Escaper.php 5.4KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173
  1. <?php
  2. /*
  3. * This file is part of Twig.
  4. *
  5. * (c) 2009 Fabien Potencier
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. /**
  11. * Twig_NodeVisitor_Escaper implements output escaping.
  12. *
  13. * @package twig
  14. * @author Fabien Potencier <fabien@symfony.com>
  15. */
  16. class Twig_NodeVisitor_Escaper implements Twig_NodeVisitorInterface
  17. {
  18. protected $statusStack = array();
  19. protected $blocks = array();
  20. protected $safeAnalysis;
  21. protected $traverser;
  22. protected $defaultStrategy = false;
  23. protected $safeVars = array();
  24. public function __construct()
  25. {
  26. $this->safeAnalysis = new Twig_NodeVisitor_SafeAnalysis();
  27. }
  28. /**
  29. * Called before child nodes are visited.
  30. *
  31. * @param Twig_NodeInterface $node The node to visit
  32. * @param Twig_Environment $env The Twig environment instance
  33. *
  34. * @return Twig_NodeInterface The modified node
  35. */
  36. public function enterNode(Twig_NodeInterface $node, Twig_Environment $env)
  37. {
  38. if ($node instanceof Twig_Node_Module) {
  39. if ($env->hasExtension('escaper') && $defaultStrategy = $env->getExtension('escaper')->getDefaultStrategy($node->getAttribute('filename'))) {
  40. $this->defaultStrategy = $defaultStrategy;
  41. }
  42. $this->safeVars = array();
  43. } elseif ($node instanceof Twig_Node_AutoEscape) {
  44. $this->statusStack[] = $node->getAttribute('value');
  45. } elseif ($node instanceof Twig_Node_Block) {
  46. $this->statusStack[] = isset($this->blocks[$node->getAttribute('name')]) ? $this->blocks[$node->getAttribute('name')] : $this->needEscaping($env);
  47. } elseif ($node instanceof Twig_Node_Import) {
  48. $this->safeVars[] = $node->getNode('var')->getAttribute('name');
  49. }
  50. return $node;
  51. }
  52. /**
  53. * Called after child nodes are visited.
  54. *
  55. * @param Twig_NodeInterface $node The node to visit
  56. * @param Twig_Environment $env The Twig environment instance
  57. *
  58. * @return Twig_NodeInterface The modified node
  59. */
  60. public function leaveNode(Twig_NodeInterface $node, Twig_Environment $env)
  61. {
  62. if ($node instanceof Twig_Node_Module) {
  63. $this->defaultStrategy = false;
  64. $this->safeVars = array();
  65. } elseif ($node instanceof Twig_Node_Expression_Filter) {
  66. return $this->preEscapeFilterNode($node, $env);
  67. } elseif ($node instanceof Twig_Node_Print) {
  68. return $this->escapePrintNode($node, $env, $this->needEscaping($env));
  69. }
  70. if ($node instanceof Twig_Node_AutoEscape || $node instanceof Twig_Node_Block) {
  71. array_pop($this->statusStack);
  72. } elseif ($node instanceof Twig_Node_BlockReference) {
  73. $this->blocks[$node->getAttribute('name')] = $this->needEscaping($env);
  74. }
  75. return $node;
  76. }
  77. protected function escapePrintNode(Twig_Node_Print $node, Twig_Environment $env, $type)
  78. {
  79. if (false === $type) {
  80. return $node;
  81. }
  82. $expression = $node->getNode('expr');
  83. if ($this->isSafeFor($type, $expression, $env)) {
  84. return $node;
  85. }
  86. $class = get_class($node);
  87. return new $class(
  88. $this->getEscaperFilter($type, $expression),
  89. $node->getLine()
  90. );
  91. }
  92. protected function preEscapeFilterNode(Twig_Node_Expression_Filter $filter, Twig_Environment $env)
  93. {
  94. $name = $filter->getNode('filter')->getAttribute('value');
  95. if (false !== $f = $env->getFilter($name)) {
  96. $type = $f->getPreEscape();
  97. if (null === $type) {
  98. return $filter;
  99. }
  100. $node = $filter->getNode('node');
  101. if ($this->isSafeFor($type, $node, $env)) {
  102. return $filter;
  103. }
  104. $filter->setNode('node', $this->getEscaperFilter($type, $node));
  105. return $filter;
  106. }
  107. return $filter;
  108. }
  109. protected function isSafeFor($type, Twig_NodeInterface $expression, $env)
  110. {
  111. $safe = $this->safeAnalysis->getSafe($expression);
  112. if (null === $safe) {
  113. if (null === $this->traverser) {
  114. $this->traverser = new Twig_NodeTraverser($env, array($this->safeAnalysis));
  115. }
  116. $this->safeAnalysis->setSafeVars($this->safeVars);
  117. $this->traverser->traverse($expression);
  118. $safe = $this->safeAnalysis->getSafe($expression);
  119. }
  120. return in_array($type, $safe) || in_array('all', $safe);
  121. }
  122. protected function needEscaping(Twig_Environment $env)
  123. {
  124. if (count($this->statusStack)) {
  125. return $this->statusStack[count($this->statusStack) - 1];
  126. }
  127. return $this->defaultStrategy ? $this->defaultStrategy : false;
  128. }
  129. protected function getEscaperFilter($type, Twig_NodeInterface $node)
  130. {
  131. $line = $node->getLine();
  132. $name = new Twig_Node_Expression_Constant('escape', $line);
  133. $args = new Twig_Node(array(new Twig_Node_Expression_Constant((string) $type, $line), new Twig_Node_Expression_Constant(null, $line), new Twig_Node_Expression_Constant(true, $line)));
  134. return new Twig_Node_Expression_Filter($node, $name, $args, $line);
  135. }
  136. /**
  137. * {@inheritdoc}
  138. */
  139. public function getPriority()
  140. {
  141. return 0;
  142. }
  143. }