directives
  */
 public static function getAllowedDirectivesForForm($allowed, $schema = null)
 {
     if (!$schema) {
         $schema = HTMLPurifier_ConfigSchema::instance();
     }
     if ($allowed !== true) {
         if (is_string($allowed)) {
             $allowed = array($allowed);
         }
         $allowed_ns = array();
         $allowed_directives = array();
         $blacklisted_directives = array();
         foreach ($allowed as $ns_or_directive) {
             if (strpos($ns_or_directive, '.') !== false) {
                 // directive
                 if ($ns_or_directive[0] == '-') {
                     $blacklisted_directives[substr($ns_or_directive, 1)] = true;
                 } else {
                     $allowed_directives[$ns_or_directive] = true;
                 }
             } else {
                 // namespace
                 $allowed_ns[$ns_or_directive] = true;
             }
         }
     }
     $ret = array();
     foreach ($schema->info as $key => $def) {
         list($ns, $directive) = explode('.', $key, 2);
         if ($allowed !== true) {
             if (isset($blacklisted_directives["{$ns}.{$directive}"])) {
                 continue;
             }
             if (!isset($allowed_directives["{$ns}.{$directive}"]) && !isset($allowed_ns[$ns])) {
                 continue;
             }
         }
         if (isset($def->isAlias)) {
             continue;
         }
         if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') {
             continue;
         }
         $ret[] = array($ns, $directive);
     }
     return $ret;
 }

define('HTMLPURIFIER_PREFIX', dirname(__FILE__));
// almost every class has an undocumented dependency to these, so make sure
// they get included
require_once 'HTMLPurifier/ConfigSchema.php';
// important
require_once 'HTMLPurifier/Config.php';
require_once 'HTMLPurifier/Context.php';
require_once 'HTMLPurifier/Lexer.php';
require_once 'HTMLPurifier/Generator.php';
require_once 'HTMLPurifier/Strategy/Core.php';
require_once 'HTMLPurifier/Encoder.php';
require_once 'HTMLPurifier/ErrorCollector.php';
require_once 'HTMLPurifier/LanguageFactory.php';
HTMLPurifier_ConfigSchema::define('Core', 'CollectErrors', false, 'bool', '
Whether or not to collect errors found while filtering the document. This
is a useful way to give feedback to your users. CURRENTLY NOT IMPLEMENTED.
This directive has been available since 2.0.0.
');
/**
 * Main library execution class.
 * 
 * Facade that performs calls to the HTMLPurifier_Lexer,
 * HTMLPurifier_Strategy and HTMLPurifier_Generator subsystems in order to
 * purify HTML.
 * 
 * @todo We need an easier way to inject strategies, it'll probably end
 *       up getting done through config though.
 */
class HTMLPurifier
{
    var $version = '2.1.2';

    lack of support in doctype</dd>
    <dt>medium</dt>
    <dd>Enforce best practices</dd>
    <dt>heavy</dt>
    <dd>Transform all deprecated elements and attributes to standards
    compliant equivalents</dd>
</dl>
<p>This directive has been available since 2.0.0</p>
');
HTMLPurifier_ConfigSchema::defineAllowedValues('HTML', 'TidyLevel', array('none', 'light', 'medium', 'heavy'));
HTMLPurifier_ConfigSchema::define('HTML', 'TidyAdd', array(), 'lookup', '
Fixes to add to the default set of Tidy fixes as per your level. This
directive has been available since 2.0.0.
');
HTMLPurifier_ConfigSchema::define('HTML', 'TidyRemove', array(), 'lookup', '
Fixes to remove from the default set of Tidy fixes as per your level. This
directive has been available since 2.0.0.
');
/**
 * Abstract class for a set of proprietary modules that clean up (tidy)
 * poorly written HTML.
 */
class HTMLPurifier_HTMLModule_Tidy extends HTMLPurifier_HTMLModule
{
    /**
     * List of supported levels. Index zero is a special case "no fixes"
     * level.
     */
    var $levels = array(0 => 'none', 'light', 'medium', 'heavy');
    /**
     * Default level to place all fixes in. Disabled by default
     */

<?php

require_once 'HTMLPurifier/URIScheme/http.php';
require_once 'HTMLPurifier/URIScheme/https.php';
require_once 'HTMLPurifier/URIScheme/mailto.php';
require_once 'HTMLPurifier/URIScheme/ftp.php';
require_once 'HTMLPurifier/URIScheme/nntp.php';
require_once 'HTMLPurifier/URIScheme/news.php';
HTMLPurifier_ConfigSchema::define('URI', 'AllowedSchemes', array('http' => true, 'https' => true, 'mailto' => true, 'ftp' => true, 'nntp' => true, 'news' => true), 'lookup', 'Whitelist that defines the schemes that a URI is allowed to have.  This ' . 'prevents XSS attacks from using pseudo-schemes like javascript or mocha.');
HTMLPurifier_ConfigSchema::define('URI', 'OverrideAllowedSchemes', true, 'bool', 'If this is set to true (which it is by default), you can override ' . '%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme ' . 'to the registry.  If false, you will also have to update that directive ' . 'in order to add more schemes.');
/**
 * Registry for retrieving specific URI scheme validator objects.
 */
class HTMLPurifier_URISchemeRegistry
{
    /**
     * Retrieve sole instance of the registry.
     * @param $prototype Optional prototype to overload sole instance with,
     *                   or bool true to reset to default registry.
     * @note Pass a registry object $prototype with a compatible interface and
     *       the function will copy it and return it all further times.
     */
    public static function instance($prototype = null)
    {
        static $instance = null;
        if ($prototype !== null) {
            $instance = $prototype;
        } elseif ($instance === null || $prototype == true) {
            $instance = new HTMLPurifier_URISchemeRegistry();
        }
        return $instance;

<?php

require_once HTML_PURIFIER_LIB_PATH . '/HTMLPurifier/Doctype.php';
// Legacy directives for doctype specification
HTMLPurifier_ConfigSchema::define('HTML', 'Strict', false, 'bool', 'Determines whether or not to use Transitional (loose) or Strict rulesets. ' . 'This directive is deprecated in favor of %HTML.Doctype. ' . 'This directive has been available since 1.3.0.');
HTMLPurifier_ConfigSchema::define('HTML', 'XHTML', true, 'bool', 'Determines whether or not output is XHTML 1.0 or HTML 4.01 flavor. ' . 'This directive is deprecated in favor of %HTML.Doctype. ' . 'This directive was available since 1.1.');
HTMLPurifier_ConfigSchema::defineAlias('Core', 'XHTML', 'HTML', 'XHTML');
class HTMLPurifier_DoctypeRegistry
{
    /**
     * Hash of doctype names to doctype objects
     * @protected
     */
    var $doctypes;
    /**
     * Lookup table of aliases to real doctype names
     * @protected
     */
    var $aliases;
    /**
     * Registers a doctype to the registry
     * @note Accepts a fully-formed doctype object, or the
     *       parameters for constructing a doctype object
     * @param $doctype Name of doctype or literal doctype object
     * @param $modules Modules doctype will load
     * @param $modules_for_modes Modules doctype will load for certain modes
     * @param $aliases Alias names for doctype
     * @return Reference to registered doctype (usable for further editing)
     */
    function &register($doctype, $xml = true, $modules = array(), $tidy_modules = array(), $aliases = array(), $dtd_public = null, $dtd_system = null)
    {

<?php

require_once HTML_PURIFIER_LIB_PATH . '/HTMLPurifier/AttrDef.php';
HTMLPurifier_ConfigSchema::define('Attr', 'AllowedRel', array(), 'lookup', 'List of allowed forward document relationships in the rel attribute. ' . 'Common values may be nofollow or print. By default, this is empty, ' . 'meaning that no document relationships are allowed. This directive ' . 'was available since 1.6.0.');
HTMLPurifier_ConfigSchema::define('Attr', 'AllowedRev', array(), 'lookup', 'List of allowed reverse document relationships in the rev attribute. ' . 'This attribute is a bit of an edge-case; if you don\'t know what it ' . 'is for, stay away. This directive was available since 1.6.0.');
/**
 * Validates a rel/rev link attribute against a directive of allowed values
 * @note We cannot use Enum because link types allow multiple
 *       values.
 * @note Assumes link types are ASCII text
 */
class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
{
    /** Name config attribute to pull. */
    var $name;
    function HTMLPurifier_AttrDef_HTML_LinkTypes($name)
    {
        $configLookup = array('rel' => 'AllowedRel', 'rev' => 'AllowedRev');
        if (!isset($configLookup[$name])) {
            trigger_error('Unrecognized attribute name for link ' . 'relationship.', E_USER_ERROR);
            return;
        }
        $this->name = $configLookup[$name];
    }
    function validate($string, $config, &$context)
    {
        $allowed = $config->get('Attr', $this->name);
        if (empty($allowed)) {
            return false;
        }
        $string = $this->parseCDATA($string);

require_once 'HTMLPurifier/AttrDef/CSS/Border.php';
require_once 'HTMLPurifier/AttrDef/CSS/Color.php';
require_once 'HTMLPurifier/AttrDef/CSS/Composite.php';
require_once 'HTMLPurifier/AttrDef/CSS/Font.php';
require_once 'HTMLPurifier/AttrDef/CSS/FontFamily.php';
require_once 'HTMLPurifier/AttrDef/CSS/Length.php';
require_once 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
require_once 'HTMLPurifier/AttrDef/CSS/Multiple.php';
require_once 'HTMLPurifier/AttrDef/CSS/Percentage.php';
require_once 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
require_once 'HTMLPurifier/AttrDef/CSS/URI.php';
require_once 'HTMLPurifier/AttrDef/Enum.php';
HTMLPurifier_ConfigSchema::define('CSS', 'DefinitionRev', 1, 'int', '
<p>
    Revision identifier for your custom definition. See
    %HTML.DefinitionRev for details. This directive has been available
    since 2.0.0.
</p>
');
/**
 * Defines allowed CSS attributes and what their values are.
 * @see HTMLPurifier_HTMLDefinition
 */
class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
{
    var $type = 'CSS';
    /**
     * Assoc array of attribute name to definition object.
     */
    var $info = array();
    /**

<?php

// does not support network paths
require_once 'HTMLPurifier/URIFilter.php';
HTMLPurifier_ConfigSchema::define('URI', 'MakeAbsolute', false, 'bool', '
<p>
    Converts all URIs into absolute forms. This is useful when the HTML
    being filtered assumes a specific base path, but will actually be
    viewed in a different context (and setting an alternate base URI is
    not possible). %URI.Base must be set for this directive to work.
    This directive has been available since 2.1.0.
</p>
');
class HTMLPurifier_URIFilter_MakeAbsolute extends HTMLPurifier_URIFilter
{
    var $name = 'MakeAbsolute';
    var $base;
    var $basePathStack = array();
    function prepare($config)
    {
        $def = $config->getDefinition('URI');
        $this->base = $def->base;
        if (is_null($this->base)) {
            trigger_error('URI.MakeAbsolute is being ignored due to lack of value for URI.Base configuration', E_USER_ERROR);
            return;
        }
        $this->base->fragment = null;
        // fragment is invalid for base URI
        $stack = explode('/', $this->base->path);
        array_pop($stack);
        // discard last segment

  has been available since 3.0.0.
</p>
');
HTMLPurifier_ConfigSchema::define('Filter', 'ExtractStyleBlocksScope', null, 'string/null', '
<p>
  If you would like users to be able to define external stylesheets, but
  only allow them to specify CSS declarations for a specific node and
  prevent them from fiddling with other elements, use this directive.
  It accepts any valid CSS selector, and will prepend this to any
  CSS declaration extracted from the document. For example, if this
  directive is set to <code>#user-content</code> and a user uses the
  selector <code>a:hover</code>, the final selector will be
  <code>#user-content a:hover</code>.
</p>
<p>
  The comma shorthand may be used; consider the above example, with
  <code>#user-content, #user-content2</code>, the final selector will
  be <code>#user-content a:hover, #user-content2 a:hover</code>.
</p>
<p>
  <strong>Warning:</strong> It is possible for users to bypass this measure
  using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML
  Purifier, and I am working to get it fixed. Until then, HTML Purifier
  performs a basic check to prevent this.
</p>
<p>
  This directive has been available since 3.0.0.
</p>
');
/**
 * This filter extracts <style> blocks from input HTML, cleans them up
 * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks')

<?php

HTMLPurifier_ConfigSchema::define('Core', 'Encoding', 'utf-8', 'istring', 'If for some reason you are unable to convert all webpages to UTF-8, ' . 'you can use this directive as a stop-gap compatibility change to ' . 'let HTML Purifier deal with non UTF-8 input.  This technique has ' . 'notable deficiencies: absolutely no characters outside of the selected ' . 'character encoding will be preserved, not even the ones that have ' . 'been ampersand escaped (this is due to a UTF-8 specific <em>feature</em> ' . 'that automatically resolves all entities), making it pretty useless ' . 'for anything except the most I18N-blind applications, although ' . '%Core.EscapeNonASCIICharacters offers fixes this trouble with ' . 'another tradeoff. This directive ' . 'only accepts ISO-8859-1 if iconv is not enabled.');
HTMLPurifier_ConfigSchema::define('Core', 'EscapeNonASCIICharacters', false, 'bool', 'This directive overcomes a deficiency in %Core.Encoding by blindly ' . 'converting all non-ASCII characters into decimal numeric entities before ' . 'converting it to its native encoding. This means that even ' . 'characters that can be expressed in the non-UTF-8 encoding will ' . 'be entity-ized, which can be a real downer for encodings like Big5. ' . 'It also assumes that the ASCII repetoire is available, although ' . 'this is the case for almost all encodings. Anyway, use UTF-8! This ' . 'directive has been available since 1.4.0.');
if (!function_exists('iconv')) {
    // only encodings with native PHP support
    HTMLPurifier_ConfigSchema::defineAllowedValues('Core', 'Encoding', array('utf-8', 'iso-8859-1'));
    HTMLPurifier_ConfigSchema::defineValueAliases('Core', 'Encoding', array('iso8859-1' => 'iso-8859-1'));
}
HTMLPurifier_ConfigSchema::define('Test', 'ForceNoIconv', false, 'bool', 'When set to true, HTMLPurifier_Encoder will act as if iconv does not ' . 'exist and use only pure PHP implementations.');
/**
 * A UTF-8 specific character encoder that handles cleaning and transforming.
 * @note All functions in this class should be static.
 */
class HTMLPurifier_Encoder
{
    /**
     * Constructor throws fatal error if you attempt to instantiate class
     */
    private function __construct()
    {
        trigger_error('Cannot instantiate encoder, call methods statically', E_USER_ERROR);
    }
    /**
     * Cleans a UTF-8 string for well-formedness and SGML validity
     * 
     * It will parse according to UTF-8 and return a valid UTF8 string, with
     * non-SGML codepoints excluded.
     * 
     * @note Just for reference, the non-SGML code points are 0 to 31 and
     *       127 to 159, inclusive.  However, we allow code points 9, 10

require_once 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
require_once 'HTMLPurifier/AttrDef/CSS/Multiple.php';
require_once 'HTMLPurifier/AttrDef/CSS/Percentage.php';
require_once 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
require_once 'HTMLPurifier/AttrDef/CSS/URI.php';
require_once 'HTMLPurifier/AttrDef/Enum.php';
HTMLPurifier_ConfigSchema::define('CSS', 'DefinitionRev', 1, 'int', '
<p>
    Revision identifier for your custom definition. See
    %HTML.DefinitionRev for details. This directive has been available
    since 2.0.0.
</p>
');
HTMLPurifier_ConfigSchema::define('CSS', 'Proprietary', false, 'bool', '
<p>
    Whether or not to allow safe, proprietary CSS values. This directive
    has been available since 3.0.0.
</p>
');
/**
 * Defines allowed CSS attributes and what their values are.
 * @see HTMLPurifier_HTMLDefinition
 */
class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
{
    public $type = 'CSS';
    /**
     * Assoc array of attribute name to definition object.
     */
    public $info = array();
    /**
     * Constructs the info array.  The meat of this class.

<?php

require_once 'HTMLPurifier/URIFilter.php';
HTMLPurifier_ConfigSchema::define('URI', 'HostBlacklist', array(), 'list', 'List of strings that are forbidden in the host of any URI. Use it to ' . 'kill domain names of spam, etc. Note that it will catch anything in ' . 'the domain, so <tt>moo.com</tt> will catch <tt>moo.com.example.com</tt>. ' . 'This directive has been available since 1.3.0.');
class HTMLPurifier_URIFilter_HostBlacklist extends HTMLPurifier_URIFilter
{
    public $name = 'HostBlacklist';
    protected $blacklist = array();
    public function prepare($config)
    {
        $this->blacklist = $config->get('URI', 'HostBlacklist');
    }
    public function filter(&$uri, $config, $context)
    {
        foreach ($this->blacklist as $blacklisted_host_fragment) {
            if (strpos($uri->host, $blacklisted_host_fragment) !== false) {
                return false;
            }
        }
        return true;
    }
}