diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php index 4009782..d55b91c 100644 --- a/core/lib/Drupal/Component/Utility/Xss.php +++ b/core/lib/Drupal/Component/Utility/Xss.php @@ -178,89 +178,89 @@ protected static function split($matches, $store = FALSE) { /** * Processes a string of HTML attributes. * - * @param string $attr + * @param string $attributes * The html attribute to process. * * @return string * Cleaned up version of the HTML attributes. */ - protected static function attributes($attr) { - $attrarr = array(); + protected static function attributes($attributes) { + $attributes_array = array(); $mode = 0; - $attrname = ''; + $attribute_name = ''; - while (strlen($attr) != 0) { + while (strlen($attributes) != 0) { // Was the last operation successful? $working = 0; switch ($mode) { case 0: // Attribute name, href for instance. - if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) { - $attrname = strtolower($match[1]); - $skip = ($attrname == 'style' || substr($attrname, 0, 2) == 'on'); + if (preg_match('/^([-a-zA-Z]+)/', $attributes, $match)) { + $attribute_name = strtolower($match[1]); + $skip = ($attribute_name == 'style' || substr($attribute_name, 0, 2) == 'on'); $working = $mode = 1; - $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); + $attributes = preg_replace('/^[-a-zA-Z]+/', '', $attributes); } break; case 1: // Equals sign or valueless ("selected"). - if (preg_match('/^\s*=\s*/', $attr)) { + if (preg_match('/^\s*=\s*/', $attributes)) { $working = 1; $mode = 2; - $attr = preg_replace('/^\s*=\s*/', '', $attr); + $attributes = preg_replace('/^\s*=\s*/', '', $attributes); break; } - if (preg_match('/^\s+/', $attr)) { + if (preg_match('/^\s+/', $attributes)) { $working = 1; $mode = 0; if (!$skip) { - $attrarr[] = $attrname; + $attributes_array[] = $attribute_name; } - $attr = preg_replace('/^\s+/', '', $attr); + $attributes = preg_replace('/^\s+/', '', $attributes); } break; case 2: // Attribute value, a URL after href= for instance. - if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) { + if (preg_match('/^"([^"]*)"(\s+|$)/', $attributes, $match)) { $thisval = UrlValidator::filterBadProtocol($match[1]); if (!$skip) { - $attrarr[] = "$attrname=\"$thisval\""; + $attributes_array[] = "$attribute_name=\"$thisval\""; } $working = 1; $mode = 0; - $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); + $attributes = preg_replace('/^"[^"]*"(\s+|$)/', '', $attributes); break; } - if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) { + if (preg_match("/^'([^']*)'(\s+|$)/", $attributes, $match)) { $thisval = UrlValidator::filterBadProtocol($match[1]); if (!$skip) { - $attrarr[] = "$attrname='$thisval'"; + $attributes_array[] = "$attribute_name='$thisval'"; } $working = 1; $mode = 0; - $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); + $attributes = preg_replace("/^'[^']*'(\s+|$)/", '', $attributes); break; } - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) { + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attributes, $match)) { $thisval = UrlValidator::filterBadProtocol($match[1]); if (!$skip) { - $attrarr[] = "$attrname=\"$thisval\""; + $attributes_array[] = "$attribute_name=\"$thisval\""; } $working = 1; $mode = 0; - $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); + $attributes = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attributes); } break; } if ($working == 0) { // Not well formed; remove and try again. - $attr = preg_replace('/ + $attributes = preg_replace('/ ^ ( "[^"]*("|$) # - a string that starts with a double quote, up until the next double quote or the end of the string @@ -270,16 +270,16 @@ protected static function attributes($attr) { \S # - a non-whitespace character )* # any number of the above three \s* # any number of whitespaces - /x', '', $attr); + /x', '', $attributes); $mode = 0; } } // The attribute list ends with a valueless attribute like "selected". if ($mode == 1 && !$skip) { - $attrarr[] = $attrname; + $attributes_array[] = $attribute_name; } - return $attrarr; + return $attributes_array; } }