webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-08-09 10:22:51 +03:00
Code Activity

HTML: Aligned and standardised DOMDocument usage

Browse Source 
Adds a thin wrapper for DOMDocument to simplify and align usage within
all areas of BookStack.
Also means we move away from old depreacted mb_convert_encoding usage.

Closes #4638
This commit is contained in:
Dan Brown
2023-11-14 15:46:32 +00:00
parent 3a6f50e668
commit db7b11fe93
8 changed files with 214 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
app/Util/HtmlNonceApplicator.php
View File

@@ -2,14 +2,12 @@
namespace BookStack\Util;
use DOMDocument;
use DOMElement;
use DOMNodeList;
use DOMXPath;
class HtmlNonceApplicator
{
protected static $placeholder = '[CSP_NONCE_VALUE]';
protected static string $placeholder = '[CSP_NONCE_VALUE]';
/**
* Prepare the given HTML content with nonce attributes including a placeholder
@@ -21,28 +19,20 @@ class HtmlNonceApplicator
return $html;
}
$html = '<?xml encoding="utf-8" ?><body>' . $html . '</body>';
libxml_use_internal_errors(true);
$doc = new DOMDocument();
$doc->loadHTML($html, LIBXML_SCHEMA_CREATE);
$xPath = new DOMXPath($doc);
// LIBXML_SCHEMA_CREATE was found to be required here otherwise
// the PHP DOMDocument handling will attempt to format/close
// HTML tags within scripts and therefore change JS content.
$doc = new HtmlDocument($html, LIBXML_SCHEMA_CREATE);
// Apply to scripts
$scriptElems = $xPath->query('//script');
$scriptElems = $doc->queryXPath('//script');
static::addNonceAttributes($scriptElems, static::$placeholder);
// Apply to styles
$styleElems = $xPath->query('//style');
$styleElems = $doc->queryXPath('//style');
static::addNonceAttributes($styleElems, static::$placeholder);
$returnHtml = '';
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
foreach ($topElems as $child) {
$content = $doc->saveHTML($child);
$returnHtml .= $content;
}
return $returnHtml;
return $doc->getBodyInnerHtml();
}
/**