DOCSEARCHbyAlgolia
Submit Docs

ZentaoPHP

repository·master·Indexed 41 days ago

https://github.com/easysoft/zentaophp

A PHP web application framework featuring a central router for application lifecycle management and a standalone implementation of HTMLPurifier for filtering HTML and sanitizing CSS to prevent XSS attacks.

Tokens
1.3K
Snippets
5
Records
6
Agent score
52%

What's inside ZentaoPHP

  1. Use HTMLPurifier_Filter_ExtractStyleBlocks to extract and clean <style> blocks

    master

    The HTMLPurifier_Filter_ExtractStyleBlocks filter identifies <style> blocks within input HTML, removes them from the main HTML stream to prevent inline styling, and cleans the CSS content using csstidy.

    The extracted and cleaned CSS blocks are stored in the HTMLPurifier_Context under the key 'StyleBlocks'. This allows you to retrieve the cleaned styles later to place them in a single <style> tag in the document head or elsewhere.

    Key behaviors:

    • Extraction: It uses regex to find <style> tags and moves their content to the context.
    • Cleaning: It uses csstidy to format and validate the CSS.
    • Validation: It validates CSS selectors against allowed HTML elements and validates CSS properties against the CSS definition in the HTMLPurifier_Config.
    • Escaping: If configured, it escapes special characters (<, >, &) within the CSS to prevent injection attacks (e.g., via font-family).
    // Assuming $purifier is an instance of HTMLPurifier
// and the ExtractStyleBlocks filter has been added to the configuration.

$html = '<p>Hello</p><style>body { color: red; }</style>';
$clean_html = $purifier->purify($html);

// Retrieve the cleaned CSS blocks from the context
$context = $purifier->context;
$style_blocks = $context->get('StyleBlocks');

// $style_blocks now contains ['body { color: red; }']

  2. Initialize HTMLPurifier_Printer with configuration

    master

    To use the HTMLPurifier_Printer class for generating purified HTML, you must first instantiate it and then call prepareGenerator() with an HTMLPurifier_Config object. This step initializes the internal HTMLPurifier_Generator which handles the actual token-to-HTML conversion.

    Note: This class is marked as out of date and is recommended to be replaced by XMLWriter in newer implementations.

    $printer = new HTMLPurifier_Printer();
$printer->prepareGenerator($config); // $config is an instance of HTMLPurifier_Config

  3. Initialize and run the ZentaoPHP application

    master

    The ZentaoPHP web application is initialized through index.php, which acts as the central router. The application lifecycle follows a specific sequence: creating the app instance, loading common modules, parsing the incoming request, and loading the specific module required for the request. Output is captured via output buffering and cleaned of UTF-8 BOM before being sent to the client.

    // The application lifecycle sequence:
$app    = router::createApp('demo', dirname(__FILE__), 'router');
$common = $app->loadCommon();
$app->parseRequest();
$app->loadModule();
echo helper::removeUTF8Bom(ob_get_clean());

  4. Configure HTMLPurifier_Filter_ExtractStyleBlocks

    master

    You can customize the behavior of the ExtractStyleBlocks filter using the HTMLPurifier_Config object. The following configuration keys are available:

    Config KeyTypeDescription
    Filter.ExtractStyleBlocks.TidyImplHTMLPurifier_Filter_ExtractStyleBlocksAllows providing a custom implementation of the csstidy object.
    Filter.ExtractStyleBlocks.Scopestring (comma-separated)A list of selector scopes to prepend to all extracted selectors. For example, setting this to body, .container will turn a selector like p into body p, .container p.
    Filter.ExtractStyleBlocks.EscapingbooleanIf true, the filter escapes <, >, and & in the resulting CSS to prevent XSS via CSS properties.

  5. Use router::createApp() to instantiate the application

    master

    The router::createApp() method is the primary entry point for bootstrapping the ZentaoPHP framework. It initializes the application instance with a specific mode, the base directory, and a router identifier.

    Parameters:

    • mode (string): The application mode (e.g., 'demo').
    • baseDir (string): The directory path of the application.
    • routerName (string): The identifier for the router.

    Returns an application instance capable of loading modules and parsing requests.

    $app = router::createApp('demo', dirname(__FILE__), 'router');

  6. Clean CSS strings directly with cleanCSS()

    master

    If you have a standalone CSS string (not embedded in HTML) and want to use the same cleaning logic as the ExtractStyleBlocks filter, you can call the cleanCSS() method directly on an instance of HTMLPurifier_Filter_ExtractStyleBlocks.

    Note: This method requires the csstidy extension to be installed and available.

    $filter = new HTMLPurifier_Filter_ExtractStyleBlocks();
$css = "body { color: red; }";
$clean_css = $filter->cleanCSS($css, $config, $context);