Skip to content

GitLab

D
drupal
Commit 91c32e3d authored by alexpott's avatar alexpott
Browse files
Options

Issue #2010024 by damiankloip, dawehner, ParisLiakos: Move url related... 

Issue #2010024 by damiankloip, dawehner, ParisLiakos: Move url related functions to a new Url component.
parent a5c93987
Hide whitespace changes
Inline Side-by-side
Showing with 458 additions and 203 deletions
core/includes/bootstrap.inc
View file @ 91c32e3d
......@@ -6,7 +6,7 @@
use Drupal\Component\Utility\String;
use Drupal\Component\Utility\Timer;
use Drupal\Component\Utility\Unicode;
use Drupal\Component\Utility\UrlValidator;
use Drupal\Component\Utility\Url;
use Drupal\Core\DrupalKernel;
use Drupal\Core\Database\Database;
use Drupal\Core\DependencyInjection\ContainerBuilder;
......
core/includes/common.inc
View file @ 91c32e3d
......@@ -4,7 +4,7 @@
use Drupal\Component\Utility\Json;
use Drupal\Component\Utility\String;
use Drupal\Component\Utility\Tags;
use Drupal\Component\Utility\UrlValidator;
use Drupal\Component\Utility\Url;
use Drupal\Component\Utility\Xss;
use Drupal\Core\Cache\Cache;
use Drupal\Core\Language\Language;
......@@ -440,56 +440,14 @@ function drupal_get_feeds($delimiter = "\n") {
*
* @return
* An array containing query parameters, which can be used for url().
*
* @deprecated as of Drupal 8.0. Use Url::filterQueryParameters() instead.
*/
function drupal_get_query_parameters(array $query = NULL, array $exclude = array(), $parent = '') {
// Set defaults, if none given.
if (!isset($query)) {
$query = $_GET;
}
// If $exclude is empty, there is nothing to filter.
if (empty($exclude)) {
return $query;
}
elseif (!$parent) {
$exclude = array_flip($exclude);
}
$params = array();
foreach ($query as $key => $value) {
$string_key = ($parent ? $parent . '[' . $key . ']' : $key);
if (isset($exclude[$string_key])) {
continue;
}
if (is_array($value)) {
$params[$key] = drupal_get_query_parameters($value, $exclude, $string_key);
}
else {
$params[$key] = $value;
}
}
return $params;
}
/**
* Splits a URL-encoded query string into an array.
*
* @param $query
* The query string to split.
*
* @return
* An array of URL decoded couples $param_name => $value.
*/
function drupal_get_query_array($query) {
$result = array();
if (!empty($query)) {
foreach (explode('&', $query) as $param) {
$param = explode('=', $param);
$result[$param[0]] = isset($param[1]) ? rawurldecode($param[1]) : '';
}
$query = Drupal::request()->query->all();
}
return $result;
return Url::filterQueryParameters($query, $exclude, $parent);
}
/**
......@@ -497,12 +455,13 @@ function drupal_get_query_array($query) {
*
* @see \Drupal\Core\Routing\PathBasedGeneratorInterface::httpBuildQuery()
* @see drupal_get_query_parameters()
* @deprecated as of Drupal 8.0. Use
* Drupal::urlGenerator()->httpBuildQuery() instead.
* @deprecated as of Drupal 8.0. Use Url::buildQuery() instead.
* @ingroup php_wrappers
*
* @deprecated as of Drupal 8.0. Use Url::buildQuery() instead.
*/
function drupal_http_build_query(array $query, $parent = '') {
return Drupal::urlGenerator()->httpBuildQuery($query, $parent);
return Url::buildQuery($query, $parent);
}
/**
......@@ -527,12 +486,13 @@ function drupal_get_destination() {
return $destination;
}
if (isset($_GET['destination'])) {
$destination = array('destination' => $_GET['destination']);
$query = Drupal::request()->query;
if ($query->has('destination')) {
$destination = array('destination' => $query->get('destination'));
}
else {
$path = current_path();
$query = Drupal::urlGenerator()->httpBuildQuery(drupal_get_query_parameters());
$query = Url::buildQuery(Url::filterQueryParameters($query->all()));
if ($query != '') {
$path .= '?' . $query;
}
......@@ -573,46 +533,11 @@ function drupal_get_destination() {
*
* @see url()
* @ingroup php_wrappers
*
* @deprecated as of Drupal 8.0. Use Url::parse() instead.
*/
function drupal_parse_url($url) {
$options = array(
'path' => NULL,
'query' => array(),
'fragment' => '',
);
// External URLs: not using parse_url() here, so we do not have to rebuild
// the scheme, host, and path without having any use for it.
if (strpos($url, '://') !== FALSE) {
// Split off everything before the query string into 'path'.
$parts = explode('?', $url);
$options['path'] = $parts[0];
// If there is a query string, transform it into keyed query parameters.
if (isset($parts[1])) {
$query_parts = explode('#', $parts[1]);
parse_str($query_parts[0], $options['query']);
// Take over the fragment, if there is any.
if (isset($query_parts[1])) {
$options['fragment'] = $query_parts[1];
}
}
}
// Internal URLs.
else {
// parse_url() does not support relative URLs, so make it absolute. E.g. the
// relative URL "foo/bar:1" isn't properly parsed.
$parts = parse_url('http://example.com/' . $url);
// Strip the leading slash that was just added.
$options['path'] = substr($parts['path'], 1);
if (isset($parts['query'])) {
parse_str($parts['query'], $options['query']);
}
if (isset($parts['fragment'])) {
$options['fragment'] = $parts['fragment'];
}
}
return $options;
return Url::parse($url);
}
/**
......@@ -625,9 +550,11 @@ function drupal_parse_url($url) {
*
* @param $path
* The Drupal path to encode.
*
* @deprecated as of Drupal 8.0. Use Url::encodePath() instead.
*/
function drupal_encode_path($path) {
return str_replace('%2F', '/', rawurlencode($path));
return Url::encodePath($path);
}
/**
......@@ -638,20 +565,11 @@ function drupal_encode_path($path) {
*
* @return
* TRUE if the URL has the same domain and base path.
*
* @deprecated as of Drupal 8.0. Use Url::externalIsLocal() instead.
*/
function _external_url_is_local($url) {
$url_parts = parse_url($url);
$base_host = parse_url($GLOBALS['base_url'], PHP_URL_HOST);
if (!isset($url_parts['path'])) {
return ($url_parts['host'] == $base_host);
}
else {
// When comparing base paths, we need a trailing slash to make sure a
// partial URL match isn't occuring. Since base_path() always returns with
// a trailing slash, we don't need to add the trailing slash here.
return ($url_parts['host'] == $base_host && stripos($url_parts['path'], base_path()) === 0);
}
return Url::externalIsLocal($url, base_path());
}
/**
......@@ -705,12 +623,12 @@ function valid_email_address($mail) {
* @return
* TRUE if the URL is in a valid format.
*
* @see \Drupal\Component\Utility\UrlValidator::isValid()
* @see \Drupal\Component\Utility\Url::isValid()
*
* @deprecated as of Drupal 8.0. Use UrlValidator::isValid() instead.
* @deprecated as of Drupal 8.0. Use Url::isValid() instead.
*/
function valid_url($url, $absolute = FALSE) {
return UrlValidator::isValid($url, $absolute);
return Url::isValid($url, $absolute);
}
/**
......@@ -795,7 +713,7 @@ function valid_number_step($value, $step, $offset = 0.0) {
* @see \Drupal\Component\Utility\Url::stripDangerousProtocols()
*/
function drupal_strip_dangerous_protocols($uri) {
return UrlValidator::stripDangerousProtocols($uri);
return Url::stripDangerousProtocols($uri);
}
/**
......@@ -817,7 +735,7 @@ function drupal_strip_dangerous_protocols($uri) {
* @see \Drupal\Component\Utility\String::checkPlain()
*/
function check_url($uri) {
return String::checkPlain(UrlValidator::stripDangerousProtocols($uri));
return String::checkPlain(Url::stripDangerousProtocols($uri));
}
/**
......@@ -885,7 +803,7 @@ function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite',
* @see \Drupal\Component\Utility\Url::filterBadProtocol()
*/
function filter_xss_bad_protocol($string) {
return UrlValidator::filterBadProtocol($string);
return Url::filterBadProtocol($string);
}
/**
......@@ -1313,11 +1231,7 @@ function url($path = NULL, array $options = array()) {
* Boolean TRUE or FALSE, where TRUE indicates an external path.
*/
function url_is_external($path) {
$colonpos = strpos($path, ':');
// Avoid calling drupal_strip_dangerous_protocols() if there is any
// slash (/), hash (#) or question_mark (?) before the colon (:)
// occurrence - if any - as this would clearly mean it is not a URL.
return $colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) && drupal_strip_dangerous_protocols($path) == $path;
return Url::isExternal($path);
}
/**
......@@ -4019,7 +3933,7 @@ function _drupal_bootstrap_code() {
// of allowed protocols for these cases.
$allowed_protocols = array('http', 'https');
}
UrlValidator::setAllowedProtocols($allowed_protocols);
Url::setAllowedProtocols($allowed_protocols);
}
/**
......
core/lib/Drupal/Component/Utility/UrlValidator.php → core/lib/Drupal/Component/Utility/Url.php
View file @ 91c32e3d
......@@ -2,15 +2,15 @@
/**
* @file
* Contains \Drupal\Component\Utility\UrlValidator.
* Contains \Drupal\Component\Utility\Url.
*/
namespace Drupal\Component\Utility;
/**
* Helper class to support filtering bad protocols from an url.
* Helper class URL based methods.
*/
class UrlValidator {
class Url {
/**
* The list of allowed protocols.
......@@ -19,6 +19,225 @@ class UrlValidator {
*/
protected static $allowedProtocols = array('http', 'https');
/**
* Parses an array into a valid, rawurlencoded query string.
*
*
* rawurlencode() is RFC3986 compliant, and as a consequence RFC3987
* compliant. The latter defines the required format of "URLs" in HTML5.
* urlencode() is almost the same as rawurlencode(), except that it encodes
* spaces as "+" instead of "%20". This makes its result non compliant to
* RFC3986 and as a consequence non compliant to RFC3987 and as a consequence
* not valid as a "URL" in HTML5.
*
* @todo Remove this function once PHP 5.4 is required as we can use just
* http_build_query() directly.
*
* @param array $query
* The query parameter array to be processed, e.g. $_GET.
* @param string $parent
* Internal use only. Used to build the $query array key for nested items.
*
* @return string
* A rawurlencoded string which can be used as or appended to the URL query
* string.
*
* @ingroup php_wrappers
*/
public static function buildQuery(array $query, $parent = '') {
$params = array();
foreach ($query as $key => $value) {
$key = ($parent ? $parent . '[' . rawurlencode($key) . ']' : rawurlencode($key));
// Recurse into children.
if (is_array($value)) {
$params[] = static::buildQuery($value, $key);
}
// If a query parameter value is NULL, only append its key.
elseif (!isset($value)) {
$params[] = $key;
}
else {
// For better readability of paths in query strings, we decode slashes.
$params[] = $key . '=' . str_replace('%2F', '/', rawurlencode($value));
}
}
return implode('&', $params);
}
/**
* Filters a URL query parameter array to remove unwanted elements.
*
* @param array $query
* An array to be processed.
* @param array $exclude
* (optional) A list of $query array keys to remove. Use "parent[child]" to
* exclude nested items.
* @param string $parent
* Internal use only. Used to build the $query array key for nested items.
*
* @return
* An array containing query parameters.
*/
public static function filterQueryParameters(array $query, array $exclude = array(), $parent = '') {
// If $exclude is empty, there is nothing to filter.
if (empty($exclude)) {
return $query;
}
elseif (!$parent) {
$exclude = array_flip($exclude);
}
$params = array();
foreach ($query as $key => $value) {
$string_key = ($parent ? $parent . '[' . $key . ']' : $key);
if (isset($exclude[$string_key])) {
continue;
}
if (is_array($value)) {
$params[$key] = static::filterQueryParameters($value, $exclude, $string_key);
}
else {
$params[$key] = $value;
}
}
return $params;
}
/**
* Parses a system URL string into an associative array.
*
* This function should only be used for URLs that have been generated by the
* system. It should not be used for URLs that come from external sources, or
* URLs that link to external resources.
*
* The returned array contains a 'path' that may be passed separately to url().
* For example:
* @code
* $options = Url::parse($_GET['destination']);
* $my_url = url($options['path'], $options);
* $my_link = l('Example link', $options['path'], $options);
* @endcode
*
* @param string $url
* The URL string to parse, f.e. $_GET['destination'].
*
* @return
* An associative array containing the keys:
* - 'path': The path of the URL. If the given $url is external, this includes
* the scheme and host.
* - 'query': An array of query parameters of $url, if existent.
* - 'fragment': The fragment of $url, if existent.
*
* @ingroup php_wrappers
*/
public static function parse($url) {
$options = array(
'path' => NULL,
'query' => array(),
'fragment' => '',
);
// External URLs: not using parse_url() here, so we do not have to rebuild
// the scheme, host, and path without having any use for it.
if (strpos($url, '://') !== FALSE) {
// Split off everything before the query string into 'path'.
$parts = explode('?', $url);
$options['path'] = $parts[0];
// If there is a query string, transform it into keyed query parameters.
if (isset($parts[1])) {
$query_parts = explode('#', $parts[1]);
parse_str($query_parts[0], $options['query']);
// Take over the fragment, if there is any.
if (isset($query_parts[1])) {
$options['fragment'] = $query_parts[1];
}
}
}
// Internal URLs.
else {
// parse_url() does not support relative URLs, so make it absolute. E.g. the
// relative URL "foo/bar:1" isn't properly parsed.
$parts = parse_url('http://example.com/' . $url);
// Strip the leading slash that was just added.
$options['path'] = substr($parts['path'], 1);
if (isset($parts['query'])) {
parse_str($parts['query'], $options['query']);
}
if (isset($parts['fragment'])) {
$options['fragment'] = $parts['fragment'];
}
}
return $options;
}
/**
* Encodes a Drupal path for use in a URL.
*
* For aesthetic reasons slashes are not escaped.
*
* @param string $path
* The Drupal path to encode.
*
* @return string
* The encoded path.
*/
public static function encodePath($path) {
return str_replace('%2F', '/', rawurlencode($path));
}
/**
* Returns whether a path is external to Drupal (e.g. http://example.com).
*
* If a path cannot be assessed by Drupal's menu handler, then we must
* treat it as potentially insecure.
*
* @param string $path
* The internal path or external URL being linked to, such as "node/34" or
* "http://example.com/foo".
*
* @return bool
* TRUE or FALSE, where TRUE indicates an external path.
*/
public static function isExternal($path) {
$colonpos = strpos($path, ':');
// Avoid calling stripDangerousProtocols() if there is any
// slash (/), hash (#) or question_mark (?) before the colon (:)
// occurrence - if any - as this would clearly mean it is not a URL.
return $colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) && static::stripDangerousProtocols($path) == $path;
}
/**
* Determines if an external URL points to this installation.
*
* @param string $url
* A string containing an external URL, such as "http://example.com/foo".
* @param string $base_url
* The base URL string to check against, such as "http://example.com/"
*
* @return
* TRUE if the URL has the same domain and base path.
*/
public static function externalIsLocal($url, $base_url) {
$url_parts = parse_url($url);
$base_host = parse_url($base_url, PHP_URL_HOST);
if (!isset($url_parts['path'])) {
return ($url_parts['host'] == $base_host);
}
else {
// When comparing base paths, we need a trailing slash to make sure a
// partial URL match isn't occuring. Since base_path() always returns with
// a trailing slash, we don't need to add the trailing slash here.
return ($url_parts['host'] == $base_host && stripos($url_parts['path'], $base_url) === 0);
}
}
/**
* Processes an HTML attribute value and strips dangerous protocols from URLs.
*
......@@ -29,9 +248,9 @@ class UrlValidator {
* Cleaned up and HTML-escaped version of $string.
*/
public static function filterBadProtocol($string) {
// Get the plain text representation of the attribute value (i.e. its meaning).
// Get the plain text representation of the attribute value (i.e. its
// meaning).
$string = String::decodeEntities($string);
return String::checkPlain(static::stripDangerousProtocols($string));
}
......@@ -50,11 +269,11 @@ public static function setAllowedProtocols(array $protocols = array()) {
*
* This function must be called for all URIs within user-entered input prior
* to being output to an HTML attribute value. It is often called as part of
* check_url() or filter_xss(), but those functions return an HTML-encoded
* string, so this function can be called independently when the output needs to
* be a plain-text string for passing to t(), l(),
* check_url() or Drupal\Component\Utility\Xss::filter(), but those functions
* return an HTML-encoded string, so this function can be called independently
* when the output needs to be a plain-text string for passing to t(), l(),
* Drupal\Core\Template\Attribute, or another function that will call
* check_plain() separately.
* \Drupal\Component\Utility\String::checkPlain() separately.
*
* @param string $uri
* A plain-text URI that might contain dangerous protocols.
......@@ -62,10 +281,8 @@ public static function setAllowedProtocols(array $protocols = array()) {
* @return string
* A plain-text URI stripped of dangerous protocols. As with all plain-text
* strings, this return value must not be output to an HTML page without
* check_plain() being called on it. However, it can be passed to functions
* being sanitized first. However, it can be passed to functions
* expecting plain-text strings.
*
* @see check_url()
*/
public static function stripDangerousProtocols($uri) {
$allowed_protocols = array_flip(static::$allowedProtocols);
......@@ -107,7 +324,7 @@ public static function stripDangerousProtocols($uri) {
* Whether the URL is absolute (beginning with a scheme such as "http:").
*
* @return bool
* TRUE if the URL is in a valid format.
* TRUE if the URL is in a valid format, FALSE otherwise.
*/
public static function isValid($url, $absolute = FALSE) {
if ($absolute) {
......
core/lib/Drupal/Component/Utility/Xss.php
View file @ 91c32e3d
......@@ -225,7 +225,7 @@ protected static function attributes($attributes) {
case 2:
// Attribute value, a URL after href= for instance.
if (preg_match('/^"([^"]*)"(\s+|$)/', $attributes, $match)) {
$thisval = UrlValidator::filterBadProtocol($match[1]);
$thisval = Url::filterBadProtocol($match[1]);
if (!$skip) {
$attributes_array[] = "$attribute_name=\"$thisval\"";
......@@ -237,7 +237,7 @@ protected static function attributes($attributes) {
}
if (preg_match("/^'([^']*)'(\s+|$)/", $attributes, $match)) {
$thisval = UrlValidator::filterBadProtocol($match[1]);
$thisval = Url::filterBadProtocol($match[1]);
if (!$skip) {
$attributes_array[] = "$attribute_name='$thisval'";
......@@ -248,7 +248,7 @@ protected static function attributes($attributes) {
}
if (preg_match("%^([^\s\"']+)(\s+|$)%", $attributes, $match)) {
$thisval = UrlValidator::filterBadProtocol($match[1]);
$thisval = Url::filterBadProtocol($match[1]);
if (!$skip) {
$attributes_array[] = "$attribute_name=\"$thisval\"";
......
core/lib/Drupal/Core/Routing/UrlGenerator.php
View file @ 91c32e3d
......@@ -16,7 +16,7 @@
use Symfony\Cmf\Component\Routing\ProviderBasedGenerator;
use Drupal\Component\Utility\Settings;
use Drupal\Component\Utility\UrlValidator;
use Drupal\Component\Utility\Url;
use Drupal\Core\Config\ConfigFactory;
use Drupal\Core\PathProcessor\OutboundPathProcessorInterface;
......@@ -83,7 +83,7 @@ public function __construct(RouteProviderInterface $provider, OutboundPathProces
$this->pathProcessor = $path_processor;
$this->mixedModeSessions = $settings->get('mixed_mode_sessions', FALSE);
$allowed_protocols = $config->get('system.filter')->get('protocols') ?: array('http', 'https');
UrlValidator::setAllowedProtocols($allowed_protocols);
Url::setAllowedProtocols($allowed_protocols);
}
/**
......@@ -112,7 +112,7 @@ public function generate($name, $parameters = array(), $absolute = FALSE) {
if ($name instanceof SymfonyRoute) {
$route = $name;
}
elseif (null === $route = $this->provider->getRouteByName($name, $parameters)) {
elseif (NULL === $route = $this->provider->getRouteByName($name, $parameters)) {
throw new RouteNotFoundException(sprintf('Route "%s" does not exist.', $name));
}
......@@ -239,7 +239,7 @@ public function generateFromPath($path = NULL, $options = array()) {
// that would require another function call, and performance inside url() is
// critical.
$colonpos = strpos($path, ':');
$options['external'] = ($colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) && UrlValidator::stripDangerousProtocols($path) == $path);
$options['external'] = ($colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) && Url::stripDangerousProtocols($path) == $path);
}
if (isset($options['fragment']) && $options['fragment'] !== '') {
......@@ -257,7 +257,7 @@ public function generateFromPath($path = NULL, $options = array()) {
}
// Append the query.
if ($options['query']) {
$path .= (strpos($path, '?') !== FALSE ? '&' : '?') . $this->httpBuildQuery($options['query']);
$path .= (strpos($path, '?') !== FALSE ? '&' : '?') . Url::buildQuery($options['query']);
}
if (isset($options['https']) && $this->mixedModeSessions) {
if ($options['https'] === TRUE) {
......@@ -300,7 +300,7 @@ public function generateFromPath($path = NULL, $options = array()) {
$prefix = empty($path) ? rtrim($options['prefix'], '/') : $options['prefix'];
$path = str_replace('%2F', '/', rawurlencode($prefix . $path));
$query = $options['query'] ? ('?' . $this->httpBuildQuery($options['query'])) : '';
$query = $options['query'] ? ('?' . Url::buildQuery($options['query'])) : '';
return $base . $options['script'] . $path . $query . $options['fragment'];
}
......@@ -325,47 +325,6 @@ public function setScriptPath($path) {
$this->scriptPath = $path;
}
/**
* Parses an array into a valid, rawurlencoded query string.
*
* This differs from http_build_query() as we need to rawurlencode() (instead of
* urlencode()) all query parameters.