includes/libs/XmlTypeCheck.php

   1 <?php
   2 /**
   3  * XML syntax and type checker.
   4  *
   5  * Since 1.24.2, it uses XMLReader instead of xml_parse, which gives us
   6  * more control over the expansion of XML entities. When passed to the
   7  * callback, entities will be fully expanded, but may report the XML is
   8  * invalid if expanding the entities are likely to cause a DoS.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 2 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License along
  21  * with this program; if not, write to the Free Software Foundation, Inc.,
  22  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  23  * http://www.gnu.org/copyleft/gpl.html
  24  *
  25  * @file
  26  */
  27
  28 class XmlTypeCheck {
  29         /**
  30          * Will be set to true or false to indicate whether the file is
  31          * well-formed XML. Note that this doesn't check schema validity.
  32          */
  33         public $wellFormed = null;
  34
  35         /**
  36          * Will be set to true if the optional element filter returned
  37          * a match at some point.
  38          */
  39         public $filterMatch = false;
  40
  41         /**
  42          * Will contain the type of filter hit if the optional element filter returned
  43          * a match at some point.
  44          * @var mixed
  45          */
  46         public $filterMatchType = false;
  47
  48         /**
  49          * Name of the document's root element, including any namespace
  50          * as an expanded URL.
  51          */
  52         public $rootElement = '';
  53
  54         /**
  55          * A stack of strings containing the data of each xml element as it's processed. Append
  56          * data to the top string of the stack, then pop off the string and process it when the
  57          * element is closed.
  58          */
  59         protected $elementData = [];
  60
  61         /**
  62          * A stack of element names and attributes, as we process them.
  63          */
  64         protected $elementDataContext = [];
  65
  66         /**
  67          * Current depth of the data stack.
  68          */
  69         protected $stackDepth = 0;
  70
  71         /**
  72          * Additional parsing options
  73          */
  74         private $parserOptions = [
  75                 'processing_instruction_handler' => '',
  76         ];
  77
  78         /**
  79          * @param string $input a filename or string containing the XML element
  80          * @param callable $filterCallback (optional)
  81          *        Function to call to do additional custom validity checks from the
  82          *        SAX element handler event. This gives you access to the element
  83          *        namespace, name, attributes, and text contents.
  84          *        Filter should return 'true' to toggle on $this->filterMatch
  85          * @param bool $isFile (optional) indicates if the first parameter is a
  86          *        filename (default, true) or if it is a string (false)
  87          * @param array $options list of additional parsing options:
  88          *        processing_instruction_handler: Callback for xml_set_processing_instruction_handler
  89          */
  90         function __construct( $input, $filterCallback = null, $isFile = true, $options = [] ) {
  91                 $this->filterCallback = $filterCallback;
  92                 $this->parserOptions = array_merge( $this->parserOptions, $options );
  93                 $this->validateFromInput( $input, $isFile );
  94         }
  95
  96         /**
  97          * Alternative constructor: from filename
  98          *
  99          * @param string $fname the filename of an XML document
 100          * @param callable $filterCallback (optional)
 101          *        Function to call to do additional custom validity checks from the
 102          *        SAX element handler event. This gives you access to the element
 103          *        namespace, name, and attributes, but not to text contents.
 104          *        Filter should return 'true' to toggle on $this->filterMatch
 105          * @return XmlTypeCheck
 106          */
 107         public static function newFromFilename( $fname, $filterCallback = null ) {
 108                 return new self( $fname, $filterCallback, true );
 109         }
 110
 111         /**
 112          * Alternative constructor: from string
 113          *
 114          * @param string $string a string containing an XML element
 115          * @param callable $filterCallback (optional)
 116          *        Function to call to do additional custom validity checks from the
 117          *        SAX element handler event. This gives you access to the element
 118          *        namespace, name, and attributes, but not to text contents.
 119          *        Filter should return 'true' to toggle on $this->filterMatch
 120          * @return XmlTypeCheck
 121          */
 122         public static function newFromString( $string, $filterCallback = null ) {
 123                 return new self( $string, $filterCallback, false );
 124         }
 125
 126         /**
 127          * Get the root element. Simple accessor to $rootElement
 128          *
 129          * @return string
 130          */
 131         public function getRootElement() {
 132                 return $this->rootElement;
 133         }
 134
 135         /**
 136          * @param string $fname the filename
 137          */
 138         private function validateFromInput( $xml, $isFile ) {
 139                 $reader = new XMLReader();
 140                 if ( $isFile ) {
 141                         $s = $reader->open( $xml, null, LIBXML_NOERROR | LIBXML_NOWARNING );
 142                 } else {
 143                         $s = $reader->XML( $xml, null, LIBXML_NOERROR | LIBXML_NOWARNING );
 144                 }
 145                 if ( $s !== true ) {
 146                         // Couldn't open the XML
 147                         $this->wellFormed = false;
 148                 } else {
 149                         $oldDisable = libxml_disable_entity_loader( true );
 150                         $reader->setParserProperty( XMLReader::SUBST_ENTITIES, true );
 151                         try {
 152                                 $this->validate( $reader );
 153                         } catch ( Exception $e ) {
 154                                 // Calling this malformed, because we didn't parse the whole
 155                                 // thing. Maybe just an external entity refernce.
 156                                 $this->wellFormed = false;
 157                                 $reader->close();
 158                                 libxml_disable_entity_loader( $oldDisable );
 159                                 throw $e;
 160                         }
 161                         $reader->close();
 162                         libxml_disable_entity_loader( $oldDisable );
 163                 }
 164         }
 165
 166         private function readNext( XMLReader $reader ) {
 167                 set_error_handler( [ $this, 'XmlErrorHandler' ] );
 168                 $ret = $reader->read();
 169                 restore_error_handler();
 170                 return $ret;
 171         }
 172
 173         public function XmlErrorHandler( $errno, $errstr ) {
 174                 $this->wellFormed = false;
 175         }
 176
 177         private function validate( $reader ) {
 178
 179                 // First, move through anything that isn't an element, and
 180                 // handle any processing instructions with the callback
 181                 do {
 182                         if ( !$this->readNext( $reader ) ) {
 183                                 // Hit the end of the document before any elements
 184                                 $this->wellFormed = false;
 185                                 return;
 186                         }
 187                         if ( $reader->nodeType === XMLReader::PI ) {
 188                                 $this->processingInstructionHandler( $reader->name, $reader->value );
 189                         }
 190                 } while ( $reader->nodeType != XMLReader::ELEMENT );
 191
 192                 // Process the rest of the document
 193                 do {
 194                         switch ( $reader->nodeType ) {
 195                                 case XMLReader::ELEMENT:
 196                                         $name = $this->expandNS(
 197                                                 $reader->name,
 198                                                 $reader->namespaceURI
 199                                         );
 200                                         if ( $this->rootElement === '' ) {
 201                                                 $this->rootElement = $name;
 202                                         }
 203                                         $empty = $reader->isEmptyElement;
 204                                         $attrs = $this->getAttributesArray( $reader );
 205                                         $this->elementOpen( $name, $attrs );
 206                                         if ( $empty ) {
 207                                                 $this->elementClose();
 208                                         }
 209                                         break;
 210
 211                                 case XMLReader::END_ELEMENT:
 212                                         $this->elementClose();
 213                                         break;
 214
 215                                 case XMLReader::WHITESPACE:
 216                                 case XMLReader::SIGNIFICANT_WHITESPACE:
 217                                 case XMLReader::CDATA:
 218                                 case XMLReader::TEXT:
 219                                         $this->elementData( $reader->value );
 220                                         break;
 221
 222                                 case XMLReader::ENTITY_REF:
 223                                         // Unexpanded entity (maybe external?),
 224                                         // don't send to the filter (xml_parse didn't)
 225                                         break;
 226
 227                                 case XMLReader::COMMENT:
 228                                         // Don't send to the filter (xml_parse didn't)
 229                                         break;
 230
 231                                 case XMLReader::PI:
 232                                         // Processing instructions can happen after the header too
 233                                         $this->processingInstructionHandler(
 234                                                 $reader->name,
 235                                                 $reader->value
 236                                         );
 237                                         break;
 238                                 default:
 239                                         // One of DOC, DOC_TYPE, ENTITY, END_ENTITY,
 240                                         // NOTATION, or XML_DECLARATION
 241                                         // xml_parse didn't send these to the filter, so we won't.
 242                         }
 243
 244                 } while ( $this->readNext( $reader ) );
 245
 246                 if ( $this->stackDepth !== 0 ) {
 247                         $this->wellFormed = false;
 248                 } elseif ( $this->wellFormed === null ) {
 249                         $this->wellFormed = true;
 250                 }
 251
 252         }
 253
 254         /**
 255          * Get all of the attributes for an XMLReader's current node
 256          * @param $r XMLReader
 257          * @return array of attributes
 258          */
 259         private function getAttributesArray( XMLReader $r ) {
 260                 $attrs = [];
 261                 while ( $r->moveToNextAttribute() ) {
 262                         if ( $r->namespaceURI === 'http://www.w3.org/2000/xmlns/' ) {
 263                                 // XMLReader treats xmlns attributes as normal
 264                                 // attributes, while xml_parse doesn't
 265                                 continue;
 266                         }
 267                         $name = $this->expandNS( $r->name, $r->namespaceURI );
 268                         $attrs[$name] = $r->value;
 269                 }
 270                 return $attrs;
 271         }
 272
 273         /**
 274          * @param $name element or attribute name, maybe with a full or short prefix
 275          * @param $namespaceURI the namespaceURI
 276          * @return string the name prefixed with namespaceURI
 277          */
 278         private function expandNS( $name, $namespaceURI ) {
 279                 if ( $namespaceURI ) {
 280                         $parts = explode( ':', $name );
 281                         $localname = array_pop( $parts );
 282                         return "$namespaceURI:$localname";
 283                 }
 284                 return $name;
 285         }
 286
 287         /**
 288          * @param $name
 289          * @param $attribs
 290          */
 291         private function elementOpen( $name, $attribs ) {
 292                 $this->elementDataContext[] = [ $name, $attribs ];
 293                 $this->elementData[] = '';
 294                 $this->stackDepth++;
 295         }
 296
 297         /**
 298          */
 299         private function elementClose() {
 300                 list( $name, $attribs ) = array_pop( $this->elementDataContext );
 301                 $data = array_pop( $this->elementData );
 302                 $this->stackDepth--;
 303                 $callbackReturn = false;
 304
 305                 if ( is_callable( $this->filterCallback ) ) {
 306                         $callbackReturn = call_user_func(
 307                                 $this->filterCallback,
 308                                 $name,
 309                                 $attribs,
 310                                 $data
 311                         );
 312                 }
 313                 if ( $callbackReturn ) {
 314                         // Filter hit!
 315                         $this->filterMatch = true;
 316                         $this->filterMatchType = $callbackReturn;
 317                 }
 318         }
 319
 320         /**
 321          * @param $data
 322          */
 323         private function elementData( $data ) {
 324                 // Collect any data here, and we'll run the callback in elementClose
 325                 $this->elementData[ $this->stackDepth - 1 ] .= trim( $data );
 326         }
 327
 328         /**
 329          * @param $target
 330          * @param $data
 331          */
 332         private function processingInstructionHandler( $target, $data ) {
 333                 $callbackReturn = false;
 334                 if ( $this->parserOptions['processing_instruction_handler'] ) {
 335                         $callbackReturn = call_user_func(
 336                                 $this->parserOptions['processing_instruction_handler'],
 337                                 $target,
 338                                 $data
 339                         );
 340                 }
 341                 if ( $callbackReturn ) {
 342                         // Filter hit!
 343                         $this->filterMatch = true;
 344                         $this->filterMatchType = $callbackReturn;
 345                 }
 346         }
 347 }