bot-28/app/Support/RichTextContent.php

<?php

namespace App\Support;

/** Table-capable HTML fragment for public editorial content. */
final class RichTextContent
{
    private const TAGS = ['p', 'br', 'div', 'span', 'strong', 'b', 'em', 'i', 'u', 's', 'strike', 'del',
        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'blockquote', 'pre', 'code', 'hr', 'sup', 'sub',
        'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td', 'caption', 'colgroup', 'col', 'a'];
    private const DROP = ['script', 'style', 'iframe', 'object', 'embed', 'svg', 'math', 'template',
        'form', 'input', 'button', 'textarea', 'select', 'link', 'meta', 'base', 'noscript'];
    private const STYLES = ['color', 'background-color', 'font-size', 'font-weight', 'font-style', 'font-family',
        'text-align', 'text-decoration', 'line-height', 'vertical-align', 'white-space',
        'width', 'height', 'min-width', 'max-width', 'table-layout', 'border', 'border-collapse', 'border-spacing',
        'border-width', 'border-style', 'border-color', 'border-top', 'border-right', 'border-bottom', 'border-left',
        'padding', 'padding-top', 'padding-right', 'padding-bottom', 'padding-left',
        'margin', 'margin-top', 'margin-right', 'margin-bottom', 'margin-left'];

    public static function clean(string $html): string
    {
        if (trim($html) === '') return '';
        $doc = new \DOMDocument('1.0', 'UTF-8');
        $previous = libxml_use_internal_errors(true);
        try {
            $doc->loadHTML('<?xml encoding="UTF-8" ?><!DOCTYPE html><html><body>' . $html . '</body></html>', LIBXML_NONET);
            $body = $doc->getElementsByTagName('body')->item(0);
            if (!$body) return '';
            self::children($body);
            $output = '';
            foreach ($body->childNodes as $node) $output .= $doc->saveHTML($node);
            return trim($output);
        } finally { libxml_clear_errors(); libxml_use_internal_errors($previous); }
    }

    private static function children(\DOMNode $parent): void
    {
        foreach (iterator_to_array($parent->childNodes) as $node) {
            if ($node instanceof \DOMComment || $node instanceof \DOMProcessingInstruction) { $parent->removeChild($node); continue; }
            if (!$node instanceof \DOMElement) continue;
            $tag = strtolower($node->tagName);
            if (in_array($tag, self::DROP, true)) { $parent->removeChild($node); continue; }
            self::children($node);
            if (!in_array($tag, self::TAGS, true)) {
                while ($node->firstChild) $parent->insertBefore($node->firstChild, $node);
                $parent->removeChild($node);
                continue;
            }
            foreach (iterator_to_array($node->attributes) as $attribute) {
                $name = strtolower($attribute->name); $value = $attribute->value;
                $allowed = in_array($name, ['title', 'dir'], true);
                if ($name === 'style') { $value = self::style($value); $allowed = $value !== ''; }
                if (in_array($name, ['colspan', 'rowspan'], true)) $allowed = in_array($tag, ['td', 'th'], true) && (bool)preg_match('/^[1-9]\d{0,2}$/D', $value);
                if (in_array($name, ['width', 'height', 'border', 'cellpadding', 'cellspacing', 'span'], true)) $allowed = (bool)preg_match('/^\d{1,4}%?$/D', $value);
                if ($name === 'align') $allowed = in_array($value, ['left', 'right', 'center', 'justify'], true);
                if ($name === 'valign') $allowed = in_array($value, ['top', 'middle', 'bottom', 'baseline'], true);
                if ($name === 'scope') $allowed = $tag === 'th' && in_array($value, ['row', 'col', 'rowgroup', 'colgroup'], true);
                if ($name === 'href') $allowed = $tag === 'a' && self::link($value);
                if ($name === 'target') $allowed = $tag === 'a' && in_array($value, ['_self', '_blank'], true);
                if (!$allowed) $node->removeAttributeNode($attribute);
                else $node->setAttribute($name, $value);
            }
            if ($tag === 'a' && $node->getAttribute('target') === '_blank') $node->setAttribute('rel', 'noopener noreferrer');
        }
    }

    private static function style(string $style): string
    {
        $result = [];
        foreach (explode(';', $style) as $declaration) {
            $parts = explode(':', $declaration, 2);
            if (count($parts) !== 2) continue;
            $property = strtolower(trim($parts[0])); $value = trim($parts[1]);
            if (!in_array($property, self::STYLES, true) || !preg_match('/^[#a-zA-Z0-9\s.,()%+\-\x27"]+$/D', $value)
                || preg_match('/(?:url|expression|image-set|attr)\s*\(/i', $value)) continue;
            $result[] = $property . ': ' . $value;
        }
        return implode('; ', $result);
    }

    private static function link(string $value): bool
    {
        if ($value === '' || preg_match('/[\x00-\x20\x7f\\\\]/', $value)) return false;
        if (str_starts_with($value, '#') || (str_starts_with($value, '/') && !str_starts_with($value, '//'))) return true;
        $parts = parse_url($value);
        return filter_var($value, FILTER_VALIDATE_URL) && $parts && in_array(strtolower($parts['scheme'] ?? ''), ['http', 'https'], true)
            && !isset($parts['user']) && !isset($parts['pass']);
    }
}