Coverage Report

Created: 2025-06-13 06:43

/src/php-src/ext/standard/html.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright (c) The PHP Group                                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to version 3.01 of the PHP license,      |
6
   | that is bundled with this package in the file LICENSE, and is        |
7
   | available through the world-wide-web at the following url:           |
8
   | https://www.php.net/license/3_01.txt                                 |
9
   | If you did not receive a copy of the PHP license and are unable to   |
10
   | obtain it through the world-wide-web, please send a note to          |
11
   | license@php.net so we can mail you a copy immediately.               |
12
   +----------------------------------------------------------------------+
13
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
14
   |          Jaakko Hyvätti <jaakko.hyvatti@iki.fi>                      |
15
   |          Wez Furlong    <wez@thebrainroom.com>                       |
16
   |          Gustavo Lopes  <cataphract@php.net>                         |
17
   +----------------------------------------------------------------------+
18
*/
19
20
/*
21
 * HTML entity resources:
22
 *
23
 * http://www.unicode.org/Public/MAPPINGS/OBSOLETE/UNI2SGML.TXT
24
 *
25
 * XHTML 1.0 DTD
26
 * http://www.w3.org/TR/2002/REC-xhtml1-20020801/dtds.html#h-A2
27
 *
28
 * From HTML 4.01 strict DTD:
29
 * http://www.w3.org/TR/html4/HTMLlat1.ent
30
 * http://www.w3.org/TR/html4/HTMLsymbol.ent
31
 * http://www.w3.org/TR/html4/HTMLspecial.ent
32
 *
33
 * HTML 5:
34
 * http://dev.w3.org/html5/spec/Overview.html#named-character-references
35
 */
36
37
#include "php.h"
38
#ifdef PHP_WIN32
39
#include "config.w32.h"
40
#else
41
#include <php_config.h>
42
#endif
43
#include "php_standard.h"
44
#include "SAPI.h"
45
#include <locale.h>
46
47
#include <zend_hash.h>
48
#include "html_tables.h"
49
50
/* Macro for disabling flag of translation of non-basic entities where this isn't supported.
51
 * Not appropriate for html_entity_decode/htmlspecialchars_decode */
52
654
#define LIMIT_ALL(all, doctype, charset) do { \
53
654
  (all) = (all) && !CHARSET_PARTIAL_SUPPORT((charset)) && ((doctype) != ENT_HTML_DOC_XML1); \
54
654
} while (0)
55
56
860k
#define MB_FAILURE(pos, advance) do { \
57
1.47M
  *cursor = pos + (advance); \
58
860k
  *status = FAILURE; \
59
860k
  return 0; \
60
860k
} while (0)
61
62
1.89M
#define CHECK_LEN(pos, chars_need) ((str_len - (pos)) >= (chars_need))
63
64
/* valid as single byte character or leading byte */
65
80.3k
#define utf8_lead(c)  ((c) < 0x80 || ((c) >= 0xC2 && (c) <= 0xF4))
66
/* whether it's actually valid depends on other stuff;
67
 * this macro cannot check for non-shortest forms, surrogates or
68
 * code points above 0x10FFFF */
69
511k
#define utf8_trail(c) ((c) >= 0x80 && (c) <= 0xBF)
70
71
49.4k
#define gb2312_lead(c) ((c) != 0x8E && (c) != 0x8F && (c) != 0xA0 && (c) != 0xFF)
72
2.19k
#define gb2312_trail(c) ((c) >= 0xA1 && (c) <= 0xFE)
73
74
188
#define sjis_lead(c) ((c) != 0x80 && (c) != 0xA0 && (c) < 0xFD)
75
887
#define sjis_trail(c) ((c) >= 0x40  && (c) != 0x7F && (c) < 0xFD)
76
77
/* {{{ get_default_charset */
78
802
static char *get_default_charset(void) {
79
802
  if (PG(internal_encoding) && PG(internal_encoding)[0]) {
80
0
    return PG(internal_encoding);
81
802
  } else if (SG(default_charset) && SG(default_charset)[0] ) {
82
802
    return SG(default_charset);
83
802
  }
84
0
  return NULL;
85
802
}
86
/* }}} */
87
88
/* {{{ get_next_char */
89
static inline unsigned int get_next_char(
90
    enum entity_charset charset,
91
    const unsigned char *str,
92
    size_t str_len,
93
    size_t *cursor,
94
    zend_result *status)
95
1.55M
{
96
1.55M
  size_t pos = *cursor;
97
1.55M
  unsigned int this_char = 0;
98
99
1.55M
  *status = SUCCESS;
100
1.55M
  assert(pos <= str_len);
101
102
1.55M
  if (!CHECK_LEN(pos, 1))
103
0
    MB_FAILURE(pos, 1);
104
105
1.55M
  switch (charset) {
106
1.40M
  case cs_utf_8:
107
1.40M
    {
108
      /* We'll follow strategy 2. from section 3.6.1 of UTR #36:
109
       * "In a reported illegal byte sequence, do not include any
110
       *  non-initial byte that encodes a valid character or is a leading
111
       *  byte for a valid sequence." */
112
1.40M
      unsigned char c;
113
1.40M
      c = str[pos];
114
1.40M
      if (c < 0x80) {
115
475k
        this_char = c;
116
475k
        pos++;
117
933k
      } else if (c < 0xc2) {
118
373k
        MB_FAILURE(pos, 1);
119
559k
      } else if (c < 0xe0) {
120
337k
        if (!CHECK_LEN(pos, 2))
121
13
          MB_FAILURE(pos, 1);
122
123
337k
        if (!utf8_trail(str[pos + 1])) {
124
256k
          MB_FAILURE(pos, utf8_lead(str[pos + 1]) ? 1 : 2);
125
256k
        }
126
80.3k
        this_char = ((c & 0x1f) << 6) | (str[pos + 1] & 0x3f);
127
80.3k
        if (this_char < 0x80) { /* non-shortest form */
128
0
          MB_FAILURE(pos, 2);
129
0
        }
130
80.3k
        pos += 2;
131
222k
      } else if (c < 0xf0) {
132
60.6k
        size_t avail = str_len - pos;
133
134
60.6k
        if (avail < 3 ||
135
60.6k
            !utf8_trail(str[pos + 1]) || !utf8_trail(str[pos + 2])) {
136
59.4k
          if (avail < 2 || utf8_lead(str[pos + 1]))
137
55.5k
            MB_FAILURE(pos, 1);
138
3.88k
          else if (avail < 3 || utf8_lead(str[pos + 2]))
139
2.23k
            MB_FAILURE(pos, 2);
140
1.64k
          else
141
1.64k
            MB_FAILURE(pos, 3);
142
59.4k
        }
143
144
1.24k
        this_char = ((c & 0x0f) << 12) | ((str[pos + 1] & 0x3f) << 6) | (str[pos + 2] & 0x3f);
145
1.24k
        if (this_char < 0x800) { /* non-shortest form */
146
22
          MB_FAILURE(pos, 3);
147
1.22k
        } else if (this_char >= 0xd800 && this_char <= 0xdfff) { /* surrogate */
148
62
          MB_FAILURE(pos, 3);
149
62
        }
150
1.15k
        pos += 3;
151
162k
      } else if (c < 0xf5) {
152
15.3k
        size_t avail = str_len - pos;
153
154
15.3k
        if (avail < 4 ||
155
15.3k
            !utf8_trail(str[pos + 1]) || !utf8_trail(str[pos + 2]) ||
156
15.3k
            !utf8_trail(str[pos + 3])) {
157
14.0k
          if (avail < 2 || utf8_lead(str[pos + 1]))
158
12.0k
            MB_FAILURE(pos, 1);
159
2.02k
          else if (avail < 3 || utf8_lead(str[pos + 2]))
160
1.05k
            MB_FAILURE(pos, 2);
161
972
          else if (avail < 4 || utf8_lead(str[pos + 3]))
162
387
            MB_FAILURE(pos, 3);
163
585
          else
164
585
            MB_FAILURE(pos, 4);
165
14.0k
        }
166
167
1.25k
        this_char = ((c & 0x07) << 18) | ((str[pos + 1] & 0x3f) << 12) | ((str[pos + 2] & 0x3f) << 6) | (str[pos + 3] & 0x3f);
168
1.25k
        if (this_char < 0x10000 || this_char > 0x10FFFF) { /* non-shortest form or outside range */
169
40
          MB_FAILURE(pos, 4);
170
40
        }
171
1.21k
        pos += 4;
172
146k
      } else {
173
146k
        MB_FAILURE(pos, 1);
174
146k
      }
175
1.40M
    }
176
558k
    break;
177
178
558k
  case cs_big5:
179
    /* reference http://demo.icu-project.org/icu-bin/convexp?conv=big5 */
180
2.68k
    {
181
2.68k
      unsigned char c = str[pos];
182
2.68k
      if (c >= 0x81 && c <= 0xFE) {
183
196
        unsigned char next;
184
196
        if (!CHECK_LEN(pos, 2))
185
0
          MB_FAILURE(pos, 1);
186
187
196
        next = str[pos + 1];
188
189
196
        if ((next >= 0x40 && next <= 0x7E) ||
190
196
            (next >= 0xA1 && next <= 0xFE)) {
191
28
          this_char = (c << 8) | next;
192
168
        } else {
193
168
          MB_FAILURE(pos, 1);
194
168
        }
195
28
        pos += 2;
196
2.48k
      } else {
197
2.48k
        this_char = c;
198
2.48k
        pos += 1;
199
2.48k
      }
200
2.68k
    }
201
2.51k
    break;
202
203
2.51k
  case cs_big5hkscs:
204
0
    {
205
0
      unsigned char c = str[pos];
206
0
      if (c >= 0x81 && c <= 0xFE) {
207
0
        unsigned char next;
208
0
        if (!CHECK_LEN(pos, 2))
209
0
          MB_FAILURE(pos, 1);
210
211
0
        next = str[pos + 1];
212
213
0
        if ((next >= 0x40 && next <= 0x7E) ||
214
0
            (next >= 0xA1 && next <= 0xFE)) {
215
0
          this_char = (c << 8) | next;
216
0
        } else if (next != 0x80 && next != 0xFF) {
217
0
          MB_FAILURE(pos, 1);
218
0
        } else {
219
0
          MB_FAILURE(pos, 2);
220
0
        }
221
0
        pos += 2;
222
0
      } else {
223
0
        this_char = c;
224
0
        pos += 1;
225
0
      }
226
0
    }
227
0
    break;
228
229
50.0k
  case cs_gb2312: /* EUC-CN */
230
50.0k
    {
231
50.0k
      unsigned char c = str[pos];
232
50.0k
      if (c >= 0xA1 && c <= 0xFE) {
233
2.24k
        unsigned char next;
234
2.24k
        if (!CHECK_LEN(pos, 2))
235
49
          MB_FAILURE(pos, 1);
236
237
2.19k
        next = str[pos + 1];
238
239
2.19k
        if (gb2312_trail(next)) {
240
570
          this_char = (c << 8) | next;
241
1.62k
        } else if (gb2312_lead(next)) {
242
1.17k
          MB_FAILURE(pos, 1);
243
1.17k
        } else {
244
454
          MB_FAILURE(pos, 2);
245
454
        }
246
570
        pos += 2;
247
47.7k
      } else if (gb2312_lead(c)) {
248
42.2k
        this_char = c;
249
42.2k
        pos += 1;
250
42.2k
      } else {
251
5.50k
        MB_FAILURE(pos, 1);
252
5.50k
      }
253
50.0k
    }
254
42.8k
    break;
255
256
42.8k
  case cs_sjis:
257
17.7k
    {
258
17.7k
      unsigned char c = str[pos];
259
17.7k
      if ((c >= 0x81 && c <= 0x9F) || (c >= 0xE0 && c <= 0xFC)) {
260
889
        unsigned char next;
261
889
        if (!CHECK_LEN(pos, 2))
262
2
          MB_FAILURE(pos, 1);
263
264
887
        next = str[pos + 1];
265
266
887
        if (sjis_trail(next)) {
267
699
          this_char = (c << 8) | next;
268
699
        } else if (sjis_lead(next)) {
269
133
          MB_FAILURE(pos, 1);
270
133
        } else {
271
55
          MB_FAILURE(pos, 2);
272
55
        }
273
699
        pos += 2;
274
16.8k
      } else if (c < 0x80 || (c >= 0xA1 && c <= 0xDF)) {
275
14.5k
        this_char = c;
276
14.5k
        pos += 1;
277
14.5k
      } else {
278
2.28k
        MB_FAILURE(pos, 1);
279
2.28k
      }
280
17.7k
    }
281
15.2k
    break;
282
283
15.2k
  case cs_eucjp:
284
0
    {
285
0
      unsigned char c = str[pos];
286
287
0
      if (c >= 0xA1 && c <= 0xFE) {
288
0
        unsigned next;
289
0
        if (!CHECK_LEN(pos, 2))
290
0
          MB_FAILURE(pos, 1);
291
0
        next = str[pos + 1];
292
293
0
        if (next >= 0xA1 && next <= 0xFE) {
294
          /* this a jis kanji char */
295
0
          this_char = (c << 8) | next;
296
0
        } else {
297
0
          MB_FAILURE(pos, (next != 0xA0 && next != 0xFF) ? 1 : 2);
298
0
        }
299
0
        pos += 2;
300
0
      } else if (c == 0x8E) {
301
0
        unsigned next;
302
0
        if (!CHECK_LEN(pos, 2))
303
0
          MB_FAILURE(pos, 1);
304
305
0
        next = str[pos + 1];
306
0
        if (next >= 0xA1 && next <= 0xDF) {
307
          /* JIS X 0201 kana */
308
0
          this_char = (c << 8) | next;
309
0
        } else {
310
0
          MB_FAILURE(pos, (next != 0xA0 && next != 0xFF) ? 1 : 2);
311
0
        }
312
0
        pos += 2;
313
0
      } else if (c == 0x8F) {
314
0
        size_t avail = str_len - pos;
315
316
0
        if (avail < 3 || !(str[pos + 1] >= 0xA1 && str[pos + 1] <= 0xFE) ||
317
0
            !(str[pos + 2] >= 0xA1 && str[pos + 2] <= 0xFE)) {
318
0
          if (avail < 2 || (str[pos + 1] != 0xA0 && str[pos + 1] != 0xFF))
319
0
            MB_FAILURE(pos, 1);
320
0
          else if (avail < 3 || (str[pos + 2] != 0xA0 && str[pos + 2] != 0xFF))
321
0
            MB_FAILURE(pos, 2);
322
0
          else
323
0
            MB_FAILURE(pos, 3);
324
0
        } else {
325
          /* JIS X 0212 hojo-kanji */
326
0
          this_char = (c << 16) | (str[pos + 1] << 8) | str[pos + 2];
327
0
        }
328
0
        pos += 3;
329
0
      } else if (c != 0xA0 && c != 0xFF) {
330
        /* character encoded in 1 code unit */
331
0
        this_char = c;
332
0
        pos += 1;
333
0
      } else {
334
0
        MB_FAILURE(pos, 1);
335
0
      }
336
0
    }
337
0
    break;
338
73.4k
  default:
339
    /* single-byte charsets */
340
73.4k
    this_char = str[pos++];
341
73.4k
    break;
342
1.55M
  }
343
344
692k
  *cursor = pos;
345
692k
  return this_char;
346
1.55M
}
347
/* }}} */
348
349
/* {{{ php_next_utf8_char
350
 * Public interface for get_next_char used with UTF-8 */
351
PHPAPI unsigned int php_next_utf8_char(
352
    const unsigned char *str,
353
    size_t str_len,
354
    size_t *cursor,
355
    zend_result *status)
356
226k
{
357
226k
  return get_next_char(cs_utf_8, str, str_len, cursor, status);
358
226k
}
359
/* }}} */
360
361
/* {{{ entity_charset determine_charset
362
 * Returns the charset identifier based on an explicitly provided charset,
363
 * the internal_encoding and default_charset ini settings, or UTF-8 by default. */
364
static enum entity_charset determine_charset(const char *charset_hint, bool quiet)
365
1.30k
{
366
1.30k
  if (!charset_hint || !*charset_hint) {
367
802
    charset_hint = get_default_charset();
368
802
  }
369
370
1.30k
  if (charset_hint && *charset_hint) {
371
1.30k
    size_t len = strlen(charset_hint);
372
    /* now walk the charset map and look for the codeset */
373
18.1k
    for (size_t i = 0; i < sizeof(charset_map)/sizeof(charset_map[0]); i++) {
374
17.9k
      if (len == charset_map[i].codeset_len &&
375
17.9k
          zend_binary_strcasecmp(charset_hint, len, charset_map[i].codeset, len) == 0) {
376
1.08k
        return charset_map[i].charset;
377
1.08k
      }
378
17.9k
    }
379
380
227
    if (!quiet) {
381
227
      php_error_docref(NULL, E_WARNING, "Charset \"%s\" is not supported, assuming UTF-8",
382
227
          charset_hint);
383
227
    }
384
227
  }
385
386
227
  return cs_utf_8;
387
1.30k
}
388
/* }}} */
389
390
/* {{{ php_utf32_utf8 */
391
static inline size_t php_utf32_utf8(unsigned char *buf, unsigned k)
392
0
{
393
0
  size_t retval = 0;
394
395
  /* assert(0x0 <= k <= 0x10FFFF); */
396
397
0
  if (k < 0x80) {
398
0
    buf[0] = k;
399
0
    retval = 1;
400
0
  } else if (k < 0x800) {
401
0
    buf[0] = 0xc0 | (k >> 6);
402
0
    buf[1] = 0x80 | (k & 0x3f);
403
0
    retval = 2;
404
0
  } else if (k < 0x10000) {
405
0
    buf[0] = 0xe0 | (k >> 12);
406
0
    buf[1] = 0x80 | ((k >> 6) & 0x3f);
407
0
    buf[2] = 0x80 | (k & 0x3f);
408
0
    retval = 3;
409
0
  } else {
410
0
    buf[0] = 0xf0 | (k >> 18);
411
0
    buf[1] = 0x80 | ((k >> 12) & 0x3f);
412
0
    buf[2] = 0x80 | ((k >> 6) & 0x3f);
413
0
    buf[3] = 0x80 | (k & 0x3f);
414
0
    retval = 4;
415
0
  }
416
  /* UTF-8 has been restricted to max 4 bytes since RFC 3629 */
417
418
0
  return retval;
419
0
}
420
/* }}} */
421
422
/* {{{ unimap_bsearc_cmp
423
 * Binary search of unicode code points in unicode <--> charset mapping.
424
 * Returns the code point in the target charset (whose mapping table was given) or 0 if
425
 * the unicode code point is not in the table.
426
 */
427
static inline unsigned char unimap_bsearch(const uni_to_enc *table, unsigned code_key_a, size_t num)
428
0
{
429
0
  const uni_to_enc *l = table,
430
0
           *h = &table[num-1],
431
0
           *m;
432
0
  unsigned short code_key;
433
434
  /* we have no mappings outside the BMP */
435
0
  if (code_key_a > 0xFFFFU)
436
0
    return 0;
437
438
0
  code_key = (unsigned short) code_key_a;
439
440
0
  while (l <= h) {
441
0
    m = l + (h - l) / 2;
442
0
    if (code_key < m->un_code_point)
443
0
      h = m - 1;
444
0
    else if (code_key > m->un_code_point)
445
0
      l = m + 1;
446
0
    else
447
0
      return m->cs_code;
448
0
  }
449
0
  return 0;
450
0
}
451
/* }}} */
452
453
/* {{{ map_from_unicode */
454
static inline zend_result map_from_unicode(unsigned code, enum entity_charset charset, unsigned *res)
455
10.3k
{
456
10.3k
  unsigned char found;
457
10.3k
  const uni_to_enc *table;
458
10.3k
  size_t table_size;
459
460
10.3k
  switch (charset) {
461
10.3k
  case cs_8859_1:
462
    /* identity mapping of code points to unicode */
463
10.3k
    if (code > 0xFF) {
464
0
      return FAILURE;
465
0
    }
466
10.3k
    *res = code;
467
10.3k
    break;
468
469
0
  case cs_8859_5:
470
0
    if (code <= 0xA0 || code == 0xAD /* soft hyphen */) {
471
0
      *res = code;
472
0
    } else if (code == 0x2116) {
473
0
      *res = 0xF0; /* numero sign */
474
0
    } else if (code == 0xA7) {
475
0
      *res = 0xFD; /* section sign */
476
0
    } else if (code >= 0x0401 && code <= 0x045F) {
477
0
      if (code == 0x040D || code == 0x0450 || code == 0x045D)
478
0
        return FAILURE;
479
0
      *res = code - 0x360;
480
0
    } else {
481
0
      return FAILURE;
482
0
    }
483
0
    break;
484
485
0
  case cs_8859_15:
486
0
    if (code < 0xA4 || (code > 0xBE && code <= 0xFF)) {
487
0
      *res = code;
488
0
    } else { /* between A4 and 0xBE */
489
0
      found = unimap_bsearch(unimap_iso885915,
490
0
        code, sizeof(unimap_iso885915) / sizeof(*unimap_iso885915));
491
0
      if (found)
492
0
        *res = found;
493
0
      else
494
0
        return FAILURE;
495
0
    }
496
0
    break;
497
498
0
  case cs_cp1252:
499
0
    if (code <= 0x7F || (code >= 0xA0 && code <= 0xFF)) {
500
0
      *res = code;
501
0
    } else {
502
0
      found = unimap_bsearch(unimap_win1252,
503
0
        code, sizeof(unimap_win1252) / sizeof(*unimap_win1252));
504
0
      if (found)
505
0
        *res = found;
506
0
      else
507
0
        return FAILURE;
508
0
    }
509
0
    break;
510
511
0
  case cs_macroman:
512
0
    if (code == 0x7F)
513
0
      return FAILURE;
514
0
    table = unimap_macroman;
515
0
    table_size = sizeof(unimap_macroman) / sizeof(*unimap_macroman);
516
0
    goto table_over_7F;
517
0
  case cs_cp1251:
518
0
    table = unimap_win1251;
519
0
    table_size = sizeof(unimap_win1251) / sizeof(*unimap_win1251);
520
0
    goto table_over_7F;
521
0
  case cs_koi8r:
522
0
    table = unimap_koi8r;
523
0
    table_size = sizeof(unimap_koi8r) / sizeof(*unimap_koi8r);
524
0
    goto table_over_7F;
525
0
  case cs_cp866:
526
0
    table = unimap_cp866;
527
0
    table_size = sizeof(unimap_cp866) / sizeof(*unimap_cp866);
528
529
0
table_over_7F:
530
0
    if (code <= 0x7F) {
531
0
      *res = code;
532
0
    } else {
533
0
      found = unimap_bsearch(table, code, table_size);
534
0
      if (found)
535
0
        *res = found;
536
0
      else
537
0
        return FAILURE;
538
0
    }
539
0
    break;
540
541
  /* from here on, only map the possible characters in the ASCII range.
542
   * to improve support here, it's a matter of building the unicode mappings.
543
   * See <http://www.unicode.org/Public/6.0.0/ucd/Unihan.zip> */
544
0
  case cs_sjis:
545
0
  case cs_eucjp:
546
    /* we interpret 0x5C as the Yen symbol. This is not universal.
547
     * See <http://www.w3.org/Submission/japanese-xml/#ambiguity_of_yen> */
548
0
    if (code >= 0x20 && code <= 0x7D) {
549
0
      if (code == 0x5C)
550
0
        return FAILURE;
551
0
      *res = code;
552
0
    } else {
553
0
      return FAILURE;
554
0
    }
555
0
    break;
556
557
0
  case cs_big5:
558
0
  case cs_big5hkscs:
559
0
  case cs_gb2312:
560
0
    if (code >= 0x20 && code <= 0x7D) {
561
0
      *res = code;
562
0
    } else {
563
0
      return FAILURE;
564
0
    }
565
0
    break;
566
567
0
  default:
568
0
    return FAILURE;
569
10.3k
  }
570
571
10.3k
  return SUCCESS;
572
10.3k
}
573
/* }}} */
574
575
/* {{{ */
576
static inline void map_to_unicode(unsigned code, const enc_to_uni *table, unsigned *res)
577
73.0k
{
578
  /* only single byte encodings are currently supported; assumed code <= 0xFF */
579
73.0k
  *res = table->inner[ENT_ENC_TO_UNI_STAGE1(code)]->uni_cp[ENT_ENC_TO_UNI_STAGE2(code)];
580
73.0k
}
581
/* }}} */
582
583
/* {{{ unicode_cp_is_allowed */
584
static inline int unicode_cp_is_allowed(unsigned uni_cp, int document_type)
585
236k
{
586
  /* XML 1.0        HTML 4.01     HTML 5
587
   * 0x09..0x0A     0x09..0x0A      0x09..0x0A
588
   * 0x0D         0x0D        0x0C..0x0D
589
   * 0x0020..0xD7FF   0x20..0x7E      0x20..0x7E
590
   *            0x00A0..0xD7FF    0x00A0..0xD7FF
591
   * 0xE000..0xFFFD   0xE000..0x10FFFF  0xE000..0xFDCF
592
   * 0x010000..0x10FFFF           0xFDF0..0x10FFFF (*)
593
   *
594
   * (*) exclude code points where ((code & 0xFFFF) >= 0xFFFE)
595
   *
596
   * References:
597
   * XML 1.0:   <http://www.w3.org/TR/REC-xml/#charsets>
598
   * HTML 4.01: <http://www.w3.org/TR/1999/PR-html40-19990824/sgml/sgmldecl.html>
599
   * HTML 5:    <http://dev.w3.org/html5/spec/Overview.html#preprocessing-the-input-stream>
600
   *
601
   * Not sure this is the relevant part for HTML 5, though. I opted to
602
   * disallow the characters that would result in a parse error when
603
   * preprocessing of the input stream. See also section 8.1.3.
604
   *
605
   * It's unclear if XHTML 1.0 allows C1 characters. I'll opt to apply to
606
   * XHTML 1.0 the same rules as for XML 1.0.
607
   * See <http://cmsmcq.com/2007/C1.xml>.
608
   */
609
610
236k
  switch (document_type) {
611
92.8k
  case ENT_HTML_DOC_HTML401:
612
92.8k
    return (uni_cp >= 0x20 && uni_cp <= 0x7E) ||
613
92.8k
      (uni_cp == 0x0A || uni_cp == 0x09 || uni_cp == 0x0D) ||
614
92.8k
      (uni_cp >= 0xA0 && uni_cp <= 0xD7FF) ||
615
92.8k
      (uni_cp >= 0xE000 && uni_cp <= 0x10FFFF);
616
55.5k
  case ENT_HTML_DOC_HTML5:
617
55.5k
    return (uni_cp >= 0x20 && uni_cp <= 0x7E) ||
618
55.5k
      (uni_cp >= 0x09 && uni_cp <= 0x0D && uni_cp != 0x0B) || /* form feed U+0C allowed */
619
55.5k
      (uni_cp >= 0xA0 && uni_cp <= 0xD7FF) ||
620
55.5k
      (uni_cp >= 0xE000 && uni_cp <= 0x10FFFF &&
621
32.2k
        ((uni_cp & 0xFFFF) < 0xFFFE) && /* last two of each plane (nonchars) disallowed */
622
32.2k
        (uni_cp < 0xFDD0 || uni_cp > 0xFDEF)); /* U+FDD0-U+FDEF (nonchars) disallowed */
623
76.0k
  case ENT_HTML_DOC_XHTML:
624
88.2k
  case ENT_HTML_DOC_XML1:
625
88.2k
    return (uni_cp >= 0x20 && uni_cp <= 0xD7FF) ||
626
88.2k
      (uni_cp == 0x0A || uni_cp == 0x09 || uni_cp == 0x0D) ||
627
88.2k
      (uni_cp >= 0xE000 && uni_cp <= 0x10FFFF && uni_cp != 0xFFFE && uni_cp != 0xFFFF);
628
0
  default:
629
0
    return 1;
630
236k
  }
631
236k
}
632
/* }}} */
633
634
/* {{{ unicode_cp_is_allowed */
635
static inline int numeric_entity_is_allowed(unsigned uni_cp, int document_type)
636
0
{
637
  /* less restrictive than unicode_cp_is_allowed */
638
0
  switch (document_type) {
639
0
  case ENT_HTML_DOC_HTML401:
640
    /* all non-SGML characters (those marked with UNUSED in DESCSET) should be
641
     * representable with numeric entities */
642
0
    return uni_cp <= 0x10FFFF;
643
0
  case ENT_HTML_DOC_HTML5:
644
    /* 8.1.4. The numeric character reference forms described above are allowed to
645
     * reference any Unicode code point other than U+0000, U+000D, permanently
646
     * undefined Unicode characters (noncharacters), and control characters other
647
     * than space characters (U+0009, U+000A, U+000C and U+000D) */
648
    /* seems to allow surrogate characters, then */
649
0
    return (uni_cp >= 0x20 && uni_cp <= 0x7E) ||
650
0
      (uni_cp >= 0x09 && uni_cp <= 0x0C && uni_cp != 0x0B) || /* form feed U+0C allowed, but not U+0D */
651
0
      (uni_cp >= 0xA0 && uni_cp <= 0x10FFFF &&
652
0
        ((uni_cp & 0xFFFF) < 0xFFFE) && /* last two of each plane (nonchars) disallowed */
653
0
        (uni_cp < 0xFDD0 || uni_cp > 0xFDEF)); /* U+FDD0-U+FDEF (nonchars) disallowed */
654
0
  case ENT_HTML_DOC_XHTML:
655
0
  case ENT_HTML_DOC_XML1:
656
    /* OTOH, XML 1.0 requires "character references to match the production for Char
657
     * See <http://www.w3.org/TR/REC-xml/#NT-CharRef> */
658
0
    return unicode_cp_is_allowed(uni_cp, document_type);
659
0
  default:
660
0
    return 1;
661
0
  }
662
0
}
663
/* }}} */
664
665
/* {{{ process_numeric_entity
666
 * Auxiliary function to traverse_for_entities.
667
 * On input, *buf should point to the first character after # and on output, it's the last
668
 * byte read, no matter if there was success or insuccess.
669
 */
670
static inline zend_result process_numeric_entity(const char **buf, unsigned *code_point)
671
58
{
672
58
  zend_long code_l;
673
58
  int hexadecimal = (**buf == 'x' || **buf == 'X'); /* TODO: XML apparently disallows "X" */
674
58
  char *endptr;
675
676
58
  if (hexadecimal)
677
0
    (*buf)++;
678
679
  /* strtol allows whitespace and other stuff in the beginning
680
    * we're not interested */
681
58
  if ((hexadecimal && !isxdigit(**buf)) ||
682
58
      (!hexadecimal && !isdigit(**buf))) {
683
58
    return FAILURE;
684
58
  }
685
686
0
  code_l = ZEND_STRTOL(*buf, &endptr, hexadecimal ? 16 : 10);
687
  /* we're guaranteed there were valid digits, so *endptr > buf */
688
0
  *buf = endptr;
689
690
0
  if (**buf != ';')
691
0
    return FAILURE;
692
693
  /* many more are invalid, but that depends on whether it's HTML
694
   * (and which version) or XML. */
695
0
  if (code_l > Z_L(0x10FFFF))
696
0
    return FAILURE;
697
698
0
  if (code_point != NULL)
699
0
    *code_point = (unsigned)code_l;
700
701
0
  return SUCCESS;
702
0
}
703
/* }}} */
704
705
/* {{{ process_named_entity */
706
static inline zend_result process_named_entity_html(const char **buf, const char **start, size_t *length)
707
16.0k
{
708
16.0k
  *start = *buf;
709
710
  /* "&" is represented by a 0x26 in all supported encodings. That means
711
   * the byte after represents a character or is the leading byte of a
712
   * sequence of 8-bit code units. If in the ranges below, it represents
713
   * necessarily an alpha character because none of the supported encodings
714
   * has an overlap with ASCII in the leading byte (only on the second one) */
715
46.6k
  while ((**buf >= 'a' && **buf <= 'z') ||
716
46.6k
      (**buf >= 'A' && **buf <= 'Z') ||
717
46.6k
      (**buf >= '0' && **buf <= '9')) {
718
30.6k
    (*buf)++;
719
30.6k
  }
720
721
16.0k
  if (**buf != ';')
722
5.36k
    return FAILURE;
723
724
  /* cast to size_t OK as the quantity is always non-negative */
725
10.6k
  *length = *buf - *start;
726
727
10.6k
  if (*length == 0)
728
11
    return FAILURE;
729
730
10.6k
  return SUCCESS;
731
10.6k
}
732
/* }}} */
733
734
/* {{{ resolve_named_entity_html */
735
static zend_result resolve_named_entity_html(const char *start, size_t length, const entity_ht *ht, unsigned *uni_cp1, unsigned *uni_cp2)
736
10.6k
{
737
10.6k
  const entity_cp_map *s;
738
10.6k
  zend_ulong hash = zend_inline_hash_func(start, length);
739
740
10.6k
  s = ht->buckets[hash % ht->num_elems];
741
10.9k
  while (s->entity) {
742
10.6k
    if (s->entity_len == length) {
743
10.3k
      if (memcmp(start, s->entity, length) == 0) {
744
10.3k
        *uni_cp1 = s->codepoint1;
745
10.3k
        *uni_cp2 = s->codepoint2;
746
10.3k
        return SUCCESS;
747
10.3k
      }
748
10.3k
    }
749
274
    s++;
750
274
  }
751
328
  return FAILURE;
752
10.6k
}
753
/* }}} */
754
755
10.3k
static inline size_t write_octet_sequence(unsigned char *buf, enum entity_charset charset, unsigned code) {
756
  /* code is not necessarily a unicode code point */
757
10.3k
  switch (charset) {
758
0
  case cs_utf_8:
759
0
    return php_utf32_utf8(buf, code);
760
761
10.3k
  case cs_8859_1:
762
10.3k
  case cs_cp1252:
763
10.3k
  case cs_8859_15:
764
10.3k
  case cs_koi8r:
765
10.3k
  case cs_cp1251:
766
10.3k
  case cs_8859_5:
767
10.3k
  case cs_cp866:
768
10.3k
  case cs_macroman:
769
    /* single byte stuff */
770
10.3k
    *buf = code;
771
10.3k
    return 1;
772
773
0
  case cs_big5:
774
0
  case cs_big5hkscs:
775
0
  case cs_sjis:
776
0
  case cs_gb2312:
777
    /* we don't have complete unicode mappings for these yet in entity_decode,
778
     * and we opt to pass through the octet sequences for these in htmlentities
779
     * instead of converting to an int and then converting back. */
780
#if 0
781
    return php_mb2_int_to_char(buf, code);
782
#else
783
0
    ZEND_ASSERT(code <= 0xFFU);
784
0
    *buf = code;
785
0
    return 1;
786
0
#endif
787
788
0
  case cs_eucjp:
789
#if 0 /* idem */
790
    return php_mb2_int_to_char(buf, code);
791
#else
792
0
    ZEND_ASSERT(code <= 0xFFU);
793
0
    *buf = code;
794
0
    return 1;
795
0
#endif
796
797
0
  default:
798
0
    assert(0);
799
0
    return 0;
800
10.3k
  }
801
10.3k
}
802
803
/* {{{ traverse_for_entities
804
 * Auxiliary function to php_unescape_html_entities().
805
 * - The argument "all" determines if all numeric entities are decode or only those
806
 *   that correspond to quotes (depending on quote_style).
807
 */
808
/* maximum expansion (factor 1.2) for HTML 5 with &nGt; and &nLt; */
809
/* +2 is 1 because of rest (probably unnecessary), 1 because of terminating 0 */
810
295
#define TRAVERSE_FOR_ENTITIES_EXPAND_SIZE(oldlen) ((oldlen) + (oldlen) / 5 + 2)
811
static void traverse_for_entities(
812
  const char *old,
813
  size_t oldlen,
814
  zend_string *ret, /* should have allocated TRAVERSE_FOR_ENTITIES_EXPAND_SIZE(olden) */
815
  int all,
816
  int flags,
817
  const entity_ht *inv_map,
818
  enum entity_charset charset)
819
295
{
820
295
  const char *p,
821
295
         *lim;
822
295
  char     *q;
823
295
  int doctype = flags & ENT_HTML_DOC_TYPE_MASK;
824
825
295
  lim = old + oldlen; /* terminator address */
826
295
  assert(*lim == '\0');
827
828
262k
  for (p = old, q = ZSTR_VAL(ret); p < lim;) {
829
262k
    unsigned code, code2 = 0;
830
262k
    const char *next = NULL; /* when set, next > p, otherwise possible inf loop */
831
832
    /* Shift JIS, Big5 and HKSCS use multi-byte encodings where an
833
     * ASCII range byte can be part of a multi-byte sequence.
834
     * However, they start at 0x40, therefore if we find a 0x26 byte,
835
     * we're sure it represents the '&' character. */
836
837
    /* assumes there are no single-char entities */
838
262k
    if (p[0] != '&' || (p + 3 >= lim)) {
839
251k
      *(q++) = *(p++);
840
251k
      continue;
841
251k
    }
842
843
    /* now p[3] is surely valid and is no terminator */
844
845
    /* numerical entity */
846
10.4k
    if (p[1] == '#') {
847
3
      next = &p[2];
848
3
      if (process_numeric_entity(&next, &code) == FAILURE)
849
3
        goto invalid_code;
850
851
      /* If we're in htmlspecialchars_decode, we're only decoding entities
852
       * that represent &, <, >, " and '. Is this one of them? */
853
0
      if (!all && (code > 63U ||
854
0
          stage3_table_be_apos_00000[code].data.ent.entity == NULL))
855
0
        goto invalid_code;
856
857
      /* are we allowed to decode this entity in this document type?
858
       * HTML 5 is the only that has a character that cannot be used in
859
       * a numeric entity but is allowed literally (U+000D). The
860
       * unoptimized version would be ... || !numeric_entity_is_allowed(code) */
861
0
      if (!unicode_cp_is_allowed(code, doctype) ||
862
0
          (doctype == ENT_HTML_DOC_HTML5 && code == 0x0D))
863
0
        goto invalid_code;
864
10.4k
    } else {
865
10.4k
      const char *start;
866
10.4k
      size_t ent_len;
867
868
10.4k
      next = &p[1];
869
10.4k
      start = next;
870
871
10.4k
      if (process_named_entity_html(&next, &start, &ent_len) == FAILURE)
872
133
        goto invalid_code;
873
874
10.3k
      if (resolve_named_entity_html(start, ent_len, inv_map, &code, &code2) == FAILURE) {
875
27
        if (doctype == ENT_HTML_DOC_XHTML && ent_len == 4 && start[0] == 'a'
876
27
              && start[1] == 'p' && start[2] == 'o' && start[3] == 's') {
877
          /* uses html4 inv_map, which doesn't include apos;. This is a
878
           * hack to support it */
879
0
          code = (unsigned) '\'';
880
27
        } else {
881
27
          goto invalid_code;
882
27
        }
883
27
      }
884
10.3k
    }
885
886
10.3k
    assert(*next == ';');
887
888
10.3k
    if (((code == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
889
10.3k
        (code == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE)))
890
10.3k
        /* && code2 == '\0' always true for current maps */)
891
0
      goto invalid_code;
892
893
    /* UTF-8 doesn't need mapping (ISO-8859-1 doesn't either, but
894
     * the call is needed to ensure the codepoint <= U+00FF)  */
895
10.3k
    if (charset != cs_utf_8) {
896
      /* replace unicode code point */
897
10.3k
      if (map_from_unicode(code, charset, &code) == FAILURE || code2 != 0)
898
0
        goto invalid_code; /* not representable in target charset */
899
10.3k
    }
900
901
10.3k
    q += write_octet_sequence((unsigned char*)q, charset, code);
902
10.3k
    if (code2) {
903
0
      q += write_octet_sequence((unsigned char*)q, charset, code2);
904
0
    }
905
906
    /* jump over the valid entity; may go beyond size of buffer; np */
907
10.3k
    p = next + 1;
908
10.3k
    continue;
909
910
163
invalid_code:
911
691
    for (; p < next; p++) {
912
528
      *(q++) = *p;
913
528
    }
914
163
  }
915
916
295
  *q = '\0';
917
295
  ZSTR_LEN(ret) = (size_t)(q - ZSTR_VAL(ret));
918
295
}
919
/* }}} */
920
921
/* {{{ unescape_inverse_map */
922
static const entity_ht *unescape_inverse_map(int all, int flags)
923
313
{
924
313
  int document_type = flags & ENT_HTML_DOC_TYPE_MASK;
925
926
313
  if (all) {
927
18
    switch (document_type) {
928
18
    case ENT_HTML_DOC_HTML401:
929
18
    case ENT_HTML_DOC_XHTML: /* but watch out for &apos;...*/
930
18
      return &ent_ht_html4;
931
0
    case ENT_HTML_DOC_HTML5:
932
0
      return &ent_ht_html5;
933
0
    default:
934
0
      return &ent_ht_be_apos;
935
18
    }
936
295
  } else {
937
295
    switch (document_type) {
938
295
    case ENT_HTML_DOC_HTML401:
939
295
      return &ent_ht_be_noapos;
940
0
    default:
941
0
      return &ent_ht_be_apos;
942
295
    }
943
295
  }
944
313
}
945
/* }}} */
946
947
/* {{{ determine_entity_table
948
 * Entity table to use. Note that entity tables are defined in terms of
949
 * unicode code points */
950
static entity_table_opt determine_entity_table(int all, int doctype)
951
1.30k
{
952
1.30k
  entity_table_opt retval = {0};
953
954
1.30k
  assert(!(doctype == ENT_HTML_DOC_XML1 && all));
955
956
1.30k
  if (all) {
957
366
    retval.ms_table = (doctype == ENT_HTML_DOC_HTML5) ?
958
237
      entity_ms_table_html5 : entity_ms_table_html4;
959
942
  } else {
960
942
    retval.table = (doctype == ENT_HTML_DOC_HTML401) ?
961
659
      stage3_table_be_noapos_00000 : stage3_table_be_apos_00000;
962
942
  }
963
1.30k
  return retval;
964
1.30k
}
965
/* }}} */
966
967
/* {{{ php_unescape_html_entities
968
 * The parameter "all" should be true to decode all possible entities, false to decode
969
 * only the basic ones, i.e., those in basic_entities_ex + the numeric entities
970
 * that correspond to quotes.
971
 */
972
PHPAPI zend_string *php_unescape_html_entities(zend_string *str, int all, int flags, const char *hint_charset)
973
496
{
974
496
  zend_string *ret;
975
496
  enum entity_charset charset;
976
496
  const entity_ht *inverse_map;
977
496
  size_t new_size;
978
979
496
  if (!memchr(ZSTR_VAL(str), '&', ZSTR_LEN(str))) {
980
201
    return zend_string_copy(str);
981
201
  }
982
983
295
  if (all) {
984
0
    charset = determine_charset(hint_charset, /* quiet */ 0);
985
295
  } else {
986
295
    charset = cs_8859_1; /* charset shouldn't matter, use ISO-8859-1 for performance */
987
295
  }
988
989
  /* don't use LIMIT_ALL! */
990
991
295
  new_size = TRAVERSE_FOR_ENTITIES_EXPAND_SIZE(ZSTR_LEN(str));
992
295
  if (ZSTR_LEN(str) > new_size) {
993
    /* overflow, refuse to do anything */
994
0
    return zend_string_copy(str);
995
0
  }
996
997
295
  ret = zend_string_alloc(new_size, 0);
998
999
295
  inverse_map = unescape_inverse_map(all, flags);
1000
1001
  /* replace numeric entities */
1002
295
  traverse_for_entities(ZSTR_VAL(str), ZSTR_LEN(str), ret, all, flags, inverse_map, charset);
1003
1004
295
  return ret;
1005
295
}
1006
/* }}} */
1007
1008
PHPAPI zend_string *php_escape_html_entities(const unsigned char *old, size_t oldlen, int all, int flags, const char *hint_charset)
1009
0
{
1010
0
  return php_escape_html_entities_ex(old, oldlen, all, flags, hint_charset, 1, /* quiet */ 0);
1011
0
}
1012
1013
/* {{{ find_entity_for_char */
1014
static inline void find_entity_for_char(
1015
  unsigned int k,
1016
  enum entity_charset charset,
1017
  const entity_stage1_row *table,
1018
  const unsigned char **entity,
1019
  size_t *entity_len,
1020
  const unsigned char *old,
1021
  size_t oldlen,
1022
  size_t *cursor)
1023
193k
{
1024
193k
  unsigned stage1_idx = ENT_STAGE1_INDEX(k);
1025
193k
  const entity_stage3_row *c;
1026
1027
193k
  if (stage1_idx > 0x1D) {
1028
436
    *entity     = NULL;
1029
436
    *entity_len = 0;
1030
436
    return;
1031
436
  }
1032
1033
193k
  c = &table[stage1_idx][ENT_STAGE2_INDEX(k)][ENT_STAGE3_INDEX(k)];
1034
1035
193k
  if (!c->ambiguous) {
1036
190k
    *entity     = (const unsigned char *)c->data.ent.entity;
1037
190k
    *entity_len = c->data.ent.entity_len;
1038
190k
  } else {
1039
    /* peek at next char */
1040
2.27k
    size_t cursor_before = *cursor;
1041
2.27k
    zend_result status = SUCCESS;
1042
2.27k
    unsigned next_char;
1043
1044
2.27k
    if (!(*cursor < oldlen))
1045
12
      goto no_suitable_2nd;
1046
1047
2.26k
    next_char = get_next_char(charset, old, oldlen, cursor, &status);
1048
1049
2.26k
    if (status == FAILURE)
1050
556
      goto no_suitable_2nd;
1051
1052
1.70k
    {
1053
1.70k
      const entity_multicodepoint_row *s, *e;
1054
1055
1.70k
      s = &c->data.multicodepoint_table[1];
1056
1.70k
      e = s - 1 + c->data.multicodepoint_table[0].leading_entry.size;
1057
      /* we could do a binary search but it's not worth it since we have
1058
       * at most two entries... */
1059
3.41k
      for ( ; s <= e; s++) {
1060
1.70k
        if (s->normal_entry.second_cp == next_char) {
1061
0
          *entity     = (const unsigned char *) s->normal_entry.entity;
1062
0
          *entity_len = s->normal_entry.entity_len;
1063
0
          return;
1064
0
        }
1065
1.70k
      }
1066
1.70k
    }
1067
2.27k
no_suitable_2nd:
1068
2.27k
    *cursor = cursor_before;
1069
2.27k
    *entity = (const unsigned char *)
1070
2.27k
      c->data.multicodepoint_table[0].leading_entry.default_entity;
1071
2.27k
    *entity_len = c->data.multicodepoint_table[0].leading_entry.default_entity_len;
1072
2.27k
  }
1073
193k
}
1074
/* }}} */
1075
1076
/* {{{ find_entity_for_char_basic */
1077
static inline void find_entity_for_char_basic(
1078
  unsigned int k,
1079
  const entity_stage3_row *table,
1080
  const unsigned char **entity,
1081
  size_t *entity_len)
1082
473k
{
1083
473k
  if (k >= 64U) {
1084
275k
    *entity     = NULL;
1085
275k
    *entity_len = 0;
1086
275k
    return;
1087
275k
  }
1088
1089
198k
  *entity     = (const unsigned char *) table[k].data.ent.entity;
1090
198k
  *entity_len = table[k].data.ent.entity_len;
1091
198k
}
1092
/* }}} */
1093
1094
/* {{{ php_escape_html_entities */
1095
PHPAPI zend_string *php_escape_html_entities_ex(const unsigned char *old, size_t oldlen, int all, int flags, const char *hint_charset, bool double_encode, bool quiet)
1096
1.30k
{
1097
1.30k
  size_t cursor, maxlen, len;
1098
1.30k
  zend_string *replaced;
1099
1.30k
  enum entity_charset charset = determine_charset(hint_charset, quiet);
1100
1.30k
  int doctype = flags & ENT_HTML_DOC_TYPE_MASK;
1101
1.30k
  entity_table_opt entity_table;
1102
1.30k
  const enc_to_uni *to_uni_table = NULL;
1103
1.30k
  const entity_ht *inv_map = NULL; /* used for !double_encode */
1104
  /* only used if flags includes ENT_HTML_IGNORE_ERRORS or ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS */
1105
1.30k
  const unsigned char *replacement = NULL;
1106
1.30k
  size_t replacement_len = 0;
1107
1108
1.30k
  if (all) { /* replace with all named entities */
1109
654
    if (!quiet && CHARSET_PARTIAL_SUPPORT(charset)) {
1110
131
      php_error_docref(NULL, E_NOTICE, "Only basic entities "
1111
131
        "substitution is supported for multi-byte encodings other than UTF-8; "
1112
131
        "functionality is equivalent to htmlspecialchars");
1113
131
    }
1114
654
    LIMIT_ALL(all, doctype, charset);
1115
654
  }
1116
1.30k
  entity_table = determine_entity_table(all, doctype);
1117
1.30k
  if (all && !CHARSET_UNICODE_COMPAT(charset)) {
1118
148
    to_uni_table = enc_to_uni_index[charset];
1119
148
  }
1120
1121
1.30k
  if (!double_encode) {
1122
    /* first arg is 1 because we want to identify valid named entities
1123
     * even if we are only encoding the basic ones */
1124
18
    inv_map = unescape_inverse_map(1, flags);
1125
18
  }
1126
1127
1.30k
  if (flags & (ENT_HTML_SUBSTITUTE_ERRORS | ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS)) {
1128
1.29k
    if (charset == cs_utf_8) {
1129
1.01k
      replacement = (const unsigned char*)"\xEF\xBF\xBD";
1130
1.01k
      replacement_len = sizeof("\xEF\xBF\xBD") - 1;
1131
1.01k
    } else {
1132
276
      replacement = (const unsigned char*)"&#xFFFD;";
1133
276
      replacement_len = sizeof("&#xFFFD;") - 1;
1134
276
    }
1135
1.29k
  }
1136
1137
  /* initial estimate */
1138
1.30k
  if (oldlen < 64) {
1139
109
    maxlen = 128;
1140
1.19k
  } else {
1141
1.19k
    maxlen = zend_safe_addmult(oldlen, 2, 0, "html_entities");
1142
1.19k
  }
1143
1144
1.30k
  replaced = zend_string_alloc(maxlen, 0);
1145
1.30k
  len = 0;
1146
1.30k
  cursor = 0;
1147
1.32M
  while (cursor < oldlen) {
1148
1.32M
    const unsigned char *mbsequence = NULL;
1149
1.32M
    size_t mbseqlen         = 0,
1150
1.32M
           cursor_before      = cursor;
1151
1.32M
    zend_result status        = SUCCESS;
1152
1.32M
    unsigned int this_char      = get_next_char(charset, old, oldlen, &cursor, &status);
1153
1154
    /* guarantee we have at least 40 bytes to write.
1155
     * In HTML5, entities may take up to 33 bytes */
1156
1.32M
    if (len > maxlen - 40) { /* maxlen can never be smaller than 128 */
1157
5.61k
      replaced = zend_string_safe_realloc(replaced, maxlen, 1, 128, 0);
1158
5.61k
      maxlen += 128;
1159
5.61k
    }
1160
1161
1.32M
    if (status == FAILURE) {
1162
      /* invalid MB sequence */
1163
634k
      if (flags & ENT_HTML_IGNORE_ERRORS) {
1164
47.4k
        continue;
1165
587k
      } else if (flags & ENT_HTML_SUBSTITUTE_ERRORS) {
1166
587k
        memcpy(&ZSTR_VAL(replaced)[len], replacement, replacement_len);
1167
587k
        len += replacement_len;
1168
587k
        continue;
1169
587k
      } else {
1170
144
        zend_string_efree(replaced);
1171
144
        return ZSTR_EMPTY_ALLOC();
1172
144
      }
1173
688k
    } else { /* SUCCESS */
1174
688k
      mbsequence = &old[cursor_before];
1175
688k
      mbseqlen = cursor - cursor_before;
1176
688k
    }
1177
1178
688k
    if (this_char != '&') { /* no entity on this position */
1179
671k
      const unsigned char *rep  = NULL;
1180
671k
      size_t        rep_len = 0;
1181
1182
671k
      if (((this_char == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1183
671k
          (this_char == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1184
4.15k
        goto pass_char_through;
1185
1186
667k
      if (all) { /* false that CHARSET_PARTIAL_SUPPORT(charset) */
1187
193k
        if (to_uni_table != NULL) {
1188
          /* !CHARSET_UNICODE_COMPAT therefore not UTF-8; since UTF-8
1189
           * is the only multibyte encoding with !CHARSET_PARTIAL_SUPPORT,
1190
           * we're using a single byte encoding */
1191
73.0k
          map_to_unicode(this_char, to_uni_table, &this_char);
1192
73.0k
          if (this_char == 0xFFFF) /* no mapping; pass through */
1193
0
            goto pass_char_through;
1194
73.0k
        }
1195
        /* the cursor may advance */
1196
193k
        find_entity_for_char(this_char, charset, entity_table.ms_table, &rep,
1197
193k
          &rep_len, old, oldlen, &cursor);
1198
473k
      } else {
1199
473k
        find_entity_for_char_basic(this_char, entity_table.table, &rep, &rep_len);
1200
473k
      }
1201
1202
667k
      if (rep != NULL) {
1203
40.1k
        ZSTR_VAL(replaced)[len++] = '&';
1204
40.1k
        memcpy(&ZSTR_VAL(replaced)[len], rep, rep_len);
1205
40.1k
        len += rep_len;
1206
40.1k
        ZSTR_VAL(replaced)[len++] = ';';
1207
627k
      } else {
1208
        /* we did not find an entity for this char.
1209
         * check for its validity, if its valid pass it unchanged */
1210
627k
        if (flags & ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS) {
1211
241k
          if (CHARSET_UNICODE_COMPAT(charset)) {
1212
126k
            if (!unicode_cp_is_allowed(this_char, doctype)) {
1213
45.2k
              mbsequence = replacement;
1214
45.2k
              mbseqlen = replacement_len;
1215
45.2k
            }
1216
126k
          } else if (to_uni_table) {
1217
58.2k
            if (!all) /* otherwise we already did this */
1218
0
              map_to_unicode(this_char, to_uni_table, &this_char);
1219
58.2k
            if (!unicode_cp_is_allowed(this_char, doctype)) {
1220
23.2k
              mbsequence = replacement;
1221
23.2k
              mbseqlen = replacement_len;
1222
23.2k
            }
1223
58.2k
          } else {
1224
            /* not a unicode code point, unless, coincidentally, it's in
1225
             * the 0x20..0x7D range (except 0x5C in sjis). We know nothing
1226
             * about other code points, because we have no tables. Since
1227
             * Unicode code points in that range are not disallowed in any
1228
             * document type, we could do nothing. However, conversion
1229
             * tables frequently map 0x00-0x1F to the respective C0 code
1230
             * points. Let's play it safe and admit that's the case */
1231
56.6k
            if (this_char <= 0x7D &&
1232
56.6k
                !unicode_cp_is_allowed(this_char, doctype)) {
1233
28.1k
              mbsequence = replacement;
1234
28.1k
              mbseqlen = replacement_len;
1235
28.1k
            }
1236
56.6k
          }
1237
241k
        }
1238
631k
pass_char_through:
1239
631k
        if (mbseqlen > 1) {
1240
178k
          memcpy(ZSTR_VAL(replaced) + len, mbsequence, mbseqlen);
1241
178k
          len += mbseqlen;
1242
452k
        } else {
1243
452k
          ZSTR_VAL(replaced)[len++] = mbsequence[0];
1244
452k
        }
1245
631k
      }
1246
667k
    } else { /* this_char == '&' */
1247
16.9k
      if (double_encode) {
1248
16.9k
encode_amp:
1249
16.9k
        memcpy(&ZSTR_VAL(replaced)[len], "&amp;", sizeof("&amp;") - 1);
1250
16.9k
        len += sizeof("&amp;") - 1;
1251
16.9k
      } else { /* no double encode */
1252
        /* check if entity is valid */
1253
5.60k
        size_t ent_len; /* not counting & or ; */
1254
        /* peek at next char */
1255
5.60k
        if (old[cursor] == '#') { /* numeric entity */
1256
55
          unsigned code_point;
1257
55
          int valid;
1258
55
          char *pos = (char*)&old[cursor+1];
1259
55
          valid = process_numeric_entity((const char **)&pos, &code_point);
1260
55
          if (valid == FAILURE)
1261
55
            goto encode_amp;
1262
0
          if (flags & ENT_HTML_SUBSTITUTE_DISALLOWED_CHARS) {
1263
0
            if (!numeric_entity_is_allowed(code_point, doctype))
1264
0
              goto encode_amp;
1265
0
          }
1266
0
          ent_len = pos - (char*)&old[cursor];
1267
5.55k
        } else { /* named entity */
1268
          /* check for vality of named entity */
1269
5.55k
          const char *start = (const char *) &old[cursor],
1270
5.55k
                 *next = start;
1271
5.55k
          unsigned   dummy1, dummy2;
1272
1273
5.55k
          if (process_named_entity_html(&next, &start, &ent_len) == FAILURE)
1274
5.24k
            goto encode_amp;
1275
308
          if (resolve_named_entity_html(start, ent_len, inv_map, &dummy1, &dummy2) == FAILURE) {
1276
301
            if (!(doctype == ENT_HTML_DOC_XHTML && ent_len == 4 && start[0] == 'a'
1277
301
                  && start[1] == 'p' && start[2] == 'o' && start[3] == 's')) {
1278
              /* uses html4 inv_map, which doesn't include apos;. This is a
1279
               * hack to support it */
1280
301
              goto encode_amp;
1281
301
            }
1282
301
          }
1283
308
        }
1284
        /* checks passed; copy entity to result */
1285
        /* entity size is unbounded, we may need more memory */
1286
        /* at this point maxlen - len >= 40 */
1287
7
        if (maxlen - len < ent_len + 2 /* & and ; */) {
1288
          /* ent_len < oldlen, which is certainly <= SIZE_MAX/2 */
1289
0
          replaced = zend_string_safe_realloc(replaced, maxlen, 1, ent_len + 128, 0);
1290
0
          maxlen += ent_len + 128;
1291
0
        }
1292
7
        ZSTR_VAL(replaced)[len++] = '&';
1293
7
        memcpy(&ZSTR_VAL(replaced)[len], &old[cursor], ent_len);
1294
7
        len += ent_len;
1295
7
        ZSTR_VAL(replaced)[len++] = ';';
1296
7
        cursor += ent_len + 1;
1297
7
      }
1298
16.9k
    }
1299
688k
  }
1300
1.16k
  ZSTR_VAL(replaced)[len] = '\0';
1301
1.16k
  ZSTR_LEN(replaced) = len;
1302
1303
1.16k
  return replaced;
1304
1.30k
}
1305
/* }}} */
1306
1307
/* {{{ php_html_entities */
1308
static void php_html_entities(INTERNAL_FUNCTION_PARAMETERS, int all)
1309
1.30k
{
1310
1.30k
  zend_string *str, *hint_charset = NULL;
1311
1.30k
  zend_long flags = ENT_QUOTES|ENT_SUBSTITUTE;
1312
1.30k
  zend_string *replaced;
1313
1.30k
  bool double_encode = 1;
1314
1315
3.92k
  ZEND_PARSE_PARAMETERS_START(1, 4)
1316
5.23k
    Z_PARAM_STR(str)
1317
1.30k
    Z_PARAM_OPTIONAL
1318
4.04k
    Z_PARAM_LONG(flags)
1319
3.19k
    Z_PARAM_STR_OR_NULL(hint_charset)
1320
1.64k
    Z_PARAM_BOOL(double_encode);
1321
1.30k
  ZEND_PARSE_PARAMETERS_END();
1322
1323
1.30k
  replaced = php_escape_html_entities_ex(
1324
1.30k
    (unsigned char*)ZSTR_VAL(str), ZSTR_LEN(str), all, (int) flags,
1325
1.30k
    hint_charset ? ZSTR_VAL(hint_charset) : NULL, double_encode, /* quiet */ 0);
1326
1.30k
  RETVAL_STR(replaced);
1327
1.30k
}
1328
/* }}} */
1329
1330
/* {{{ Convert special characters to HTML entities */
1331
PHP_FUNCTION(htmlspecialchars)
1332
654
{
1333
654
  php_html_entities(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0);
1334
654
}
1335
/* }}} */
1336
1337
/* {{{ Convert special HTML entities back to characters */
1338
PHP_FUNCTION(htmlspecialchars_decode)
1339
496
{
1340
496
  zend_string *str;
1341
496
  zend_long quote_style = ENT_QUOTES|ENT_SUBSTITUTE;
1342
496
  zend_string *replaced;
1343
1344
1.48k
  ZEND_PARSE_PARAMETERS_START(1, 2)
1345
1.98k
    Z_PARAM_STR(str)
1346
496
    Z_PARAM_OPTIONAL
1347
992
    Z_PARAM_LONG(quote_style)
1348
496
  ZEND_PARSE_PARAMETERS_END();
1349
1350
496
  replaced = php_unescape_html_entities(str, 0 /*!all*/, (int)quote_style, NULL);
1351
496
  RETURN_STR(replaced);
1352
496
}
1353
/* }}} */
1354
1355
/* {{{ Convert all HTML entities to their applicable characters */
1356
PHP_FUNCTION(html_entity_decode)
1357
0
{
1358
0
  zend_string *str, *hint_charset = NULL;
1359
0
  zend_long quote_style = ENT_QUOTES|ENT_SUBSTITUTE;
1360
0
  zend_string *replaced;
1361
1362
0
  ZEND_PARSE_PARAMETERS_START(1, 3)
1363
0
    Z_PARAM_STR(str)
1364
0
    Z_PARAM_OPTIONAL
1365
0
    Z_PARAM_LONG(quote_style)
1366
0
    Z_PARAM_STR_OR_NULL(hint_charset)
1367
0
  ZEND_PARSE_PARAMETERS_END();
1368
1369
0
  replaced = php_unescape_html_entities(
1370
0
    str, 1 /*all*/, (int)quote_style, hint_charset ? ZSTR_VAL(hint_charset) : NULL);
1371
0
  RETURN_STR(replaced);
1372
0
}
1373
/* }}} */
1374
1375
1376
/* {{{ Convert all applicable characters to HTML entities */
1377
PHP_FUNCTION(htmlentities)
1378
654
{
1379
654
  php_html_entities(INTERNAL_FUNCTION_PARAM_PASSTHRU, 1);
1380
654
}
1381
/* }}} */
1382
1383
/* {{{ write_s3row_data */
1384
static inline void write_s3row_data(
1385
  const entity_stage3_row *r,
1386
  unsigned orig_cp,
1387
  enum entity_charset charset,
1388
  zval *arr)
1389
0
{
1390
0
  char key[9] = ""; /* two unicode code points in UTF-8 */
1391
0
  char entity[LONGEST_ENTITY_LENGTH + 2] = {'&'};
1392
0
  size_t written_k1;
1393
1394
0
  written_k1 = write_octet_sequence((unsigned char*)key, charset, orig_cp);
1395
1396
0
  if (!r->ambiguous) {
1397
0
    size_t l = r->data.ent.entity_len;
1398
0
    memcpy(&entity[1], r->data.ent.entity, l);
1399
0
    entity[l + 1] = ';';
1400
0
    add_assoc_stringl_ex(arr, key, written_k1, entity, l + 2);
1401
0
  } else {
1402
0
    unsigned i,
1403
0
           num_entries;
1404
0
    const entity_multicodepoint_row *mcpr = r->data.multicodepoint_table;
1405
1406
0
    if (mcpr[0].leading_entry.default_entity != NULL) {
1407
0
      size_t l = mcpr[0].leading_entry.default_entity_len;
1408
0
      memcpy(&entity[1], mcpr[0].leading_entry.default_entity, l);
1409
0
      entity[l + 1] = ';';
1410
0
      add_assoc_stringl_ex(arr, key, written_k1, entity, l + 2);
1411
0
    }
1412
0
    num_entries = mcpr[0].leading_entry.size;
1413
0
    for (i = 1; i <= num_entries; i++) {
1414
0
      size_t   l,
1415
0
             written_k2;
1416
0
      unsigned uni_cp,
1417
0
           spe_cp;
1418
1419
0
      uni_cp = mcpr[i].normal_entry.second_cp;
1420
0
      l = mcpr[i].normal_entry.entity_len;
1421
1422
0
      if (!CHARSET_UNICODE_COMPAT(charset)) {
1423
0
        if (map_from_unicode(uni_cp, charset, &spe_cp) == FAILURE)
1424
0
          continue; /* non representable in this charset */
1425
0
      } else {
1426
0
        spe_cp = uni_cp;
1427
0
      }
1428
1429
0
      written_k2 = write_octet_sequence((unsigned char*)&key[written_k1], charset, spe_cp);
1430
0
      memcpy(&entity[1], mcpr[i].normal_entry.entity, l);
1431
0
      entity[l + 1] = ';';
1432
0
      add_assoc_stringl_ex(arr, key, written_k1 + written_k2, entity, l + 2);
1433
0
    }
1434
0
  }
1435
0
}
1436
/* }}} */
1437
1438
/* {{{ Returns the internal translation table used by htmlspecialchars and htmlentities */
1439
PHP_FUNCTION(get_html_translation_table)
1440
0
{
1441
0
  zend_long all = PHP_HTML_SPECIALCHARS,
1442
0
     flags = ENT_QUOTES|ENT_SUBSTITUTE;
1443
0
  int doctype;
1444
0
  entity_table_opt entity_table;
1445
0
  const enc_to_uni *to_uni_table = NULL;
1446
0
  char *charset_hint = NULL;
1447
0
  size_t charset_hint_len;
1448
0
  enum entity_charset charset;
1449
1450
  /* in this function we have to jump through some loops because we're
1451
   * getting the translated table from data structures that are optimized for
1452
   * random access, not traversal */
1453
1454
0
  ZEND_PARSE_PARAMETERS_START(0, 3)
1455
0
    Z_PARAM_OPTIONAL
1456
0
    Z_PARAM_LONG(all)
1457
0
    Z_PARAM_LONG(flags)
1458
0
    Z_PARAM_STRING(charset_hint, charset_hint_len)
1459
0
  ZEND_PARSE_PARAMETERS_END();
1460
1461
0
  charset = determine_charset(charset_hint, /* quiet */ 0);
1462
0
  doctype = flags & ENT_HTML_DOC_TYPE_MASK;
1463
0
  LIMIT_ALL(all, doctype, charset);
1464
1465
0
  array_init(return_value);
1466
1467
0
  entity_table = determine_entity_table((int)all, doctype);
1468
0
  if (all && !CHARSET_UNICODE_COMPAT(charset)) {
1469
0
    to_uni_table = enc_to_uni_index[charset];
1470
0
  }
1471
1472
0
  if (all) { /* PHP_HTML_ENTITIES (actually, any non-zero value for 1st param) */
1473
0
    const entity_stage1_row *ms_table = entity_table.ms_table;
1474
1475
0
    if (CHARSET_UNICODE_COMPAT(charset)) {
1476
0
      unsigned i, j, k,
1477
0
           max_i, max_j, max_k;
1478
      /* no mapping to unicode required */
1479
0
      if (CHARSET_SINGLE_BYTE(charset)) { /* ISO-8859-1 */
1480
0
        max_i = 1; max_j = 4; max_k = 64;
1481
0
      } else {
1482
0
        max_i = 0x1E; max_j = 64; max_k = 64;
1483
0
      }
1484
1485
0
      for (i = 0; i < max_i; i++) {
1486
0
        if (ms_table[i] == empty_stage2_table)
1487
0
          continue;
1488
0
        for (j = 0; j < max_j; j++) {
1489
0
          if (ms_table[i][j] == empty_stage3_table)
1490
0
            continue;
1491
0
          for (k = 0; k < max_k; k++) {
1492
0
            const entity_stage3_row *r = &ms_table[i][j][k];
1493
0
            unsigned code;
1494
1495
0
            if (r->data.ent.entity == NULL)
1496
0
              continue;
1497
1498
0
            code = ENT_CODE_POINT_FROM_STAGES(i, j, k);
1499
0
            if (((code == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1500
0
                (code == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1501
0
              continue;
1502
0
            write_s3row_data(r, code, charset, return_value);
1503
0
          }
1504
0
        }
1505
0
      }
1506
0
    } else {
1507
      /* we have to iterate through the set of code points for this
1508
       * encoding and map them to unicode code points */
1509
0
      unsigned i;
1510
0
      for (i = 0; i <= 0xFF; i++) {
1511
0
        const entity_stage3_row *r;
1512
0
        unsigned uni_cp;
1513
1514
        /* can be done before mapping, they're invariant */
1515
0
        if (((i == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1516
0
            (i == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1517
0
          continue;
1518
1519
0
        map_to_unicode(i, to_uni_table, &uni_cp);
1520
0
        r = &ms_table[ENT_STAGE1_INDEX(uni_cp)][ENT_STAGE2_INDEX(uni_cp)][ENT_STAGE3_INDEX(uni_cp)];
1521
0
        if (r->data.ent.entity == NULL)
1522
0
          continue;
1523
1524
0
        write_s3row_data(r, i, charset, return_value);
1525
0
      }
1526
0
    }
1527
0
  } else {
1528
    /* we could use sizeof(stage3_table_be_apos_00000) as well */
1529
0
    unsigned    j,
1530
0
            numelems = sizeof(stage3_table_be_noapos_00000) /
1531
0
              sizeof(*stage3_table_be_noapos_00000);
1532
1533
0
    for (j = 0; j < numelems; j++) {
1534
0
      const entity_stage3_row *r = &entity_table.table[j];
1535
0
      if (r->data.ent.entity == NULL)
1536
0
        continue;
1537
1538
0
      if (((j == '\'' && !(flags & ENT_HTML_QUOTE_SINGLE)) ||
1539
0
          (j == '"' && !(flags & ENT_HTML_QUOTE_DOUBLE))))
1540
0
        continue;
1541
1542
      /* charset is indifferent, used cs_8859_1 for efficiency */
1543
0
      write_s3row_data(r, j, cs_8859_1, return_value);
1544
0
    }
1545
0
  }
1546
0
}
1547
/* }}} */