fix: Task 8 review round 1 - quote-aware tokenizer, context check, skipped global nodes (S45)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,201 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace LIT\MCP\Integrations\Divi\Compose;
|
||||
|
||||
/**
|
||||
* An independent second scan of an HTML fragment (ruling S45): a small state machine after the
|
||||
* HTML tokenizer rules, written separately from TextReplacer's regex tokenizer so a mistake in
|
||||
* one is caught by the other. It lists the byte spans that are NOT text: tags (with quoted
|
||||
* attribute values, where ">" does not end the tag), comments, bogus comments and the bodies of
|
||||
* raw-text elements (script, style, …). Where it is unsure it errs towards "not text": an
|
||||
* unterminated construct runs to the end, a script body containing "<!--" (the escaped/double-
|
||||
* escaped script states) makes the rest of the string markup. Linear time, pure PHP.
|
||||
*/
|
||||
final class HtmlContext
|
||||
{
|
||||
/** Elements whose body the browser does not parse as text/markup. */
|
||||
public const RAW = ['script', 'style', 'xmp', 'iframe', 'noembed', 'noframes', 'noscript', 'plaintext'];
|
||||
|
||||
/** @return list<array{int, int}> [start, end) byte spans that are markup or raw bodies. */
|
||||
public static function markupSpans(string $html): array
|
||||
{
|
||||
$spans = [];
|
||||
$length = strlen($html);
|
||||
$i = 0;
|
||||
while ($i < $length) {
|
||||
$lt = strpos($html, '<', $i);
|
||||
if ($lt === false) {
|
||||
break;
|
||||
}
|
||||
|
||||
$end = self::markupEnd($html, $lt);
|
||||
if ($end === $lt) {
|
||||
$i = $lt + 1;
|
||||
continue;
|
||||
}
|
||||
|
||||
$end ??= $length;
|
||||
$name = self::rawName($html, $lt, $end);
|
||||
if ($name !== null && $end < $length) {
|
||||
$end = self::rawEnd($html, $name, $end);
|
||||
}
|
||||
$spans[] = [$lt, $end];
|
||||
$i = $end;
|
||||
}
|
||||
|
||||
return $spans;
|
||||
}
|
||||
|
||||
/** Whether [start, end) overlaps no markup span. */
|
||||
public static function isText(array $spans, int $start, int $end): bool
|
||||
{
|
||||
foreach ($spans as [$from, $to]) {
|
||||
if ($start < $to && $from < $end) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/** Whether offset $position lies between spans (not strictly inside one). */
|
||||
public static function isBoundary(array $spans, int $position): bool
|
||||
{
|
||||
foreach ($spans as [$from, $to]) {
|
||||
if ($from < $position && $position < $to) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* End (exclusive) of the markup starting with the "<" at $lt; $lt itself when that "<" is
|
||||
* plain text, null when the markup is not terminated.
|
||||
*/
|
||||
private static function markupEnd(string $html, int $lt): ?int
|
||||
{
|
||||
$next = $html[$lt + 1] ?? '';
|
||||
if (substr($html, $lt, 4) === '<!--') {
|
||||
return self::commentEnd($html, $lt + 4);
|
||||
}
|
||||
|
||||
if ($next === '!' || $next === '?') {
|
||||
return self::after($html, '>', $lt + 2);
|
||||
}
|
||||
|
||||
if ($next === '/') {
|
||||
$third = $html[$lt + 2] ?? '';
|
||||
if (ctype_alpha($third)) {
|
||||
return self::tagEnd($html, $lt + 3);
|
||||
}
|
||||
|
||||
return $third === '>' ? $lt + 3 : self::after($html, '>', $lt + 2);
|
||||
}
|
||||
|
||||
return ctype_alpha($next) ? self::tagEnd($html, $lt + 2) : $lt;
|
||||
}
|
||||
|
||||
/** After "<!--": "-->" or "--!>", and the abrupt "<!-->" / "<!--->". */
|
||||
private static function commentEnd(string $html, int $from): ?int
|
||||
{
|
||||
if (($html[$from] ?? '') === '>') {
|
||||
return $from + 1;
|
||||
}
|
||||
if (substr($html, $from, 2) === '->') {
|
||||
return $from + 2;
|
||||
}
|
||||
|
||||
$close = strpos($html, '-->', $from);
|
||||
$bang = strpos($html, '--!>', $from);
|
||||
if ($bang !== false && ($close === false || $bang < $close)) {
|
||||
return $bang + 4;
|
||||
}
|
||||
|
||||
return $close === false ? null : $close + 3;
|
||||
}
|
||||
|
||||
/**
|
||||
* Inside a tag: ">" ends it unless it lies in an attribute value quoted right after "="
|
||||
* (whitespace allowed around "=").
|
||||
*/
|
||||
private static function tagEnd(string $html, int $from): ?int
|
||||
{
|
||||
$length = strlen($html);
|
||||
for ($p = $from; $p < $length; $p++) {
|
||||
$char = $html[$p];
|
||||
if ($char === '>') {
|
||||
return $p + 1;
|
||||
}
|
||||
if ($char !== '=') {
|
||||
continue;
|
||||
}
|
||||
|
||||
$p++;
|
||||
while ($p < $length && strpos(" \t\n\r\f", $html[$p]) !== false) {
|
||||
$p++;
|
||||
}
|
||||
$quote = $html[$p] ?? '';
|
||||
if ($quote === '"' || $quote === "'") {
|
||||
$close = strpos($html, $quote, $p + 1);
|
||||
if ($close === false) {
|
||||
return null;
|
||||
}
|
||||
$p = $close;
|
||||
} else {
|
||||
$p--;
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static function after(string $html, string $needle, int $from): ?int
|
||||
{
|
||||
$found = strpos($html, $needle, $from);
|
||||
|
||||
return $found === false ? null : $found + strlen($needle);
|
||||
}
|
||||
|
||||
/** Name of a raw-text element opened by the start tag [$lt, $end), else null. */
|
||||
private static function rawName(string $html, int $lt, int $end): ?string
|
||||
{
|
||||
if (preg_match('/^<([A-Za-z][A-Za-z0-9]*)/', substr($html, $lt, min(20, $end - $lt)), $match) !== 1) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$name = strtolower($match[1]);
|
||||
|
||||
return in_array($name, self::RAW, true) ? $name : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Where the raw body after $from ends: at its "</name" followed by whitespace, "/" or ">".
|
||||
* plaintext never ends; a script body with "<!--" is treated as running to the end.
|
||||
*/
|
||||
private static function rawEnd(string $html, string $name, int $from): int
|
||||
{
|
||||
$length = strlen($html);
|
||||
if ($name === 'plaintext') {
|
||||
return $length;
|
||||
}
|
||||
|
||||
$p = $from;
|
||||
while (($found = stripos($html, '</' . $name, $p)) !== false) {
|
||||
$follow = $html[$found + 2 + strlen($name)] ?? '';
|
||||
if ($follow !== '' && strpos(" \t\n\r\f/>", $follow) !== false) {
|
||||
if ($name === 'script' && str_contains(substr($html, $from, $found - $from), '<!--')) {
|
||||
return $length;
|
||||
}
|
||||
|
||||
return $found;
|
||||
}
|
||||
$p = $found + 1;
|
||||
}
|
||||
|
||||
return $length;
|
||||
}
|
||||
}
|
||||
@@ -7,6 +7,7 @@ namespace LIT\MCP\Integrations\Divi\Compose;
|
||||
use InvalidArgumentException;
|
||||
use LIT\MCP\Integrations\Divi\BlockTree\AttrMap;
|
||||
use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
|
||||
use LIT\MCP\Integrations\Divi\BlockTree\Serializer;
|
||||
|
||||
/**
|
||||
* Replaces visible text in the attributes of one block (lit/divi-replace-text, spec §5.7, D10):
|
||||
@@ -14,25 +15,32 @@ use LIT\MCP\Integrations\Divi\BlockTree\NodeSummary;
|
||||
* title, label, alt, titleText) – never in URLs, IDs, styles or $variable(…)$ references.
|
||||
* Pure PHP.
|
||||
*
|
||||
* Ruling S8: each string is split into tags, entities and references (kept byte for byte) and
|
||||
* plain text; only plain text outside <script>/<style> bodies is searched. The inserted text is
|
||||
* the replacement as the $clean callback returns it for that place (AttrWriter::cleanValue() in
|
||||
* the ability: sanitized by the field kind, markers rejected – rulings S2/S28). A string with no
|
||||
* hit is returned as it is and never cleaned (Task 1 forward risk: stored references outside
|
||||
* the allow list must survive). A changed string must have exactly the tags, entities and
|
||||
* references of the original plus those of the inserted text – otherwise the replacement glued
|
||||
* something new together across a boundary (a lone "<" closed into a tag, "&" + ";", a
|
||||
* partial reference closed by ")$") and the whole call is refused (InvalidArgumentException).
|
||||
* Rulings S8/S45: each string is tokenized (quote-aware tags, comments, entities, references,
|
||||
* raw-text bodies such as <script>); only text tokens are searched. A string with an
|
||||
* unterminated tag, quote, comment or reference and a hit is refused. The inserted text is the
|
||||
* replacement as the $clean callback returns it for that place (AttrWriter::cleanValue() in the
|
||||
* ability: sanitized by the field kind, markers rejected – rulings S2/S28). A string with no
|
||||
* effective hit is returned as it is and never cleaned (Task 1 forward risk). A changed string
|
||||
* must keep every non-text token of the original byte for byte, gain only the inserted text's
|
||||
* own, add no reference marker, and an independent scan (HtmlContext) must see each replaced
|
||||
* hit and both ends of each insertion in text context – otherwise the whole call is refused
|
||||
* (InvalidArgumentException, the page is not changed).
|
||||
*/
|
||||
final class TextReplacer
|
||||
{
|
||||
/** Ruling S8, verbatim: tags, entities and references are delimiters, the rest is plain text. */
|
||||
public const SPLIT = '/(<[^>]*>|&[#A-Za-z0-9]+;|\$variable\(.+?\)\$)/';
|
||||
/**
|
||||
* Rulings S8/S45: comments, tags (quote-aware: a ">" inside a quoted attribute value does not
|
||||
* end the tag; an unquoted "<" does, so an unterminated tag cannot make PCRE rescan the
|
||||
* rest from every "<"), entities and references are tokens, the rest is text. Possessive
|
||||
* quantifiers keep it linear.
|
||||
*/
|
||||
public const SPLIT = '/((?s:<!--.*?-->)|<(?:[^<>"\']++|"[^"]*+"|\'[^\']*+\')*+>|&[#A-Za-z0-9]++;'
|
||||
. '|\$variable\(.+?\)\$)/';
|
||||
|
||||
private const TEXT_KEYS = ['text', 'title', 'label', 'alt', 'titleText'];
|
||||
|
||||
/** Elements whose body is code, not text. */
|
||||
private const RAW_OPEN = '/^<(script|style)\b/i';
|
||||
/** Raw-text elements (HtmlContext::RAW): their body is code, never text. */
|
||||
private const RAW_OPEN = '/^<(script|style|xmp|iframe|noembed|noframes|noscript|plaintext)\b/i';
|
||||
|
||||
private const CONTEXT = 30;
|
||||
|
||||
@@ -64,7 +72,9 @@ final class TextReplacer
|
||||
$problems = [];
|
||||
if (! mb_check_encoding($search, 'UTF-8') || mb_strlen($search) < 2) {
|
||||
$problems['search'] = 'Suchtext: mindestens 2 Zeichen gültiges UTF-8.';
|
||||
} elseif (VariableRef::contains(VariableRef::withoutControls($search))) {
|
||||
} elseif (VariableRef::withoutControls($search) !== $search) {
|
||||
$problems['search'] = 'Suchtext darf keine Steuerzeichen enthalten.';
|
||||
} elseif (VariableRef::contains($search)) {
|
||||
$problems['search'] = 'Suchtext darf keinen $variable(…)$-Verweis enthalten; dynamische Inhalte werden '
|
||||
. 'nie ersetzt.';
|
||||
}
|
||||
@@ -79,6 +89,49 @@ final class TextReplacer
|
||||
return $problems;
|
||||
}
|
||||
|
||||
/**
|
||||
* The search text as it can be stored in block markup: raw, as serialize_block_attributes()
|
||||
* escapes it (<, >, &, " and --; the JS builder keeps non-ASCII raw) and with \uXXXX for
|
||||
* non-ASCII (WordPress' PHP serializer). Case-insensitive adds the lower and upper case
|
||||
* forms, since the hex digits of \u escapes do not fold.
|
||||
*
|
||||
* @return list<string>
|
||||
*/
|
||||
public static function forms(string $search, bool $caseSensitive): array
|
||||
{
|
||||
$variants = $caseSensitive ? [$search] : [$search, mb_strtolower($search), mb_strtoupper($search)];
|
||||
$forms = [];
|
||||
foreach ($variants as $variant) {
|
||||
$escaped = substr(Serializer::attributes(['s' => $variant]), 6, -2);
|
||||
array_push($forms, $variant, $escaped, self::unicodeEscaped($escaped));
|
||||
}
|
||||
|
||||
return array_values(array_unique($forms));
|
||||
}
|
||||
|
||||
/** Whether block markup (e.g. of a global module this tool does not edit) contains the search text. */
|
||||
public function mentions(string $markup): bool
|
||||
{
|
||||
foreach (self::forms($this->search, $this->caseSensitive) as $form) {
|
||||
$found = $this->caseSensitive ? str_contains($markup, $form) : mb_stripos($markup, $form) !== false;
|
||||
if ($found) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/** Non-ASCII characters as JSON \uXXXX escapes (UTF-16, lower-case hex like json_encode()). */
|
||||
private static function unicodeEscaped(string $value): string
|
||||
{
|
||||
return (string) preg_replace_callback('/[^\x00-\x7F]/u', static function (array $match): string {
|
||||
$units = unpack('n*', (string) mb_convert_encoding($match[0], 'UTF-16BE', 'UTF-8'));
|
||||
|
||||
return implode('', array_map(static fn (int $unit): string => sprintf('\\u%04x', $unit), (array) $units));
|
||||
}, $value);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array<string, mixed> $attrs
|
||||
* @param callable(string $path, ?string $key, string $replacement): ?string $clean
|
||||
@@ -145,48 +198,45 @@ final class TextReplacer
|
||||
int &$count,
|
||||
array &$samples
|
||||
): string {
|
||||
$parts = preg_split(self::SPLIT, $value, -1, PREG_SPLIT_DELIM_CAPTURE);
|
||||
if (! is_array($parts)) {
|
||||
return $value;
|
||||
}
|
||||
|
||||
$hits = $this->hits($parts);
|
||||
if ($hits === null || array_sum($hits) === 0) {
|
||||
return $value;
|
||||
}
|
||||
|
||||
$place = $path . ($key === null ? '' : '.' . $key);
|
||||
$tokens = self::tokenize($value);
|
||||
if ($tokens === null) {
|
||||
// Unterminated markup, quotes, comments or references: where does the text end? Never guess.
|
||||
if (preg_match($this->pattern, $value) === 1) {
|
||||
throw self::refused($place);
|
||||
}
|
||||
|
||||
return $value;
|
||||
}
|
||||
|
||||
$hits = $this->hits($tokens);
|
||||
if ($hits === null || $hits === []) {
|
||||
return $value;
|
||||
}
|
||||
|
||||
$replacement = $this->replacement($path, $key, $clean);
|
||||
if ($replacement === null) {
|
||||
return $value;
|
||||
}
|
||||
|
||||
$expected = [];
|
||||
$insert = static fn (): string => $replacement;
|
||||
$replacementDelimiters = self::delimiters($replacement);
|
||||
foreach ($parts as $i => $part) {
|
||||
if ($i % 2 === 1) {
|
||||
$expected[] = $part;
|
||||
} elseif (($hits[$i] ?? 0) > 0) {
|
||||
$parts[$i] = (string) preg_replace_callback($this->pattern, $insert, $part);
|
||||
for ($n = 0; $n < $hits[$i]; $n++) {
|
||||
array_push($expected, ...$replacementDelimiters);
|
||||
}
|
||||
}
|
||||
// Only hits that change something (search == replacement, or a cleaned replacement equal
|
||||
// to the match, change nothing and are no hits).
|
||||
$hits = array_values(array_filter($hits, static fn (array $hit): bool => $hit[2] !== $replacement));
|
||||
if ($hits === []) {
|
||||
return $value;
|
||||
}
|
||||
|
||||
$replaced = implode('', $parts);
|
||||
// Every marker of the original must be a whole reference (else the string holds a partial
|
||||
// or nested one Divi might read differently), none may be added, and the structure must
|
||||
// be the original's plus the inserted text's own.
|
||||
$markers = substr_count($value, VariableRef::MARKER);
|
||||
$wholeReferences = $markers === self::referenceCount($parts);
|
||||
$sameMarkers = substr_count($replaced, VariableRef::MARKER) === $markers;
|
||||
if (! $wholeReferences || ! $sameMarkers || self::delimiters($replaced) !== $expected) {
|
||||
$inserted = self::tokenize($replacement);
|
||||
if ($inserted === null) {
|
||||
throw self::refused($place);
|
||||
}
|
||||
|
||||
$count += array_sum($hits);
|
||||
[$replaced, $insertedRanges, $expected] = self::splice($value, $tokens, $hits, $replacement, $inserted);
|
||||
if (! self::safe($value, $tokens, $hits, $replaced, $insertedRanges, $expected)) {
|
||||
throw self::refused($place);
|
||||
}
|
||||
|
||||
$count += count($hits);
|
||||
if (count($samples) < 5) {
|
||||
$samples[] = [
|
||||
'path' => $place,
|
||||
@@ -199,40 +249,222 @@ final class TextReplacer
|
||||
}
|
||||
|
||||
/**
|
||||
* Hits per plain part (index => count); plain text inside <script>/<style> has none. Null
|
||||
* when a part cannot be searched (invalid UTF-8): the string stays as it is.
|
||||
* Hits in text tokens: [byte offset in the value, byte length, matched text]. Null when a
|
||||
* token cannot be searched (invalid UTF-8): the string stays as it is.
|
||||
*
|
||||
* @param list<string> $parts
|
||||
* @return array<int, int>|null
|
||||
* @param list<array{string, string, int}> $tokens
|
||||
* @return list<array{int, int, string}>|null
|
||||
*/
|
||||
private function hits(array $parts): ?array
|
||||
private function hits(array $tokens): ?array
|
||||
{
|
||||
$hits = [];
|
||||
$raw = null;
|
||||
foreach ($parts as $i => $part) {
|
||||
if ($i % 2 === 1) {
|
||||
if ($raw === null && preg_match(self::RAW_OPEN, $part, $match) === 1) {
|
||||
$raw = strtolower($match[1]);
|
||||
} elseif ($raw !== null && preg_match('#^</' . $raw . '\b#i', $part) === 1) {
|
||||
$raw = null;
|
||||
}
|
||||
foreach ($tokens as [$type, $text, $offset]) {
|
||||
if ($type !== 'text') {
|
||||
continue;
|
||||
}
|
||||
|
||||
if ($raw !== null || $part === '') {
|
||||
continue;
|
||||
}
|
||||
|
||||
$found = preg_match_all($this->pattern, $part);
|
||||
if ($found === false) {
|
||||
if (preg_match_all($this->pattern, $text, $matches, PREG_OFFSET_CAPTURE) === false) {
|
||||
return null;
|
||||
}
|
||||
$hits[$i] = $found;
|
||||
foreach ($matches[0] as [$match, $at]) {
|
||||
$hits[] = [$offset + (int) $at, strlen((string) $match), (string) $match];
|
||||
}
|
||||
}
|
||||
|
||||
return $hits;
|
||||
}
|
||||
|
||||
/**
|
||||
* The value with every hit replaced, the byte ranges of the inserted text in it, and the
|
||||
* non-text tokens it must have: the original ones with the inserted text's own at each hit.
|
||||
*
|
||||
* @param list<array{string, string, int}> $tokens
|
||||
* @param list<array{int, int, string}> $hits
|
||||
* @param list<array{string, string, int}> $inserted
|
||||
* @return array{string, list<array{int, int}>, list<array{string, string}>}
|
||||
*/
|
||||
private static function splice(
|
||||
string $value,
|
||||
array $tokens,
|
||||
array $hits,
|
||||
string $replacement,
|
||||
array $inserted
|
||||
): array {
|
||||
$own = self::structure($inserted);
|
||||
$replaced = '';
|
||||
$ranges = [];
|
||||
$expected = [];
|
||||
$position = 0;
|
||||
$next = 0;
|
||||
foreach ($tokens as [$type, $text, $offset]) {
|
||||
if ($type !== 'text') {
|
||||
$expected[] = [$type, $text];
|
||||
continue;
|
||||
}
|
||||
|
||||
$end = $offset + strlen($text);
|
||||
while (isset($hits[$next]) && $hits[$next][0] < $end) {
|
||||
[$at, $length] = $hits[$next];
|
||||
$replaced .= substr($value, $position, $at - $position);
|
||||
$ranges[] = [strlen($replaced), strlen($replaced) + strlen($replacement)];
|
||||
$replaced .= $replacement;
|
||||
array_push($expected, ...$own);
|
||||
$position = $at + $length;
|
||||
$next++;
|
||||
}
|
||||
}
|
||||
$replaced .= substr($value, $position);
|
||||
|
||||
return [$replaced, $ranges, $expected];
|
||||
}
|
||||
|
||||
/**
|
||||
* Rulings S8/S45: the changed value is safe when (1) every reference marker of the original
|
||||
* is a whole reference and none is added, (2) its full non-text tokens (tags byte for byte,
|
||||
* comments, entities, references, raw bodies) are exactly the expected ones, and (3) an
|
||||
* independent scan (HtmlContext) puts every replaced hit of the original and both ends of
|
||||
* every inserted text in text context.
|
||||
*
|
||||
* @param list<array{string, string, int}> $tokens
|
||||
* @param list<array{int, int, string}> $hits
|
||||
* @param list<array{int, int}> $insertedRanges
|
||||
* @param list<array{string, string}> $expected
|
||||
*/
|
||||
private static function safe(
|
||||
string $value,
|
||||
array $tokens,
|
||||
array $hits,
|
||||
string $replaced,
|
||||
array $insertedRanges,
|
||||
array $expected
|
||||
): bool {
|
||||
$markers = substr_count($value, VariableRef::MARKER);
|
||||
$references = count(array_filter(
|
||||
$tokens,
|
||||
static fn (array $token): bool => $token[0] === 'token' && str_starts_with($token[1], VariableRef::MARKER)
|
||||
));
|
||||
$after = self::tokenize($replaced);
|
||||
$sameMarkers = $markers === $references && substr_count($replaced, VariableRef::MARKER) === $markers;
|
||||
if (! $sameMarkers || $after === null || self::structure($after) !== $expected) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$before = HtmlContext::markupSpans($value);
|
||||
foreach ($hits as [$at, $length]) {
|
||||
if (! HtmlContext::isText($before, $at, $at + $length)) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
$spans = HtmlContext::markupSpans($replaced);
|
||||
foreach ($insertedRanges as [$start, $end]) {
|
||||
if (! HtmlContext::isBoundary($spans, $start) || ! HtmlContext::isBoundary($spans, $end)) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param list<array{string, string, int}> $tokens
|
||||
* @return list<array{string, string}> The non-text tokens (type and bytes), in order.
|
||||
*/
|
||||
private static function structure(array $tokens): array
|
||||
{
|
||||
$structure = [];
|
||||
foreach ($tokens as [$type, $text]) {
|
||||
if ($type !== 'text') {
|
||||
$structure[] = [$type, $text];
|
||||
}
|
||||
}
|
||||
|
||||
return $structure;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ruling S45 tokenizer: [type, bytes, offset] with type "token" (tag – quote-aware, ">" in a
|
||||
* quoted value does not end it –, comment, entity, reference), "raw" (body of script, style
|
||||
* and the other raw-text elements) or "text". Null when the value has an unterminated tag,
|
||||
* quote, comment or reference – then nobody can say where its text is.
|
||||
*
|
||||
* @return list<array{string, string, int}>|null
|
||||
*/
|
||||
private static function tokenize(string $value): ?array
|
||||
{
|
||||
if (self::unterminated($value)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$parts = preg_split(self::SPLIT, $value, -1, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_OFFSET_CAPTURE);
|
||||
if (! is_array($parts)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$tokens = [];
|
||||
$raw = null;
|
||||
foreach ($parts as $i => [$text, $offset]) {
|
||||
$text = (string) $text;
|
||||
if ($i % 2 === 1) {
|
||||
if ($raw === null && preg_match(self::RAW_OPEN, $text, $match) === 1) {
|
||||
$raw = strtolower($match[1]);
|
||||
} elseif ($raw !== null && self::closes($raw, $text)) {
|
||||
$raw = null;
|
||||
}
|
||||
$tokens[] = ['token', $text, (int) $offset];
|
||||
continue;
|
||||
}
|
||||
|
||||
if ($text === '') {
|
||||
continue;
|
||||
}
|
||||
|
||||
// A "<" that starts markup but matched no token: an unterminated tag or quote.
|
||||
if ($raw === null && preg_match('#<[A-Za-z/!?]#', $text) === 1) {
|
||||
return null;
|
||||
}
|
||||
$tokens[] = [$raw === null ? 'text' : 'raw', $text, (int) $offset];
|
||||
}
|
||||
|
||||
return $tokens;
|
||||
}
|
||||
|
||||
/** Whether token $text closes raw-text element $raw ("</script-x>" does not; plaintext never ends). */
|
||||
private static function closes(string $raw, string $text): bool
|
||||
{
|
||||
return $raw !== 'plaintext' && preg_match('#^</' . $raw . '[\s/>]#i', $text) === 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Cheap checks that keep the tokenizer linear: a comment opened after the last "-->", or a
|
||||
* reference marker after the last ")$" of its line, can never be closed – PCRE would retry
|
||||
* it from every later opener.
|
||||
*/
|
||||
private static function unterminated(string $value): bool
|
||||
{
|
||||
$open = strrpos($value, '<!--');
|
||||
if ($open !== false) {
|
||||
$close = strrpos($value, '-->');
|
||||
if ($close === false || $close < $open + 2) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
if (! str_contains($value, VariableRef::MARKER)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
foreach (explode("\n", $value) as $line) {
|
||||
$marker = strrpos($line, VariableRef::MARKER);
|
||||
$end = $marker === false ? false : strrpos($line, ')$');
|
||||
if ($marker !== false && ($end === false || $end < $marker)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/** @param callable(string, ?string, string): ?string $clean */
|
||||
private function replacement(string $path, ?string $key, callable $clean): ?string
|
||||
{
|
||||
@@ -248,29 +480,6 @@ final class TextReplacer
|
||||
return $this->cleaned[$place];
|
||||
}
|
||||
|
||||
/** @return list<string> Tags, entities and references of $value, in order. */
|
||||
private static function delimiters(string $value): array
|
||||
{
|
||||
$parts = preg_split(self::SPLIT, $value, -1, PREG_SPLIT_DELIM_CAPTURE);
|
||||
|
||||
return is_array($parts)
|
||||
? array_values(array_filter($parts, static fn (int $i): bool => $i % 2 === 1, ARRAY_FILTER_USE_KEY))
|
||||
: [$value];
|
||||
}
|
||||
|
||||
/** @param list<string> $parts */
|
||||
private static function referenceCount(array $parts): int
|
||||
{
|
||||
$count = 0;
|
||||
foreach ($parts as $i => $part) {
|
||||
if ($i % 2 === 1 && str_starts_with($part, VariableRef::MARKER)) {
|
||||
$count++;
|
||||
}
|
||||
}
|
||||
|
||||
return $count;
|
||||
}
|
||||
|
||||
/**
|
||||
* $value as a sanitizer could leave it: controls gone, then tags (nested like strip_tags
|
||||
* counts them, an unclosed one up to the end) and %XX octets removed until nothing changes.
|
||||
|
||||
Reference in New Issue
Block a user