diff --git a/src/Behavior.php b/src/Behavior.php index 15157a2..c9573b3 100644 --- a/src/Behavior.php +++ b/src/Behavior.php @@ -16,6 +16,7 @@ use LogicException; use TYPO3\HtmlSanitizer\Behavior\Tag; +use TYPO3\HtmlSanitizer\Builder\Preset\PresetInterface; /** * Declares behavior used by node visitors @@ -65,6 +66,11 @@ class Behavior */ protected $tags = []; + public function withPreset(PresetInterface $preset, int $flags = 0): self + { + return $preset->applyTo($this, $flags); + } + public function withFlags(int $flags): self { if ($flags === $this->flags) { diff --git a/src/Builder/Preset/IframePreset.php b/src/Builder/Preset/IframePreset.php new file mode 100644 index 0000000..c39089e --- /dev/null +++ b/src/Builder/Preset/IframePreset.php @@ -0,0 +1,53 @@ +` element. + */ +class IframePreset implements PresetInterface +{ + public function applyTo(Behavior $behavior, int $flags = 0): Behavior + { + return $behavior->withTags( + (new Behavior\Tag('iframe'))->addAttrs( + (new Behavior\Attr('id')), + // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-allow + (new Behavior\Attr('allow'))->withValues( + new Behavior\MultiTokenAttrValue(' ', 'fullscreen') + ), + // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox + (new Behavior\Attr('sandbox', Behavior\Attr::MANDATORY))->withValues( + new Behavior\EmptyAttrValue(), + new Behavior\MultiTokenAttrValue( + ' ', + 'allow-downloads', + 'allow-modals', + 'allow-orientation-lock', + 'allow-pointer-lock', + 'allow-popups', + 'allow-scripts' + ) + ), + (new Behavior\Attr('src'))->withValues( + ...(new Behavior\Attr\UriAttrValueBuilder()) + ->allowSchemes('http', 'https')->getValues() + ) + ) + ); + } +} diff --git a/src/Builder/Preset/PresetInterface.php b/src/Builder/Preset/PresetInterface.php new file mode 100644 index 0000000..c67f5e9 --- /dev/null +++ b/src/Builder/Preset/PresetInterface.php @@ -0,0 +1,30 @@ +withFlags(Behavior::ENCODE_INVALID_TAG | Behavior::REMOVE_UNEXPECTED_CHILDREN) ->withName('scenario-test') - ->withTags( - (new Behavior\Tag('iframe'))->addAttrs( - (new Behavior\Attr('id')), - // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-allow - (new Behavior\Attr('allow'))->withValues( - new Behavior\MultiTokenAttrValue(' ', 'fullscreen') - ), - // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox - (new Behavior\Attr('sandbox', Behavior\Attr::MANDATORY))->withValues( - new Behavior\EmptyAttrValue(), - new Behavior\MultiTokenAttrValue( - ' ', - 'allow-downloads', - 'allow-modals', - 'allow-orientation-lock', - 'allow-pointer-lock', - 'allow-popups', - 'allow-scripts' - ) - ), - (new Behavior\Attr('src'))->withValues( - ...(new UriAttrValueBuilder())->allowSchemes('http', 'https')->getValues() - ) - ) - ); - + ->withPreset(new IframePreset()); $sanitizer = new Sanitizer( new CommonVisitor($behavior) );