updated plugin Menu Icons version 0.13.14
This commit is contained in:
Gitium
parent
938cef2946
commit
877a737c75
@ -1,3 +1,7 @@
|
||||
##### [Version 0.13.14](https://github.com/codeinwp/wp-menu-icons/compare/v0.13.13...v0.13.14) (2024-05-14)
|
||||
|
||||
- Enhanced security
|
||||
|
||||
##### [Version 0.13.13](https://github.com/codeinwp/wp-menu-icons/compare/v0.13.12...v0.13.13) (2024-04-18)
|
||||
|
||||
### Improvements
|
||||
|
||||
@ -11,7 +11,7 @@
|
||||
* Plugin name: Menu Icons
|
||||
* Plugin URI: https://github.com/Codeinwp/wp-menu-icons
|
||||
* Description: Spice up your navigation menus with pretty icons, easily.
|
||||
* Version: 0.13.13
|
||||
* Version: 0.13.14
|
||||
* Author: ThemeIsle
|
||||
* Author URI: https://themeisle.com
|
||||
* License: GPLv2
|
||||
@ -29,7 +29,7 @@ final class Menu_Icons {
|
||||
|
||||
const DISMISS_NOTICE = 'menu-icons-dismiss-notice';
|
||||
|
||||
const VERSION = '0.13.13';
|
||||
const VERSION = '0.13.14';
|
||||
|
||||
/**
|
||||
* Holds plugin data
|
||||
|
||||
@ -225,6 +225,13 @@ Read [this blog post](http://kucrut.org/add-custom-image-sizes-right-way/).
|
||||
|
||||
== Changelog ==
|
||||
|
||||
##### [Version 0.13.14](https://github.com/codeinwp/wp-menu-icons/compare/v0.13.13...v0.13.14) (2024-05-14)
|
||||
|
||||
- Enhanced security
|
||||
|
||||
|
||||
|
||||
|
||||
##### [Version 0.13.13](https://github.com/codeinwp/wp-menu-icons/compare/v0.13.12...v0.13.13) (2024-04-18)
|
||||
|
||||
### Improvements
|
||||
|
||||
@ -6,6 +6,8 @@
|
||||
* @author Dzikri Aziz <kvcrvt@gmail.com>
|
||||
*/
|
||||
|
||||
use enshrined\svgSanitize\Sanitizer;
|
||||
|
||||
require_once dirname( __FILE__ ) . '/image.php';
|
||||
|
||||
/**
|
||||
@ -53,6 +55,108 @@ class Icon_Picker_Type_Svg extends Icon_Picker_Type_Image {
|
||||
|
||||
parent::__construct( $args );
|
||||
add_filter( 'upload_mimes', array( $this, '_add_mime_type' ) );
|
||||
add_filter( 'wp_handle_upload_prefilter', array( $this, '_check_svg_and_sanitize' ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Sanitize the SVG
|
||||
*
|
||||
* @param string $file Temp file path.
|
||||
*
|
||||
* @return bool|int
|
||||
*/
|
||||
protected function sanitize_svg( $file ) {
|
||||
// We can ignore the phpcs warning here as we're reading and writing to the Temp file.
|
||||
$dirty = file_get_contents( $file ); // phpcs:ignore
|
||||
|
||||
// Is the SVG gzipped? If so we try and decode the string.
|
||||
$is_zipped = $this->is_gzipped( $dirty );
|
||||
if ( $is_zipped && ( ! function_exists( 'gzdecode' ) || ! function_exists( 'gzencode' ) ) ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( $is_zipped ) {
|
||||
$dirty = gzdecode( $dirty );
|
||||
|
||||
// If decoding fails, bail as we're not secure.
|
||||
if ( false === $dirty ) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
$sanitizer = new Sanitizer();
|
||||
$clean = $sanitizer->sanitize( $dirty );
|
||||
|
||||
if ( false === $clean ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// If we were gzipped, we need to re-zip.
|
||||
if ( $is_zipped ) {
|
||||
$clean = gzencode( $clean );
|
||||
}
|
||||
|
||||
// We can ignore the phpcs warning here as we're reading and writing to the Temp file.
|
||||
file_put_contents( $file, $clean ); // phpcs:ignore
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the contents are gzipped
|
||||
*
|
||||
* @see http://www.gzip.org/zlib/rfc-gzip.html#member-format
|
||||
*
|
||||
* @param string $contents Content to check.
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
protected function is_gzipped( $contents ) {
|
||||
// phpcs:disable Generic.Strings.UnnecessaryStringConcat.Found
|
||||
if ( function_exists( 'mb_strpos' ) ) {
|
||||
return 0 === mb_strpos( $contents, "\x1f" . "\x8b" . "\x08" );
|
||||
} else {
|
||||
return 0 === strpos( $contents, "\x1f" . "\x8b" . "\x08" );
|
||||
}
|
||||
// phpcs:enable
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the file is an SVG, if so handle appropriately and sanitize.
|
||||
*
|
||||
* @param array $file An array of data for a single file.
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
public function _check_svg_and_sanitize( $file ) {
|
||||
// Ensure we have a proper file path before processing.
|
||||
if ( ! isset( $file['tmp_name'] ) ) {
|
||||
return $file;
|
||||
}
|
||||
|
||||
$file_name = isset( $file['name'] ) ? $file['name'] : '';
|
||||
$wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file_name );
|
||||
$type = ! empty( $wp_filetype['type'] ) ? $wp_filetype['type'] : '';
|
||||
|
||||
if ( 'image/svg+xml' === $type ) {
|
||||
if ( ! current_user_can( 'upload_files' ) ) {
|
||||
$file['error'] = __(
|
||||
'Sorry, you are not allowed to upload files.',
|
||||
'icon-picker'
|
||||
);
|
||||
|
||||
return $file;
|
||||
}
|
||||
|
||||
if ( ! $this->sanitize_svg( $file['tmp_name'] ) ) {
|
||||
$file['error'] = __(
|
||||
"Sorry, this file couldn't be sanitized so for security reasons wasn't uploaded",
|
||||
'icon-picker'
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
return $file;
|
||||
}
|
||||
|
||||
|
||||
|
||||
@ -7,4 +7,15 @@ $baseDir = dirname($vendorDir);
|
||||
|
||||
return array(
|
||||
'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Resolver' => $vendorDir . '/enshrined/svg-sanitize/src/ElementReference/Resolver.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Subject' => $vendorDir . '/enshrined/svg-sanitize/src/ElementReference/Subject.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Usage' => $vendorDir . '/enshrined/svg-sanitize/src/ElementReference/Usage.php',
|
||||
'enshrined\\svgSanitize\\Exceptions\\NestingException' => $vendorDir . '/enshrined/svg-sanitize/src/Exceptions/NestingException.php',
|
||||
'enshrined\\svgSanitize\\Helper' => $vendorDir . '/enshrined/svg-sanitize/src/Helper.php',
|
||||
'enshrined\\svgSanitize\\Sanitizer' => $vendorDir . '/enshrined/svg-sanitize/src/Sanitizer.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedAttributes' => $vendorDir . '/enshrined/svg-sanitize/src/data/AllowedAttributes.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedTags' => $vendorDir . '/enshrined/svg-sanitize/src/data/AllowedTags.php',
|
||||
'enshrined\\svgSanitize\\data\\AttributeInterface' => $vendorDir . '/enshrined/svg-sanitize/src/data/AttributeInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\TagInterface' => $vendorDir . '/enshrined/svg-sanitize/src/data/TagInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\XPath' => $vendorDir . '/enshrined/svg-sanitize/src/data/XPath.php',
|
||||
);
|
||||
|
||||
@ -6,4 +6,5 @@ $vendorDir = dirname(__DIR__);
|
||||
$baseDir = dirname($vendorDir);
|
||||
|
||||
return array(
|
||||
'enshrined\\svgSanitize\\' => array($vendorDir . '/enshrined/svg-sanitize/src'),
|
||||
);
|
||||
|
||||
@ -22,6 +22,8 @@ class ComposerAutoloaderInite0e064cdd82a4be104872380c8a68791
|
||||
return self::$loader;
|
||||
}
|
||||
|
||||
require __DIR__ . '/platform_check.php';
|
||||
|
||||
spl_autoload_register(array('ComposerAutoloaderInite0e064cdd82a4be104872380c8a68791', 'loadClassLoader'), true, true);
|
||||
self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
|
||||
spl_autoload_unregister(array('ComposerAutoloaderInite0e064cdd82a4be104872380c8a68791', 'loadClassLoader'));
|
||||
|
||||
@ -13,13 +13,40 @@ class ComposerStaticInite0e064cdd82a4be104872380c8a68791
|
||||
'5a095c604245b0e67e4573f0a3b240cd' => __DIR__ . '/..' . '/codeinwp/themeisle-sdk/load.php',
|
||||
);
|
||||
|
||||
public static $prefixLengthsPsr4 = array (
|
||||
'e' =>
|
||||
array (
|
||||
'enshrined\\svgSanitize\\' => 22,
|
||||
),
|
||||
);
|
||||
|
||||
public static $prefixDirsPsr4 = array (
|
||||
'enshrined\\svgSanitize\\' =>
|
||||
array (
|
||||
0 => __DIR__ . '/..' . '/enshrined/svg-sanitize/src',
|
||||
),
|
||||
);
|
||||
|
||||
public static $classMap = array (
|
||||
'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Resolver' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/ElementReference/Resolver.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Subject' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/ElementReference/Subject.php',
|
||||
'enshrined\\svgSanitize\\ElementReference\\Usage' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/ElementReference/Usage.php',
|
||||
'enshrined\\svgSanitize\\Exceptions\\NestingException' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/Exceptions/NestingException.php',
|
||||
'enshrined\\svgSanitize\\Helper' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/Helper.php',
|
||||
'enshrined\\svgSanitize\\Sanitizer' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/Sanitizer.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedAttributes' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/AllowedAttributes.php',
|
||||
'enshrined\\svgSanitize\\data\\AllowedTags' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/AllowedTags.php',
|
||||
'enshrined\\svgSanitize\\data\\AttributeInterface' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/AttributeInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\TagInterface' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/TagInterface.php',
|
||||
'enshrined\\svgSanitize\\data\\XPath' => __DIR__ . '/..' . '/enshrined/svg-sanitize/src/data/XPath.php',
|
||||
);
|
||||
|
||||
public static function getInitializer(ClassLoader $loader)
|
||||
{
|
||||
return \Closure::bind(function () use ($loader) {
|
||||
$loader->prefixLengthsPsr4 = ComposerStaticInite0e064cdd82a4be104872380c8a68791::$prefixLengthsPsr4;
|
||||
$loader->prefixDirsPsr4 = ComposerStaticInite0e064cdd82a4be104872380c8a68791::$prefixDirsPsr4;
|
||||
$loader->classMap = ComposerStaticInite0e064cdd82a4be104872380c8a68791::$classMap;
|
||||
|
||||
}, null, ClassLoader::class);
|
||||
|
||||
@ -53,21 +53,23 @@
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/Codeinwp/icon-picker.git",
|
||||
"reference": "0c60ce3a41653e41a20e710c4d5a6a2104c85020"
|
||||
"reference": "8efc2e400231ad7d4af94ff9270cd5b50248d4c9"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/Codeinwp/icon-picker/zipball/0c60ce3a41653e41a20e710c4d5a6a2104c85020",
|
||||
"reference": "0c60ce3a41653e41a20e710c4d5a6a2104c85020",
|
||||
"url": "https://api.github.com/repos/Codeinwp/icon-picker/zipball/8efc2e400231ad7d4af94ff9270cd5b50248d4c9",
|
||||
"reference": "8efc2e400231ad7d4af94ff9270cd5b50248d4c9",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"composer/installers": "~1.0"
|
||||
"composer/installers": "~1.0",
|
||||
"enshrined/svg-sanitize": "^0.18.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"wp-coding-standards/wpcs": "^0.10.0"
|
||||
},
|
||||
"time": "2021-05-05T18:52:26+00:00",
|
||||
"time": "2024-05-13T08:27:15+00:00",
|
||||
"default-branch": true,
|
||||
"type": "wordpress-plugin",
|
||||
"installation-source": "dist",
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
@ -86,6 +88,9 @@
|
||||
"plugin",
|
||||
"wordpress"
|
||||
],
|
||||
"support": {
|
||||
"source": "https://github.com/Codeinwp/icon-picker/tree/master"
|
||||
},
|
||||
"install-path": "../codeinwp/icon-picker"
|
||||
},
|
||||
{
|
||||
@ -164,6 +169,54 @@
|
||||
"wordpress"
|
||||
],
|
||||
"install-path": "../codeinwp/themeisle-sdk"
|
||||
},
|
||||
{
|
||||
"name": "enshrined/svg-sanitize",
|
||||
"version": "0.18.0",
|
||||
"version_normalized": "0.18.0.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/darylldoyle/svg-sanitizer.git",
|
||||
"reference": "6a2c069dab3843ca4d887ff09c972fc7033888d0"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/6a2c069dab3843ca4d887ff09c972fc7033888d0",
|
||||
"reference": "6a2c069dab3843ca4d887ff09c972fc7033888d0",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"ext-dom": "*",
|
||||
"ext-libxml": "*",
|
||||
"php": "^5.6 || ^7.0 || ^8.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": "^5.7 || ^6.5 || ^8.5"
|
||||
},
|
||||
"time": "2024-02-22T17:51:05+00:00",
|
||||
"type": "library",
|
||||
"installation-source": "dist",
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"enshrined\\svgSanitize\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"GPL-2.0-or-later"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Daryll Doyle",
|
||||
"email": "daryll@enshrined.co.uk"
|
||||
}
|
||||
],
|
||||
"description": "An SVG sanitizer for PHP",
|
||||
"support": {
|
||||
"issues": "https://github.com/darylldoyle/svg-sanitizer/issues",
|
||||
"source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.18.0"
|
||||
},
|
||||
"install-path": "../enshrined/svg-sanitize"
|
||||
}
|
||||
],
|
||||
"dev": false,
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
<?php return array(
|
||||
'root' => array(
|
||||
'name' => 'codeinwp/wp-menu-icons',
|
||||
'pretty_version' => 'v0.13.13',
|
||||
'version' => '0.13.13.0',
|
||||
'reference' => '1d9b7a1bc87b0942bb633546596245b44c1dd15e',
|
||||
'pretty_version' => 'v0.13.14',
|
||||
'version' => '0.13.14.0',
|
||||
'reference' => 'a7c071a7be5a809a8379624381d823e2d9b20e50',
|
||||
'type' => 'wordpress-plugin',
|
||||
'install_path' => __DIR__ . '/../../',
|
||||
'aliases' => array(),
|
||||
@ -22,10 +22,12 @@
|
||||
'codeinwp/icon-picker' => array(
|
||||
'pretty_version' => 'dev-master',
|
||||
'version' => 'dev-master',
|
||||
'reference' => '0c60ce3a41653e41a20e710c4d5a6a2104c85020',
|
||||
'reference' => '8efc2e400231ad7d4af94ff9270cd5b50248d4c9',
|
||||
'type' => 'wordpress-plugin',
|
||||
'install_path' => __DIR__ . '/../codeinwp/icon-picker',
|
||||
'aliases' => array(),
|
||||
'aliases' => array(
|
||||
0 => '9999999-dev',
|
||||
),
|
||||
'dev_requirement' => false,
|
||||
),
|
||||
'codeinwp/menu-item-custom-fields' => array(
|
||||
@ -47,9 +49,9 @@
|
||||
'dev_requirement' => false,
|
||||
),
|
||||
'codeinwp/wp-menu-icons' => array(
|
||||
'pretty_version' => 'v0.13.13',
|
||||
'version' => '0.13.13.0',
|
||||
'reference' => '1d9b7a1bc87b0942bb633546596245b44c1dd15e',
|
||||
'pretty_version' => 'v0.13.14',
|
||||
'version' => '0.13.14.0',
|
||||
'reference' => 'a7c071a7be5a809a8379624381d823e2d9b20e50',
|
||||
'type' => 'wordpress-plugin',
|
||||
'install_path' => __DIR__ . '/../../',
|
||||
'aliases' => array(),
|
||||
@ -61,5 +63,14 @@
|
||||
0 => '*',
|
||||
),
|
||||
),
|
||||
'enshrined/svg-sanitize' => array(
|
||||
'pretty_version' => '0.18.0',
|
||||
'version' => '0.18.0.0',
|
||||
'reference' => '6a2c069dab3843ca4d887ff09c972fc7033888d0',
|
||||
'type' => 'library',
|
||||
'install_path' => __DIR__ . '/../enshrined/svg-sanitize',
|
||||
'aliases' => array(),
|
||||
'dev_requirement' => false,
|
||||
),
|
||||
),
|
||||
);
|
||||
|
||||
26
wp-content/plugins/menu-icons/vendor/composer/platform_check.php
vendored
Normal file
26
wp-content/plugins/menu-icons/vendor/composer/platform_check.php
vendored
Normal file
@ -0,0 +1,26 @@
|
||||
<?php
|
||||
|
||||
// platform_check.php @generated by Composer
|
||||
|
||||
$issues = array();
|
||||
|
||||
if (!(PHP_VERSION_ID >= 50600)) {
|
||||
$issues[] = 'Your Composer dependencies require a PHP version ">= 5.6.0". You are running ' . PHP_VERSION . '.';
|
||||
}
|
||||
|
||||
if ($issues) {
|
||||
if (!headers_sent()) {
|
||||
header('HTTP/1.1 500 Internal Server Error');
|
||||
}
|
||||
if (!ini_get('display_errors')) {
|
||||
if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
|
||||
fwrite(STDERR, 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . implode(PHP_EOL, $issues) . PHP_EOL.PHP_EOL);
|
||||
} elseif (!headers_sent()) {
|
||||
echo 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . str_replace('You are running '.PHP_VERSION.'.', '', implode(PHP_EOL, $issues)) . PHP_EOL.PHP_EOL;
|
||||
}
|
||||
}
|
||||
trigger_error(
|
||||
'Composer detected issues in your platform: ' . implode(' ', $issues),
|
||||
E_USER_ERROR
|
||||
);
|
||||
}
|
||||
340
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/LICENSE
vendored
Normal file
340
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/LICENSE
vendored
Normal file
@ -0,0 +1,340 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/>
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
{description}
|
||||
Copyright (C) {year} {fullname}
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
{signature of Ty Coon}, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
|
||||
93
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/README.md
vendored
Normal file
93
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/README.md
vendored
Normal file
@ -0,0 +1,93 @@
|
||||
# svg-sanitizer
|
||||
|
||||
[](https://travis-ci.org/darylldoyle/svg-sanitizer) [](https://codeclimate.com/github/darylldoyle/svg-sanitizer/coverage)
|
||||
|
||||
This is my attempt at building a decent SVG sanitizer in PHP. The work is largely borrowed from [DOMPurify](https://github.com/cure53/DOMPurify).
|
||||
|
||||
## Installation
|
||||
|
||||
Either require `enshrined/svg-sanitize` through composer or download the repo and include the old way!
|
||||
|
||||
## Usage
|
||||
|
||||
Using this is fairly easy. Create a new instance of `enshrined\svgSanitize\Sanitizer` and then call the `sanitize` whilst passing in your dirty SVG/XML
|
||||
|
||||
**Basic Example**
|
||||
|
||||
```php
|
||||
use enshrined\svgSanitize\Sanitizer;
|
||||
|
||||
// Create a new sanitizer instance
|
||||
$sanitizer = new Sanitizer();
|
||||
|
||||
// Load the dirty svg
|
||||
$dirtySVG = file_get_contents('filthy.svg');
|
||||
|
||||
// Pass it to the sanitizer and get it back clean
|
||||
$cleanSVG = $sanitizer->sanitize($dirtySVG);
|
||||
|
||||
// Now do what you want with your clean SVG/XML data
|
||||
|
||||
```
|
||||
|
||||
## Output
|
||||
|
||||
This will either return a sanitized SVG/XML string or boolean `false` if XML parsing failed (usually due to a badly formatted file).
|
||||
|
||||
## Options
|
||||
|
||||
You may pass your own whitelist of tags and attributes by using the `Sanitizer::setAllowedTags` and `Sanitizer::setAllowedAttrs` methods respectively.
|
||||
|
||||
These methods require that you implement the `enshrined\svgSanitize\data\TagInterface` or `enshrined\svgSanitize\data\AttributeInterface`.
|
||||
|
||||
## Remove remote references
|
||||
|
||||
You have the option to remove attributes that reference remote files, this will stop HTTP leaks but will add an overhead to the sanitizer.
|
||||
|
||||
This defaults to false, set to true to remove references.
|
||||
|
||||
`$sanitizer->removeRemoteReferences(true);`
|
||||
|
||||
## Viewing Sanitization Issues
|
||||
|
||||
You may use the `getXmlIssues()` method to return an array of issues that occurred during sanitization.
|
||||
|
||||
This may be useful for logging or providing feedback to the user on why an SVG was refused.
|
||||
|
||||
`$issues = $sanitizer->getXmlIssues();`
|
||||
|
||||
## Minification
|
||||
|
||||
You can minify the XML output by calling `$sanitizer->minify(true);`.
|
||||
|
||||
## Demo
|
||||
There is a demo available at: [http://svg.enshrined.co.uk/](http://svg.enshrined.co.uk/)
|
||||
|
||||
## WordPress
|
||||
|
||||
I've just released a WordPress plugin containing this code so you can sanitize your WordPress uploads. It's available from the WordPress plugin directory: [https://wordpress.org/plugins/safe-svg/](https://wordpress.org/plugins/safe-svg/)
|
||||
|
||||
## Drupal
|
||||
|
||||
[Michael Potter](https://github.com/heyMP) has kindly created a Drupal module for this library which is available at: [https://www.drupal.org/project/svg_sanitizer](https://www.drupal.org/project/svg_sanitizer)
|
||||
|
||||
## TYPO3
|
||||
|
||||
This SVG sanitizer library is used per default in the core of TYPO3 v9 and later versions.
|
||||
See [corresponding changelog entry](https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/9.5.x/Important-94492-IntroduceSVGSanitizer.html) for more details.
|
||||
|
||||
## Tests
|
||||
|
||||
You can run these by running `vendor/bin/phpunit` from the base directory of this package.
|
||||
|
||||
## Standalone scanning of files via CLI
|
||||
|
||||
Thanks to the work by [gudmdharalds](https://github.com/gudmdharalds) there's now a standalone scanner that can be used via the CLI.
|
||||
|
||||
Any errors will be output in JSON format. See [the PR](https://github.com/darylldoyle/svg-sanitizer/pull/25) for an example.
|
||||
|
||||
Use it as follows: `php svg-scanner.php ~/svgs/myfile.svg`
|
||||
|
||||
## To-Do
|
||||
|
||||
More extensive testing for the SVGs/XML would be lovely, I'll try and add these soon. If you feel like doing it for me, please do and make a PR!
|
||||
169
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/ElementReference/Resolver.php
vendored
Normal file
169
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/ElementReference/Resolver.php
vendored
Normal file
@ -0,0 +1,169 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\ElementReference;
|
||||
|
||||
use enshrined\svgSanitize\data\XPath;
|
||||
use enshrined\svgSanitize\Exceptions\NestingException;
|
||||
use enshrined\svgSanitize\Helper;
|
||||
|
||||
class Resolver
|
||||
{
|
||||
/**
|
||||
* @var XPath
|
||||
*/
|
||||
protected $xPath;
|
||||
|
||||
/**
|
||||
* @var Subject[]
|
||||
*/
|
||||
protected $subjects = [];
|
||||
|
||||
/**
|
||||
* @var array DOMElement[]
|
||||
*/
|
||||
protected $elementsToRemove = [];
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useNestingLimit;
|
||||
|
||||
public function __construct(XPath $xPath, $useNestingLimit)
|
||||
{
|
||||
$this->xPath = $xPath;
|
||||
$this->useNestingLimit = $useNestingLimit;
|
||||
}
|
||||
|
||||
public function collect()
|
||||
{
|
||||
$this->collectIdentifiedElements();
|
||||
$this->processReferences();
|
||||
$this->determineInvalidSubjects();
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolves one subject by element.
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @param bool $considerChildren Whether to search in Subject's children as well
|
||||
* @return Subject|null
|
||||
*/
|
||||
public function findByElement(\DOMElement $element, $considerChildren = false)
|
||||
{
|
||||
foreach ($this->subjects as $subject) {
|
||||
if (
|
||||
$element === $subject->getElement()
|
||||
|| $considerChildren && Helper::isElementContainedIn($element, $subject->getElement())
|
||||
) {
|
||||
return $subject;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolves subjects (plural!) by element id - in theory malformed
|
||||
* DOM might have same ids assigned to different elements and leaving
|
||||
* it to client/browser implementation which element to actually use.
|
||||
*
|
||||
* @param string $elementId
|
||||
* @return Subject[]
|
||||
*/
|
||||
public function findByElementId($elementId)
|
||||
{
|
||||
return array_filter(
|
||||
$this->subjects,
|
||||
function (Subject $subject) use ($elementId) {
|
||||
return $elementId === $subject->getElementId();
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Collects elements having `id` attribute (those that can be referenced).
|
||||
*/
|
||||
protected function collectIdentifiedElements()
|
||||
{
|
||||
/** @var \DOMNodeList|\DOMElement[] $elements */
|
||||
$elements = $this->xPath->query('//*[@id]');
|
||||
foreach ($elements as $element) {
|
||||
$this->subjects[$element->getAttribute('id')] = new Subject($element, $this->useNestingLimit);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Processes references from and to elements having `id` attribute concerning
|
||||
* their occurrence in `<use ... xlink:href="#identifier">` statements.
|
||||
*/
|
||||
protected function processReferences()
|
||||
{
|
||||
$useNodeName = $this->xPath->createNodeName('use');
|
||||
foreach ($this->subjects as $subject) {
|
||||
$useElements = $this->xPath->query(
|
||||
$useNodeName . '[@href or @xlink:href]',
|
||||
$subject->getElement()
|
||||
);
|
||||
|
||||
/** @var \DOMElement $useElement */
|
||||
foreach ($useElements as $useElement) {
|
||||
$useId = Helper::extractIdReferenceFromHref(
|
||||
Helper::getElementHref($useElement)
|
||||
);
|
||||
if ($useId === null || !isset($this->subjects[$useId])) {
|
||||
continue;
|
||||
}
|
||||
$subject->addUse($this->subjects[$useId]);
|
||||
$this->subjects[$useId]->addUsedIn($subject);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines and tags infinite loops.
|
||||
*/
|
||||
protected function determineInvalidSubjects()
|
||||
{
|
||||
foreach ($this->subjects as $subject) {
|
||||
|
||||
if (in_array($subject->getElement(), $this->elementsToRemove)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$useId = Helper::extractIdReferenceFromHref(
|
||||
Helper::getElementHref($subject->getElement())
|
||||
);
|
||||
|
||||
try {
|
||||
if ($useId === $subject->getElementId()) {
|
||||
$this->markSubjectAsInvalid($subject);
|
||||
} elseif ($subject->hasInfiniteLoop()) {
|
||||
$this->markSubjectAsInvalid($subject);
|
||||
}
|
||||
} catch (NestingException $e) {
|
||||
$this->elementsToRemove[] = $e->getElement();
|
||||
$this->markSubjectAsInvalid($subject);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all the elements that caused a nesting exception.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getElementsToRemove() {
|
||||
return $this->elementsToRemove;
|
||||
}
|
||||
|
||||
/**
|
||||
* The Subject is invalid for some reason, therefore we should
|
||||
* remove it and all it's child usages.
|
||||
*
|
||||
* @param Subject $subject
|
||||
*/
|
||||
protected function markSubjectAsInvalid(Subject $subject) {
|
||||
$this->elementsToRemove = array_merge(
|
||||
$this->elementsToRemove,
|
||||
$subject->clearInternalAndGetAffectedElements()
|
||||
);
|
||||
}
|
||||
}
|
||||
153
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/ElementReference/Subject.php
vendored
Normal file
153
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/ElementReference/Subject.php
vendored
Normal file
@ -0,0 +1,153 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\ElementReference;
|
||||
|
||||
class Subject
|
||||
{
|
||||
/**
|
||||
* @var \DOMElement
|
||||
*/
|
||||
protected $element;
|
||||
|
||||
/**
|
||||
* @var Usage[]
|
||||
*/
|
||||
protected $useCollection = [];
|
||||
|
||||
/**
|
||||
* @var Usage[]
|
||||
*/
|
||||
protected $usedInCollection = [];
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useNestingLimit;
|
||||
|
||||
/**
|
||||
* Subject constructor.
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @param int $useNestingLimit
|
||||
*/
|
||||
public function __construct(\DOMElement $element, $useNestingLimit)
|
||||
{
|
||||
$this->element = $element;
|
||||
$this->useNestingLimit = $useNestingLimit;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return \DOMElement
|
||||
*/
|
||||
public function getElement()
|
||||
{
|
||||
return $this->element;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getElementId()
|
||||
{
|
||||
return $this->element->getAttribute('id');
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $subjects Previously processed subjects
|
||||
* @param int $level The current level of nesting.
|
||||
* @return bool
|
||||
* @throws \enshrined\svgSanitize\Exceptions\NestingException
|
||||
*/
|
||||
public function hasInfiniteLoop(array $subjects = [], $level = 1)
|
||||
{
|
||||
if ($level > $this->useNestingLimit) {
|
||||
throw new \enshrined\svgSanitize\Exceptions\NestingException('Nesting level too high, aborting', 1570713498, null, $this->getElement());
|
||||
}
|
||||
|
||||
if (in_array($this, $subjects, true)) {
|
||||
return true;
|
||||
}
|
||||
$subjects[] = $this;
|
||||
foreach ($this->useCollection as $usage) {
|
||||
if ($usage->getSubject()->hasInfiniteLoop($subjects, $level + 1)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param Subject $subject
|
||||
*/
|
||||
public function addUse(Subject $subject)
|
||||
{
|
||||
if ($subject === $this) {
|
||||
throw new \LogicException('Cannot add self usage', 1570713416);
|
||||
}
|
||||
$identifier = $subject->getElementId();
|
||||
if (isset($this->useCollection[$identifier])) {
|
||||
$this->useCollection[$identifier]->increment();
|
||||
return;
|
||||
}
|
||||
$this->useCollection[$identifier] = new Usage($subject);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param Subject $subject
|
||||
*/
|
||||
public function addUsedIn(Subject $subject)
|
||||
{
|
||||
if ($subject === $this) {
|
||||
throw new \LogicException('Cannot add self as usage', 1570713417);
|
||||
}
|
||||
$identifier = $subject->getElementId();
|
||||
if (isset($this->usedInCollection[$identifier])) {
|
||||
$this->usedInCollection[$identifier]->increment();
|
||||
return;
|
||||
}
|
||||
$this->usedInCollection[$identifier] = new Usage($subject);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param bool $accumulated
|
||||
* @return int
|
||||
*/
|
||||
public function countUse($accumulated = false)
|
||||
{
|
||||
$count = 0;
|
||||
foreach ($this->useCollection as $use) {
|
||||
$useCount = $use->getSubject()->countUse();
|
||||
$count += $use->getCount() * ($accumulated ? 1 + $useCount : max(1, $useCount));
|
||||
}
|
||||
return $count;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return int
|
||||
*/
|
||||
public function countUsedIn()
|
||||
{
|
||||
$count = 0;
|
||||
foreach ($this->usedInCollection as $usedIn) {
|
||||
$count += $usedIn->getCount() * max(1, $usedIn->getSubject()->countUsedIn());
|
||||
}
|
||||
return $count;
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear the internal arrays (to free up memory as they can get big)
|
||||
* and return all the child usages DOMElement's
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function clearInternalAndGetAffectedElements()
|
||||
{
|
||||
$elements = array_map(function(Usage $usage) {
|
||||
return $usage->getSubject()->getElement();
|
||||
}, $this->useCollection);
|
||||
|
||||
$this->usedInCollection = [];
|
||||
$this->useCollection = [];
|
||||
|
||||
return $elements;
|
||||
}
|
||||
}
|
||||
49
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/ElementReference/Usage.php
vendored
Normal file
49
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/ElementReference/Usage.php
vendored
Normal file
@ -0,0 +1,49 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\ElementReference;
|
||||
|
||||
class Usage
|
||||
{
|
||||
/**
|
||||
* @var Subject
|
||||
*/
|
||||
protected $subject;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $count;
|
||||
|
||||
/**
|
||||
* @param Subject $subject
|
||||
* @param int $count
|
||||
*/
|
||||
public function __construct(Subject $subject, $count = 1)
|
||||
{
|
||||
$this->subject = $subject;
|
||||
$this->count = (int)$count;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param int $by
|
||||
*/
|
||||
public function increment($by = 1)
|
||||
{
|
||||
$this->count += (int)$by;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return Subject
|
||||
*/
|
||||
public function getSubject()
|
||||
{
|
||||
return $this->subject;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return int
|
||||
*/
|
||||
public function getCount()
|
||||
{
|
||||
return $this->count;
|
||||
}
|
||||
}
|
||||
36
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/Exceptions/NestingException.php
vendored
Normal file
36
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/Exceptions/NestingException.php
vendored
Normal file
@ -0,0 +1,36 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\Exceptions;
|
||||
|
||||
use Exception;
|
||||
|
||||
class NestingException extends \Exception
|
||||
{
|
||||
/**
|
||||
* @var \DOMElement
|
||||
*/
|
||||
protected $element;
|
||||
|
||||
/**
|
||||
* NestingException constructor.
|
||||
*
|
||||
* @param string $message
|
||||
* @param int $code
|
||||
* @param Exception|null $previous
|
||||
* @param \DOMElement|null $element
|
||||
*/
|
||||
public function __construct($message = "", $code = 0, Exception $previous = null, \DOMElement $element = null)
|
||||
{
|
||||
$this->element = $element;
|
||||
parent::__construct($message, $code, $previous);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the element that caused the exception.
|
||||
*
|
||||
* @return \DOMElement
|
||||
*/
|
||||
public function getElement()
|
||||
{
|
||||
return $this->element;
|
||||
}
|
||||
}
|
||||
53
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/Helper.php
vendored
Normal file
53
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/Helper.php
vendored
Normal file
@ -0,0 +1,53 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize;
|
||||
|
||||
class Helper
|
||||
{
|
||||
/**
|
||||
* @param \DOMElement $element
|
||||
* @return string|null
|
||||
*/
|
||||
public static function getElementHref(\DOMElement $element)
|
||||
{
|
||||
if ($element->hasAttribute('href')) {
|
||||
return $element->getAttribute('href');
|
||||
}
|
||||
if ($element->hasAttributeNS('http://www.w3.org/1999/xlink', 'href')) {
|
||||
return $element->getAttributeNS('http://www.w3.org/1999/xlink', 'href');
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $href
|
||||
* @return string|null
|
||||
*/
|
||||
public static function extractIdReferenceFromHref($href)
|
||||
{
|
||||
if (!is_string($href) || strpos($href, '#') !== 0) {
|
||||
return null;
|
||||
}
|
||||
return substr($href, 1);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param \DOMElement $needle
|
||||
* @param \DOMElement $haystack
|
||||
* @return bool
|
||||
*/
|
||||
public static function isElementContainedIn(\DOMElement $needle, \DOMElement $haystack)
|
||||
{
|
||||
if ($needle === $haystack) {
|
||||
return true;
|
||||
}
|
||||
foreach ($haystack->childNodes as $childNode) {
|
||||
if (!$childNode instanceof \DOMElement) {
|
||||
continue;
|
||||
}
|
||||
if (self::isElementContainedIn($needle, $childNode)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
701
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/Sanitizer.php
vendored
Normal file
701
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/Sanitizer.php
vendored
Normal file
@ -0,0 +1,701 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize;
|
||||
|
||||
use enshrined\svgSanitize\data\AllowedAttributes;
|
||||
use enshrined\svgSanitize\data\AllowedTags;
|
||||
use enshrined\svgSanitize\data\AttributeInterface;
|
||||
use enshrined\svgSanitize\data\TagInterface;
|
||||
use enshrined\svgSanitize\data\XPath;
|
||||
use enshrined\svgSanitize\ElementReference\Resolver;
|
||||
|
||||
/**
|
||||
* Class Sanitizer
|
||||
*
|
||||
* @package enshrined\svgSanitize
|
||||
*/
|
||||
class Sanitizer
|
||||
{
|
||||
|
||||
/**
|
||||
* @var \DOMDocument
|
||||
*/
|
||||
protected $xmlDocument;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
protected $allowedTags;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
protected $allowedAttrs;
|
||||
|
||||
/**
|
||||
* @var
|
||||
*/
|
||||
protected $xmlLoaderValue;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $xmlErrorHandlerPreviousValue;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $minifyXML = false;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $removeRemoteReferences = false;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useThreshold = 1000;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $removeXMLTag = false;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $xmlOptions = LIBXML_NOEMPTYTAG;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
protected $xmlIssues = array();
|
||||
|
||||
/**
|
||||
* @var Resolver
|
||||
*/
|
||||
protected $elementReferenceResolver;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
protected $useNestingLimit = 15;
|
||||
|
||||
/**
|
||||
* @var bool
|
||||
*/
|
||||
protected $allowHugeFiles = false;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
function __construct()
|
||||
{
|
||||
// Load default tags/attributes
|
||||
$this->allowedAttrs = array_map('strtolower', AllowedAttributes::getAttributes());
|
||||
$this->allowedTags = array_map('strtolower', AllowedTags::getTags());
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up the DOMDocument
|
||||
*/
|
||||
protected function resetInternal()
|
||||
{
|
||||
$this->xmlDocument = new \DOMDocument();
|
||||
$this->xmlDocument->preserveWhiteSpace = false;
|
||||
$this->xmlDocument->strictErrorChecking = false;
|
||||
$this->xmlDocument->formatOutput = !$this->minifyXML;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set XML options to use when saving XML
|
||||
* See: DOMDocument::saveXML
|
||||
*
|
||||
* @param int $xmlOptions
|
||||
*/
|
||||
public function setXMLOptions($xmlOptions)
|
||||
{
|
||||
$this->xmlOptions = $xmlOptions;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get XML options to use when saving XML
|
||||
* See: DOMDocument::saveXML
|
||||
*
|
||||
* @return int
|
||||
*/
|
||||
public function getXMLOptions()
|
||||
{
|
||||
return $this->xmlOptions;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the array of allowed tags
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getAllowedTags()
|
||||
{
|
||||
return $this->allowedTags;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set custom allowed tags
|
||||
*
|
||||
* @param TagInterface $allowedTags
|
||||
*/
|
||||
public function setAllowedTags(TagInterface $allowedTags)
|
||||
{
|
||||
$this->allowedTags = array_map('strtolower', $allowedTags::getTags());
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the array of allowed attributes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getAllowedAttrs()
|
||||
{
|
||||
return $this->allowedAttrs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set custom allowed attributes
|
||||
*
|
||||
* @param AttributeInterface $allowedAttrs
|
||||
*/
|
||||
public function setAllowedAttrs(AttributeInterface $allowedAttrs)
|
||||
{
|
||||
$this->allowedAttrs = array_map('strtolower', $allowedAttrs::getAttributes());
|
||||
}
|
||||
|
||||
/**
|
||||
* Should we remove references to remote files?
|
||||
*
|
||||
* @param bool $removeRemoteRefs
|
||||
*/
|
||||
public function removeRemoteReferences($removeRemoteRefs = false)
|
||||
{
|
||||
$this->removeRemoteReferences = $removeRemoteRefs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get XML issues.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getXmlIssues() {
|
||||
return $this->xmlIssues;
|
||||
}
|
||||
|
||||
/**
|
||||
* Can we allow huge files?
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
public function getAllowHugeFiles() {
|
||||
return $this->allowHugeFiles;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set whether we can allow huge files.
|
||||
*
|
||||
* @param bool $allowHugeFiles
|
||||
*/
|
||||
public function setAllowHugeFiles( $allowHugeFiles ) {
|
||||
$this->allowHugeFiles = $allowHugeFiles;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Sanitize the passed string
|
||||
*
|
||||
* @param string $dirty
|
||||
* @return string|false
|
||||
*/
|
||||
public function sanitize($dirty)
|
||||
{
|
||||
// Don't run on an empty string
|
||||
if (empty($dirty)) {
|
||||
return '';
|
||||
}
|
||||
|
||||
// Strip php tags
|
||||
$dirty = preg_replace('/<\?(=|php)(.+?)\?>/i', '', $dirty);
|
||||
|
||||
$this->resetInternal();
|
||||
$this->setUpBefore();
|
||||
|
||||
$loaded = $this->xmlDocument->loadXML($dirty, $this->getAllowHugeFiles() ? LIBXML_PARSEHUGE : 0);
|
||||
|
||||
// If we couldn't parse the XML then we go no further. Reset and return false
|
||||
if (!$loaded) {
|
||||
$this->resetAfter();
|
||||
return false;
|
||||
}
|
||||
|
||||
// Pre-process all identified elements
|
||||
$xPath = new XPath($this->xmlDocument);
|
||||
$this->elementReferenceResolver = new Resolver($xPath, $this->useNestingLimit);
|
||||
$this->elementReferenceResolver->collect();
|
||||
$elementsToRemove = $this->elementReferenceResolver->getElementsToRemove();
|
||||
|
||||
// Start the cleaning process
|
||||
$this->startClean($this->xmlDocument->childNodes, $elementsToRemove);
|
||||
|
||||
// Save cleaned XML to a variable
|
||||
if ($this->removeXMLTag) {
|
||||
$clean = $this->xmlDocument->saveXML($this->xmlDocument->documentElement, $this->xmlOptions);
|
||||
} else {
|
||||
$clean = $this->xmlDocument->saveXML($this->xmlDocument, $this->xmlOptions);
|
||||
}
|
||||
|
||||
$this->resetAfter();
|
||||
|
||||
// Remove any extra whitespaces when minifying
|
||||
if ($this->minifyXML) {
|
||||
$clean = preg_replace('/\s+/', ' ', $clean);
|
||||
}
|
||||
|
||||
// Return result
|
||||
return $clean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up libXML before we start
|
||||
*/
|
||||
protected function setUpBefore()
|
||||
{
|
||||
// This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is
|
||||
// disabled by default, so this function is no longer needed to protect against XXE attacks.
|
||||
if (\LIBXML_VERSION < 20900) {
|
||||
// Turn off the entity loader
|
||||
$this->xmlLoaderValue = libxml_disable_entity_loader(true);
|
||||
}
|
||||
|
||||
// Suppress the errors because we don't really have to worry about formation before cleansing.
|
||||
// See reset in resetAfter().
|
||||
$this->xmlErrorHandlerPreviousValue = libxml_use_internal_errors(true);
|
||||
|
||||
// Reset array of altered XML
|
||||
$this->xmlIssues = array();
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset the class after use
|
||||
*/
|
||||
protected function resetAfter()
|
||||
{
|
||||
// This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is
|
||||
// disabled by default, so this function is no longer needed to protect against XXE attacks.
|
||||
if (\LIBXML_VERSION < 20900) {
|
||||
// Reset the entity loader
|
||||
libxml_disable_entity_loader($this->xmlLoaderValue);
|
||||
}
|
||||
|
||||
libxml_clear_errors();
|
||||
libxml_use_internal_errors($this->xmlErrorHandlerPreviousValue);
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the cleaning with tags, then we move onto attributes and hrefs later
|
||||
*
|
||||
* @param \DOMNodeList $elements
|
||||
* @param array $elementsToRemove
|
||||
*/
|
||||
protected function startClean(\DOMNodeList $elements, array $elementsToRemove)
|
||||
{
|
||||
// loop through all elements
|
||||
// we do this backwards so we don't skip anything if we delete a node
|
||||
// see comments at: http://php.net/manual/en/class.domnamednodemap.php
|
||||
for ($i = $elements->length - 1; $i >= 0; $i--) {
|
||||
/** @var \DOMElement $currentElement */
|
||||
$currentElement = $elements->item($i);
|
||||
|
||||
/**
|
||||
* If the element has exceeded the nesting limit, we should remove it.
|
||||
*
|
||||
* As it's only <use> elements that cause us issues with nesting DOS attacks
|
||||
* we should check what the element is before removing it. For now we'll only
|
||||
* remove <use> elements.
|
||||
*/
|
||||
if (in_array($currentElement, $elementsToRemove) && 'use' === $currentElement->nodeName) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Invalid \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
|
||||
if ($currentElement instanceof \DOMElement) {
|
||||
// If the tag isn't in the whitelist, remove it and continue with next iteration
|
||||
if (!in_array(strtolower($currentElement->tagName), $this->allowedTags)) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious tag \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->cleanHrefs( $currentElement );
|
||||
|
||||
$this->cleanXlinkHrefs( $currentElement );
|
||||
|
||||
$this->cleanAttributesOnWhitelist($currentElement);
|
||||
|
||||
if (strtolower($currentElement->tagName) === 'use') {
|
||||
if ($this->isUseTagDirty($currentElement)
|
||||
|| $this->isUseTagExceedingThreshold($currentElement)
|
||||
) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
// Strip out font elements that will break out of foreign content.
|
||||
if (strtolower($currentElement->tagName) === 'font') {
|
||||
$breaksOutOfForeignContent = false;
|
||||
for ($x = $currentElement->attributes->length - 1; $x >= 0; $x--) {
|
||||
// get attribute name
|
||||
$attrName = $currentElement->attributes->item( $x )->name;
|
||||
|
||||
if (in_array(strtolower($attrName), ['face', 'color', 'size'])) {
|
||||
$breaksOutOfForeignContent = true;
|
||||
}
|
||||
}
|
||||
|
||||
if ($breaksOutOfForeignContent) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious tag \'' . $currentElement->tagName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$this->cleanUnsafeNodes($currentElement);
|
||||
|
||||
if ($currentElement->hasChildNodes()) {
|
||||
$this->startClean($currentElement->childNodes, $elementsToRemove);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Only allow attributes that are on the whitelist
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
*/
|
||||
protected function cleanAttributesOnWhitelist(\DOMElement $element)
|
||||
{
|
||||
for ($x = $element->attributes->length - 1; $x >= 0; $x--) {
|
||||
// get attribute name
|
||||
$attrName = $element->attributes->item($x)->name;
|
||||
|
||||
// Remove attribute if not in whitelist
|
||||
if (!in_array(strtolower($attrName), $this->allowedAttrs) && !$this->isAriaAttribute(strtolower($attrName)) && !$this->isDataAttribute(strtolower($attrName))) {
|
||||
|
||||
$element->removeAttribute($attrName);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'' . $attrName . '\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* This is used for when a namespace isn't imported properly.
|
||||
* Such as xlink:href when the xlink namespace isn't imported.
|
||||
* We have to do this as the link is still ran in this case.
|
||||
*/
|
||||
if (false !== strpos($attrName, 'href')) {
|
||||
$href = $element->getAttribute($attrName);
|
||||
if (false === $this->isHrefSafeValue($href)) {
|
||||
$element->removeAttribute($attrName);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'href\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Do we want to strip remote references?
|
||||
if($this->removeRemoteReferences) {
|
||||
// Remove attribute if it has a remote reference
|
||||
if (isset($element->attributes->item($x)->value) && $this->hasRemoteReference($element->attributes->item($x)->value)) {
|
||||
$element->removeAttribute($attrName);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'' . $attrName . '\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean the xlink:hrefs of script and data embeds
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
*/
|
||||
protected function cleanXlinkHrefs(\DOMElement $element)
|
||||
{
|
||||
$xlinks = $element->getAttributeNS('http://www.w3.org/1999/xlink', 'href');
|
||||
if (false === $this->isHrefSafeValue($xlinks)) {
|
||||
$element->removeAttributeNS( 'http://www.w3.org/1999/xlink', 'href' );
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'href\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean the hrefs of script and data embeds
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
*/
|
||||
protected function cleanHrefs(\DOMElement $element)
|
||||
{
|
||||
$href = $element->getAttribute('href');
|
||||
if (false === $this->isHrefSafeValue($href)) {
|
||||
$element->removeAttribute('href');
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious attribute \'href\'',
|
||||
'line' => $element->getLineNo(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Only allow whitelisted starts to be within the href.
|
||||
*
|
||||
* This will stop scripts etc from being passed through, with or without attempting to hide bypasses.
|
||||
* This stops the need for us to use a complicated script regex.
|
||||
*
|
||||
* @param $value
|
||||
* @return bool
|
||||
*/
|
||||
protected function isHrefSafeValue($value) {
|
||||
|
||||
// Allow empty values
|
||||
if (empty($value)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow fragment identifiers.
|
||||
if ('#' === substr($value, 0, 1)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow relative URIs.
|
||||
if ('/' === substr($value, 0, 1)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow HTTPS domains.
|
||||
if ('https://' === substr($value, 0, 8)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow HTTP domains.
|
||||
if ('http://' === substr($value, 0, 7)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow known data URIs.
|
||||
if (in_array(substr($value, 0, 14), array(
|
||||
'data:image/png', // PNG
|
||||
'data:image/gif', // GIF
|
||||
'data:image/jpg', // JPG
|
||||
'data:image/jpe', // JPEG
|
||||
'data:image/pjp', // PJPEG
|
||||
))) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Allow known short data URIs.
|
||||
if (in_array(substr($value, 0, 12), array(
|
||||
'data:img/png', // PNG
|
||||
'data:img/gif', // GIF
|
||||
'data:img/jpg', // JPG
|
||||
'data:img/jpe', // JPEG
|
||||
'data:img/pjp', // PJPEG
|
||||
))) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Removes non-printable ASCII characters from string & trims it
|
||||
*
|
||||
* @param string $value
|
||||
* @return bool
|
||||
*/
|
||||
protected function removeNonPrintableCharacters($value)
|
||||
{
|
||||
return trim(preg_replace('/[^ -~]/xu','',$value));
|
||||
}
|
||||
|
||||
/**
|
||||
* Does this attribute value have a remote reference?
|
||||
*
|
||||
* @param $value
|
||||
* @return bool
|
||||
*/
|
||||
protected function hasRemoteReference($value)
|
||||
{
|
||||
$value = $this->removeNonPrintableCharacters($value);
|
||||
|
||||
$wrapped_in_url = preg_match('~^url\(\s*[\'"]\s*(.*)\s*[\'"]\s*\)$~xi', $value, $match);
|
||||
if (!$wrapped_in_url){
|
||||
return false;
|
||||
}
|
||||
|
||||
$value = trim($match[1], '\'"');
|
||||
|
||||
return preg_match('~^((https?|ftp|file):)?//~xi', $value);
|
||||
}
|
||||
|
||||
/**
|
||||
* Should we minify the output?
|
||||
*
|
||||
* @param bool $shouldMinify
|
||||
*/
|
||||
public function minify($shouldMinify = false)
|
||||
{
|
||||
$this->minifyXML = (bool) $shouldMinify;
|
||||
}
|
||||
|
||||
/**
|
||||
* Should we remove the XML tag in the header?
|
||||
*
|
||||
* @param bool $removeXMLTag
|
||||
*/
|
||||
public function removeXMLTag($removeXMLTag = false)
|
||||
{
|
||||
$this->removeXMLTag = (bool) $removeXMLTag;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether `<use ... xlink:href="#identifier">` elements shall be
|
||||
* removed in case expansion would exceed this threshold.
|
||||
*
|
||||
* @param int $useThreshold
|
||||
*/
|
||||
public function useThreshold($useThreshold = 1000)
|
||||
{
|
||||
$this->useThreshold = (int)$useThreshold;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check to see if an attribute is an aria attribute or not
|
||||
*
|
||||
* @param $attributeName
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
protected function isAriaAttribute($attributeName)
|
||||
{
|
||||
return strpos($attributeName, 'aria-') === 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check to see if an attribute is an data attribute or not
|
||||
*
|
||||
* @param $attributeName
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
protected function isDataAttribute($attributeName)
|
||||
{
|
||||
return strpos($attributeName, 'data-') === 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Make sure our use tag is only referencing internal resources
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @return bool
|
||||
*/
|
||||
protected function isUseTagDirty(\DOMElement $element)
|
||||
{
|
||||
$href = Helper::getElementHref($element);
|
||||
return $href && strpos($href, '#') !== 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines whether `<use ... xlink:href="#identifier">` is expanded
|
||||
* recursively in order to create DoS scenarios. The amount of a actually
|
||||
* used element needs to be below `$this->useThreshold`.
|
||||
*
|
||||
* @param \DOMElement $element
|
||||
* @return bool
|
||||
*/
|
||||
protected function isUseTagExceedingThreshold(\DOMElement $element)
|
||||
{
|
||||
if ($this->useThreshold <= 0) {
|
||||
return false;
|
||||
}
|
||||
$useId = Helper::extractIdReferenceFromHref(
|
||||
Helper::getElementHref($element)
|
||||
);
|
||||
if ($useId === null) {
|
||||
return false;
|
||||
}
|
||||
foreach ($this->elementReferenceResolver->findByElementId($useId) as $subject) {
|
||||
if ($subject->countUse() >= $this->useThreshold) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the nesting limit for <use> tags.
|
||||
*
|
||||
* @param $limit
|
||||
*/
|
||||
public function setUseNestingLimit($limit)
|
||||
{
|
||||
$this->useNestingLimit = (int) $limit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove nodes that are either invalid or malformed.
|
||||
*
|
||||
* @param \DOMNode $currentElement The current element.
|
||||
*/
|
||||
protected function cleanUnsafeNodes(\DOMNode $currentElement) {
|
||||
// Replace CDATA node with encoded text node
|
||||
if ($currentElement instanceof \DOMCdataSection) {
|
||||
$textNode = $currentElement->ownerDocument->createTextNode($currentElement->nodeValue);
|
||||
$currentElement->parentNode->replaceChild($textNode, $currentElement);
|
||||
// If the element doesn't have a tagname, remove it and continue with next iteration
|
||||
} elseif (!$currentElement instanceof \DOMElement && !$currentElement instanceof \DOMText) {
|
||||
$currentElement->parentNode->removeChild($currentElement);
|
||||
$this->xmlIssues[] = array(
|
||||
'message' => 'Suspicious node \'' . $currentElement->nodeName . '\'',
|
||||
'line' => $currentElement->getLineNo(),
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
if ( $currentElement->childNodes && $currentElement->childNodes->length > 0 ) {
|
||||
for ($j = $currentElement->childNodes->length - 1; $j >= 0; $j--) {
|
||||
/** @var \DOMElement $childElement */
|
||||
$childElement = $currentElement->childNodes->item($j);
|
||||
$this->cleanUnsafeNodes($childElement);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
356
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/AllowedAttributes.php
vendored
Normal file
356
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/AllowedAttributes.php
vendored
Normal file
@ -0,0 +1,356 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Class AllowedAttributes
|
||||
*
|
||||
* @package enshrined\svgSanitize\data
|
||||
*/
|
||||
class AllowedAttributes implements AttributeInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of attributes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getAttributes()
|
||||
{
|
||||
return array(
|
||||
// HTML
|
||||
'about',
|
||||
'accept',
|
||||
'action',
|
||||
'align',
|
||||
'alt',
|
||||
'autocomplete',
|
||||
'background',
|
||||
'bgcolor',
|
||||
'border',
|
||||
'cellpadding',
|
||||
'cellspacing',
|
||||
'checked',
|
||||
'cite',
|
||||
'class',
|
||||
'clear',
|
||||
'color',
|
||||
'cols',
|
||||
'colspan',
|
||||
'coords',
|
||||
'crossorigin',
|
||||
'datetime',
|
||||
'default',
|
||||
'dir',
|
||||
'disabled',
|
||||
'download',
|
||||
'enctype',
|
||||
'encoding',
|
||||
'face',
|
||||
'for',
|
||||
'headers',
|
||||
'height',
|
||||
'hidden',
|
||||
'high',
|
||||
'href',
|
||||
'hreflang',
|
||||
'id',
|
||||
'integrity',
|
||||
'ismap',
|
||||
'label',
|
||||
'lang',
|
||||
'list',
|
||||
'loop',
|
||||
'low',
|
||||
'max',
|
||||
'maxlength',
|
||||
'media',
|
||||
'method',
|
||||
'min',
|
||||
'multiple',
|
||||
'name',
|
||||
'noshade',
|
||||
'novalidate',
|
||||
'nowrap',
|
||||
'open',
|
||||
'optimum',
|
||||
'pattern',
|
||||
'placeholder',
|
||||
'poster',
|
||||
'preload',
|
||||
'pubdate',
|
||||
'radiogroup',
|
||||
'readonly',
|
||||
'rel',
|
||||
'required',
|
||||
'rev',
|
||||
'reversed',
|
||||
'role',
|
||||
'rows',
|
||||
'rowspan',
|
||||
'spellcheck',
|
||||
'scope',
|
||||
'selected',
|
||||
'shape',
|
||||
'size',
|
||||
'sizes',
|
||||
'span',
|
||||
'srclang',
|
||||
'start',
|
||||
'src',
|
||||
'srcset',
|
||||
'step',
|
||||
'style',
|
||||
'summary',
|
||||
'tabindex',
|
||||
'title',
|
||||
'type',
|
||||
'usemap',
|
||||
'valign',
|
||||
'value',
|
||||
'version',
|
||||
'width',
|
||||
'xmlns',
|
||||
|
||||
// SVG
|
||||
'accent-height',
|
||||
'accumulate',
|
||||
'additivive',
|
||||
'alignment-baseline',
|
||||
'ascent',
|
||||
'attributename',
|
||||
'attributetype',
|
||||
'azimuth',
|
||||
'basefrequency',
|
||||
'baseline-shift',
|
||||
'begin',
|
||||
'bias',
|
||||
'by',
|
||||
'class',
|
||||
'clip',
|
||||
'clip-path',
|
||||
'clip-rule',
|
||||
'color',
|
||||
'color-interpolation',
|
||||
'color-interpolation-filters',
|
||||
'color-profile',
|
||||
'color-rendering',
|
||||
'cx',
|
||||
'cy',
|
||||
'd',
|
||||
'dx',
|
||||
'dy',
|
||||
'diffuseconstant',
|
||||
'direction',
|
||||
'display',
|
||||
'divisor',
|
||||
'dur',
|
||||
'edgemode',
|
||||
'elevation',
|
||||
'end',
|
||||
'fill',
|
||||
'fill-opacity',
|
||||
'fill-rule',
|
||||
'filter',
|
||||
'filterUnits',
|
||||
'flood-color',
|
||||
'flood-opacity',
|
||||
'font-family',
|
||||
'font-size',
|
||||
'font-size-adjust',
|
||||
'font-stretch',
|
||||
'font-style',
|
||||
'font-variant',
|
||||
'font-weight',
|
||||
'fx',
|
||||
'fy',
|
||||
'g1',
|
||||
'g2',
|
||||
'glyph-name',
|
||||
'glyphref',
|
||||
'gradientunits',
|
||||
'gradienttransform',
|
||||
'height',
|
||||
'href',
|
||||
'id',
|
||||
'image-rendering',
|
||||
'in',
|
||||
'in2',
|
||||
'k',
|
||||
'k1',
|
||||
'k2',
|
||||
'k3',
|
||||
'k4',
|
||||
'kerning',
|
||||
'keypoints',
|
||||
'keysplines',
|
||||
'keytimes',
|
||||
'lang',
|
||||
'lengthadjust',
|
||||
'letter-spacing',
|
||||
'kernelmatrix',
|
||||
'kernelunitlength',
|
||||
'lighting-color',
|
||||
'local',
|
||||
'marker-end',
|
||||
'marker-mid',
|
||||
'marker-start',
|
||||
'markerheight',
|
||||
'markerunits',
|
||||
'markerwidth',
|
||||
'maskcontentunits',
|
||||
'maskunits',
|
||||
'max',
|
||||
'mask',
|
||||
'media',
|
||||
'method',
|
||||
'mode',
|
||||
'min',
|
||||
'name',
|
||||
'numoctaves',
|
||||
'offset',
|
||||
'operator',
|
||||
'opacity',
|
||||
'order',
|
||||
'orient',
|
||||
'orientation',
|
||||
'origin',
|
||||
'overflow',
|
||||
'paint-order',
|
||||
'path',
|
||||
'pathlength',
|
||||
'patterncontentunits',
|
||||
'patterntransform',
|
||||
'patternunits',
|
||||
'points',
|
||||
'preservealpha',
|
||||
'preserveaspectratio',
|
||||
'r',
|
||||
'rx',
|
||||
'ry',
|
||||
'radius',
|
||||
'refx',
|
||||
'refy',
|
||||
'repeatcount',
|
||||
'repeatdur',
|
||||
'restart',
|
||||
'result',
|
||||
'rotate',
|
||||
'scale',
|
||||
'seed',
|
||||
'shape-rendering',
|
||||
'specularconstant',
|
||||
'specularexponent',
|
||||
'spreadmethod',
|
||||
'stddeviation',
|
||||
'stitchtiles',
|
||||
'stop-color',
|
||||
'stop-opacity',
|
||||
'stroke-dasharray',
|
||||
'stroke-dashoffset',
|
||||
'stroke-linecap',
|
||||
'stroke-linejoin',
|
||||
'stroke-miterlimit',
|
||||
'stroke-opacity',
|
||||
'stroke',
|
||||
'stroke-width',
|
||||
'style',
|
||||
'surfacescale',
|
||||
'tabindex',
|
||||
'targetx',
|
||||
'targety',
|
||||
'transform',
|
||||
'text-anchor',
|
||||
'text-decoration',
|
||||
'text-rendering',
|
||||
'textlength',
|
||||
'type',
|
||||
'u1',
|
||||
'u2',
|
||||
'unicode',
|
||||
'values',
|
||||
'viewbox',
|
||||
'visibility',
|
||||
'vector-effect',
|
||||
'vert-adv-y',
|
||||
'vert-origin-x',
|
||||
'vert-origin-y',
|
||||
'width',
|
||||
'word-spacing',
|
||||
'wrap',
|
||||
'writing-mode',
|
||||
'xchannelselector',
|
||||
'ychannelselector',
|
||||
'x',
|
||||
'x1',
|
||||
'x2',
|
||||
'xmlns',
|
||||
'y',
|
||||
'y1',
|
||||
'y2',
|
||||
'z',
|
||||
'zoomandpan',
|
||||
|
||||
// MathML
|
||||
'accent',
|
||||
'accentunder',
|
||||
'align',
|
||||
'bevelled',
|
||||
'close',
|
||||
'columnsalign',
|
||||
'columnlines',
|
||||
'columnspan',
|
||||
'denomalign',
|
||||
'depth',
|
||||
'dir',
|
||||
'display',
|
||||
'displaystyle',
|
||||
'fence',
|
||||
'frame',
|
||||
'height',
|
||||
'href',
|
||||
'id',
|
||||
'largeop',
|
||||
'length',
|
||||
'linethickness',
|
||||
'lspace',
|
||||
'lquote',
|
||||
'mathbackground',
|
||||
'mathcolor',
|
||||
'mathsize',
|
||||
'mathvariant',
|
||||
'maxsize',
|
||||
'minsize',
|
||||
'movablelimits',
|
||||
'notation',
|
||||
'numalign',
|
||||
'open',
|
||||
'rowalign',
|
||||
'rowlines',
|
||||
'rowspacing',
|
||||
'rowspan',
|
||||
'rspace',
|
||||
'rquote',
|
||||
'scriptlevel',
|
||||
'scriptminsize',
|
||||
'scriptsizemultiplier',
|
||||
'selection',
|
||||
'separator',
|
||||
'separators',
|
||||
'slope',
|
||||
'stretchy',
|
||||
'subscriptshift',
|
||||
'supscriptshift',
|
||||
'symmetric',
|
||||
'voffset',
|
||||
'width',
|
||||
'xmlns',
|
||||
|
||||
// XML
|
||||
'xlink:href',
|
||||
'xml:id',
|
||||
'xlink:title',
|
||||
'xml:space',
|
||||
'xmlns:xlink',
|
||||
);
|
||||
}
|
||||
}
|
||||
99
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/AllowedTags.php
vendored
Normal file
99
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/AllowedTags.php
vendored
Normal file
@ -0,0 +1,99 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Class AllowedTags
|
||||
*
|
||||
* @package enshrined\svgSanitize\data
|
||||
*/
|
||||
class AllowedTags implements TagInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of tags
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getTags()
|
||||
{
|
||||
return array (
|
||||
// HTML
|
||||
'a',
|
||||
'font',
|
||||
'image',
|
||||
'style',
|
||||
|
||||
// SVG
|
||||
'svg',
|
||||
'altglyph',
|
||||
'altglyphdef',
|
||||
'altglyphitem',
|
||||
'animatecolor',
|
||||
'animatemotion',
|
||||
'animatetransform',
|
||||
'circle',
|
||||
'clippath',
|
||||
'defs',
|
||||
'desc',
|
||||
'ellipse',
|
||||
'filter',
|
||||
'font',
|
||||
'g',
|
||||
'glyph',
|
||||
'glyphref',
|
||||
'hkern',
|
||||
'image',
|
||||
'line',
|
||||
'lineargradient',
|
||||
'marker',
|
||||
'mask',
|
||||
'metadata',
|
||||
'mpath',
|
||||
'path',
|
||||
'pattern',
|
||||
'polygon',
|
||||
'polyline',
|
||||
'radialgradient',
|
||||
'rect',
|
||||
'stop',
|
||||
'switch',
|
||||
'symbol',
|
||||
'text',
|
||||
'textpath',
|
||||
'title',
|
||||
'tref',
|
||||
'tspan',
|
||||
'use',
|
||||
'view',
|
||||
'vkern',
|
||||
|
||||
// SVG Filters
|
||||
'feBlend',
|
||||
'feColorMatrix',
|
||||
'feComponentTransfer',
|
||||
'feComposite',
|
||||
'feConvolveMatrix',
|
||||
'feDiffuseLighting',
|
||||
'feDisplacementMap',
|
||||
'feDistantLight',
|
||||
'feFlood',
|
||||
'feFuncA',
|
||||
'feFuncB',
|
||||
'feFuncG',
|
||||
'feFuncR',
|
||||
'feGaussianBlur',
|
||||
'feMerge',
|
||||
'feMergeNode',
|
||||
'feMorphology',
|
||||
'feOffset',
|
||||
'fePointLight',
|
||||
'feSpecularLighting',
|
||||
'feSpotLight',
|
||||
'feTile',
|
||||
'feTurbulence',
|
||||
|
||||
//text
|
||||
'#text'
|
||||
);
|
||||
}
|
||||
}
|
||||
18
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/AttributeInterface.php
vendored
Normal file
18
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/AttributeInterface.php
vendored
Normal file
@ -0,0 +1,18 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Class AttributeInterface
|
||||
*
|
||||
* @package enshrined\svgSanitize\data
|
||||
*/
|
||||
interface AttributeInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of attributes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getAttributes();
|
||||
}
|
||||
19
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/TagInterface.php
vendored
Normal file
19
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/TagInterface.php
vendored
Normal file
@ -0,0 +1,19 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
/**
|
||||
* Interface TagInterface
|
||||
*
|
||||
* @package enshrined\svgSanitize\tags
|
||||
*/
|
||||
interface TagInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* Returns an array of tags
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function getTags();
|
||||
|
||||
}
|
||||
64
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/XPath.php
vendored
Normal file
64
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/data/XPath.php
vendored
Normal file
@ -0,0 +1,64 @@
|
||||
<?php
|
||||
namespace enshrined\svgSanitize\data;
|
||||
|
||||
class XPath extends \DOMXPath
|
||||
{
|
||||
const DEFAULT_NAMESPACE_PREFIX = 'svg';
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $defaultNamespaceURI;
|
||||
|
||||
public function __construct(\DOMDocument $doc)
|
||||
{
|
||||
parent::__construct($doc);
|
||||
$this->handleDefaultNamespace();
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $nodeName
|
||||
* @return string
|
||||
*/
|
||||
public function createNodeName($nodeName)
|
||||
{
|
||||
if (empty($this->defaultNamespaceURI)) {
|
||||
return $nodeName;
|
||||
}
|
||||
return self::DEFAULT_NAMESPACE_PREFIX . ':' . $nodeName;
|
||||
}
|
||||
|
||||
protected function handleDefaultNamespace()
|
||||
{
|
||||
$rootElements = $this->getRootElements();
|
||||
|
||||
if (count($rootElements) !== 1) {
|
||||
throw new \LogicException(
|
||||
sprintf('Got %d svg elements, expected exactly one', count($rootElements)),
|
||||
1570870568
|
||||
);
|
||||
}
|
||||
$this->defaultNamespaceURI = (string)$rootElements[0]->namespaceURI;
|
||||
|
||||
if ($this->defaultNamespaceURI !== '') {
|
||||
$this->registerNamespace(self::DEFAULT_NAMESPACE_PREFIX, $this->defaultNamespaceURI);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return \DOMElement[]
|
||||
*/
|
||||
protected function getRootElements()
|
||||
{
|
||||
$rootElements = [];
|
||||
$elements = $this->document->getElementsByTagName('svg');
|
||||
/** @var \DOMElement $element */
|
||||
foreach ($elements as $element) {
|
||||
if ($element->parentNode !== $this->document) {
|
||||
continue;
|
||||
}
|
||||
$rootElements[] = $element;
|
||||
}
|
||||
return $rootElements;
|
||||
}
|
||||
}
|
||||
192
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/svg-scanner.php
vendored
Normal file
192
wp-content/plugins/menu-icons/vendor/enshrined/svg-sanitize/src/svg-scanner.php
vendored
Normal file
@ -0,0 +1,192 @@
|
||||
#!/usr/bin/env php
|
||||
<?php
|
||||
|
||||
/*
|
||||
* Simple program that uses svg-sanitizer
|
||||
* to find issues in files specified on the
|
||||
* command line, and prints a JSON output with
|
||||
* the issues found on exit.
|
||||
*/
|
||||
|
||||
require_once( __DIR__ . '/data/AttributeInterface.php' );
|
||||
require_once( __DIR__ . '/data/TagInterface.php' );
|
||||
require_once( __DIR__ . '/data/AllowedAttributes.php' );
|
||||
require_once( __DIR__ . '/data/AllowedTags.php' );
|
||||
require_once( __DIR__ . '/data/XPath.php' );
|
||||
require_once( __DIR__ . '/ElementReference/Resolver.php' );
|
||||
require_once( __DIR__ . '/ElementReference/Subject.php' );
|
||||
require_once( __DIR__ . '/ElementReference/Usage.php' );
|
||||
require_once( __DIR__ . '/Exceptions/NestingException.php' );
|
||||
require_once( __DIR__ . '/Helper.php' );
|
||||
require_once( __DIR__ . '/Sanitizer.php' );
|
||||
|
||||
/*
|
||||
* Print array as JSON and then
|
||||
* exit program with a particular
|
||||
* exit-code.
|
||||
*/
|
||||
|
||||
function sysexit(
|
||||
$results,
|
||||
$status
|
||||
) {
|
||||
echo json_encode(
|
||||
$results,
|
||||
JSON_PRETTY_PRINT
|
||||
);
|
||||
|
||||
exit( $status );
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Main part begins
|
||||
*/
|
||||
|
||||
global $argv;
|
||||
|
||||
/*
|
||||
* Set up results array, to
|
||||
* be printed on exit.
|
||||
*/
|
||||
$results = array(
|
||||
'totals' => array(
|
||||
'errors' => 0,
|
||||
),
|
||||
|
||||
'files' => array(
|
||||
),
|
||||
);
|
||||
|
||||
|
||||
/*
|
||||
* Catch files to scan from $argv.
|
||||
*/
|
||||
|
||||
$files_to_scan = $argv;
|
||||
unset( $files_to_scan[0] );
|
||||
|
||||
$files_to_scan = array_values(
|
||||
$files_to_scan
|
||||
);
|
||||
|
||||
/*
|
||||
* Catch no file specified.
|
||||
*/
|
||||
|
||||
if ( empty( $files_to_scan ) ) {
|
||||
$results['totals']['errors']++;
|
||||
$results['messages'] = array(
|
||||
array( 'No files to scan specified' ),
|
||||
);
|
||||
|
||||
sysexit(
|
||||
$results,
|
||||
1
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize the SVG scanner.
|
||||
*
|
||||
* Make sure to allow custom attributes,
|
||||
* and to remove remote references.
|
||||
*/
|
||||
$sanitizer = new enshrined\svgSanitize\Sanitizer();
|
||||
|
||||
$sanitizer->removeRemoteReferences( true );
|
||||
|
||||
/*
|
||||
* Scan each file specified to be scanned.
|
||||
*/
|
||||
|
||||
foreach( $files_to_scan as $file_name ) {
|
||||
/*
|
||||
* Read SVG file.
|
||||
*/
|
||||
$svg_file = @file_get_contents( $file_name );
|
||||
|
||||
/*
|
||||
* If not found, report that and continue.
|
||||
*/
|
||||
if ( false === $svg_file ) {
|
||||
$results['totals']['errors']++;
|
||||
|
||||
$results['files'][ $file_name ][] = array(
|
||||
'errors' => 1,
|
||||
'messages' => array(
|
||||
array(
|
||||
'message' => 'File specified could not be read (' . $file_name . ')',
|
||||
'line' => null,
|
||||
),
|
||||
),
|
||||
);
|
||||
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* Sanitize file and get issues found.
|
||||
*/
|
||||
$sanitize_status = $sanitizer->sanitize( $svg_file );
|
||||
|
||||
$xml_issues = $sanitizer->getXmlIssues();
|
||||
|
||||
/*
|
||||
* If we find no issues, simply note that.
|
||||
*/
|
||||
if ( empty( $xml_issues ) && ( false !== $sanitize_status ) ) {
|
||||
$results['files'][ $file_name ] = array(
|
||||
'errors' => 0,
|
||||
'messages' => array()
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* Could not sanitize the file.
|
||||
*/
|
||||
else if (
|
||||
( '' === $sanitize_status ) ||
|
||||
( false === $sanitize_status )
|
||||
) {
|
||||
$results['totals']['errors']++;
|
||||
|
||||
$results['files'][ $file_name ] = array(
|
||||
'errors' => 1,
|
||||
'messages' => array(
|
||||
array(
|
||||
'message' => 'Unable to sanitize file \'' . $file_name . '\'' ,
|
||||
'line' => null,
|
||||
)
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* If we find issues, note it and update statistics.
|
||||
*/
|
||||
|
||||
else {
|
||||
$results['totals']['errors'] += count( $xml_issues );
|
||||
|
||||
$results['files'][ $file_name ] = array(
|
||||
'errors' => count( $xml_issues ),
|
||||
'messages' => $xml_issues,
|
||||
);
|
||||
}
|
||||
|
||||
unset( $svg_file );
|
||||
unset( $xml_issues );
|
||||
unset( $sanitize_status );
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Exit with a status
|
||||
* that reflects what issues
|
||||
* we found.
|
||||
*/
|
||||
sysexit(
|
||||
$results,
|
||||
( $results['totals']['errors'] === 0 ? 0 : 1 )
|
||||
);
|
||||
Loading…
Reference in New Issue
Block a user