diff options
Diffstat (limited to 'vendor/github.com')
22 files changed, 4073 insertions, 106 deletions
diff --git a/vendor/github.com/aymerick/douceur/LICENSE b/vendor/github.com/aymerick/douceur/LICENSE new file mode 100644 index 0000000000..6ce87cd374 --- /dev/null +++ b/vendor/github.com/aymerick/douceur/LICENSE @@ -0,0 +1,22 @@ +The MIT License (MIT) + +Copyright (c) 2015 Aymerick JEHANNE + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + diff --git a/vendor/github.com/aymerick/douceur/css/declaration.go b/vendor/github.com/aymerick/douceur/css/declaration.go new file mode 100644 index 0000000000..61d29d3359 --- /dev/null +++ b/vendor/github.com/aymerick/douceur/css/declaration.go @@ -0,0 +1,60 @@ +package css + +import "fmt" + +// Declaration represents a parsed style property +type Declaration struct { + Property string + Value string + Important bool +} + +// NewDeclaration instanciates a new Declaration +func NewDeclaration() *Declaration { + return &Declaration{} +} + +// Returns string representation of the Declaration +func (decl *Declaration) String() string { + return decl.StringWithImportant(true) +} + +// StringWithImportant returns string representation with optional !important part +func (decl *Declaration) StringWithImportant(option bool) string { + result := fmt.Sprintf("%s: %s", decl.Property, decl.Value) + + if option && decl.Important { + result += " !important" + } + + result += ";" + + return result +} + +// Equal returns true if both Declarations are equals +func (decl *Declaration) Equal(other *Declaration) bool { + return (decl.Property == other.Property) && (decl.Value == other.Value) && (decl.Important == other.Important) +} + +// +// DeclarationsByProperty +// + +// DeclarationsByProperty represents sortable style declarations +type DeclarationsByProperty []*Declaration + +// Implements sort.Interface +func (declarations DeclarationsByProperty) Len() int { + return len(declarations) +} + +// Implements sort.Interface +func (declarations DeclarationsByProperty) Swap(i, j int) { + declarations[i], declarations[j] = declarations[j], declarations[i] +} + +// Implements sort.Interface +func (declarations DeclarationsByProperty) Less(i, j int) bool { + return declarations[i].Property < declarations[j].Property +} diff --git a/vendor/github.com/aymerick/douceur/css/rule.go b/vendor/github.com/aymerick/douceur/css/rule.go new file mode 100644 index 0000000000..b5a44b5429 --- /dev/null +++ b/vendor/github.com/aymerick/douceur/css/rule.go @@ -0,0 +1,230 @@ +package css + +import ( + "fmt" + "strings" +) + +const ( + indentSpace = 2 +) + +// RuleKind represents a Rule kind +type RuleKind int + +// Rule kinds +const ( + QualifiedRule RuleKind = iota + AtRule +) + +// At Rules than have Rules inside their block instead of Declarations +var atRulesWithRulesBlock = []string{ + "@document", "@font-feature-values", "@keyframes", "@media", "@supports", +} + +// Rule represents a parsed CSS rule +type Rule struct { + Kind RuleKind + + // At Rule name (eg: "@media") + Name string + + // Raw prelude + Prelude string + + // Qualified Rule selectors parsed from prelude + Selectors []string + + // Style properties + Declarations []*Declaration + + // At Rule embedded rules + Rules []*Rule + + // Current rule embedding level + EmbedLevel int +} + +// NewRule instanciates a new Rule +func NewRule(kind RuleKind) *Rule { + return &Rule{ + Kind: kind, + } +} + +// Returns string representation of rule kind +func (kind RuleKind) String() string { + switch kind { + case QualifiedRule: + return "Qualified Rule" + case AtRule: + return "At Rule" + default: + return "WAT" + } +} + +// EmbedsRules returns true if this rule embeds another rules +func (rule *Rule) EmbedsRules() bool { + if rule.Kind == AtRule { + for _, atRuleName := range atRulesWithRulesBlock { + if rule.Name == atRuleName { + return true + } + } + } + + return false +} + +// Equal returns true if both rules are equals +func (rule *Rule) Equal(other *Rule) bool { + if (rule.Kind != other.Kind) || + (rule.Prelude != other.Prelude) || + (rule.Name != other.Name) { + return false + } + + if (len(rule.Selectors) != len(other.Selectors)) || + (len(rule.Declarations) != len(other.Declarations)) || + (len(rule.Rules) != len(other.Rules)) { + return false + } + + for i, sel := range rule.Selectors { + if sel != other.Selectors[i] { + return false + } + } + + for i, decl := range rule.Declarations { + if !decl.Equal(other.Declarations[i]) { + return false + } + } + + for i, rule := range rule.Rules { + if !rule.Equal(other.Rules[i]) { + return false + } + } + + return true +} + +// Diff returns a string representation of rules differences +func (rule *Rule) Diff(other *Rule) []string { + result := []string{} + + if rule.Kind != other.Kind { + result = append(result, fmt.Sprintf("Kind: %s | %s", rule.Kind.String(), other.Kind.String())) + } + + if rule.Prelude != other.Prelude { + result = append(result, fmt.Sprintf("Prelude: \"%s\" | \"%s\"", rule.Prelude, other.Prelude)) + } + + if rule.Name != other.Name { + result = append(result, fmt.Sprintf("Name: \"%s\" | \"%s\"", rule.Name, other.Name)) + } + + if len(rule.Selectors) != len(other.Selectors) { + result = append(result, fmt.Sprintf("Selectors: %v | %v", strings.Join(rule.Selectors, ", "), strings.Join(other.Selectors, ", "))) + } else { + for i, sel := range rule.Selectors { + if sel != other.Selectors[i] { + result = append(result, fmt.Sprintf("Selector: \"%s\" | \"%s\"", sel, other.Selectors[i])) + } + } + } + + if len(rule.Declarations) != len(other.Declarations) { + result = append(result, fmt.Sprintf("Declarations Nb: %d | %d", len(rule.Declarations), len(other.Declarations))) + } else { + for i, decl := range rule.Declarations { + if !decl.Equal(other.Declarations[i]) { + result = append(result, fmt.Sprintf("Declaration: \"%s\" | \"%s\"", decl.String(), other.Declarations[i].String())) + } + } + } + + if len(rule.Rules) != len(other.Rules) { + result = append(result, fmt.Sprintf("Rules Nb: %d | %d", len(rule.Rules), len(other.Rules))) + } else { + + for i, rule := range rule.Rules { + if !rule.Equal(other.Rules[i]) { + result = append(result, fmt.Sprintf("Rule: \"%s\" | \"%s\"", rule.String(), other.Rules[i].String())) + } + } + } + + return result +} + +// Returns the string representation of a rule +func (rule *Rule) String() string { + result := "" + + if rule.Kind == QualifiedRule { + for i, sel := range rule.Selectors { + if i != 0 { + result += ", " + } + result += sel + } + } else { + // AtRule + result += fmt.Sprintf("%s", rule.Name) + + if rule.Prelude != "" { + if result != "" { + result += " " + } + result += fmt.Sprintf("%s", rule.Prelude) + } + } + + if (len(rule.Declarations) == 0) && (len(rule.Rules) == 0) { + result += ";" + } else { + result += " {\n" + + if rule.EmbedsRules() { + for _, subRule := range rule.Rules { + result += fmt.Sprintf("%s%s\n", rule.indent(), subRule.String()) + } + } else { + for _, decl := range rule.Declarations { + result += fmt.Sprintf("%s%s\n", rule.indent(), decl.String()) + } + } + + result += fmt.Sprintf("%s}", rule.indentEndBlock()) + } + + return result +} + +// Returns identation spaces for declarations and rules +func (rule *Rule) indent() string { + result := "" + + for i := 0; i < ((rule.EmbedLevel + 1) * indentSpace); i++ { + result += " " + } + + return result +} + +// Returns identation spaces for end of block character +func (rule *Rule) indentEndBlock() string { + result := "" + + for i := 0; i < (rule.EmbedLevel * indentSpace); i++ { + result += " " + } + + return result +} diff --git a/vendor/github.com/aymerick/douceur/css/stylesheet.go b/vendor/github.com/aymerick/douceur/css/stylesheet.go new file mode 100644 index 0000000000..6b32c2ec90 --- /dev/null +++ b/vendor/github.com/aymerick/douceur/css/stylesheet.go @@ -0,0 +1,25 @@ +package css + +// Stylesheet represents a parsed stylesheet +type Stylesheet struct { + Rules []*Rule +} + +// NewStylesheet instanciate a new Stylesheet +func NewStylesheet() *Stylesheet { + return &Stylesheet{} +} + +// Returns string representation of the Stylesheet +func (sheet *Stylesheet) String() string { + result := "" + + for _, rule := range sheet.Rules { + if result != "" { + result += "\n" + } + result += rule.String() + } + + return result +} diff --git a/vendor/github.com/chris-ramon/douceur/LICENSE b/vendor/github.com/chris-ramon/douceur/LICENSE new file mode 100644 index 0000000000..6ce87cd374 --- /dev/null +++ b/vendor/github.com/chris-ramon/douceur/LICENSE @@ -0,0 +1,22 @@ +The MIT License (MIT) + +Copyright (c) 2015 Aymerick JEHANNE + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + diff --git a/vendor/github.com/chris-ramon/douceur/parser/parser.go b/vendor/github.com/chris-ramon/douceur/parser/parser.go new file mode 100644 index 0000000000..6c4917ccf9 --- /dev/null +++ b/vendor/github.com/chris-ramon/douceur/parser/parser.go @@ -0,0 +1,409 @@ +package parser + +import ( + "errors" + "fmt" + "regexp" + "strings" + + "github.com/gorilla/css/scanner" + + "github.com/aymerick/douceur/css" +) + +const ( + importantSuffixRegexp = `(?i)\s*!important\s*$` +) + +var ( + importantRegexp *regexp.Regexp +) + +// Parser represents a CSS parser +type Parser struct { + scan *scanner.Scanner // Tokenizer + + // Tokens parsed but not consumed yet + tokens []*scanner.Token + + // Rule embedding level + embedLevel int +} + +func init() { + importantRegexp = regexp.MustCompile(importantSuffixRegexp) +} + +// NewParser instanciates a new parser +func NewParser(txt string) *Parser { + return &Parser{ + scan: scanner.New(txt), + } +} + +// Parse parses a whole stylesheet +func Parse(text string) (*css.Stylesheet, error) { + result, err := NewParser(text).ParseStylesheet() + if err != nil { + return nil, err + } + + return result, nil +} + +// ParseDeclarations parses CSS declarations +func ParseDeclarations(text string) ([]*css.Declaration, error) { + result, err := NewParser(text).ParseDeclarations() + if err != nil { + return nil, err + } + + return result, nil +} + +// ParseStylesheet parses a stylesheet +func (parser *Parser) ParseStylesheet() (*css.Stylesheet, error) { + result := css.NewStylesheet() + + // Parse BOM + if _, err := parser.parseBOM(); err != nil { + return result, err + } + + // Parse list of rules + rules, err := parser.ParseRules() + if err != nil { + return result, err + } + + result.Rules = rules + + return result, nil +} + +// ParseRules parses a list of rules +func (parser *Parser) ParseRules() ([]*css.Rule, error) { + result := []*css.Rule{} + + inBlock := false + if parser.tokenChar("{") { + // parsing a block of rules + inBlock = true + parser.embedLevel++ + + parser.shiftToken() + } + + for parser.tokenParsable() { + if parser.tokenIgnorable() { + parser.shiftToken() + } else if parser.tokenChar("}") { + if !inBlock { + errMsg := fmt.Sprintf("Unexpected } character: %s", parser.nextToken().String()) + return result, errors.New(errMsg) + } + + parser.shiftToken() + parser.embedLevel-- + + // finished + break + } else { + rule, err := parser.ParseRule() + if err != nil { + return result, err + } + + rule.EmbedLevel = parser.embedLevel + result = append(result, rule) + } + } + + return result, parser.err() +} + +// ParseRule parses a rule +func (parser *Parser) ParseRule() (*css.Rule, error) { + if parser.tokenAtKeyword() { + return parser.parseAtRule() + } + + return parser.parseQualifiedRule() +} + +// ParseDeclarations parses a list of declarations +func (parser *Parser) ParseDeclarations() ([]*css.Declaration, error) { + result := []*css.Declaration{} + + if parser.tokenChar("{") { + parser.shiftToken() + } + + for parser.tokenParsable() { + if parser.tokenIgnorable() { + parser.shiftToken() + } else if parser.tokenChar("}") { + // end of block + parser.shiftToken() + break + } else { + declaration, err := parser.ParseDeclaration() + if err != nil { + return result, err + } + + result = append(result, declaration) + } + } + + return result, parser.err() +} + +// ParseDeclaration parses a declaration +func (parser *Parser) ParseDeclaration() (*css.Declaration, error) { + result := css.NewDeclaration() + curValue := "" + + for parser.tokenParsable() { + if parser.tokenChar(":") { + result.Property = strings.TrimSpace(curValue) + curValue = "" + + parser.shiftToken() + } else if parser.tokenChar(";") || parser.tokenChar("}") { + if result.Property == "" { + errMsg := fmt.Sprintf("Unexpected ; character: %s", parser.nextToken().String()) + return result, errors.New(errMsg) + } + + if importantRegexp.MatchString(curValue) { + result.Important = true + curValue = importantRegexp.ReplaceAllString(curValue, "") + } + + result.Value = strings.TrimSpace(curValue) + + if parser.tokenChar(";") { + parser.shiftToken() + } + + // finished + break + } else { + token := parser.shiftToken() + curValue += token.Value + } + } + + // log.Printf("[parsed] Declaration: %s", result.String()) + + return result, parser.err() +} + +// Parse an At Rule +func (parser *Parser) parseAtRule() (*css.Rule, error) { + // parse rule name (eg: "@import") + token := parser.shiftToken() + + result := css.NewRule(css.AtRule) + result.Name = token.Value + + for parser.tokenParsable() { + if parser.tokenChar(";") { + parser.shiftToken() + + // finished + break + } else if parser.tokenChar("{") { + if result.EmbedsRules() { + // parse rules block + rules, err := parser.ParseRules() + if err != nil { + return result, err + } + + result.Rules = rules + } else { + // parse declarations block + declarations, err := parser.ParseDeclarations() + if err != nil { + return result, err + } + + result.Declarations = declarations + } + + // finished + break + } else { + // parse prelude + prelude, err := parser.parsePrelude() + if err != nil { + return result, err + } + + result.Prelude = prelude + } + } + + // log.Printf("[parsed] Rule: %s", result.String()) + + return result, parser.err() +} + +// Parse a Qualified Rule +func (parser *Parser) parseQualifiedRule() (*css.Rule, error) { + result := css.NewRule(css.QualifiedRule) + + for parser.tokenParsable() { + if parser.tokenChar("{") { + if result.Prelude == "" { + errMsg := fmt.Sprintf("Unexpected { character: %s", parser.nextToken().String()) + return result, errors.New(errMsg) + } + + // parse declarations block + declarations, err := parser.ParseDeclarations() + if err != nil { + return result, err + } + + result.Declarations = declarations + + // finished + break + } else { + // parse prelude + prelude, err := parser.parsePrelude() + if err != nil { + return result, err + } + + result.Prelude = prelude + } + } + + result.Selectors = strings.Split(result.Prelude, ",") + for i, sel := range result.Selectors { + result.Selectors[i] = strings.TrimSpace(sel) + } + + // log.Printf("[parsed] Rule: %s", result.String()) + + return result, parser.err() +} + +// Parse Rule prelude +func (parser *Parser) parsePrelude() (string, error) { + result := "" + + for parser.tokenParsable() && !parser.tokenEndOfPrelude() { + token := parser.shiftToken() + result += token.Value + } + + result = strings.TrimSpace(result) + + // log.Printf("[parsed] prelude: %s", result) + + return result, parser.err() +} + +// Parse BOM +func (parser *Parser) parseBOM() (bool, error) { + if parser.nextToken().Type == scanner.TokenBOM { + parser.shiftToken() + return true, nil + } + + return false, parser.err() +} + +// Returns next token without removing it from tokens buffer +func (parser *Parser) nextToken() *scanner.Token { + if len(parser.tokens) == 0 { + // fetch next token + nextToken := parser.scan.Next() + + // log.Printf("[token] %s => %v", nextToken.Type.String(), nextToken.Value) + + // queue it + parser.tokens = append(parser.tokens, nextToken) + } + + return parser.tokens[0] +} + +// Returns next token and remove it from the tokens buffer +func (parser *Parser) shiftToken() *scanner.Token { + var result *scanner.Token + + result, parser.tokens = parser.tokens[0], parser.tokens[1:] + return result +} + +// Returns tokenizer error, or nil if no error +func (parser *Parser) err() error { + if parser.tokenError() { + token := parser.nextToken() + return fmt.Errorf("Tokenizer error: %s", token.String()) + } + + return nil +} + +// Returns true if next token is Error +func (parser *Parser) tokenError() bool { + return parser.nextToken().Type == scanner.TokenError +} + +// Returns true if next token is EOF +func (parser *Parser) tokenEOF() bool { + return parser.nextToken().Type == scanner.TokenEOF +} + +// Returns true if next token is a whitespace +func (parser *Parser) tokenWS() bool { + return parser.nextToken().Type == scanner.TokenS +} + +// Returns true if next token is a comment +func (parser *Parser) tokenComment() bool { + return parser.nextToken().Type == scanner.TokenComment +} + +// Returns true if next token is a CDO or a CDC +func (parser *Parser) tokenCDOorCDC() bool { + switch parser.nextToken().Type { + case scanner.TokenCDO, scanner.TokenCDC: + return true + default: + return false + } +} + +// Returns true if next token is ignorable +func (parser *Parser) tokenIgnorable() bool { + return parser.tokenWS() || parser.tokenComment() || parser.tokenCDOorCDC() +} + +// Returns true if next token is parsable +func (parser *Parser) tokenParsable() bool { + return !parser.tokenEOF() && !parser.tokenError() +} + +// Returns true if next token is an At Rule keyword +func (parser *Parser) tokenAtKeyword() bool { + return parser.nextToken().Type == scanner.TokenAtKeyword +} + +// Returns true if next token is given character +func (parser *Parser) tokenChar(value string) bool { + token := parser.nextToken() + return (token.Type == scanner.TokenChar) && (token.Value == value) +} + +// Returns true if next token marks the end of a prelude +func (parser *Parser) tokenEndOfPrelude() bool { + return parser.tokenChar(";") || parser.tokenChar("{") +} diff --git a/vendor/github.com/gorilla/css/LICENSE b/vendor/github.com/gorilla/css/LICENSE new file mode 100644 index 0000000000..bee2a059d3 --- /dev/null +++ b/vendor/github.com/gorilla/css/LICENSE @@ -0,0 +1,27 @@ +Copyright (c) 2013, Gorilla web toolkit +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + + Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + + Redistributions in binary form must reproduce the above copyright notice, this + list of conditions and the following disclaimer in the documentation and/or + other materials provided with the distribution. + + Neither the name of the {organization} nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR +ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON +ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/vendor/github.com/gorilla/css/scanner/doc.go b/vendor/github.com/gorilla/css/scanner/doc.go new file mode 100644 index 0000000000..f19850e15f --- /dev/null +++ b/vendor/github.com/gorilla/css/scanner/doc.go @@ -0,0 +1,33 @@ +// Copyright 2012 The Gorilla Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +/* +Package gorilla/css/scanner generates tokens for a CSS3 input. + +It follows the CSS3 specification located at: + + http://www.w3.org/TR/css3-syntax/ + +To use it, create a new scanner for a given CSS string and call Next() until +the token returned has type TokenEOF or TokenError: + + s := scanner.New(myCSS) + for { + token := s.Next() + if token.Type == scanner.TokenEOF || token.Type == scanner.TokenError { + break + } + // Do something with the token... + } + +Following the CSS3 specification, an error can only occur when the scanner +finds an unclosed quote or unclosed comment. In these cases the text becomes +"untokenizable". Everything else is tokenizable and it is up to a parser +to make sense of the token stream (or ignore nonsensical token sequences). + +Note: the scanner doesn't perform lexical analysis or, in other words, it +doesn't care about the token context. It is intended to be used by a +lexer or parser. +*/ +package scanner diff --git a/vendor/github.com/gorilla/css/scanner/scanner.go b/vendor/github.com/gorilla/css/scanner/scanner.go new file mode 100644 index 0000000000..23fa7404ec --- /dev/null +++ b/vendor/github.com/gorilla/css/scanner/scanner.go @@ -0,0 +1,356 @@ +// Copyright 2012 The Gorilla Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +package scanner + +import ( + "fmt" + "regexp" + "strings" + "unicode" + "unicode/utf8" +) + +// tokenType identifies the type of lexical tokens. +type tokenType int + +// String returns a string representation of the token type. +func (t tokenType) String() string { + return tokenNames[t] +} + +// Token represents a token and the corresponding string. +type Token struct { + Type tokenType + Value string + Line int + Column int +} + +// String returns a string representation of the token. +func (t *Token) String() string { + if len(t.Value) > 10 { + return fmt.Sprintf("%s (line: %d, column: %d): %.10q...", + t.Type, t.Line, t.Column, t.Value) + } + return fmt.Sprintf("%s (line: %d, column: %d): %q", + t.Type, t.Line, t.Column, t.Value) +} + +// All tokens ----------------------------------------------------------------- + +// The complete list of tokens in CSS3. +const ( + // Scanner flags. + TokenError tokenType = iota + TokenEOF + // From now on, only tokens from the CSS specification. + TokenIdent + TokenAtKeyword + TokenString + TokenHash + TokenNumber + TokenPercentage + TokenDimension + TokenURI + TokenUnicodeRange + TokenCDO + TokenCDC + TokenS + TokenComment + TokenFunction + TokenIncludes + TokenDashMatch + TokenPrefixMatch + TokenSuffixMatch + TokenSubstringMatch + TokenChar + TokenBOM +) + +// tokenNames maps tokenType's to their names. Used for conversion to string. +var tokenNames = map[tokenType]string{ + TokenError: "error", + TokenEOF: "EOF", + TokenIdent: "IDENT", + TokenAtKeyword: "ATKEYWORD", + TokenString: "STRING", + TokenHash: "HASH", + TokenNumber: "NUMBER", + TokenPercentage: "PERCENTAGE", + TokenDimension: "DIMENSION", + TokenURI: "URI", + TokenUnicodeRange: "UNICODE-RANGE", + TokenCDO: "CDO", + TokenCDC: "CDC", + TokenS: "S", + TokenComment: "COMMENT", + TokenFunction: "FUNCTION", + TokenIncludes: "INCLUDES", + TokenDashMatch: "DASHMATCH", + TokenPrefixMatch: "PREFIXMATCH", + TokenSuffixMatch: "SUFFIXMATCH", + TokenSubstringMatch: "SUBSTRINGMATCH", + TokenChar: "CHAR", + TokenBOM: "BOM", +} + +// Macros and productions ----------------------------------------------------- +// http://www.w3.org/TR/css3-syntax/#tokenization + +var macroRegexp = regexp.MustCompile(`\{[a-z]+\}`) + +// macros maps macro names to patterns to be expanded. +var macros = map[string]string{ + // must be escaped: `\.+*?()|[]{}^$` + "ident": `-?{nmstart}{nmchar}*`, + "name": `{nmchar}+`, + "nmstart": `[a-zA-Z_]|{nonascii}|{escape}`, + "nonascii": "[\u0080-\uD7FF\uE000-\uFFFD\U00010000-\U0010FFFF]", + "unicode": `\\[0-9a-fA-F]{1,6}{wc}?`, + "escape": "{unicode}|\\\\[\u0020-\u007E\u0080-\uD7FF\uE000-\uFFFD\U00010000-\U0010FFFF]", + "nmchar": `[a-zA-Z0-9_-]|{nonascii}|{escape}`, + "num": `[0-9]*\.[0-9]+|[0-9]+`, + "string": `"(?:{stringchar}|')*"|'(?:{stringchar}|")*'`, + "stringchar": `{urlchar}|[ ]|\\{nl}`, + "nl": `[\n\r\f]|\r\n`, + "w": `{wc}*`, + "wc": `[\t\n\f\r ]`, + + // urlchar should accept [(ascii characters minus those that need escaping)|{nonascii}|{escape}] + // ASCII characters range = `[\u0020-\u007e]` + // Skip space \u0020 = `[\u0021-\u007e]` + // Skip quotation mark \0022 = `[\u0021\u0023-\u007e]` + // Skip apostrophe \u0027 = `[\u0021\u0023-\u0026\u0028-\u007e]` + // Skip reverse solidus \u005c = `[\u0021\u0023-\u0026\u0028-\u005b\u005d\u007e]` + // Finally, the left square bracket (\u005b) and right (\u005d) needs escaping themselves + "urlchar": "[\u0021\u0023-\u0026\u0028-\\\u005b\\\u005d-\u007E]|{nonascii}|{escape}", +} + +// productions maps the list of tokens to patterns to be expanded. +var productions = map[tokenType]string{ + // Unused regexps (matched using other methods) are commented out. + TokenIdent: `{ident}`, + TokenAtKeyword: `@{ident}`, + TokenString: `{string}`, + TokenHash: `#{name}`, + TokenNumber: `{num}`, + TokenPercentage: `{num}%`, + TokenDimension: `{num}{ident}`, + TokenURI: `url\({w}(?:{string}|{urlchar}*?){w}\)`, + TokenUnicodeRange: `U\+[0-9A-F\?]{1,6}(?:-[0-9A-F]{1,6})?`, + //TokenCDO: `<!--`, + TokenCDC: `-->`, + TokenS: `{wc}+`, + TokenComment: `/\*[^\*]*[\*]+(?:[^/][^\*]*[\*]+)*/`, + TokenFunction: `{ident}\(`, + //TokenIncludes: `~=`, + //TokenDashMatch: `\|=`, + //TokenPrefixMatch: `\^=`, + //TokenSuffixMatch: `\$=`, + //TokenSubstringMatch: `\*=`, + //TokenChar: `[^"']`, + //TokenBOM: "\uFEFF", +} + +// matchers maps the list of tokens to compiled regular expressions. +// +// The map is filled on init() using the macros and productions defined in +// the CSS specification. +var matchers = map[tokenType]*regexp.Regexp{} + +// matchOrder is the order to test regexps when first-char shortcuts +// can't be used. +var matchOrder = []tokenType{ + TokenURI, + TokenFunction, + TokenUnicodeRange, + TokenIdent, + TokenDimension, + TokenPercentage, + TokenNumber, + TokenCDC, +} + +func init() { + // replace macros and compile regexps for productions. + replaceMacro := func(s string) string { + return "(?:" + macros[s[1:len(s)-1]] + ")" + } + for t, s := range productions { + for macroRegexp.MatchString(s) { + s = macroRegexp.ReplaceAllStringFunc(s, replaceMacro) + } + matchers[t] = regexp.MustCompile("^(?:" + s + ")") + } +} + +// Scanner -------------------------------------------------------------------- + +// New returns a new CSS scanner for the given input. +func New(input string) *Scanner { + // Normalize newlines. + input = strings.Replace(input, "\r\n", "\n", -1) + return &Scanner{ + input: input, + row: 1, + col: 1, + } +} + +// Scanner scans an input and emits tokens following the CSS3 specification. +type Scanner struct { + input string + pos int + row int + col int + err *Token +} + +// Next returns the next token from the input. +// +// At the end of the input the token type is TokenEOF. +// +// If the input can't be tokenized the token type is TokenError. This occurs +// in case of unclosed quotation marks or comments. +func (s *Scanner) Next() *Token { + if s.err != nil { + return s.err + } + if s.pos >= len(s.input) { + s.err = &Token{TokenEOF, "", s.row, s.col} + return s.err + } + if s.pos == 0 { + // Test BOM only once, at the beginning of the file. + if strings.HasPrefix(s.input, "\uFEFF") { + return s.emitSimple(TokenBOM, "\uFEFF") + } + } + // There's a lot we can guess based on the first byte so we'll take a + // shortcut before testing multiple regexps. + input := s.input[s.pos:] + switch input[0] { + case '\t', '\n', '\f', '\r', ' ': + // Whitespace. + return s.emitToken(TokenS, matchers[TokenS].FindString(input)) + case '.': + // Dot is too common to not have a quick check. + // We'll test if this is a Char; if it is followed by a number it is a + // dimension/percentage/number, and this will be matched later. + if len(input) > 1 && !unicode.IsDigit(rune(input[1])) { + return s.emitSimple(TokenChar, ".") + } + case '#': + // Another common one: Hash or Char. + if match := matchers[TokenHash].FindString(input); match != "" { + return s.emitToken(TokenHash, match) + } + return s.emitSimple(TokenChar, "#") + case '@': + // Another common one: AtKeyword or Char. + if match := matchers[TokenAtKeyword].FindString(input); match != "" { + return s.emitSimple(TokenAtKeyword, match) + } + return s.emitSimple(TokenChar, "@") + case ':', ',', ';', '%', '&', '+', '=', '>', '(', ')', '[', ']', '{', '}': + // More common chars. + return s.emitSimple(TokenChar, string(input[0])) + case '"', '\'': + // String or error. + match := matchers[TokenString].FindString(input) + if match != "" { + return s.emitToken(TokenString, match) + } + + s.err = &Token{TokenError, "unclosed quotation mark", s.row, s.col} + return s.err + case '/': + // Comment, error or Char. + if len(input) > 1 && input[1] == '*' { + match := matchers[TokenComment].FindString(input) + if match != "" { + return s.emitToken(TokenComment, match) + } else { + s.err = &Token{TokenError, "unclosed comment", s.row, s.col} + return s.err + } + } + return s.emitSimple(TokenChar, "/") + case '~': + // Includes or Char. + return s.emitPrefixOrChar(TokenIncludes, "~=") + case '|': + // DashMatch or Char. + return s.emitPrefixOrChar(TokenDashMatch, "|=") + case '^': + // PrefixMatch or Char. + return s.emitPrefixOrChar(TokenPrefixMatch, "^=") + case '$': + // SuffixMatch or Char. + return s.emitPrefixOrChar(TokenSuffixMatch, "$=") + case '*': + // SubstringMatch or Char. + return s.emitPrefixOrChar(TokenSubstringMatch, "*=") + case '<': + // CDO or Char. + return s.emitPrefixOrChar(TokenCDO, "<!--") + } + // Test all regexps, in order. + for _, token := range matchOrder { + if match := matchers[token].FindString(input); match != "" { + return s.emitToken(token, match) + } + } + // We already handled unclosed quotation marks and comments, + // so this can only be a Char. + r, width := utf8.DecodeRuneInString(input) + token := &Token{TokenChar, string(r), s.row, s.col} + s.col += width + s.pos += width + return token +} + +// updatePosition updates input coordinates based on the consumed text. +func (s *Scanner) updatePosition(text string) { + width := utf8.RuneCountInString(text) + lines := strings.Count(text, "\n") + s.row += lines + if lines == 0 { + s.col += width + } else { + s.col = utf8.RuneCountInString(text[strings.LastIndex(text, "\n"):]) + } + s.pos += len(text) // while col is a rune index, pos is a byte index +} + +// emitToken returns a Token for the string v and updates the scanner position. +func (s *Scanner) emitToken(t tokenType, v string) *Token { + token := &Token{t, v, s.row, s.col} + s.updatePosition(v) + return token +} + +// emitSimple returns a Token for the string v and updates the scanner +// position in a simplified manner. +// +// The string is known to have only ASCII characters and to not have a newline. +func (s *Scanner) emitSimple(t tokenType, v string) *Token { + token := &Token{t, v, s.row, s.col} + s.col += len(v) + s.pos += len(v) + return token +} + +// emitPrefixOrChar returns a Token for type t if the current position +// matches the given prefix. Otherwise it returns a Char token using the +// first character from the prefix. +// +// The prefix is known to have only ASCII characters and to not have a newline. +func (s *Scanner) emitPrefixOrChar(t tokenType, prefix string) *Token { + if strings.HasPrefix(s.input[s.pos:], prefix) { + return s.emitSimple(t, prefix) + } + return s.emitSimple(TokenChar, string(prefix[0])) +} diff --git a/vendor/github.com/microcosm-cc/bluemonday/.gitignore b/vendor/github.com/microcosm-cc/bluemonday/.gitignore index 00268614f0..c3df40e7c3 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/.gitignore +++ b/vendor/github.com/microcosm-cc/bluemonday/.gitignore @@ -1,22 +1,15 @@ -# Compiled Object files, Static and Dynamic libs (Shared Objects) -*.o -*.a + # Binaries for programs and plugins +*.exe +*.exe~ +*.dll *.so +*.dylib -# Folders -_obj -_test - -# Architecture specific extensions/prefixes -*.[568vq] -[568vq].out +# Test binary, built with `go test -c` +*.test -*.cgo1.go -*.cgo2.c -_cgo_defun.c -_cgo_gotypes.go -_cgo_export.* +# Output of the go coverage tool, specifically when used with LiteIDE +*.out -_testmain.go - -*.exe +# goland idea folder +*.idea
\ No newline at end of file diff --git a/vendor/github.com/microcosm-cc/bluemonday/.travis.yml b/vendor/github.com/microcosm-cc/bluemonday/.travis.yml index 5694dace7f..808091784a 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/.travis.yml +++ b/vendor/github.com/microcosm-cc/bluemonday/.travis.yml @@ -1,18 +1,22 @@ language: go go: - - 1.1 - - 1.2 - - 1.3 - - 1.4 - - 1.5 - - 1.6 - - 1.7 + - 1.2.x + - 1.3.x + - 1.4.x + - 1.5.x + - 1.6.x + - 1.7.x + - 1.8.x + - 1.9.x + - 1.10.x + - 1.11.x + - 1.12.x - tip matrix: allow_failures: - go: tip fast_finish: true install: - - go get golang.org/x/net/html + - go get . script: - go test -v ./... diff --git a/vendor/github.com/microcosm-cc/bluemonday/CONTRIBUTING.md b/vendor/github.com/microcosm-cc/bluemonday/CONTRIBUTING.md index e0e0c815f6..d2b12302f9 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/CONTRIBUTING.md +++ b/vendor/github.com/microcosm-cc/bluemonday/CONTRIBUTING.md @@ -6,6 +6,10 @@ Third-party patches are essential for keeping bluemonday secure and offering the * Make sure you have a [Github account](https://github.com/signup/free) +## Guidelines + +1. Do not vendor dependencies. As a security package, were we to vendor dependencies the projects that then vendor bluemonday may not receive the latest security updates to the dependencies. By not vendoring dependencies the project that implements bluemonday will vendor the latest version of any dependent packages. Vendoring is a project problem, not a package problem. bluemonday will be tested against the latest version of dependencies periodically and during any PR/merge. + ## Submitting an Issue * Submit a ticket for your issue, assuming one does not already exist diff --git a/vendor/github.com/microcosm-cc/bluemonday/CREDITS.md b/vendor/github.com/microcosm-cc/bluemonday/CREDITS.md index 4422905a3f..b3185f5438 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/CREDITS.md +++ b/vendor/github.com/microcosm-cc/bluemonday/CREDITS.md @@ -1,6 +1,7 @@ - 1. John Graham-Cumming http://jgc.org/ +1. Mohammad Gufran https://github.com/Gufran +1. Steven Gutzwiller https://github.com/StevenGutzwiller +1. Andrew Krasichkov @buglloc https://github.com/buglloc 1. Mike Samuel mikesamuel@gmail.com 1. Dmitri Shuralyov shurcooL@gmail.com -1. https://github.com/opennota -1. https://github.com/Gufran
\ No newline at end of file +1. https://github.com/opennota
\ No newline at end of file diff --git a/vendor/github.com/microcosm-cc/bluemonday/LICENCE.md b/vendor/github.com/microcosm-cc/bluemonday/LICENSE.md index f822458ed0..f822458ed0 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/LICENCE.md +++ b/vendor/github.com/microcosm-cc/bluemonday/LICENSE.md diff --git a/vendor/github.com/microcosm-cc/bluemonday/README.md b/vendor/github.com/microcosm-cc/bluemonday/README.md index b8508ff04a..cd2766f6b2 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/README.md +++ b/vendor/github.com/microcosm-cc/bluemonday/README.md @@ -1,4 +1,4 @@ -# bluemonday [](https://travis-ci.org/microcosm-cc/bluemonday) [](https://godoc.org/github.com/microcosm-cc/bluemonday) +# bluemonday [](https://travis-ci.org/microcosm-cc/bluemonday) [](https://godoc.org/github.com/microcosm-cc/bluemonday) [](https://sourcegraph.com/github.com/microcosm-cc/bluemonday?badge) bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. @@ -58,10 +58,12 @@ We expect to be supplied with well-formatted HTML (closing elements for every ap ### Supported Go Versions -bluemonday is regularly tested against Go 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7 and tip. +bluemonday is tested against Go 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, and tip. We do not support Go 1.0 as we depend on `golang.org/x/net/html` which includes a reference to `io.ErrNoProgress` which did not exist in Go 1.0. +We support Go 1.1 but Travis no longer tests against it. + ## Is it production ready? *Yes* @@ -87,7 +89,11 @@ import ( ) func main() { + // Do this once for each unique policy, and use the policy for the life of the program + // Policy creation/editing is not safe to use in multiple goroutines p := bluemonday.UGCPolicy() + + // The policy can then be used to sanitize lots of input and it is safe to use the policy in multiple goroutines html := p.Sanitize( `<a onblur="alert(secret)" href="http://www.google.com">Google</a>`, ) @@ -140,7 +146,7 @@ func main() { We ship two default policies: -1. `bluemonday.StrictPolicy()` which can be thought of as equivalent to stripping all HTML elements and their attributes as it has nothing on it's whitelist. An example usage scenario would be blog post titles where HTML tags are not expected at all and if they are then the elements *and* the content of the elements should be stripped. This is a *very* strict policy. +1. `bluemonday.StrictPolicy()` which can be thought of as equivalent to stripping all HTML elements and their attributes as it has nothing on its whitelist. An example usage scenario would be blog post titles where HTML tags are not expected at all and if they are then the elements *and* the content of the elements should be stripped. This is a *very* strict policy. 2. `bluemonday.UGCPolicy()` which allows a broad selection of HTML elements and attributes that are safe for user generated content. Note that this policy does *not* whitelist iframes, object, embed, styles, script, etc. An example usage scenario would be blog post bodies where a variety of formatting is expected along with the potential for TABLEs and IMGs. ## Policy Building @@ -163,12 +169,26 @@ To add elements to a policy either add just the elements: p.AllowElements("b", "strong") ``` +Or using a regex: + +_Note: if an element is added by name as shown above, any matching regex will be ignored_ + +It is also recommended to ensure multiple patterns don't overlap as order of execution is not guaranteed and can result in some rules being missed. +```go +p.AllowElementsMatching(regex.MustCompile(`^my-element-`)) +``` + Or add elements as a virtue of adding an attribute: ```go // Not the recommended pattern, see the recommendation on using .Matching() below p.AllowAttrs("nowrap").OnElements("td", "th") ``` +Again, this also supports a regex pattern match alternative: +```go +p.AllowAttrs("nowrap").OnElementsMatching(regex.MustCompile(`^my-element-`)) +``` + Attributes can either be added to all elements: ```go p.AllowAttrs("dir").Matching(regexp.MustCompile("(?i)rtl|ltr")).Globally() @@ -198,6 +218,49 @@ p := bluemonday.UGCPolicy() p.AllowElements("fieldset", "select", "option") ``` +### Inline CSS + +Although it's possible to handle inline CSS using `AllowAttrs` with a `Matching` rule, writing a single monolithic regular expression to safely process all inline CSS which you wish to allow is not a trivial task. Instead of attempting to do so, you can whitelist the `style` attribute on whichever element(s) you desire and use style policies to control and sanitize inline styles. + +It is suggested that you use `Matching` (with a suitable regular expression) +`MatchingEnum`, or `MatchingHandler` to ensure each style matches your needs, +but default handlers are supplied for most widely used styles. + +Similar to attributes, you can allow specific CSS properties to be set inline: +```go +p.AllowAttrs("style").OnElements("span", "p") +// Allow the 'color' property with valid RGB(A) hex values only (on any element allowed a 'style' attribute) +p.AllowStyles("color").Matching(regexp.MustCompile("(?i)^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$")).Globally() +``` + +Additionally, you can allow a CSS property to be set only to an allowed value: +```go +p.AllowAttrs("style").OnElements("span", "p") +// Allow the 'text-decoration' property to be set to 'underline', 'line-through' or 'none' +// on 'span' elements only +p.AllowStyles("text-decoration").MatchingEnum("underline", "line-through", "none").OnElements("span") +``` + +Or you can specify elements based on a regex patterm match: +```go +p.AllowAttrs("style").OnElementsMatching(regex.MustCompile(`^my-element-`)) +// Allow the 'text-decoration' property to be set to 'underline', 'line-through' or 'none' +// on 'span' elements only +p.AllowStyles("text-decoration").MatchingEnum("underline", "line-through", "none").OnElementsMatching(regex.MustCompile(`^my-element-`)) +``` + +If you need more specific checking, you can create a handler that takes in a string and returns a bool to +validate the values for a given property. The string parameter has been +converted to lowercase and unicode code points have been converted. +```go +myHandler := func(value string) bool{ + return true +} +p.AllowAttrs("style").OnElements("span", "p") +// Allow the 'color' property with values validated by the handler (on any element allowed a 'style' attribute) +p.AllowStyles("color").MatchingHandler(myHandler).Globally() +``` + ### Links Links are difficult beasts to sanitise safely and also one of the biggest attack vectors for malicious content. @@ -232,6 +295,13 @@ Regardless of whether you have enabled parseable URLs, you can force all URLs to p.RequireNoFollowOnLinks(true) ``` +Similarly, you can force all URLs to have "noreferrer" in their rel attribute. +```go +// This applies to "a" "area" "link" elements that have a "href" attribute +p.RequireNoReferrerOnLinks(true) +``` + + We provide a convenience method that applies all of the above, but you will still need to whitelist the linkable elements for the URL rules to be applied to: ```go p.AllowStandardURLs() @@ -273,7 +343,7 @@ We also bundle some helpers to simplify policy building: // Permits the "dir", "id", "lang", "title" attributes globally p.AllowStandardAttributes() -// Permits the "img" element and it's standard attributes +// Permits the "img" element and its standard attributes p.AllowImages() // Permits ordered and unordered lists, and also definition lists @@ -312,7 +382,6 @@ It is not the job of bluemonday to fix your bad HTML, it is merely the job of bl ## TODO -* Add support for CSS sanitisation to allow some CSS properties based on a whitelist, possibly using the [Gorilla CSS3 scanner](http://www.gorillatoolkit.org/pkg/css/scanner) * Investigate whether devs want to blacklist elements and attributes. This would allow devs to take an existing policy (such as the `bluemonday.UGCPolicy()` ) that encapsulates 90% of what they're looking for but does more than they need, and to remove the extra things they do not want to make it 100% what they want * Investigate whether devs want a validating HTML mode, in which the HTML elements are not just transformed into a balanced tree (every start tag has a closing tag at the correct depth) but also that elements and character data appear only in their allowed context (i.e. that a `table` element isn't a descendent of a `caption`, that `colgroup`, `thead`, `tbody`, `tfoot` and `tr` are permitted, and that character data is not permitted) diff --git a/vendor/github.com/microcosm-cc/bluemonday/doc.go b/vendor/github.com/microcosm-cc/bluemonday/doc.go index 2cb0a3652f..71dab60898 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/doc.go +++ b/vendor/github.com/microcosm-cc/bluemonday/doc.go @@ -84,7 +84,7 @@ bluemonday is heavily inspired by both the OWASP Java HTML Sanitizer We ship two default policies, one is bluemonday.StrictPolicy() and can be thought of as equivalent to stripping all HTML elements and their attributes as -it has nothing on it's whitelist. +it has nothing on its whitelist. The other is bluemonday.UGCPolicy() and allows a broad selection of HTML elements and attributes that are safe for user generated content. Note that diff --git a/vendor/github.com/microcosm-cc/bluemonday/go.mod b/vendor/github.com/microcosm-cc/bluemonday/go.mod new file mode 100644 index 0000000000..47b521a75b --- /dev/null +++ b/vendor/github.com/microcosm-cc/bluemonday/go.mod @@ -0,0 +1,10 @@ +module github.com/microcosm-cc/bluemonday + +go 1.9 + +require ( + github.com/aymerick/douceur v0.2.0 // indirect + github.com/chris-ramon/douceur v0.2.0 + github.com/gorilla/css v1.0.0 // indirect + golang.org/x/net v0.0.0-20181220203305-927f97764cc3 +) diff --git a/vendor/github.com/microcosm-cc/bluemonday/go.sum b/vendor/github.com/microcosm-cc/bluemonday/go.sum new file mode 100644 index 0000000000..8c34e7a404 --- /dev/null +++ b/vendor/github.com/microcosm-cc/bluemonday/go.sum @@ -0,0 +1,8 @@ +github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk= +github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4= +github.com/chris-ramon/douceur v0.2.0 h1:IDMEdxlEUUBYBKE4z/mJnFyVXox+MjuEVDJNN27glkU= +github.com/chris-ramon/douceur v0.2.0/go.mod h1:wDW5xjJdeoMm1mRt4sD4c/LbF/mWdEpRXQKjTR8nIBE= +github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY= +github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c= +golang.org/x/net v0.0.0-20181220203305-927f97764cc3 h1:eH6Eip3UpmR+yM/qI9Ijluzb1bNv/cAU/n+6l8tRSis= +golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= diff --git a/vendor/github.com/microcosm-cc/bluemonday/handlers.go b/vendor/github.com/microcosm-cc/bluemonday/handlers.go new file mode 100644 index 0000000000..1ef4c8acd0 --- /dev/null +++ b/vendor/github.com/microcosm-cc/bluemonday/handlers.go @@ -0,0 +1,2085 @@ +// Copyright (c) 2019, David Kitchen <david@buro9.com> +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this +// list of conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, +// this list of conditions and the following disclaimer in the documentation +// and/or other materials provided with the distribution. +// +// * Neither the name of the organisation (Microcosm) nor the names of its +// contributors may be used to endorse or promote products derived from +// this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +package bluemonday + +import ( + "regexp" + "strings" +) + +var ( + defaultStyleHandlers = map[string]func(string) bool{ + "align-content": AlignContentHandler, + "align-items": AlignItemsHandler, + "align-self": AlignSelfHandler, + "all": AllHandler, + "animation": AnimationHandler, + "animation-delay": AnimationDelayHandler, + "animation-direction": AnimationDirectionHandler, + "animation-duration": AnimationDurationHandler, + "animation-fill-mode": AnimationFillModeHandler, + "animation-iteration-count": AnimationIterationCountHandler, + "animation-name": AnimationNameHandler, + "animation-play-state": AnimationPlayStateHandler, + "animation-timing-function": TimingFunctionHandler, + "backface-visibility": BackfaceVisibilityHandler, + "background": BackgroundHandler, + "background-attachment": BackgroundAttachmentHandler, + "background-blend-mode": BackgroundBlendModeHandler, + "background-clip": BackgroundClipHandler, + "background-color": ColorHandler, + "background-image": ImageHandler, + "background-origin": BackgroundOriginHandler, + "background-position": BackgroundPositionHandler, + "background-repeat": BackgroundRepeatHandler, + "background-size": BackgroundSizeHandler, + "border": BorderHandler, + "border-bottom": BorderSideHandler, + "border-bottom-color": ColorHandler, + "border-bottom-left-radius": BorderSideRadiusHandler, + "border-bottom-right-radius": BorderSideRadiusHandler, + "border-bottom-style": BorderSideStyleHandler, + "border-bottom-width": BorderSideWidthHandler, + "border-collapse": BorderCollapseHandler, + "border-color": ColorHandler, + "border-image": BorderImageHandler, + "border-image-outset": BorderImageOutsetHandler, + "border-image-repeat": BorderImageRepeatHandler, + "border-image-slice": BorderImageSliceHandler, + "border-image-source": ImageHandler, + "border-image-width": BorderImageWidthHandler, + "border-left": BorderSideHandler, + "border-left-color": ColorHandler, + "border-left-style": BorderSideStyleHandler, + "border-left-width": BorderSideWidthHandler, + "border-radius": BorderRadiusHandler, + "border-right": BorderSideHandler, + "border-right-color": ColorHandler, + "border-right-style": BorderSideStyleHandler, + "border-right-width": BorderSideWidthHandler, + "border-spacing": BorderSpacingHandler, + "border-style": BorderStyleHandler, + "border-top": BorderSideHandler, + "border-top-color": ColorHandler, + "border-top-left-radius": BorderSideRadiusHandler, + "border-top-right-radius": BorderSideRadiusHandler, + "border-top-style": BorderSideStyleHandler, + "border-top-width": BorderSideWidthHandler, + "border-width": BorderWidthHandler, + "bottom": SideHandler, + "box-decoration-break": BoxDecorationBreakHandler, + "box-shadow": BoxShadowHandler, + "box-sizing": BoxSizingHandler, + "break-after": BreakBeforeAfterHandler, + "break-before": BreakBeforeAfterHandler, + "break-inside": BreakInsideHandler, + "caption-side": CaptionSideHandler, + "caret-color": CaretColorHandler, + "clear": ClearHandler, + "clip": ClipHandler, + "color": ColorHandler, + "column-count": ColumnCountHandler, + "column-fill": ColumnFillHandler, + "column-gap": ColumnGapHandler, + "column-rule": ColumnRuleHandler, + "column-rule-color": ColorHandler, + "column-rule-style": BorderSideStyleHandler, + "column-rule-width": ColumnRuleWidthHandler, + "column-span": ColumnSpanHandler, + "column-width": ColumnWidthHandler, + "columns": ColumnsHandler, + "cursor": CursorHandler, + "direction": DirectionHandler, + "display": DisplayHandler, + "empty-cells": EmptyCellsHandler, + "filter": FilterHandler, + "flex": FlexHandler, + "flex-basis": FlexBasisHandler, + "flex-direction": FlexDirectionHandler, + "flex-flow": FlexFlowHandler, + "flex-grow": FlexGrowHandler, + "flex-shrink": FlexGrowHandler, + "flex-wrap": FlexWrapHandler, + "float": FloatHandler, + "font": FontHandler, + "font-family": FontFamilyHandler, + "font-kerning": FontKerningHandler, + "font-language-override": FontLanguageOverrideHandler, + "font-size": FontSizeHandler, + "font-size-adjust": FontSizeAdjustHandler, + "font-stretch": FontStretchHandler, + "font-style": FontStyleHandler, + "font-synthesis": FontSynthesisHandler, + "font-variant": FontVariantHandler, + "font-variant-caps": FontVariantCapsHandler, + "font-variant-position": FontVariantPositionHandler, + "font-weight": FontWeightHandler, + "grid": GridHandler, + "grid-area": GridAreaHandler, + "grid-auto-columns": GridAutoColumnsHandler, + "grid-auto-flow": GridAutoFlowHandler, + "grid-auto-rows": GridAutoColumnsHandler, + "grid-column": GridColumnHandler, + "grid-column-end": GridAxisStartEndHandler, + "grid-column-gap": LengthHandler, + "grid-column-start": GridAxisStartEndHandler, + "grid-gap": GridGapHandler, + "grid-row": GridRowHandler, + "grid-row-end": GridAxisStartEndHandler, + "grid-row-gap": LengthHandler, + "grid-row-start": GridAxisStartEndHandler, + "grid-template": GridTemplateHandler, + "grid-template-areas": GridTemplateAreasHandler, + "grid-template-columns": GridTemplateColumnsHandler, + "grid-template-rows": GridTemplateRowsHandler, + "hanging-punctuation": HangingPunctuationHandler, + "height": HeightHandler, + "hyphens": HyphensHandler, + "image-rendering": ImageRenderingHandler, + "isolation": IsolationHandler, + "justify-content": JustifyContentHandler, + "left": SideHandler, + "letter-spacing": LetterSpacingHandler, + "line-break": LineBreakHandler, + "line-height": LineHeightHandler, + "list-style": ListStyleHandler, + "list-style-image": ImageHandler, + "list-style-position": ListStylePositionHandler, + "list-style-type": ListStyleTypeHandler, + "margin": MarginHandler, + "margin-bottom": MarginSideHandler, + "margin-left": MarginSideHandler, + "margin-right": MarginSideHandler, + "margin-top": MarginSideHandler, + "max-height": MaxHeightWidthHandler, + "max-width": MaxHeightWidthHandler, + "min-height": MinHeightWidthHandler, + "min-width": MinHeightWidthHandler, + "mix-blend-mode": MixBlendModeHandler, + "object-fit": ObjectFitHandler, + "object-position": ObjectPositionHandler, + "opacity": OpacityHandler, + "order": OrderHandler, + "orphans": OrphansHandler, + "outline": OutlineHandler, + "outline-color": ColorHandler, + "outline-offset": OutlineOffsetHandler, + "outline-style": OutlineStyleHandler, + "outline-width": OutlineWidthHandler, + "overflow": OverflowHandler, + "overflow-wrap": OverflowWrapHandler, + "overflow-x": OverflowXYHandler, + "overflow-y": OverflowXYHandler, + "padding": PaddingHandler, + "padding-bottom": PaddingSideHandler, + "padding-left": PaddingSideHandler, + "padding-right": PaddingSideHandler, + "padding-top": PaddingSideHandler, + "page-break-after": PageBreakBeforeAfterHandler, + "page-break-before": PageBreakBeforeAfterHandler, + "page-break-inside": PageBreakInsideHandler, + "perspective": PerspectiveHandler, + "perspective-origin": PerspectiveOriginHandler, + "pointer-events": PointerEventsHandler, + "position": PositionHandler, + "quotes": QuotesHandler, + "resize": ResizeHandler, + "right": SideHandler, + "scroll-behavior": ScrollBehaviorHandler, + "tab-size": TabSizeHandler, + "table-layout": TableLayoutHandler, + "text-align": TextAlignHandler, + "text-align-last": TextAlignLastHandler, + "text-combine-upright": TextCombineUprightHandler, + "text-decoration": TextDecorationHandler, + "text-decoration-color": ColorHandler, + "text-decoration-line": TextDecorationLineHandler, + "text-decoration-style": TextDecorationStyleHandler, + "text-indent": TextIndentHandler, + "text-justify": TextJustifyHandler, + "text-orientation": TextOrientationHandler, + "text-overflow": TextOverflowHandler, + "text-shadow": TextShadowHandler, + "text-transform": TextTransformHandler, + "top": SideHandler, + "transform": TransformHandler, + "transform-origin": TransformOriginHandler, + "transform-style": TransformStyleHandler, + "transition": TransitionHandler, + "transition-delay": TransitionDelayHandler, + "transition-duration": TransitionDurationHandler, + "transition-property": TransitionPropertyHandler, + "transition-timing-function": TimingFunctionHandler, + "unicode-bidi": UnicodeBidiHandler, + "user-select": UserSelectHandler, + "vertical-align": VerticalAlignHandler, + "visibility": VisiblityHandler, + "white-space": WhiteSpaceHandler, + "widows": OrphansHandler, + "width": WidthHandler, + "word-break": WordBreakHandler, + "word-spacing": WordSpacingHandler, + "word-wrap": WordWrapHandler, + "writing-mode": WritingModeHandler, + "z-index": ZIndexHandler, + } + colorValues = []string{"initial", "inherit", "aliceblue", "antiquewhite", + "aqua", "aquamarine", "azure", "beige", "bisque", "black", + "blanchedalmond", "blue", "blueviolet", "brown", "burlywood", + "cadetblue", "chartreuse", "chocolate", "coral", "cornflowerblue", + "cornsilk", "crimson", "cyan", "darkblue", "darkcyan", "darkgoldenrod", + "darkgray", "darkgrey", "darkgreen", "darkkhaki", "darkmagenta", + "darkolivegreen", "darkorange", "darkorchid", "darkred", "darksalmon", + "darkseagreen", "darkslateblue", "darkslategrey", "darkslategray", + "darkturquoise", "darkviolet", "deeppink", "deepskyblue", "dimgray", + "dimgrey", "dodgerblue", "firebrick", "floralwhite", "forestgreen", + "fuchsia", "gainsboro", "ghostwhite", "gold", "goldenrod", "gray", + "grey", "green", "greenyellow", "honeydew", "hotpink", "indianred", + "indigo", "ivory", "khaki", "lavender", "lavenderblush", + "lemonchiffon", "lightblue", "lightcoral", "lightcyan", + "lightgoldenrodyellow", "lightgray", "lightgrey", "lightgreen", + "lightpink", "lightsalmon", "lightseagreen", "lightskyblue", + "lightslategray", "lightslategrey", "lightsteeelblue", "lightyellow", + "lime", "limegreen", "linen", "magenta", "maroon", "mediumaquamarine", + "mediumblue", "mediumorchid", "mediumpurple", "mediumseagreen", + "mediumslateblue", "mediumspringgreen", "mediumturquoise", + "mediumvioletred", "midnightblue", "mintcream", "mistyrose", + "moccasin", "navajowhite", "navy", "oldlace", "olive", "olivedrab", + "orange", "orangered", "orchid", "palegoldenrod", "palegreen", + "paleturquoise", "palevioletred", "papayawhip", "peachpuff", "peru", + "pink", "plum", "powderblue", "purple", "rebeccapurple", "red", + "rosybrown", "royalblue", "saddlebrown", "salmon", "sandybrown", + "seagreen", "seashell", "sienna", "silver", "skyblue", "slateblue", + "slategray", "slategrey", "snow", "springgreen", "steelblue", "tan", + "teal", "thistle", "tomato", "turquoise", "violet", "wheat", "white", + "whitesmoke", "yellow", "yellowgreen"} +) + +func multiSplit(value string, seps ...string) []string { + curArray := []string{value} + for _, i := range seps { + newArray := []string{} + for _, j := range curArray { + newArray = append(newArray, strings.Split(j, i)...) + } + curArray = newArray + } + return curArray +} + +func recursiveCheck(value []string, funcs []func(string) bool) bool { + for i := 0; i < len(value); i++ { + tempVal := strings.Join(value[:i+1], " ") + for _, j := range funcs { + if j(tempVal) && (len(value[i+1:]) == 0 || recursiveCheck(value[i+1:], funcs)) { + return true + } + } + } + return false +} + +func in(value []string, arr []string) bool { + for _, i := range value { + foundString := false + for _, j := range arr { + if j == i { + foundString = true + } + } + if !foundString { + return false + } + } + return true +} + +func splitValues(value string) []string { + values := strings.Split(value, ",") + for _, strippedValue := range values { + strippedValue = strings.ToLower(strings.TrimSpace(strippedValue)) + } + return values +} + +func getDefaultHandler(attr string) func(string) bool { + + if defaultStyleHandlers[attr] != nil { + return defaultStyleHandlers[attr] + } + return BaseHandler +} + +func BaseHandler(value string) bool { + return false +} + +func AlignContentHandler(value string) bool { + values := []string{"stretch", "center", "flex-start", + "flex-end", "space-between", "space-around", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AlignItemsHandler(value string) bool { + values := []string{"stretch", "center", "flex-start", + "flex-end", "baseline", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AlignSelfHandler(value string) bool { + values := []string{"auto", "stretch", "center", "flex-start", + "flex-end", "baseline", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AllHandler(value string) bool { + values := []string{"initial", "inherit", "unset"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AnimationHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + AnimationNameHandler, + AnimationDurationHandler, + TimingFunctionHandler, + AnimationDelayHandler, + AnimationIterationCountHandler, + AnimationDirectionHandler, + AnimationFillModeHandler, + AnimationPlayStateHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func AnimationDelayHandler(value string) bool { + reg := regexp.MustCompile(`[\-]?[0-9]+[\.]?[0-9]*[s|ms]?`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AnimationDirectionHandler(value string) bool { + values := []string{"normal", "reverse", "alternate", "alternate-reverse", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AnimationDurationHandler(value string) bool { + reg := regexp.MustCompile(`[0-9]+[\.]?[0-9]*[s|ms]?`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AnimationFillModeHandler(value string) bool { + values := []string{"none", "forwards", "backwards", "both", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AnimationIterationCountHandler(value string) bool { + reg := regexp.MustCompile(`[0-9]+[\.]?[0-9]*`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"infinite", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func AnimationNameHandler(value string) bool { + reg := regexp.MustCompile(`[a-z]+`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func AnimationPlayStateHandler(value string) bool { + values := []string{"paused", "running", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TimingFunctionHandler(value string) bool { + values := []string{"linear", "ease", "ease-in", "ease-out", "ease-in-out", "step-start", "step-end", "initial", "inherit"} + splitVals := splitValues(value) + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`cubic-bezier\(([ ]*(0(.[0-9]+)?|1(.0)?),){3}[ ]*(0(.[0-9]+)?|1)\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`steps\([ ]*[0-9]+([ ]*,[ ]*(start|end)?)\)`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func BackfaceVisibilityHandler(value string) bool { + values := []string{"visible", "hidden", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BackgroundHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + newSplitVals := []string{} + for _, i := range splitVals { + if len(strings.Split(i, "/")) == 2 { + newSplitVals = append(newSplitVals, strings.Split(i, "/")...) + } else { + newSplitVals = append(newSplitVals, i) + } + } + usedFunctions := []func(string) bool{ + ColorHandler, + ImageHandler, + BackgroundPositionHandler, + BackgroundSizeHandler, + BackgroundRepeatHandler, + BackgroundOriginHandler, + BackgroundClipHandler, + BackgroundAttachmentHandler, + } + return recursiveCheck(newSplitVals, usedFunctions) +} + +func BackgroundAttachmentHandler(value string) bool { + values := []string{"scroll", "fixed", "local", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BackgroundClipHandler(value string) bool { + values := []string{"border-box", "padding-box", "content-box", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BackgroundBlendModeHandler(value string) bool { + values := []string{"normal", "multiply", "screen", "overlay", "darken", + "lighten", "color-dodge", "saturation", "color", "luminosity"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ImageHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + splitVals := splitValues(value) + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`url\([\"\']?((https|http)[a-z0-9\.\\/_:]+[\"\']?)\)`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func BackgroundOriginHandler(value string) bool { + values := []string{"padding-box", "border-box", "content-box", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BackgroundPositionHandler(value string) bool { + splitVals := strings.Split(value, ";") + values := []string{"left", "left top", "left bottom", "right", "right top", "right bottom", "right center", "center top", "center center", "center bottom", "center", "top", "bottom", "initial", "inherit"} + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`[\-]*[0-9]+[cm|mm|in|px|pt|pc\%]* [[\-]*[0-9]+[cm|mm|in|px|pt|pc\%]*]*`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + return false +} + +func BackgroundRepeatHandler(value string) bool { + values := []string{"repeat", "repeat-x", "repeat-y", "no-repeat", "space", "round", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BackgroundSizeHandler(value string) bool { + splitVals := strings.Split(value, " ") + values := []string{"auto", "cover", "contain", "initial", "inherit"} + if in(splitVals, values) { + return true + } + if len(splitVals) > 0 && LengthHandler(splitVals[0]) { + if len(splitVals) < 2 || (len(splitVals) == 2 && LengthHandler(splitVals[1])) { + return true + } + } + return false +} + +func BorderHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := multiSplit(value, " ", "/") + usedFunctions := []func(string) bool{ + BorderWidthHandler, + BorderStyleHandler, + ColorHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderSideHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + BorderSideWidthHandler, + BorderSideStyleHandler, + ColorHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderSideRadiusHandler(value string) bool { + splitVals := strings.Split(value, " ") + valid := true + for _, i := range splitVals { + if !LengthHandler(i) { + valid = false + break + } + } + if valid { + return true + } + splitVals = splitValues(value) + values := []string{"initial", "inherit"} + return in(splitVals, values) +} + +func BorderSideStyleHandler(value string) bool { + values := []string{"none", "hidden", "dotted", "dashed", "solid", "double", "groove", "ridge", "inset", "outset", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BorderSideWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + splitVals := strings.Split(value, ";") + values := []string{"medium", "thin", "thick", "initial", "inherit"} + return in(splitVals, values) +} + +func BorderCollapseHandler(value string) bool { + values := []string{"separate", "collapse", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BorderImageHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := multiSplit(value, " ", " / ") + usedFunctions := []func(string) bool{ + ImageHandler, + BorderImageSliceHandler, + BorderImageWidthHandler, + BorderImageOutsetHandler, + BorderImageRepeatHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderImageOutsetHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BorderImageRepeatHandler(value string) bool { + values := []string{"stretch", "repeat", "round", "space", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BorderImageSliceHandler(value string) bool { + values := []string{"fill", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 4 { + return false + } + usedFunctions := []func(string) bool{ + LengthHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderImageWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BorderRadiusHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 4 { + return false + } + usedFunctions := []func(string) bool{ + LengthHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderSpacingHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 2 { + return false + } + usedFunctions := []func(string) bool{ + LengthHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderStyleHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 4 { + return false + } + usedFunctions := []func(string) bool{ + BorderSideStyleHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func BorderWidthHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 4 { + return false + } + usedFunctions := []func(string) bool{ + BorderSideWidthHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func SideHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"auto", "inherit", "unset"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BoxDecorationBreakHandler(value string) bool { + values := []string{"slice", "clone", "initial", "initial", "inherit", "unset"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BoxShadowHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + commaSplitVals := strings.Split(value, ",") + for _, val := range commaSplitVals { + splitVals := strings.Split(val, " ") + if len(splitVals) > 6 || len(splitVals) < 2 { + return false + } + if !LengthHandler(splitVals[0]) { + return false + } + if !LengthHandler(splitVals[1]) { + return false + } + usedFunctions := []func(string) bool{ + LengthHandler, + ColorHandler, + } + if len(splitVals) > 2 && !recursiveCheck(splitVals[2:], usedFunctions) { + return false + } + } + return true +} + +func BoxSizingHandler(value string) bool { + values := []string{"slicontent-box", "border-box", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BreakBeforeAfterHandler(value string) bool { + values := []string{"auto", "avoid", "always", "all", "avoid-page", "page", "left", "right", "recto", "verso", "avoid-column", "column", "avoid-region", "region"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func BreakInsideHandler(value string) bool { + values := []string{"auto", "avoid", "avoid-page", "avoid-column", "avoid-region"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func CaptionSideHandler(value string) bool { + values := []string{"top", "bottom", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func CaretColorHandler(value string) bool { + splitVals := splitValues(value) + if in(splitVals, colorValues) { + return true + } + reg := regexp.MustCompile(`#[0-9abcdef]{6}`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`rgb\(([ ]*((([0-9]{1,2}|100)\%)|(([01]?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5]))),){2}([ ]*((([0-9]{1,2}|100)\%)|(([01]?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5]))))\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`rgba\(([ ]*((([0-9]{1,2}|100)\%)|(([01]?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5]))),){3}[ ]*(1(\.0)?|0|(0\.[0-9]+))\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`hsl\([ ]*([012]?[0-9]{1,2}|3[0-5][0-9]|360),[ ]*([0-9]{0,2}|100)\%,[ ]*([0-9]{0,2}|100)\%\)`) + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`hsla\(([ ]*[012]?[0-9]{1,2}|3[0-5][0-9]|360),[ ]*([0-9]{0,2}|100)\%,[ ]*([0-9]{0,2}|100)\%,[ ]*(1|1\.0|0|(0\.[0-9]+))\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + return false +} + +func ClearHandler(value string) bool { + values := []string{"none", "left", "right", "both", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ClipHandler(value string) bool { + reg := regexp.MustCompile(`rect\([0-9]+px,[ ]*[0-9]+px,[ ]*[0-9]+px,[ ]*[0-9]+px\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ColorHandler(value string) bool { + splitVals := splitValues(value) + if in(splitVals, colorValues) { + return true + } + reg := regexp.MustCompile(`#[0-9abcdef]{6}`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`rgb\(([ ]*((([0-9]{1,2}|100)\%)|(([01]?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5]))),){2}([ ]*((([0-9]{1,2}|100)\%)|(([01]?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5]))))\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`rgba\(([ ]*((([0-9]{1,2}|100)\%)|(([01]?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5]))),){3}[ ]*(1(\.0)?|0|(0\.[0-9]+))\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`hsl\([ ]*([012]?[0-9]{1,2}|3[0-5][0-9]|360),[ ]*([0-9]{0,2}|100)\%,[ ]*([0-9]{0,2}|100)\%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`hsla\(([ ]*[012]?[0-9]{1,2}|3[0-5][0-9]|360),[ ]*([0-9]{0,2}|100)\%,[ ]*([0-9]{0,2}|100)\%,[ ]*(1|1\.0|0|(0\.[0-9]+))\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + return false +} + +func ColumnCountHandler(value string) bool { + reg := regexp.MustCompile(`[0-9]+`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ColumnFillHandler(value string) bool { + values := []string{"balance", "auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ColumnGapHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"normal", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ColumnRuleHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + ColumnRuleWidthHandler, + BorderSideStyleHandler, + ColorHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func ColumnRuleWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + splitVals := strings.Split(value, ";") + values := []string{"medium", "thin", "thick", "initial", "inherit"} + return in(splitVals, values) +} + +func ColumnSpanHandler(value string) bool { + values := []string{"none", "all", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ColumnWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + splitVals := strings.Split(value, ";") + values := []string{"auto", "initial", "inherit"} + return in(splitVals, values) +} + +func ColumnsHandler(value string) bool { + values := []string{"auto", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + ColumnWidthHandler, + ColumnCountHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func CursorHandler(value string) bool { + values := []string{"alias", "all-scroll", "auto", "cell", "context-menu", "col-resize", "copy", "crosshair", "default", "e-resize", "ew-resize", "grab", "grabbing", "help", "move", "n-resize", "ne-resize", "nesw-resize", "ns-resize", "nw-resize", "nwse-resize", "no-drop", "none", "not-allowed", "pointer", "progress", "row-resize", "s-resize", "se-resize", "sw-resize", "text", "vertical-text", "w-resize", "wait", "zoom-in", "zoom-out", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func DirectionHandler(value string) bool { + values := []string{"ltr", "rtl", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func DisplayHandler(value string) bool { + values := []string{"inline", "block", "contents", "flex", "grid", "inline-block", "inline-flex", "inline-grid", "inline-table", "list-item", "run-in", "table", "table-caption", "table-column-group", "table-header-group", "table-footer-group", "table-row-group", "table-cell", "table-column", "table-row", "none", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func EmptyCellsHandler(value string) bool { + values := []string{"show", "hide", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FilterHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + splitVals := splitValues(value) + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`blur\([0-9]+px\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`(brightness|contrast)\([0-9]+\%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`drop-shadow\(([-]?[0-9]+px) ([-]?[0-9]+px)( [-]?[0-9]+px)?( ([-]?[0-9]+px))?`) + reg.Longest() + colorValue := strings.TrimSuffix(string(reg.ReplaceAll([]byte(value), []byte{})), ")") + if ColorHandler(colorValue) { + return true + } + reg = regexp.MustCompile(`grayscale\(([0-9]{1,2}|100)%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`hue-rotate\(([12]?[0-9]{1,2}|3[0-5][0-9]|360)?\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`invert\(([0-9]{1,2}|100)%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`opacity\(([0-9]{1,2}|100)%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`saturate\([0-9]+%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`sepia\(([0-9]{1,2}|100)%\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + //Not allowing URLs + return false +} + +func FlexHandler(value string) bool { + values := []string{"auto", "initial", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + FlexGrowHandler, + FlexBasisHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func FlexBasisHandler(value string) bool { + if LengthHandler(value) { + return true + } + splitVals := strings.Split(value, ";") + values := []string{"auto", "initial", "inherit"} + return in(splitVals, values) +} + +func FlexDirectionHandler(value string) bool { + values := []string{"row", "row-reverse", "column", "column-reverse", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FlexFlowHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + FlexDirectionHandler, + FlexWrapHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func FlexGrowHandler(value string) bool { + reg := regexp.MustCompile(`[0-9\.]+`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + splitVals := strings.Split(value, ";") + values := []string{"initial", "inherit"} + return in(splitVals, values) +} + +func FlexWrapHandler(value string) bool { + values := []string{"nowrap", "wrap", "wrap-reverse", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FloatHandler(value string) bool { + values := []string{"none", "left", "right", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontHandler(value string) bool { + values := []string{"caption", "icon", "menu", "message-box", "small-caption", "status-bar", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + newSplitVals := []string{} + for _, i := range splitVals { + if len(strings.Split(i, "/")) == 2 { + newSplitVals = append(newSplitVals, strings.Split(i, "/")...) + } else { + newSplitVals = append(newSplitVals, i) + } + } + usedFunctions := []func(string) bool{ + FontStyleHandler, + FontVariantHandler, + FontWeightHandler, + FontSizeHandler, + FontFamilyHandler, + } + return recursiveCheck(newSplitVals, usedFunctions) +} + +func FontFamilyHandler(value string) bool { + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`('[a-z \-]+'|[a-z \-]+)`) + reg.Longest() + for _, i := range splitVals { + i = strings.TrimSpace(i) + if reg.FindString(i) != i { + return false + } + } + return true +} + +func FontKerningHandler(value string) bool { + values := []string{"auto", "normal", "none"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontLanguageOverrideHandler(value string) bool { + reg := regexp.MustCompile(`[a-z]+`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func FontSizeHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"medium", "xx-small", "x-small", "small", "large", "x-large", "xx-large", "smaller", "larger", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontSizeAdjustHandler(value string) bool { + reg := regexp.MustCompile(`[0-9]+[\.]?[0-9]*`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontStretchHandler(value string) bool { + values := []string{"ultra-condensed", "extra-condensed", "condensed", "semi-condensed", "normal", "semi-expanded", "expanded", "extra-expanded", "ultra-expanded", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontStyleHandler(value string) bool { + values := []string{"normal", "italic", "oblique", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontSynthesisHandler(value string) bool { + values := []string{"none", "style", "weight"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontVariantCapsHandler(value string) bool { + values := []string{"normal", "small-caps", "all-small-caps", "petite-caps", "all-petite-caps", "unicase", "titling-caps"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontVariantHandler(value string) bool { + values := []string{"normal", "small-caps", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontVariantPositionHandler(value string) bool { + values := []string{"normal", "sub", "super"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func FontWeightHandler(value string) bool { + values := []string{"normal", "bold", "bolder", "lighter", "100", "200", "300", "400", "500", "600", "700", "800", "900", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func GridHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + newSplitVals := []string{} + for _, i := range splitVals { + if i != "/" { + newSplitVals = append(newSplitVals, i) + } + } + usedFunctions := []func(string) bool{ + GridTemplateRowsHandler, + GridTemplateColumnsHandler, + GridTemplateAreasHandler, + GridAutoColumnsHandler, + GridAutoFlowHandler, + } + return recursiveCheck(newSplitVals, usedFunctions) +} + +func GridAreaHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " / ") + usedFunctions := []func(string) bool{ + GridAxisStartEndHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func GridAutoColumnsHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"auto", "max-content", "min-content", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func GridAutoFlowHandler(value string) bool { + values := []string{"row", "column", "dense", "row dense", "column dense"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func GridColumnHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " / ") + if len(splitVals) > 2 { + return false + } + usedFunctions := []func(string) bool{ + GridAxisStartEndHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func GridColumnGapHandler(value string) bool { + return LengthHandler(value) +} + +func LengthHandler(value string) bool { + reg := regexp.MustCompile(`[\-]?[0-9]+[\.]?[0-9]*(%|cm|mm|in|px|pt|pc|em|ex|ch|rem|vw|vh|vmin|vmax|deg|rad|turn)?`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func LineBreakHandler(value string) bool { + values := []string{"auto", "loose", "normal", "strict"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func GridAxisStartEndHandler(value string) bool { + reg := regexp.MustCompile(`[0-9]+`) + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`span [0-9]+`) + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"auto"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func GridGapHandler(value string) bool { + splitVals := strings.Split(value, " ") + if len(splitVals) > 2 { + return false + } + usedFunctions := []func(string) bool{ + GridColumnGapHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func GridRowHandler(value string) bool { + splitVals := strings.Split(value, " / ") + if len(splitVals) > 2 { + return false + } + usedFunctions := []func(string) bool{ + GridAxisStartEndHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func GridTemplateHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " / ") + if len(splitVals) > 2 { + return false + } + usedFunctions := []func(string) bool{ + GridTemplateColumnsHandler, + GridTemplateRowsHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func GridTemplateAreasHandler(value string) bool { + values := []string{"none"} + if in([]string{value}, values) { + return true + } + reg := regexp.MustCompile(`['"]?[a-z ]+['"]?`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func GridTemplateColumnsHandler(value string) bool { + splitVals := strings.Split(value, " ") + values := []string{"none", "auto", "max-content", "min-content", "initial", "inherit"} + for _, val := range splitVals { + if LengthHandler(val) { + continue + } + valArr := []string{val} + if !in(valArr, values) { + return false + } + } + return true +} + +func GridTemplateRowsHandler(value string) bool { + splitVals := strings.Split(value, " ") + values := []string{"none", "auto", "max-content", "min-content"} + for _, val := range splitVals { + if LengthHandler(val) { + continue + } + valArr := []string{val} + if !in(valArr, values) { + return false + } + } + return true +} + +func HangingPunctuationHandler(value string) bool { + values := []string{"none", "first", "last", "allow-end", "force-end", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func HeightHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func HyphensHandler(value string) bool { + values := []string{"none", "manual", "auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ImageRenderingHandler(value string) bool { + values := []string{"auto", "smooth", "high-quality", "crisp-edges", "pixelated"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func IsolationHandler(value string) bool { + values := []string{"auto", "isolate", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func JustifyContentHandler(value string) bool { + values := []string{"flex-start", "flex-end", "center", "space-between", "space-around", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func LetterSpacingHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"normal", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func LineHeightHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"normal", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ListStyleHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + ListStyleTypeHandler, + ListStylePositionHandler, + ImageHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func ListStylePositionHandler(value string) bool { + values := []string{"inside", "outside", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ListStyleTypeHandler(value string) bool { + values := []string{"disc", "armenian", "circle", "cjk-ideographic", "decimal", "decimal-leading-zero", "georgian", "hebrew", "hiragana", "hiragana-iroha", "katakana", "katakana-iroha", "lower-alpha", "lower-greek", "lower-latin", "lower-roman", "none", "square", "upper-alpha", "upper-greek", "upper-latin", "upper-roman", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func MarginHandler(value string) bool { + values := []string{"auto", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + MarginSideHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func MarginSideHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func MaxHeightWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"none", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func MinHeightWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func MixBlendModeHandler(value string) bool { + values := []string{"normal", "multiply", "screen", "overlay", "darken", "lighten", "color-dodge", "color-burn", "difference", "exclusion", "hue", "saturation", "color", "luminosity"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ObjectFitHandler(value string) bool { + values := []string{"fill", "contain", "cover", "none", "scale-down", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ObjectPositionHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 2 { + return false + } + usedFunctions := []func(string) bool{ + LengthHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func OpacityHandler(value string) bool { + reg := regexp.MustCompile("(0[.]?[0-9]*)|(1.0)") + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OrderHandler(value string) bool { + reg := regexp.MustCompile("[0-9]+") + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OutlineHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + ColorHandler, + OutlineWidthHandler, + OutlineStyleHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func OutlineOffsetHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OutlineStyleHandler(value string) bool { + values := []string{"none", "hidden", "dotted", "dashed", "solid", "double", "groove", "ridge", "inset", "outset", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OutlineWidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"medium", "thin", "thick", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OverflowHandler(value string) bool { + values := []string{"visible", "hidden", "scroll", "auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OverflowXYHandler(value string) bool { + values := []string{"visible", "hidden", "scroll", "auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OverflowWrapHandler(value string) bool { + values := []string{"normal", "break-word", "anywhere"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func OrphansHandler(value string) bool { + reg := regexp.MustCompile(`[0-9]+`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func PaddingHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + if len(splitVals) > 4 { + return false + } + usedFunctions := []func(string) bool{ + PaddingSideHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func PaddingSideHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func PageBreakBeforeAfterHandler(value string) bool { + values := []string{"auto", "always", "avoid", "left", "right", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func PageBreakInsideHandler(value string) bool { + values := []string{"auto", "avoid", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func PerspectiveHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"none", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func PerspectiveOriginHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + xValues := []string{"left", "center", "right"} + yValues := []string{"top", "center", "bottom"} + if len(splitVals) > 1 { + if !in([]string{splitVals[0]}, xValues) && !LengthHandler(splitVals[0]) { + return false + } + return in([]string{splitVals[1]}, yValues) || LengthHandler(splitVals[1]) + } else if len(splitVals) == 1 { + return in(splitVals, xValues) || in(splitVals, yValues) || LengthHandler(splitVals[0]) + } + return false +} + +func PointerEventsHandler(value string) bool { + values := []string{"auto", "none", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func PositionHandler(value string) bool { + values := []string{"static", "absolute", "fixed", "relative", "sticky", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func QuotesHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + splitVals := splitValues(value) + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`([ ]*["'][\x{0022}\x{0027}\x{2039}\x{2039}\x{203A}\x{00AB}\x{00BB}\x{2018}\x{2019}\x{201C}-\x{201E}]["'] ["'][\x{0022}\x{0027}\x{2039}\x{2039}\x{203A}\x{00AB}\x{00BB}\x{2018}\x{2019}\x{201C}-\x{201E}]["'])+`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func ResizeHandler(value string) bool { + values := []string{"none", "both", "horizontal", "vertical", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ScrollBehaviorHandler(value string) bool { + values := []string{"auto", "smooth", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TabSizeHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TableLayoutHandler(value string) bool { + values := []string{"auto", "fixed", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextAlignHandler(value string) bool { + values := []string{"left", "right", "center", "justify", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextAlignLastHandler(value string) bool { + values := []string{"auto", "left", "right", "center", "justify", "start", "end", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextCombineUprightHandler(value string) bool { + values := []string{"none", "all"} + splitVals := splitValues(value) + if in(splitVals, values) { + return true + } + reg := regexp.MustCompile(`digits [2-4]`) + reg.Longest() + return reg.FindString(value) == value && value != "" +} + +func TextDecorationHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + TextDecorationStyleHandler, + ColorHandler, + TextDecorationLineHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func TextDecorationLineHandler(value string) bool { + values := []string{"none", "underline", "overline", "line-through", "initial", "inherit"} + splitVals := strings.Split(value, " ") + return in(splitVals, values) +} + +func TextDecorationStyleHandler(value string) bool { + values := []string{"solid", "double", "dotted", "dashed", "wavy", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextIndentHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextJustifyHandler(value string) bool { + values := []string{"auto", "inter-word", "inter-character", "none", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextOverflowHandler(value string) bool { + reg := regexp.MustCompile("[\"'][a-z]+[\"']") + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"clip", "ellipsis", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextOrientationHandler(value string) bool { + values := []string{"mixed", "upright", "sideways", "sideways-right"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TextShadowHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + commaSplitVals := strings.Split(value, ",") + for _, val := range commaSplitVals { + splitVals := strings.Split(val, " ") + if len(splitVals) > 6 || len(splitVals) < 2 { + return false + } + if !LengthHandler(splitVals[0]) { + return false + } + if !LengthHandler(splitVals[1]) { + return false + } + usedFunctions := []func(string) bool{ + LengthHandler, + ColorHandler, + } + if len(splitVals) > 2 && !recursiveCheck(splitVals[2:], usedFunctions) { + return false + } + } + return true +} + +func TextTransformHandler(value string) bool { + values := []string{"none", "capitalize", "uppercase", "lowercase", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TransformHandler(value string) bool { + values := []string{"none", "initial", "inherit"} + if in([]string{value}, values) { + return true + } + reg := regexp.MustCompile(`matrix\(([ ]*[0-9]+[\.]?[0-9]*,){5}([ ]*[0-9]+[\.]?[0-9]*)\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`matrix3d\(([ ]*[0-9]+[\.]?[0-9]*,){15}([ ]*[0-9]+[\.]?[0-9]*)\)`) + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`(translate|translate3d|translatex|translatey|translatez|scale|scale3d|scalex|scaley|scalez)\(`) + reg.Longest() + subValue := string(reg.ReplaceAll([]byte(value), []byte{})) + trimValue := strings.Split(strings.TrimSuffix(subValue, ")"), ",") + valid := true + for _, i := range trimValue { + if !LengthHandler(strings.TrimSpace(i)) { + valid = false + break + } + } + if valid && trimValue != nil { + return true + } + reg = regexp.MustCompile(`rotate(x|y|z)?\(([12]?|3[0-5][0-9]|360)\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`rotate3d\(([ ]?(1(\.0)?|0\.[0-9]+),){3}([12]?|3[0-5][0-9]|360)\)`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + reg = regexp.MustCompile(`skew(x|y)?\(`) + reg.Longest() + subValue = string(reg.ReplaceAll([]byte(value), []byte{})) + subValue = strings.TrimSuffix(subValue, ")") + trimValue = strings.Split(subValue, ",") + valid = true + for _, i := range trimValue { + if !LengthHandler(strings.TrimSpace(i)) { + valid = false + break + } + } + if valid { + return true + } + reg = regexp.MustCompile(`perspective\(`) + reg.Longest() + subValue = string(reg.ReplaceAll([]byte(value), []byte{})) + subValue = strings.TrimSuffix(subValue, ")") + return LengthHandler(subValue) +} + +func TransformOriginHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + xValues := []string{"left", "center", "right"} + yValues := []string{"top", "center", "bottom"} + if len(splitVals) > 2 { + if !in([]string{splitVals[0]}, xValues) && !LengthHandler(splitVals[0]) { + return false + } + if !in([]string{splitVals[1]}, yValues) && !LengthHandler(splitVals[1]) { + return false + } + return LengthHandler(splitVals[2]) + } else if len(splitVals) > 1 { + if !in([]string{splitVals[0]}, xValues) && !LengthHandler(splitVals[0]) { + return false + } + return in([]string{splitVals[1]}, yValues) || LengthHandler(splitVals[1]) + } else if len(splitVals) == 1 { + return in(splitVals, xValues) || in(splitVals, yValues) || LengthHandler(splitVals[0]) + } + return false +} + +func TransformStyleHandler(value string) bool { + values := []string{"flat", "preserve-3d", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TransitionHandler(value string) bool { + values := []string{"initial", "inherit"} + if in([]string{value}, values) { + return true + } + splitVals := strings.Split(value, " ") + usedFunctions := []func(string) bool{ + TransitionPropertyHandler, + TransitionDurationHandler, + TimingFunctionHandler, + TransitionDelayHandler, + ColorHandler, + } + return recursiveCheck(splitVals, usedFunctions) +} + +func TransitionDelayHandler(value string) bool { + reg := regexp.MustCompile("[0-9]+[.]?[0-9]*(s|ms)?") + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TransitionDurationHandler(value string) bool { + reg := regexp.MustCompile("[0-9]+[.]?[0-9]*(s|ms)?") + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func TransitionPropertyHandler(value string) bool { + reg := regexp.MustCompile("([a-zA-Z]+,[ ]?)*[a-zA-Z]+") + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"none", "all", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func UnicodeBidiHandler(value string) bool { + values := []string{"normal", "embed", "bidi-override", "isolate", "isolate-override", "plaintext", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func UserSelectHandler(value string) bool { + values := []string{"auto", "none", "text", "all"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func VerticalAlignHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"baseline", "sub", "super", "top", "text-top", "middle", "bottom", "text-bottom", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func VisiblityHandler(value string) bool { + values := []string{"visible", "hidden", "collapse", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func WhiteSpaceHandler(value string) bool { + values := []string{"normal", "nowrap", "pre", "pre-line", "pre-wrap", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func WidthHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func WordSpacingHandler(value string) bool { + if LengthHandler(value) { + return true + } + values := []string{"normal", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func WordBreakHandler(value string) bool { + values := []string{"normal", "break-all", "keep-all", "break-word", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func WordWrapHandler(value string) bool { + values := []string{"normal", "break-word", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func WritingModeHandler(value string) bool { + values := []string{"horizontal-tb", "vertical-rl", "vertical-lr"} + splitVals := splitValues(value) + return in(splitVals, values) +} + +func ZIndexHandler(value string) bool { + reg := regexp.MustCompile(`[\-]?[0-9]+`) + reg.Longest() + if reg.FindString(value) == value && value != "" { + return true + } + values := []string{"auto", "initial", "inherit"} + splitVals := splitValues(value) + return in(splitVals, values) +} diff --git a/vendor/github.com/microcosm-cc/bluemonday/helpers.go b/vendor/github.com/microcosm-cc/bluemonday/helpers.go index dfa5868da8..089fe9db90 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/helpers.go +++ b/vendor/github.com/microcosm-cc/bluemonday/helpers.go @@ -135,7 +135,7 @@ func (p *Policy) AllowStandardURLs() { // Most common URL schemes only p.AllowURLSchemes("mailto", "http", "https") - // For all anchors we will add rel="nofollow" if it does not already exist + // For linking elements we will add rel="nofollow" if it does not already exist // This applies to "a" "area" "link" p.RequireNoFollowOnLinks(true) } diff --git a/vendor/github.com/microcosm-cc/bluemonday/policy.go b/vendor/github.com/microcosm-cc/bluemonday/policy.go index 5d28beca36..739d302c30 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/policy.go +++ b/vendor/github.com/microcosm-cc/bluemonday/policy.go @@ -29,6 +29,8 @@ package bluemonday +//TODO sgutzwiller create map of styles to default handlers +//TODO sgutzwiller create handlers for various attributes import ( "net/url" "regexp" @@ -47,21 +49,26 @@ type Policy struct { // exceptions initialized bool - // Allows the <!DOCTYPE > tag to exist in the sanitized document - allowDocType bool - // If true then we add spaces when stripping tags, specifically the closing // tag is replaced by a space character. addSpaces bool - // When true, add rel="nofollow" to HTML anchors + // When true, add rel="nofollow" to HTML a, area, and link tags requireNoFollow bool - // When true, add rel="nofollow" to HTML anchors + // When true, add rel="nofollow" to HTML a, area, and link tags // Will add for href="http://foo" // Will skip for href="/foo" or href="foo" requireNoFollowFullyQualifiedLinks bool + // When true, add rel="noreferrer" to HTML a, area, and link tags + requireNoReferrer bool + + // When true, add rel="noreferrer" to HTML a, area, and link tags + // Will add for href="http://foo" + // Will skip for href="/foo" or href="foo" + requireNoReferrerFullyQualifiedLinks bool + // When true add target="_blank" to fully qualified links // Will add for href="http://foo" // Will skip for href="/foo" or href="foo" @@ -73,12 +80,27 @@ type Policy struct { // When true, u, _ := url.Parse("url"); !u.IsAbs() is permitted allowRelativeURLs bool + // When true, allow data attributes. + allowDataAttributes bool + // map[htmlElementName]map[htmlAttributeName]attrPolicy elsAndAttrs map[string]map[string]attrPolicy + // elsMatchingAndAttrs stores regex based element matches along with attributes + elsMatchingAndAttrs map[*regexp.Regexp]map[string]attrPolicy + // map[htmlAttributeName]attrPolicy globalAttrs map[string]attrPolicy + // map[htmlElementName]map[cssPropertyName]stylePolicy + elsAndStyles map[string]map[string]stylePolicy + + // map[regex]map[cssPropertyName]stylePolicy + elsMatchingAndStyles map[*regexp.Regexp]map[string]stylePolicy + + // map[cssPropertyName]stylePolicy + globalStyles map[string]stylePolicy + // If urlPolicy is nil, all URLs with matching schema are allowed. // Otherwise, only the URLs with matching schema and urlPolicy(url) // returning true are allowed. @@ -93,6 +115,16 @@ type Policy struct { // be maintained in the output HTML. setOfElementsAllowedWithoutAttrs map[string]struct{} + // If an element has had all attributes removed as a result of a policy + // being applied, then the element would be removed from the output. + // + // However some elements are valid and have strong layout meaning without + // any attributes, i.e. <table>. + // + // In this case, any element matching a regular expression will be accepted without + // attributes added. + setOfElementsMatchingAllowedWithoutAttrs []*regexp.Regexp + setOfElementsToSkipContent map[string]struct{} } @@ -103,6 +135,20 @@ type attrPolicy struct { regexp *regexp.Regexp } +type stylePolicy struct { + // handler to validate + handler func(string) bool + + // optional pattern to match, when not nil the regexp needs to match + // otherwise the property is removed + regexp *regexp.Regexp + + // optional list of allowed property values, for properties which + // have a defined list of allowed values; property will be removed + // if the value is not allowed + enum []string +} + type attrPolicyBuilder struct { p *Policy @@ -111,13 +157,26 @@ type attrPolicyBuilder struct { allowEmpty bool } +type stylePolicyBuilder struct { + p *Policy + + propertyNames []string + regexp *regexp.Regexp + enum []string + handler func(string) bool +} + type urlPolicy func(url *url.URL) (allowUrl bool) // init initializes the maps if this has not been done already func (p *Policy) init() { if !p.initialized { p.elsAndAttrs = make(map[string]map[string]attrPolicy) + p.elsMatchingAndAttrs = make(map[*regexp.Regexp]map[string]attrPolicy) p.globalAttrs = make(map[string]attrPolicy) + p.elsAndStyles = make(map[string]map[string]stylePolicy) + p.elsMatchingAndStyles = make(map[*regexp.Regexp]map[string]stylePolicy) + p.globalStyles = make(map[string]stylePolicy) p.allowURLSchemes = make(map[string]urlPolicy) p.setOfElementsAllowedWithoutAttrs = make(map[string]struct{}) p.setOfElementsToSkipContent = make(map[string]struct{}) @@ -161,6 +220,21 @@ func (p *Policy) AllowAttrs(attrNames ...string) *attrPolicyBuilder { return &abp } +// AllowDataAttributes whitelists all data attributes. We can't specify the name +// of each attribute exactly as they are customized. +// +// NOTE: These values are not sanitized and applications that evaluate or process +// them without checking and verification of the input may be at risk if this option +// is enabled. This is a 'caveat emptor' option and the person enabling this option +// needs to fully understand the potential impact with regards to whatever application +// will be consuming the sanitized HTML afterwards, i.e. if you know you put a link in a +// data attribute and use that to automatically load some new window then you're giving +// the author of a HTML fragment the means to open a malicious destination automatically. +// Use with care! +func (p *Policy) AllowDataAttributes() { + p.allowDataAttributes = true +} + // AllowNoAttrs says that attributes on element are optional. // // The attribute policy is only added to the core policy when OnElements(...) @@ -230,6 +304,30 @@ func (abp *attrPolicyBuilder) OnElements(elements ...string) *Policy { return abp.p } +// OnElementsMatching will bind an attribute policy to all elements matching a given regex +// and return the updated policy +func (abp *attrPolicyBuilder) OnElementsMatching(regex *regexp.Regexp) *Policy { + for _, attr := range abp.attrNames { + if _, ok := abp.p.elsMatchingAndAttrs[regex]; !ok { + abp.p.elsMatchingAndAttrs[regex] = make(map[string]attrPolicy) + } + ap := attrPolicy{} + if abp.regexp != nil { + ap.regexp = abp.regexp + } + abp.p.elsMatchingAndAttrs[regex][attr] = ap + } + + if abp.allowEmpty { + abp.p.setOfElementsMatchingAllowedWithoutAttrs = append(abp.p.setOfElementsMatchingAllowedWithoutAttrs, regex) + if _, ok := abp.p.elsMatchingAndAttrs[regex]; !ok { + abp.p.elsMatchingAndAttrs[regex] = make(map[string]attrPolicy) + } + } + + return abp.p +} + // Globally will bind an attribute policy to all HTML elements and return the // updated policy func (abp *attrPolicyBuilder) Globally() *Policy { @@ -250,6 +348,139 @@ func (abp *attrPolicyBuilder) Globally() *Policy { return abp.p } +// AllowStyles takes a range of CSS property names and returns a +// style policy builder that allows you to specify the pattern and scope of +// the whitelisted property. +// +// The style policy is only added to the core policy when either Globally() +// or OnElements(...) are called. +func (p *Policy) AllowStyles(propertyNames ...string) *stylePolicyBuilder { + + p.init() + + abp := stylePolicyBuilder{ + p: p, + } + + for _, propertyName := range propertyNames { + abp.propertyNames = append(abp.propertyNames, strings.ToLower(propertyName)) + } + + return &abp +} + +// Matching allows a regular expression to be applied to a nascent style +// policy, and returns the style policy. Calling this more than once will +// replace the existing regexp. +func (spb *stylePolicyBuilder) Matching(regex *regexp.Regexp) *stylePolicyBuilder { + + spb.regexp = regex + + return spb +} + +// MatchingEnum allows a list of allowed values to be applied to a nascent style +// policy, and returns the style policy. Calling this more than once will +// replace the existing list of allowed values. +func (spb *stylePolicyBuilder) MatchingEnum(enum ...string) *stylePolicyBuilder { + + spb.enum = enum + + return spb +} + +// MatchingHandler allows a handler to be applied to a nascent style +// policy, and returns the style policy. Calling this more than once will +// replace the existing handler. +func (spb *stylePolicyBuilder) MatchingHandler(handler func(string) bool) *stylePolicyBuilder { + + spb.handler = handler + + return spb +} + +// OnElements will bind a style policy to a given range of HTML elements +// and return the updated policy +func (spb *stylePolicyBuilder) OnElements(elements ...string) *Policy { + + for _, element := range elements { + element = strings.ToLower(element) + + for _, attr := range spb.propertyNames { + + if _, ok := spb.p.elsAndStyles[element]; !ok { + spb.p.elsAndStyles[element] = make(map[string]stylePolicy) + } + + sp := stylePolicy{} + if spb.handler != nil { + sp.handler = spb.handler + } else if len(spb.enum) > 0 { + sp.enum = spb.enum + } else if spb.regexp != nil { + sp.regexp = spb.regexp + } else { + sp.handler = getDefaultHandler(attr) + } + spb.p.elsAndStyles[element][attr] = sp + } + } + + return spb.p +} + +// OnElementsMatching will bind a style policy to any HTML elements matching the pattern +// and return the updated policy +func (spb *stylePolicyBuilder) OnElementsMatching(regex *regexp.Regexp) *Policy { + + for _, attr := range spb.propertyNames { + + if _, ok := spb.p.elsMatchingAndStyles[regex]; !ok { + spb.p.elsMatchingAndStyles[regex] = make(map[string]stylePolicy) + } + + sp := stylePolicy{} + if spb.handler != nil { + sp.handler = spb.handler + } else if len(spb.enum) > 0 { + sp.enum = spb.enum + } else if spb.regexp != nil { + sp.regexp = spb.regexp + } else { + sp.handler = getDefaultHandler(attr) + } + spb.p.elsMatchingAndStyles[regex][attr] = sp + } + + return spb.p +} + +// Globally will bind a style policy to all HTML elements and return the +// updated policy +func (spb *stylePolicyBuilder) Globally() *Policy { + + for _, attr := range spb.propertyNames { + if _, ok := spb.p.globalStyles[attr]; !ok { + spb.p.globalStyles[attr] = stylePolicy{} + } + + // Use only one strategy for validating styles, fallback to default + sp := stylePolicy{} + if spb.handler != nil { + sp.handler = spb.handler + } else if len(spb.enum) > 0 { + sp.enum = spb.enum + } else if spb.regexp != nil { + sp.regexp = spb.regexp + } else { + sp.handler = getDefaultHandler(attr) + } + spb.p.globalStyles[attr] = sp + } + + return spb.p +} + // AllowElements will append HTML elements to the whitelist without applying an // attribute policy to those elements (the elements are permitted // sans-attributes) @@ -267,8 +498,16 @@ func (p *Policy) AllowElements(names ...string) *Policy { return p } -// RequireNoFollowOnLinks will result in all <a> tags having a rel="nofollow" -// added to them if one does not already exist +func (p *Policy) AllowElementsMatching(regex *regexp.Regexp) *Policy { + p.init() + if _, ok := p.elsMatchingAndAttrs[regex]; !ok { + p.elsMatchingAndAttrs[regex] = make(map[string]attrPolicy) + } + return p +} + +// RequireNoFollowOnLinks will result in all a, area, link tags having a +// rel="nofollow"added to them if one does not already exist // // Note: This requires p.RequireParseableURLs(true) and will enable it. func (p *Policy) RequireNoFollowOnLinks(require bool) *Policy { @@ -279,9 +518,10 @@ func (p *Policy) RequireNoFollowOnLinks(require bool) *Policy { return p } -// RequireNoFollowOnFullyQualifiedLinks will result in all <a> tags that point -// to a non-local destination (i.e. starts with a protocol and has a host) -// having a rel="nofollow" added to them if one does not already exist +// RequireNoFollowOnFullyQualifiedLinks will result in all a, area, and link +// tags that point to a non-local destination (i.e. starts with a protocol and +// has a host) having a rel="nofollow" added to them if one does not already +// exist // // Note: This requires p.RequireParseableURLs(true) and will enable it. func (p *Policy) RequireNoFollowOnFullyQualifiedLinks(require bool) *Policy { @@ -292,9 +532,35 @@ func (p *Policy) RequireNoFollowOnFullyQualifiedLinks(require bool) *Policy { return p } -// AddTargetBlankToFullyQualifiedLinks will result in all <a> tags that point -// to a non-local destination (i.e. starts with a protocol and has a host) -// having a target="_blank" added to them if one does not already exist +// RequireNoReferrerOnLinks will result in all a, area, and link tags having a +// rel="noreferrrer" added to them if one does not already exist +// +// Note: This requires p.RequireParseableURLs(true) and will enable it. +func (p *Policy) RequireNoReferrerOnLinks(require bool) *Policy { + + p.requireNoReferrer = require + p.requireParseableURLs = true + + return p +} + +// RequireNoReferrerOnFullyQualifiedLinks will result in all a, area, and link +// tags that point to a non-local destination (i.e. starts with a protocol and +// has a host) having a rel="noreferrer" added to them if one does not already +// exist +// +// Note: This requires p.RequireParseableURLs(true) and will enable it. +func (p *Policy) RequireNoReferrerOnFullyQualifiedLinks(require bool) *Policy { + + p.requireNoReferrerFullyQualifiedLinks = require + p.requireParseableURLs = true + + return p +} + +// AddTargetBlankToFullyQualifiedLinks will result in all a, area and link tags +// that point to a non-local destination (i.e. starts with a protocol and has a +// host) having a target="_blank" added to them if one does not already exist // // Note: This requires p.RequireParseableURLs(true) and will enable it. func (p *Policy) AddTargetBlankToFullyQualifiedLinks(require bool) *Policy { @@ -369,21 +635,6 @@ func (p *Policy) AllowURLSchemeWithCustomPolicy( return p } -// AllowDocType states whether the HTML sanitised by the sanitizer is allowed to -// contain the HTML DocType tag: <!DOCTYPE HTML> or one of it's variants. -// -// The HTML spec only permits one doctype per document, and as you know how you -// are using the output of this, you know best as to whether we should ignore it -// (default) or not. -// -// If you are sanitizing a HTML fragment the default (false) is fine. -func (p *Policy) AllowDocType(allow bool) *Policy { - - p.allowDocType = allow - - return p -} - // AddSpaceWhenStrippingTag states whether to add a single space " " when // removing tags that are not whitelisted by the policy. // @@ -402,7 +653,7 @@ func (p *Policy) AddSpaceWhenStrippingTag(allow bool) *Policy { } // SkipElementsContent adds the HTML elements whose tags is needed to be removed -// with it's content. +// with its content. func (p *Policy) SkipElementsContent(names ...string) *Policy { p.init() @@ -440,6 +691,7 @@ func (p *Policy) addDefaultElementsWithoutAttrs() { p.setOfElementsAllowedWithoutAttrs["abbr"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["acronym"] = struct{}{} + p.setOfElementsAllowedWithoutAttrs["address"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["article"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["aside"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["audio"] = struct{}{} @@ -451,6 +703,7 @@ func (p *Policy) addDefaultElementsWithoutAttrs() { p.setOfElementsAllowedWithoutAttrs["button"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["canvas"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["caption"] = struct{}{} + p.setOfElementsAllowedWithoutAttrs["center"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["cite"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["code"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["col"] = struct{}{} @@ -484,6 +737,7 @@ func (p *Policy) addDefaultElementsWithoutAttrs() { p.setOfElementsAllowedWithoutAttrs["kbd"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["li"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["mark"] = struct{}{} + p.setOfElementsAllowedWithoutAttrs["marquee"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["nav"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["ol"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["optgroup"] = struct{}{} @@ -496,6 +750,7 @@ func (p *Policy) addDefaultElementsWithoutAttrs() { p.setOfElementsAllowedWithoutAttrs["ruby"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["s"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["samp"] = struct{}{} + p.setOfElementsAllowedWithoutAttrs["script"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["section"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["select"] = struct{}{} p.setOfElementsAllowedWithoutAttrs["small"] = struct{}{} diff --git a/vendor/github.com/microcosm-cc/bluemonday/sanitize.go b/vendor/github.com/microcosm-cc/bluemonday/sanitize.go index 8983685818..771fc2c2fa 100644 --- a/vendor/github.com/microcosm-cc/bluemonday/sanitize.go +++ b/vendor/github.com/microcosm-cc/bluemonday/sanitize.go @@ -33,9 +33,20 @@ import ( "bytes" "io" "net/url" + "regexp" + "strconv" "strings" "golang.org/x/net/html" + + cssparser "github.com/chris-ramon/douceur/parser" +) + +var ( + dataAttribute = regexp.MustCompile("^data-.+") + dataAttributeXMLPrefix = regexp.MustCompile("^xml.+") + dataAttributeInvalidChars = regexp.MustCompile("[A-Z;]+") + cssUnicodeChar = regexp.MustCompile(`\\[0-9a-f]{1,6} ?`) ) // Sanitize takes a string that contains a HTML fragment or document and applies @@ -75,6 +86,98 @@ func (p *Policy) SanitizeReader(r io.Reader) *bytes.Buffer { return p.sanitize(r) } +const escapedURLChars = "'<>\"\r" + +func escapeUrlComponent(val string) string { + w := bytes.NewBufferString("") + i := strings.IndexAny(val, escapedURLChars) + for i != -1 { + if _, err := w.WriteString(val[:i]); err != nil { + return w.String() + } + var esc string + switch val[i] { + case '\'': + // "'" is shorter than "'" and apos was not in HTML until HTML5. + esc = "'" + case '<': + esc = "<" + case '>': + esc = ">" + case '"': + // """ is shorter than """. + esc = """ + case '\r': + esc = " " + default: + panic("unrecognized escape character") + } + val = val[i+1:] + if _, err := w.WriteString(esc); err != nil { + return w.String() + } + i = strings.IndexAny(val, escapedURLChars) + } + w.WriteString(val) + return w.String() +} + +func sanitizedUrl(val string) (string, error) { + u, err := url.Parse(val) + if err != nil { + return "", err + } + // sanitize the url query params + sanitizedQueryValues := make(url.Values, 0) + queryValues := u.Query() + for k, vals := range queryValues { + sk := html.EscapeString(k) + for _, v := range vals { + sv := escapeUrlComponent(v) + sanitizedQueryValues.Set(sk, sv) + } + } + u.RawQuery = sanitizedQueryValues.Encode() + // u.String() will also sanitize host/scheme/user/pass + return u.String(), nil +} + +func (p *Policy) writeLinkableBuf(buff *bytes.Buffer, token *html.Token) { + // do not escape multiple query parameters + tokenBuff := bytes.NewBufferString("") + tokenBuff.WriteString("<") + tokenBuff.WriteString(token.Data) + for _, attr := range token.Attr { + tokenBuff.WriteByte(' ') + tokenBuff.WriteString(attr.Key) + tokenBuff.WriteString(`="`) + switch attr.Key { + case "href", "src": + u, ok := p.validURL(attr.Val) + if !ok { + tokenBuff.WriteString(html.EscapeString(attr.Val)) + continue + } + u, err := sanitizedUrl(u) + if err == nil { + tokenBuff.WriteString(u) + } else { + // fallthrough + tokenBuff.WriteString(html.EscapeString(attr.Val)) + } + default: + // re-apply + tokenBuff.WriteString(html.EscapeString(attr.Val)) + } + tokenBuff.WriteByte('"') + } + if token.Type == html.SelfClosingTagToken { + tokenBuff.WriteString("/") + } + tokenBuff.WriteString(">") + buff.WriteString(tokenBuff.String()) +} + // Performs the actual sanitization process. func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { @@ -112,9 +215,13 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { switch token.Type { case html.DoctypeToken: - if p.allowDocType { - buff.WriteString(token.String()) - } + // DocType is not handled as there is no safe parsing mechanism + // provided by golang.org/x/net/html for the content, and this can + // be misused to insert HTML tags that are not then sanitized + // + // One might wish to recursively sanitize here using the same policy + // but I will need to do some further testing before considering + // this. case html.CommentToken: @@ -122,20 +229,23 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { case html.StartTagToken: - mostRecentlyStartedToken = token.Data + mostRecentlyStartedToken = strings.ToLower(token.Data) aps, ok := p.elsAndAttrs[token.Data] if !ok { - if _, ok := p.setOfElementsToSkipContent[token.Data]; ok { - skipElementContent = true - skippingElementsCount++ - } - if p.addSpaces { - buff.WriteString(" ") + aa, matched := p.matchRegex(token.Data) + if !matched { + if _, ok := p.setOfElementsToSkipContent[token.Data]; ok { + skipElementContent = true + skippingElementsCount++ + } + if p.addSpaces { + buff.WriteString(" ") + } + break } - break + aps = aa } - if len(token.Attr) != 0 { token.Attr = p.sanitizeAttrs(token.Data, token.Attr, aps) } @@ -152,11 +262,20 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { } if !skipElementContent { - buff.WriteString(token.String()) + // do not escape multiple query parameters + if linkable(token.Data) { + p.writeLinkableBuf(&buff, &token) + } else { + buff.WriteString(token.String()) + } } case html.EndTagToken: + if mostRecentlyStartedToken == strings.ToLower(token.Data) { + mostRecentlyStartedToken = "" + } + if skipClosingTag && closingTagToSkipStack[len(closingTagToSkipStack)-1] == token.Data { closingTagToSkipStack = closingTagToSkipStack[:len(closingTagToSkipStack)-1] if len(closingTagToSkipStack) == 0 { @@ -167,18 +286,27 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { } break } - if _, ok := p.elsAndAttrs[token.Data]; !ok { - if _, ok := p.setOfElementsToSkipContent[token.Data]; ok { + match := false + for regex := range p.elsMatchingAndAttrs { + if regex.MatchString(token.Data) { + skipElementContent = false + match = true + break + } + } + if _, ok := p.setOfElementsToSkipContent[token.Data]; ok && !match { skippingElementsCount-- if skippingElementsCount == 0 { skipElementContent = false } } - if p.addSpaces { - buff.WriteString(" ") + if !match { + if p.addSpaces { + buff.WriteString(" ") + } + break } - break } if !skipElementContent { @@ -189,10 +317,14 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { aps, ok := p.elsAndAttrs[token.Data] if !ok { - if p.addSpaces { - buff.WriteString(" ") + aa, matched := p.matchRegex(token.Data) + if !matched { + if p.addSpaces && !matched { + buff.WriteString(" ") + } + break } - break + aps = aa } if len(token.Attr) != 0 { @@ -202,19 +334,23 @@ func (p *Policy) sanitize(r io.Reader) *bytes.Buffer { if len(token.Attr) == 0 && !p.allowNoAttrs(token.Data) { if p.addSpaces { buff.WriteString(" ") + break } - break } - if !skipElementContent { - buff.WriteString(token.String()) + // do not escape multiple query parameters + if linkable(token.Data) { + p.writeLinkableBuf(&buff, &token) + } else { + buff.WriteString(token.String()) + } } case html.TextToken: if !skipElementContent { - switch strings.ToLower(mostRecentlyStartedToken) { - case "javascript": + switch mostRecentlyStartedToken { + case "script": // not encouraged, but if a policy allows JavaScript we // should not HTML escape it as that would break the output buff.WriteString(token.Data) @@ -248,10 +384,47 @@ func (p *Policy) sanitizeAttrs( return attrs } + hasStylePolicies := false + sps, elementHasStylePolicies := p.elsAndStyles[elementName] + if len(p.globalStyles) > 0 || (elementHasStylePolicies && len(sps) > 0) { + hasStylePolicies = true + } + // no specific element policy found, look for a pattern match + if !hasStylePolicies{ + for k, v := range p.elsMatchingAndStyles{ + if k.MatchString(elementName) { + if len(v) > 0{ + hasStylePolicies = true + break + } + } + } + } + // Builds a new attribute slice based on the whether the attribute has been // whitelisted explicitly or globally. cleanAttrs := []html.Attribute{} for _, htmlAttr := range attrs { + if p.allowDataAttributes { + // If we see a data attribute, let it through. + if isDataAttribute(htmlAttr.Key) { + cleanAttrs = append(cleanAttrs, htmlAttr) + continue + } + } + // Is this a "style" attribute, and if so, do we need to sanitize it? + if htmlAttr.Key == "style" && hasStylePolicies { + htmlAttr = p.sanitizeStyles(htmlAttr, elementName) + if htmlAttr.Val == "" { + // We've sanitized away any and all styles; don't bother to + // output the style attribute (even if it's allowed) + continue + } else { + cleanAttrs = append(cleanAttrs, htmlAttr) + continue + } + } + // Is there an element specific attribute policy that applies? if ap, ok := aps[htmlAttr.Key]; ok { if ap.regexp != nil { @@ -267,6 +440,7 @@ func (p *Policy) sanitizeAttrs( // Is there a global attribute policy that applies? if ap, ok := p.globalAttrs[htmlAttr.Key]; ok { + if ap.regexp != nil { if ap.regexp.MatchString(htmlAttr.Val) { cleanAttrs = append(cleanAttrs, htmlAttr) @@ -332,6 +506,8 @@ func (p *Policy) sanitizeAttrs( if (p.requireNoFollow || p.requireNoFollowFullyQualifiedLinks || + p.requireNoReferrer || + p.requireNoReferrerFullyQualifiedLinks || p.addTargetBlankToFullyQualifiedLinks) && len(cleanAttrs) > 0 { @@ -359,12 +535,16 @@ func (p *Policy) sanitizeAttrs( if hrefFound { var ( noFollowFound bool + noReferrerFound bool targetBlankFound bool ) addNoFollow := (p.requireNoFollow || externalLink && p.requireNoFollowFullyQualifiedLinks) + addNoReferrer := (p.requireNoReferrer || + externalLink && p.requireNoReferrerFullyQualifiedLinks) + addTargetBlank := (externalLink && p.addTargetBlankToFullyQualifiedLinks) @@ -372,18 +552,18 @@ func (p *Policy) sanitizeAttrs( for _, htmlAttr := range cleanAttrs { var appended bool - if htmlAttr.Key == "rel" && addNoFollow { + if htmlAttr.Key == "rel" && (addNoFollow || addNoReferrer) { - if strings.Contains(htmlAttr.Val, "nofollow") { - noFollowFound = true - tmpAttrs = append(tmpAttrs, htmlAttr) - appended = true - } else { + if addNoFollow && !strings.Contains(htmlAttr.Val, "nofollow") { htmlAttr.Val += " nofollow" - noFollowFound = true - tmpAttrs = append(tmpAttrs, htmlAttr) - appended = true } + if addNoReferrer && !strings.Contains(htmlAttr.Val, "noreferrer") { + htmlAttr.Val += " noreferrer" + } + noFollowFound = addNoFollow + noReferrerFound = addNoReferrer + tmpAttrs = append(tmpAttrs, htmlAttr) + appended = true } if elementName == "a" && htmlAttr.Key == "target" { @@ -402,14 +582,22 @@ func (p *Policy) sanitizeAttrs( tmpAttrs = append(tmpAttrs, htmlAttr) } } - if noFollowFound || targetBlankFound { + if noFollowFound || noReferrerFound || targetBlankFound { cleanAttrs = tmpAttrs } - if addNoFollow && !noFollowFound { + if (addNoFollow && !noFollowFound) || (addNoReferrer && !noReferrerFound) { rel := html.Attribute{} rel.Key = "rel" - rel.Val = "nofollow" + if addNoFollow { + rel.Val = "nofollow" + } + if addNoReferrer { + if rel.Val != "" { + rel.Val += " " + } + rel.Val += "noreferrer" + } cleanAttrs = append(cleanAttrs, rel) } @@ -479,20 +667,112 @@ func (p *Policy) sanitizeAttrs( return cleanAttrs } +func (p *Policy) sanitizeStyles(attr html.Attribute, elementName string) html.Attribute { + sps := p.elsAndStyles[elementName] + if len(sps) == 0{ + sps = map[string]stylePolicy{} + // check for any matching elements, if we don't already have a policy found + // if multiple matches are found they will be overwritten, it's best + // to not have overlapping matchers + for regex, policies :=range p.elsMatchingAndStyles{ + if regex.MatchString(elementName){ + for k, v := range policies{ + sps[k] = v + } + } + } + } + + //Add semi-colon to end to fix parsing issue + if len(attr.Val) > 0 && attr.Val[len(attr.Val)-1] != ';' { + attr.Val = attr.Val + ";" + } + decs, err := cssparser.ParseDeclarations(attr.Val) + if err != nil { + attr.Val = "" + return attr + } + clean := []string{} + prefixes := []string{"-webkit-", "-moz-", "-ms-", "-o-", "mso-", "-xv-", "-atsc-", "-wap-", "-khtml-", "prince-", "-ah-", "-hp-", "-ro-", "-rim-", "-tc-"} + + for _, dec := range decs { + addedProperty := false + tempProperty := strings.ToLower(dec.Property) + tempValue := removeUnicode(strings.ToLower(dec.Value)) + for _, i := range prefixes { + tempProperty = strings.TrimPrefix(tempProperty, i) + } + if sp, ok := sps[tempProperty]; ok { + if sp.handler != nil { + if sp.handler(tempValue) { + clean = append(clean, dec.Property+": "+dec.Value) + addedProperty = true + } + } else if len(sp.enum) > 0 { + if stringInSlice(tempValue, sp.enum) { + clean = append(clean, dec.Property+": "+dec.Value) + addedProperty = true + } + } else if sp.regexp != nil { + if sp.regexp.MatchString(tempValue) { + clean = append(clean, dec.Property+": "+dec.Value) + addedProperty = true + } + continue + } + } + if sp, ok := p.globalStyles[tempProperty]; ok && !addedProperty { + if sp.handler != nil { + if sp.handler(tempValue) { + clean = append(clean, dec.Property+": "+dec.Value) + } + } else if len(sp.enum) > 0 { + if stringInSlice(tempValue, sp.enum) { + clean = append(clean, dec.Property+": "+dec.Value) + } + } else if sp.regexp != nil { + if sp.regexp.MatchString(tempValue) { + clean = append(clean, dec.Property+": "+dec.Value) + } + continue + } + } + } + if len(clean) > 0 { + attr.Val = strings.Join(clean, "; ") + } else { + attr.Val = "" + } + return attr +} + func (p *Policy) allowNoAttrs(elementName string) bool { _, ok := p.setOfElementsAllowedWithoutAttrs[elementName] + if !ok { + for _, r := range p.setOfElementsMatchingAllowedWithoutAttrs { + if r.MatchString(elementName) { + ok = true + break + } + } + } return ok } func (p *Policy) validURL(rawurl string) (string, bool) { if p.requireParseableURLs { - // URLs do not contain whitespace - if strings.Contains(rawurl, " ") || + // URLs are valid if when space is trimmed the URL is valid + rawurl = strings.TrimSpace(rawurl) + + // URLs cannot contain whitespace, unless it is a data-uri + if (strings.Contains(rawurl, " ") || strings.Contains(rawurl, "\t") || - strings.Contains(rawurl, "\n") { + strings.Contains(rawurl, "\n")) && + !strings.HasPrefix(rawurl, `data:`) { return "", false } + // URLs are valid if they parse u, err := url.Parse(rawurl) if err != nil { return "", false @@ -533,3 +813,77 @@ func linkable(elementName string) bool { return false } } + +// stringInSlice returns true if needle exists in haystack +func stringInSlice(needle string, haystack []string) bool { + for _, straw := range haystack { + if strings.ToLower(straw) == strings.ToLower(needle) { + return true + } + } + return false +} + +func isDataAttribute(val string) bool { + if !dataAttribute.MatchString(val) { + return false + } + rest := strings.Split(val, "data-") + if len(rest) == 1 { + return false + } + // data-xml* is invalid. + if dataAttributeXMLPrefix.MatchString(rest[1]) { + return false + } + // no uppercase or semi-colons allowed. + if dataAttributeInvalidChars.MatchString(rest[1]) { + return false + } + return true +} + +func removeUnicode(value string) string { + substitutedValue := value + currentLoc := cssUnicodeChar.FindStringIndex(substitutedValue) + for currentLoc != nil { + + character := substitutedValue[currentLoc[0]+1 : currentLoc[1]] + character = strings.TrimSpace(character) + if len(character) < 4 { + character = strings.Repeat("0", 4-len(character)) + character + } else { + for len(character) > 4 { + if character[0] != '0' { + character = "" + break + } else { + character = character[1:] + } + } + } + character = "\\u" + character + translatedChar, err := strconv.Unquote(`"` + character + `"`) + translatedChar = strings.TrimSpace(translatedChar) + if err != nil { + return "" + } + substitutedValue = substitutedValue[0:currentLoc[0]] + translatedChar + substitutedValue[currentLoc[1]:] + currentLoc = cssUnicodeChar.FindStringIndex(substitutedValue) + } + return substitutedValue +} + +func (p *Policy) matchRegex(elementName string ) (map[string]attrPolicy, bool) { + aps := make(map[string]attrPolicy, 0) + matched := false + for regex, attrs := range p.elsMatchingAndAttrs { + if regex.MatchString(elementName) { + matched = true + for k, v := range attrs { + aps[k] = v + } + } + } + return aps, matched +} |