Validate URL entities

Called by xss_clean()

@param
string
@return string
540099
protected function _validate_entities($str) {
		/*
		 * Protect GET variables in URLs
		 */
		
		// 901119URL5918AMP18930PROTECT8198
		
		$str = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-]+)|i', $this->xss_hash() . "\\1=\\2", $str);
		
		/*
		 * Validate standard character entities Add a semicolon if missing. We
		 * do this to enable the conversion of entities to ASCII later.
		 */
		$str = preg_replace('#(&\#?[0-9a-z]{2,})([\x00-\x20])*;?#i', "\\1;\\2", $str);
		
		/*
		 * Validate UTF16 two byte encoding (x00) Just as above, adds a
		 * semicolon if missing.
		 */
		$str = preg_replace('#(&\#x?)([0-9A-F]+);?#i', "\\1\\2;", $str);
		
		/*
		 * Un-Protect GET variables in URLs
		 */
		$str = str_replace($this->xss_hash(), '&', $str);
		
		return $str;
	}
382089
static function ConvertUrlToLink($text,$sanitize = false)
	{
		if ($sanitize) $text = VerySimpleStringUtil::Sanitize($text);
		$regex = "/[[:alpha:]]+://[^<>[:space:]]+[[:alnum:]/]/i";
		return preg_replace($regex, '<a href=\"\\0\">\\0</a>', $text);
	}
484133
public static function sanitizeLocalUrl($url = '') {
		$sanitizedUrl = '';
		$decodedUrl = rawurldecode($url);

		if (!empty($url) && self::removeXSS($decodedUrl) === $decodedUrl) {
			$testAbsoluteUrl = self::resolveBackPath($decodedUrl);
			$testRelativeUrl = self::resolveBackPath(
				self::dirname(self::getIndpEnv('SCRIPT_NAME')) . '/' . $decodedUrl
			);

				// Pass if URL is on the current host:
			if (self::isValidUrl($decodedUrl)) {
				if (self::isOnCurrentHost($decodedUrl) && strpos($decodedUrl, self::getIndpEnv('TYPO3_SITE_URL')) === 0) {
					$sanitizedUrl = $url;
				}
				// Pass if URL is an absolute file path:
			} elseif (self::isAbsPath($decodedUrl) && self::isAllowedAbsPath($decodedUrl)) {
				$sanitizedUrl = $url;
				// Pass if URL is absolute and below TYPO3 base directory:
			} elseif (strpos($testAbsoluteUrl, self::getIndpEnv('TYPO3_SITE_PATH')) === 0 && substr($decodedUrl, 0, 1) === '/') {
				$sanitizedUrl = $url;
				// Pass if URL is relative and below TYPO3 base directory:
			} elseif (strpos($testRelativeUrl, self::getIndpEnv('TYPO3_SITE_PATH')) === 0 && substr($decodedUrl, 0, 1) !== '/') {
				$sanitizedUrl = $url;
			}
		}

		if (!empty($url) && empty($sanitizedUrl)) {
			self::sysLog('The URL "' . $url . '" is not considered to be local and was denied.', 'Core', self::SYSLOG_SEVERITY_NOTICE);
		}

		return $sanitizedUrl;
	}
652203
private static function sanitizeString($value)
    {
        // $_GET and $_REQUEST already urldecode()'d
        // decode
        // note: before php 5.2.7, htmlspecialchars() double encodes &#x hex items
        $value = html_entity_decode($value, self::HTML_ENCODING_QUOTE_STYLE, 'UTF-8');

        $value = self::sanitizeNullBytes($value);

        // escape
        $tmp = @htmlspecialchars($value, self::HTML_ENCODING_QUOTE_STYLE, 'UTF-8');

        // note: php 5.2.5 and above, htmlspecialchars is destructive if input is not UTF-8
        if ($value != '' && $tmp == '') {
            // convert and escape
            $value = utf8_encode($value);
            $tmp = htmlspecialchars($value, self::HTML_ENCODING_QUOTE_STYLE, 'UTF-8');
            return $tmp;
        }
        return $tmp;
    }
711387
public function sanitizeUri(string $uri): string {
        if ($uri == '') {
            throw new BadMethodCallException('URI is empty');
        }
        $baseUrl = !$this->txUrl ? $this->apiUrl : $this->txUrl;
        $uri     = preg_replace('|^/|', '', $uri);
        $uri     = preg_replace('|^https?://[^/]+/rest/?(tx:[-0-9a-zA-Z]+/)?|', '', $uri);
        $uri     = $baseUrl . '/' . $uri;
        return $uri;
    }
1253537
static public function clean_url($url=NULL) {
		//make sure we've still got something valid to work with.
		if(strlen($url)) {
			//if there's an "APPURL" constant, drop that from the url.
			if(defined('APPURL') && strlen(constant('APPURL'))) {
				$dropThis = preg_replace('/^\//', '', constant('APPURL'));
				$dropThis = preg_replace('/\//', '\\/', $dropThis);
				$url = preg_replace('/^'. $dropThis .'/', '', $url);
			}
			
			//check the string to make sure it doesn't begin with a "/"
			if($url[0] == '/') {
				$url = substr($url, 1, strlen($url));
			}
	
			//check the last char for a "/"...
			if($url[strlen($url) -1] == '/') {
				//last char is a '/'... kill it.
				$url = substr($url, 0, strlen($url) -1);
			}
	
			//if we've been sent a query, kill it off the string...
			if(preg_match('/\?/', $url)) {
				$url = preg_split('/\?/', $url);
				$url = $url[0];
			}
	
			if(preg_match("/\./", $url)) {
				//disregard file extensions, but keep everything else...
				//	i.e. "index.php/yermom.html" becomes "index/yermom"
				$tArr = explode('/', $url);
				$tUrl = null;
				foreach($tArr as $tUrlPart) {
					$temp = explode(".", $tUrlPart);
					if(strlen($temp[0])) {
						$tUrlPart = $temp[0];
					}
					$tUrl = ToolBox::create_list($tUrl, $tUrlPart, '/');
				}
				$url = $tUrl;
			}
		}
		else {
			$url = null;
		}

		return($url);
	}
632717
public static function xss($string, $charset = 'ISO-8859-1')
    {
        $sanitize = new Sanitize();

        $string = $sanitize::removeNullCharacters($string);
        $string = $sanitize::validateStandardCharacterEntities($string);
        $string = $sanitize::validateUTF16TwoByteEncoding($string);
        $string = $sanitize::strangeThingsAreSubmitted($string);
        $string = $sanitize::convertCharacterEntitiesToASCII($string, $charset);
        $string = $sanitize::convertAllTabsToSpaces($string);
        $string = $sanitize::makesPhpTagsSafe($string);
        $string = $sanitize::compactAnyExplodedWords($string);
        $string = $sanitize::removeDisallowedJavaScriptInLinksOrImgTags($string);
        $string = $sanitize::removeJavaScriptEventHandlers($string);
        $string = $sanitize::healNaughtyHTMLElements($string);
        $string = $sanitize::healNaughtyScriptingElements($string);
        $string = $sanitize::removeJavaScriptHardRedirects($string);

        return $string;
    }
1191494
protected function sanitizeUrl($url)
	{
		$url = $url;
		$url = preg_replace('~[^\\pL0-9_]+~u', '-', $url); // substitutes anything but letters, numbers and '_' with separator
		$url = trim($url, "-");
		$url = iconv("utf-8", "us-ascii//TRANSLIT", $url); // TRANSLIT does the whole job
		$url = strtolower($url);
		$url = preg_replace('~[^-a-z0-9_]+~', '', $url); // keep only letters, numbers, '_' and separator
		return $url;
	}
782214
function _filter_uri($str) {
		if ($str != '' && $this->permitted_uri_chars != '' && $this->enable_query_strings == FALSE) {
			// preg_quote() in PHP 5.3 escapes -, so the str_replace() and addition of - to preg_quote() is to maintain backwards
			// compatibility as many are unaware of how characters in the permitted_uri_chars will be parsed as a regex pattern
			if (!preg_match("|^[" . str_replace(array ('\\-','\-' ), '-', preg_quote($this->permitted_uri_chars, '-')) . "]+$|i", $str)) {
				show_error('The URI you submitted has disallowed characters.', 400);
			}
		}

		// Convert programatic characters to entities
		$bad=array ('$','(',')','%28','%29' );
		$good=array ('&#36;','&#40;','&#41;','&#40;','&#41;' );

		return str_replace($bad, $good, $str);
	}
209971
private function validateUrl($url)
    {
        $parsed = parse_url($url);
        if (empty($parsed['scheme'])
            || empty($parsed['host'])
            || $parsed['scheme'] !== 'https'
            || substr($url, -4) !== '.pem'
            || !preg_match($this->hostPattern, $parsed['host'])
        ) {
            throw new InvalidSnsMessageException(
                'The certificate is located on an invalid domain.'
            );
        }
    }
770891
public function validateHost($host = null)
    {
        if ($host === null) {
            $parsed = parse_url($this->uri);
            $host = isset($parsed['host']) ? $parsed['host'] : $parsed['path'];
        }
        return (
            preg_match("/^([a-z\d](-*[a-z\d])*)(\.([a-z\d](-*[a-z\d])*))*$/i", $host) //valid chars check
            && preg_match("/^.{1,253}$/", $host) //overall length check
            && preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $host) //length of each label
            && !$this->validateIP($host)
        );
    }
31157
protected function validateUrl()
    {
        $this->url->convertToHttps();
        return ($this->urlMatchesPattern(array_merge($this->postPatterns, $this->videoPatterns, $this->pagePatterns)));
    }
523427
function validateUrl (url) {
  if (!url) {
    return option.some('Url is not specified')
  }
  if (typeof url !== 'string') {
    return option.some('Url should be type of string')
  }
  return option.none
}
1039789
private function ValidateData(&$array, $index = '', $xss_clean = false) {
        if (!isset($array[$index])) {
            return false;
        }

        if ($xss_clean === true && !($array[$index] instanceof \stdClass)) {
            $array[$index] = strip_tags($array[$index]);
            $array[$index] = filter_var($array[$index]);
//$security = new BL\Security\Security();
            //return $security->xss_clean($array[$index]);
        }

        return $array[$index];
    }
679241
private function cleanUrl($url)
    {
        if (strlen($url) > 1 && strrpos($url, '/') === strlen($url) - 1) {
            $url = substr($url, 0, -1);
        }
        if (strrpos($url, '.php') === strlen($url) - 4) {
            $url = substr($url, 0, -4);
        }
        return $url;
    }
697297
public static function clean($string)
	{
		if (empty($string))
		{
			return $string;
		}

		if (get_magic_quotes_gpc())
		{
			$string = stripslashes($string);
		}

		// strip out any KL_PHP, script, style, HTML comments
		$string = preg_replace('/{kl_php}(.*?){\/kl_php}/is', '', $string);
		$regex =
			'/(<link[^>]+rel="[^"]*stylesheet"[^>]*>|' .
			'<script[^>]*>.*?<\/script>|' .
			'<style[^>]*>.*?<\/style>|' .
			'<\?php.*?\?>|' .
			'<!--.*?-->)/is';
		$string = preg_replace($regex, '', $string);

		$string = str_replace(
			array('&amp;',     '&lt;',     '&gt;'),
			array('&amp;amp;', '&amp;lt;', '&amp;gt;'),
			$string
		);
		// Fix &entitiy\n;

		$string = preg_replace('#(&\#*\w+)[\x00-\x20]+;#u', "$1;", $string);
		$string = preg_replace('#(&\#x*)([0-9A-F]+);*#iu', "$1$2;", $string);
		//$string = html_entity_decode($string, ENT_COMPAT, "UTF-8");

		// Remove any attribute starting with "on" or xmlns
		$string = preg_replace('#(<[^>]+[\x00-\x20\"\'])(on|xmlns)[^>]*>#iUu', "$1>", $string);

		// Remove javascript: and vbscript: protocol
		$string = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*)[\\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iUu', '$1=$2nojavascript...', $string);
		$string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'\"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iUu', '$1=$2novbscript...', $string);

		// <span style="width: expression(alert('Ping!'));"></span>
		// only works in ie...
		$string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*).*expression[\x00-\x20]*\([^>]*>#iU', "$1>", $string);
		$string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*).*behaviour[\x00-\x20]*\([^>]*>#iU', "$1>", $string);
		$string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*).*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*>#iUu', "$1>", $string);

		// Remove namespaced elements (we do not need them...)
		$string = preg_replace('#</*\w+:\w[^>]*>#i', '', $string);

		// Remove really unwanted tags
		$string = self::stripTags($string,
			'applet', 'meta', 'xml', 'blink', 'link', 'style',
			'script', 'embed', 'object', 'iframe', 'frame', 'frameset',
			'ilayer', 'layer', 'bgsound', 'title', 'base'
		);

		return $string;
	}
741815
function clean_string($str)
	{
		if ($this->_is_ascii($str) === FALSE)
		{
			$str = @iconv('UTF-8', 'UTF-8//IGNORE', $str);
		}

		return $str;
	}