diff --git a/core/composer.lock b/core/composer.lock index fe5dc0a..80e6fd3 100644 --- a/core/composer.lock +++ b/core/composer.lock @@ -729,6 +729,71 @@ "time": "2014-10-12 19:18:40" }, { + "name": "masterminds/html5", + "version": "dev-master", + "source": { + "type": "git", + "url": "https://github.com/Masterminds/html5-php.git", + "reference": "398ebb68c9395a67858d230d0610aa3676bebdc7" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/Masterminds/html5-php/zipball/398ebb68c9395a67858d230d0610aa3676bebdc7", + "reference": "398ebb68c9395a67858d230d0610aa3676bebdc7", + "shasum": "" + }, + "require": { + "ext-libxml": "*", + "php": ">=5.3.0" + }, + "require-dev": { + "phpunit/phpunit": "4.*", + "sami/sami": "~2.0", + "satooshi/php-coveralls": "0.6.*" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "2.0-dev" + } + }, + "autoload": { + "psr-4": { + "Masterminds\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Matt Butcher", + "email": "technosophos@gmail.com" + }, + { + "name": "Asmir Mustafic", + "email": "goetas@gmail.com" + }, + { + "name": "Matt Farina", + "email": "matt@mattfarina.com" + } + ], + "description": "An HTML5 parser and serializer.", + "homepage": "http://masterminds.github.io/html5-php", + "keywords": [ + "HTML5", + "dom", + "html", + "parser", + "querypath", + "serializer", + "xml" + ], + "time": "2014-12-02 02:51:14" + }, + { "name": "mikey179/vfsStream", "version": "v1.4.0", "source": { @@ -2594,7 +2659,8 @@ "minimum-stability": "stable", "stability-flags": { "doctrine/common": 20, - "phpunit/phpunit-mock-objects": 20 + "phpunit/phpunit-mock-objects": 20, + "masterminds/html5": 20 }, "prefer-stable": false, "prefer-lowest": false, diff --git a/core/lib/Drupal/Component/Utility/Html.php b/core/lib/Drupal/Component/Utility/Html.php index 4dd9d27..e492bf4 100644 --- a/core/lib/Drupal/Component/Utility/Html.php +++ b/core/lib/Drupal/Component/Utility/Html.php @@ -7,6 +7,8 @@ namespace Drupal\Component\Utility; +use Masterminds\HTML5; + /** * Provides DOMDocument helpers for parsing and serializing HTML strings. * @@ -272,9 +274,9 @@ public static function normalize($html) { */ public static function load($html) { $document = << - - + + + !html EOD; @@ -283,9 +285,8 @@ public static function load($html) { // newlines before injecting the actual HTML body to process. $document = strtr($document, array("\n" => '', '!html' => $html)); - $dom = new \DOMDocument(); - // Ignore warnings during HTML soup loading. - @$dom->loadHTML($document); + $html5 = new HTML5(); + $dom = $html5->loadHTML($document); return $dom; } @@ -314,8 +315,9 @@ public static function serialize(\DOMDocument $document) { foreach ($body_node->getElementsByTagName('style') as $node) { static::escapeCdataElement($node, '/*', '*/'); } + $html5 = new HTML5(); foreach ($body_node->childNodes as $node) { - $html .= $document->saveXML($node); + $html .= $html5->saveHTML($node); } return $html; } diff --git a/core/lib/Drupal/Component/XpathHelper/Lexer.php b/core/lib/Drupal/Component/XpathHelper/Lexer.php new file mode 100644 index 0000000..8876aac --- /dev/null +++ b/core/lib/Drupal/Component/XpathHelper/Lexer.php @@ -0,0 +1,240 @@ + TRUE, + ']' => TRUE, + '=' => TRUE, + '(' => TRUE, + ')' => TRUE, + '.' => TRUE, + '<' => TRUE, + '>' => TRUE, + '*' => TRUE, + '+' => TRUE, + // Used in element names and functions. It's easier to just make a special + // case in the parser than to have the minus be a word boundary. + // '-' => TRUE, + '!' => TRUE, + '|' => TRUE, + ',' => TRUE, + ' ' => TRUE, + '"' => TRUE, + "'" => TRUE, + ':' => TRUE, + '::' => TRUE, + '/' => TRUE, + '//' => TRUE, + '@' => TRUE, + ); + + /** + * Lexes an XPath expression. + * + * @param string $expression + * An XPath expression. + * + * @return array + * A list of tokens from the XPath expression. + */ + public function lex($expression) { + $this->expression = $expression; + $this->length = strlen($expression); + $this->cursor = 0; + + $tokens = array(); + while (TRUE) { + $token = $this->readToken(); + if ($token === '') { + break; + } + $tokens[] = $token; + } + + return $tokens; + } + + /** + * Determines if a token is boundary for a word. + * + * @param string $token + * The token. + * + * @return bool + * Returns true if the token is a word boundary, and false if not. + */ + public static function isWordBoundary($token) { + return isset(static::$wordBoundaries[$token]); + } + + /** + * Reads the next token from the expression. + * + * @return string + * The next token, or an empty string on completion. + */ + protected function readToken() { + while ($this->cursor < $this->length) { + $char = $this->expression[$this->cursor]; + + if ($char === '/') { + return $this->readOneOrTwoSlashes($char); + } + + if ($char === '"' || $char === "'") { + return $this->consumeQuotes($char); + } + + if ($char === ':') { + return $this->readNamespaceOrAxis(); + } + + if ($char === '@') { + return $this->readAttribute(); + } + + if ($this->isWordBoundary($char)) { + $this->cursor++; + return $char; + } + + return $this->readWord(); + } + + return ''; + } + + /** + * Reads the next word from the expression. + * + * A word is considered anything that isn't a word boundary. + * + * @return string + * The next word. + */ + protected function readWord() { + $word = ''; + + while ($this->cursor < $this->length) { + $char = $this->expression[$this->cursor]; + + // Found a boundary. + if ($this->isWordBoundary($char)) { + break; + } + + $word .= $char; + $this->cursor++; + } + + return $word; + } + + /** + * Reads a quoted string from an XPath expression. + * + * @param string $start_quote + * The character that started the quoted string. + * + * @return string + * The quoted string. + */ + protected function consumeQuotes($start_quote) { + $output = $start_quote; + do { + $next_char = $this->readNextChar(); + $output .= $next_char; + } while ($next_char !== '' && $next_char !== $start_quote); + + $this->cursor++; + return $output; + } + + /** + * Reads a namespace token or an axis token. + * + * @return string + * Either a namespace separator or an axis separator. One or two colons. + */ + protected function readNamespaceOrAxis() { + if ($this->readNextChar() === ':') { + $this->cursor++; + return '::'; + } + return ':'; + } + + /** + * Reads on or two slashes. + * + * @return string + * Returns / or //. + */ + protected function readOneOrTwoSlashes() { + if ($this->readNextChar() === '/') { + $this->cursor++; + return '//'; + } + return '/'; + } + + /** + * Reads a shorthand attribute. + * + * @return string + * An attribute string starting with @. + */ + protected function readAttribute() { + $this->cursor++; + return '@' . $this->readWord(); + } + + /** + * Returns the next character advancing the cursor. + * + * @return string + * The next character. + */ + protected function readNextChar() { + $this->cursor++; + return isset($this->expression[$this->cursor]) ? $this->expression[$this->cursor] : ''; + } + +} diff --git a/core/lib/Drupal/Component/XpathHelper/Namespacer.php b/core/lib/Drupal/Component/XpathHelper/Namespacer.php new file mode 100644 index 0000000..16be994 --- /dev/null +++ b/core/lib/Drupal/Component/XpathHelper/Namespacer.php @@ -0,0 +1,356 @@ + TRUE, + 'and' => TRUE, + 'div' => TRUE, + 'mod' => TRUE, + ); + + /** + * Tokens that come before elements. + * + * @var array + */ + protected static $precedesElement = array( + '/' => TRUE, + '//' => TRUE, + '::' => TRUE, + '(' => TRUE, + ',' => TRUE, + '[' => TRUE, + ); + + /** + * Prefixes an XPath expression. + * + * Converts an expression from //div/a to //x:div/x:a. + * + * @param string $xpath + * The XPath expression to prefix. + * @param string $prefix + * (optional) The prefix to use. Defaults to "x". + * + * @return string + * The prefixed XPath expression. + */ + public static function prefix($xpath, $prefix = 'x') { + if (!isset(static::$cache[$prefix][$xpath])) { + $parser = new static($xpath, $prefix, new Lexer()); + static::$cache[$prefix][$xpath] = $parser->parse(); + } + + return static::$cache[$prefix][$xpath]; + } + + /** + * Localizes an XPath expression. + * + * Converts an expression from //div/a to + * //*[local-name() = "div"]/*[local-name() = "a"]. + * + * @param string $xpath + * The XPath expression to prefix. + * + * @return string + * The localized XPath expression. + */ + public static function localize($xpath) { + if (!isset(static::$cache[NULL][$xpath])) { + $parser = new static($xpath, NULL, new Lexer()); + static::$cache[NULL][$xpath] = $parser->parse(); + } + + return static::$cache[NULL][$xpath]; + } + + /** + * Constructs a Namespacer object. + * + * @param string $expression + * The XPath expression. + * @param string $prefix + * The prefix to use. + * @param \Drupal\Component\XpathHelper\Lexer $lexer + * The lexer that will produce tokens. + */ + public function __construct($expression, $prefix, Lexer $lexer) { + $this->prefix = $prefix; + $this->tokens = $lexer->lex($expression); + } + + /** + * Parses an XPath expression. + * + * @return string + * The rewritten XPath expression. + */ + public function parse() { + $output = ''; + + $token_count = count($this->tokens); + + for ($this->cursor; $this->cursor < $token_count; $this->cursor++) { + $token = $this->tokens[$this->cursor]; + + // A token that should be copied directly to the output. + if ($this->shouldCopy($token)) { + $output .= $token; + } + // A namespaced element. + elseif ($element = $this->getNamespacedElement($token)) { + $output .= $element; + } + // Namespace the element. + else { + $output .= $this->rewrite($token); + } + } + + return $output; + } + + /** + * Rewrites the token. + * + * Either in the form prefix:element or *[local-name() = "element"] + * + * @param string $token + * The element to rewrite. + * + * @return string + * The rewritten string. + */ + protected function rewrite($element) { + if ($this->prefix) { + return $this->prefix . ':' . $element; + } + return '*[local-name() = "' . $element . '"]'; + } + + /** + * Determines if a token should be copied as-is to the output. + * + * @param string $token + * The token. + * + * @return bool + * Returns true if the token should be copied, and false if not. + */ + protected function shouldCopy($token) { + if (Lexer::isWordBoundary($token)) { + return TRUE; + } + // Attribute or quoted string. + elseif ($token[0] === '@' || $token[0] === '"' || $token[0] === "'") { + return TRUE; + } + elseif (is_numeric($token) || is_numeric($token[0])) { + return TRUE; + } + elseif ($this->isFunctionCall()) { + return TRUE; + } + elseif ($this->isOperator($token)) { + return TRUE; + } + elseif ($this->isAxis()) { + return TRUE; + } + elseif ($this->wasAttributeAxis()) { + return TRUE; + } + // Handles the edge case where subtraction is written like 2 - 1. + elseif ($token === '-') { + return TRUE; + } + + return FALSE; + } + + /** + * Returns the namespaced element. + * + * @param string $token + * The token. + * + * @return string|bool + * The namespaced element, or false if it doesn't exist. + */ + protected function getNamespacedElement($token) { + if ($this->peek(1) !== ':') { + return FALSE; + } + + // Build the namespaced element, prefix:element. + $token .= ':' . $this->peek(2); + $this->cursor += 2; + return $token; + } + + /** + * Determines if the current token is a function call. + * + * @param string $token + * The token. + * + * @return bool + * Returns true if the token is a function call and false if not. + */ + protected function isFunctionCall() { + // Spaces before the opening parens of a function call are valid. + // Ex: //div[contains (@id, "thing")] + return $this->nextNonSpace() === '('; + } + + /** + * Checks if a token is an operator, one of div, or, and, mod. + * + * @param string $token + * The token to check. + * + * @return bool + * Returns true if the token is an operator, and false if not. + */ + protected function isOperator($token) { + if (!isset(static::$operators[$token])) { + return FALSE; + } + + $prev = $this->prevNonSpace(); + return $prev && !isset(static::$precedesElement[$prev]); + } + + /** + * Determines whether this token is an axis. + * + * descendant-or-self, attribute, etc. + * + * @return bool + * True if the token is an axis, false if not. + */ + protected function isAxis() { + return $this->nextNonSpace() === '::'; + } + + /** + * Determines whether the preceding token was an attribute axis. + * + * attribute:: + * + * @return bool + * True if the preceding token was an attribute axis, false if not. + */ + protected function wasAttributeAxis() { + return $this->prevNonSpace() === '::' && $this->prevNonSpace(2) === 'attribute'; + } + + /** + * Returns the next non-space token. + * + * @param int $delta + * (optional) The delta of the next non-space character. Defaults to 1. + * + * @return string + * The nth next non-space character. + */ + protected function nextNonSpace($delta = 1) { + $n = 1; + + for ($i = 0; $i < $delta; $i++) { + do { + $next = $this->peek($n); + $n++; + } while ($next === ' '); + } + + return $next; + } + + /** + * Returns the previous non-space token. + * + * @param int $delta + * (optional) The delta of the previous non-space character. Defaults to 1. + * + * @return string + * The nth previous non-space character. + */ + protected function prevNonSpace($delta = 1) { + $n = -1; + + for ($i = 0; $i < $delta; $i++) { + do { + $prev = $this->peek($n); + $n--; + } while ($prev === ' '); + } + + return $prev; + } + + /** + * Returns a token from an offset of the current position. + * + * @param int $offset + * The offset from the current position. + * + * @return string + * Returns the token at the given offset. + */ + protected function peek($offset) { + return isset($this->tokens[$this->cursor + $offset]) ? $this->tokens[$this->cursor + $offset] : ''; + } + +} diff --git a/core/lib/Drupal/Core/Entity/Entity.php b/core/lib/Drupal/Core/Entity/Entity.php index c76dc40..4ef2926 100644 --- a/core/lib/Drupal/Core/Entity/Entity.php +++ b/core/lib/Drupal/Core/Entity/Entity.php @@ -147,7 +147,7 @@ public function label() { $label = call_user_func($label_callback, $this); } elseif (($label_key = $entity_type->getKey('label')) && isset($this->{$label_key})) { - $label = $this->{$label_key}; + $label = (string) $this->{$label_key}; } return $label; } diff --git a/core/modules/aggregator/src/Tests/AggregatorRenderingTest.php b/core/modules/aggregator/src/Tests/AggregatorRenderingTest.php index efb3d2f..2e0e422 100644 --- a/core/modules/aggregator/src/Tests/AggregatorRenderingTest.php +++ b/core/modules/aggregator/src/Tests/AggregatorRenderingTest.php @@ -123,7 +123,7 @@ public function testFeedPage() { $outline = $this->xpath('//outline[1]'); $this->assertEqual($outline[0]['type'], 'rss', 'The correct type attribute is used for rss OPML.'); $this->assertEqual($outline[0]['text'], $feed->label(), 'The correct text attribute is used for rss OPML.'); - $this->assertEqual($outline[0]['xmlurl'], $feed->getUrl(), 'The correct xmlUrl attribute is used for rss OPML.'); + $this->assertEqual($outline[0]['xmlUrl'], $feed->getUrl(), 'The correct xmlUrl attribute is used for rss OPML.'); // Check for the presence of a pager. $this->drupalGet('aggregator/sources/' . $feed->id()); diff --git a/core/modules/comment/src/Tests/Views/RowRssTest.php b/core/modules/comment/src/Tests/Views/RowRssTest.php index 89b9c1b..4536652 100644 --- a/core/modules/comment/src/Tests/Views/RowRssTest.php +++ b/core/modules/comment/src/Tests/Views/RowRssTest.php @@ -31,7 +31,7 @@ public function testRssRow() { $result = $this->xpath('//item'); $this->assertEqual(count($result), 1, 'Just one comment was found in the rss output.'); - $this->assertEqual($result[0]->pubdate, gmdate('r', $this->comment->getCreatedTime()), 'The right pubDate appears in the rss output.'); + $this->assertEqual($result[0]->pubDate, gmdate('r', $this->comment->getCreatedTime()), 'The right pubDate appears in the rss output.'); } } diff --git a/core/modules/config/src/Tests/ConfigEntityListTest.php b/core/modules/config/src/Tests/ConfigEntityListTest.php index c578ff2..8f90ff9 100644 --- a/core/modules/config/src/Tests/ConfigEntityListTest.php +++ b/core/modules/config/src/Tests/ConfigEntityListTest.php @@ -174,7 +174,7 @@ function testListUI() { // operations list. $this->assertIdentical((string) $elements[0], 'Default'); $this->assertIdentical((string) $elements[1], 'dotted.default'); - $this->assertTrue($elements[2]->children()->xpath('//ul'), 'Operations list found.'); + $this->assertTrue($elements[2]->children()->xpath($this->localizeXpath('//ul')), 'Operations list found.'); // Add a new entity using the operations link. $this->assertLink('Add test configuration'); diff --git a/core/modules/editor/editor.admin.inc b/core/modules/editor/editor.admin.inc index 83bc2cf..67ebedf 100644 --- a/core/modules/editor/editor.admin.inc +++ b/core/modules/editor/editor.admin.inc @@ -92,8 +92,8 @@ function editor_image_upload_settings_form(Editor $editor) { $form['max_dimensions'] = array( '#type' => 'item', '#title' => t('Maximum dimensions'), - '#field_prefix' => '
', - '#field_suffix' => '
', + // '#field_prefix' => '
', + // '#field_suffix' => '
', '#description' => t('Images larger than these dimensions will be scaled down.'), '#states' => $show_if_image_uploads_enabled, ); diff --git a/core/modules/editor/src/Tests/QuickEditIntegrationLoadingTest.php b/core/modules/editor/src/Tests/QuickEditIntegrationLoadingTest.php index c4b81ea..6e7316d 100644 --- a/core/modules/editor/src/Tests/QuickEditIntegrationLoadingTest.php +++ b/core/modules/editor/src/Tests/QuickEditIntegrationLoadingTest.php @@ -85,7 +85,10 @@ public function testUsersWithoutPermission() { $this->drupalGet('node/1'); // Ensure the text is transformed. - $this->assertRaw('

Do you also love Drupal?

Druplicon
'); + $this->assertRaw('

Do you also love Drupal?

+ +
Druplicon
+
'); // Retrieving the untransformed text should result in an empty 403 response. $response = $this->drupalPost('editor/' . 'node/1/body/en/full', 'application/vnd.drupal-ajax', array()); @@ -103,7 +106,10 @@ public function testUserWithPermission() { $this->drupalGet('node/1'); // Ensure the text is transformed. - $this->assertRaw('

Do you also love Drupal?

Druplicon
'); + $this->assertRaw('

Do you also love Drupal?

+ +
Druplicon
+
'); $response = $this->drupalPost('editor/' . 'node/1/body/en/full', 'application/vnd.drupal-ajax', array()); $this->assertResponse(200); diff --git a/core/modules/filter/src/Tests/FilterUnitTest.php b/core/modules/filter/src/Tests/FilterUnitTest.php index 8d06de7..96b7b79 100644 --- a/core/modules/filter/src/Tests/FilterUnitTest.php +++ b/core/modules/filter/src/Tests/FilterUnitTest.php @@ -57,40 +57,40 @@ function testAlignFilter() { // Data-align attribute: all 3 allowed values. $input = ''; - $expected = ''; + $expected = ''; $this->assertIdentical($expected, $test($input)->getProcessedText()); - $input = ''; - $expected = ''; + $input = ''; + $expected = ''; $this->assertIdentical($expected, $test($input)->getProcessedText()); $input = ''; - $expected = ''; + $expected = ''; $this->assertIdentical($expected, $test($input)->getProcessedText()); // Data-align attribute: a disallowed value. $input = ''; - $expected = ''; + $expected = ''; $this->assertIdentical($expected, $test($input)->getProcessedText()); // Empty data-align attribute. $input = ''; - $expected = ''; + $expected = ''; $this->assertIdentical($expected, $test($input)->getProcessedText()); // Ensure the filter also works with uncommon yet valid attribute quoting. $input = ''; - $expected = ''; + $expected = ''; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); // Security test: attempt to inject an additional class. $input = ''; - $expected = ''; + $expected = ''; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); // Security test: attempt an XSS. $input = ''; - $expected = ''; + $expected = ''; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); } @@ -118,26 +118,35 @@ function testCaptionFilter() { // Data-caption attribute. $input = ''; - $expected = '
Loquacious llama!
'; + $expected = '
+ +
Loquacious llama!
+
'; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); $this->assertIdentical($attached_library, $output->getAssets()); // Empty data-caption attribute. $input = ''; - $expected = ''; + $expected = ''; $this->assertIdentical($expected, $test($input)->getProcessedText()); // HTML entities in the caption. $input = ''; - $expected = '
“Loquacious llama!”
'; + $expected = '
+ +
“Loquacious llama!”
+
'; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); $this->assertIdentical($attached_library, $output->getAssets()); // HTML encoded as HTML entities in data-caption attribute. $input = ''; - $expected = '
Loquacious llama!
'; + $expected = '
+ +
Loquacious llama!
+
'; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); $this->assertIdentical($attached_library, $output->getAssets()); @@ -146,33 +155,48 @@ function testCaptionFilter() { // not allowed by the HTML spec, but may happen when people manually write // HTML, so we explicitly support it. $input = ''; - $expected = '
Loquacious llama!
'; + $expected = '
+ +
Loquacious llama!
+
'; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); $this->assertIdentical($attached_library, $output->getAssets()); // Security test: attempt an XSS. $input = ''; - $expected = '
alert(\'Loquacious llama!\')
'; + $expected = '
+ +
alert(\'Loquacious llama!\')
+
'; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); $this->assertIdentical($attached_library, $output->getAssets()); // Ensure the filter also works with uncommon yet valid attribute quoting. $input = ''; - $expected = '
Loquacious llama!
'; + $expected = '
+ +
Loquacious llama!
+
'; $output = $test($input); $this->assertIdentical($expected, $output->getProcessedText()); $this->assertIdentical($attached_library, $output->getAssets()); // Finally, ensure that this also works on any other tag. $input = '