BookStack Code Mirror - bookstack/blobdiff - app/Entities/Tools/PageContent.php

-<?php namespace BookStack\Entities\Tools;

+<?php

+

+namespace BookStack\Entities\Tools;

use BookStack\Entities\Models\Page;

-use BookStack\Entities\Tools\Markdown\CustomStrikeThroughExtension;

-use DOMDocument;

+use BookStack\Entities\Queries\PageQueries;

+use BookStack\Entities\Tools\Markdown\MarkdownToHtml;

+use BookStack\Exceptions\ImageUploadException;

+use BookStack\Facades\Theme;

+use BookStack\Theming\ThemeEvents;

+use BookStack\Uploads\ImageRepo;

+use BookStack\Uploads\ImageService;

+use BookStack\Users\Models\User;

+use BookStack\Util\HtmlContentFilter;

+use BookStack\Util\HtmlDocument;

+use BookStack\Util\WebSafeMimeSniffer;

+use Closure;

+use DOMElement;

+use DOMNode;

use DOMNodeList;

-use DOMXPath;

-use League\CommonMark\CommonMarkConverter;

-use League\CommonMark\Environment;

-use League\CommonMark\Extension\Table\TableExtension;

-use League\CommonMark\Extension\TaskList\TaskListExtension;

+use Illuminate\Support\Str;

class PageContent

{

class PageContent

{

+ protected PageQueries $pageQueries;

- protected $page;

-

- /**

- * PageContent constructor.

- */

- public function __construct(Page $page)

- {

- $this->page = $page;

+ public function __construct(

+ protected Page $page

+ ) {

+ $this->pageQueries = app()->make(PageQueries::class);

}

/**

* Update the content of the page with new provided HTML.

*/

}

/**

* Update the content of the page with new provided HTML.

*/

- public function setNewHTML(string $html)

+ public function setNewHTML(string $html, User $updater): void

{

+ $html = $this->extractBase64ImagesFromHtml($html, $updater);

$this->page->html = $this->formatHtml($html);

$this->page->text = $this->toPlainText();

$this->page->markdown = '';

$this->page->html = $this->formatHtml($html);

$this->page->text = $this->toPlainText();

$this->page->markdown = '';

/**

* Update the content of the page with new provided Markdown content.

*/

/**

* Update the content of the page with new provided Markdown content.

*/

- public function setNewMarkdown(string $markdown)

+ public function setNewMarkdown(string $markdown, User $updater): void

{

+ $markdown = $this->extractBase64ImagesFromMarkdown($markdown, $updater);

$this->page->markdown = $markdown;

- $html = $this->markdownToHtml($markdown);

+ $html = (new MarkdownToHtml($markdown))->convert();

$this->page->html = $this->formatHtml($html);

$this->page->text = $this->toPlainText();

}

/**

$this->page->html = $this->formatHtml($html);

$this->page->text = $this->toPlainText();

}

/**

- * Convert the given Markdown content to a HTML string.

+ * Convert all base64 image data to saved images.

*/

- protected function markdownToHtml(string $markdown): string

+ protected function extractBase64ImagesFromHtml(string $htmlText, User $updater): string

{

- $environment = Environment::createCommonMarkEnvironment();

- $environment->addExtension(new TableExtension());

- $environment->addExtension(new TaskListExtension());

- $environment->addExtension(new CustomStrikeThroughExtension());

- $converter = new CommonMarkConverter([], $environment);

- return $converter->convertToHtml($markdown);

+ if (empty($htmlText) || !str_contains($htmlText, 'data:image')) {

+ return $htmlText;

+ }

+

+ $doc = new HtmlDocument($htmlText);

+

+ // Get all img elements with image data blobs

+ $imageNodes = $doc->queryXPath('//img[contains(@src, \'data:image\')]');

+ /** @var DOMElement $imageNode */

+ foreach ($imageNodes as $imageNode) {

+ $imageSrc = $imageNode->getAttribute('src');

+ $newUrl = $this->base64ImageUriToUploadedImageUrl($imageSrc, $updater);

+ $imageNode->setAttribute('src', $newUrl);

+ }

+

+ return $doc->getBodyInnerHtml();

}

/**

}

/**

- * Formats a page's html to be tagged correctly within the system.

+ * Convert all inline base64 content to uploaded image files.

+ * Regex is used to locate the start of data-uri definitions then

+ * manual looping over content is done to parse the whole data uri.

+ * Attempting to capture the whole data uri using regex can cause PHP

+ * PCRE limits to be hit with larger, multi-MB, files.

*/

- protected function formatHtml(string $htmlText): string

+ protected function extractBase64ImagesFromMarkdown(string $markdown, User $updater): string

{

- if ($htmlText == '') {

- return $htmlText;

+ $matches = [];

+ $contentLength = strlen($markdown);

+ $replacements = [];

+ preg_match_all('/!\[.*?]\(.*?(data:image\/.{1,6};base64,)/', $markdown, $matches, PREG_OFFSET_CAPTURE);

+

+ foreach ($matches[1] as $base64MatchPair) {

+ [$dataUri, $index] = $base64MatchPair;

+

+ for ($i = strlen($dataUri) + $index; $i < $contentLength; $i++) {

+ $char = $markdown[$i];

+ if ($char === ')' || $char === ' ' || $char === "\n" || $char === '"') {

+ break;

+ }

+ $dataUri .= $char;

+ }

+

+ $newUrl = $this->base64ImageUriToUploadedImageUrl($dataUri, $updater);

+ $replacements[] = [$dataUri, $newUrl];

+ }

+

+ foreach ($replacements as [$dataUri, $newUrl]) {

+ $markdown = str_replace($dataUri, $newUrl, $markdown);

}

- libxml_use_internal_errors(true);

- $doc = new DOMDocument();

- $doc->loadHTML(mb_convert_encoding($htmlText, 'HTML-ENTITIES', 'UTF-8'));

+ return $markdown;

+ }

- $container = $doc->documentElement;

- $body = $container->childNodes->item(0);

- $childNodes = $body->childNodes;

- $xPath = new DOMXPath($doc);

+ /**

+ * Parse the given base64 image URI and return the URL to the created image instance.

+ * Returns an empty string if the parsed URI is invalid or causes an error upon upload.

+ */

+ protected function base64ImageUriToUploadedImageUrl(string $uri, User $updater): string

+ {

+ $imageRepo = app()->make(ImageRepo::class);

+ $imageInfo = $this->parseBase64ImageUri($uri);

- // Set ids on top-level nodes

- $idMap = [];

- foreach ($childNodes as $index => $childNode) {

- [$oldId, $newId] = $this->setUniqueId($childNode, $idMap);

- if ($newId && $newId !== $oldId) {

- $this->updateLinks($xPath, '#' . $oldId, '#' . $newId);

- }

+ // Validate user has permission to create images

+ if (!$updater->can('image-create-all')) {

+ return '';

}

- // Ensure no duplicate ids within child items

- $idElems = $xPath->query('//body//*//*[@id]');

- foreach ($idElems as $domElem) {

- [$oldId, $newId] = $this->setUniqueId($domElem, $idMap);

- if ($newId && $newId !== $oldId) {

- $this->updateLinks($xPath, '#' . $oldId, '#' . $newId);

- }

+ // Validate extension and content

+ if (empty($imageInfo['data']) || !ImageService::isExtensionSupported($imageInfo['extension'])) {

+ return '';

+ }

+

+ // Validate content looks like an image via sniffing mime type

+ $mimeSniffer = new WebSafeMimeSniffer();

+ $mime = $mimeSniffer->sniff($imageInfo['data']);

+ if (!str_starts_with($mime, 'image/')) {

+ return '';

+ }

+

+ // Validate that the content is not over our upload limit

+ $uploadLimitBytes = (config('app.upload_limit') * 1000000);

+ if (strlen($imageInfo['data']) > $uploadLimitBytes) {

+ return '';

+ }

+

+ // Save image from data with a random name

+ $imageName = 'embedded-image-' . Str::random(8) . '.' . $imageInfo['extension'];

+

+ try {

+ $image = $imageRepo->saveNewFromData($imageName, $imageInfo['data'], 'gallery', $this->page->id);

+ } catch (ImageUploadException $exception) {

+ return '';

}

- // Generate inner html as a string

- $html = '';

- foreach ($childNodes as $childNode) {

- $html .= $doc->saveHTML($childNode);

+ return $image->url;

+ }

+

+ /**

+ * Parse a base64 image URI into the data and extension.

+ *

+ * @return array{extension: string, data: string}

+ */

+ protected function parseBase64ImageUri(string $uri): array

+ {

+ [$dataDefinition, $base64ImageData] = explode(',', $uri, 2);

+ $extension = strtolower(preg_split('/[\/;]/', $dataDefinition)[1] ?? '');

+

+ return [

+ 'extension' => $extension,

+ 'data' => base64_decode($base64ImageData) ?: '',

+ ];

+ }

+

+ /**

+ * Formats a page's html to be tagged correctly within the system.

+ */

+ protected function formatHtml(string $htmlText): string

+ {

+ if (empty($htmlText)) {

+ return $htmlText;

}

+ $doc = new HtmlDocument($htmlText);

+

+ // Map to hold used ID references

+ $idMap = [];

+ // Map to hold changing ID references

+ $changeMap = [];

+

+ $this->updateIdsRecursively($doc->getBody(), 0, $idMap, $changeMap);

+ $this->updateLinks($doc, $changeMap);

+

+ // Generate inner html as a string & perform required string-level tweaks

+ $html = $doc->getBodyInnerHtml();

+ $html = str_replace(' ', ' ', $html);

+

return $html;

}

/**

return $html;

}

/**

- * Update the all links to the $old location to instead point to $new.

+ * For the given DOMNode, traverse its children recursively and update IDs

+ * where required (Top-level, headers & elements with IDs).

+ * Will update the provided $changeMap array with changes made, where keys are the old

+ * ids and the corresponding values are the new ids.

*/

- protected function updateLinks(DOMXPath $xpath, string $old, string $new)

+ protected function updateIdsRecursively(DOMNode $element, int $depth, array &$idMap, array &$changeMap): void

{

- $old = str_replace('"', '', $old);

- $matchingLinks = $xpath->query('//body//*//*[@href="'.$old.'"]');

- foreach ($matchingLinks as $domElem) {

- $domElem->setAttribute('href', $new);

+ /* @var DOMNode $child */

+ foreach ($element->childNodes as $child) {

+ if ($child instanceof DOMElement && ($depth === 0 || in_array($child->nodeName, ['h1', 'h2', 'h3', 'h4', 'h5', 'h6']) || $child->getAttribute('id'))) {

+ [$oldId, $newId] = $this->setUniqueId($child, $idMap);

+ if ($newId && $newId !== $oldId && !isset($idMap[$oldId])) {

+ $changeMap[$oldId] = $newId;

+ }

+

+ if ($child->hasChildNodes()) {

+ $this->updateIdsRecursively($child, $depth + 1, $idMap, $changeMap);

+ }

+

+ /**

+ * Update the all links in the given xpath to apply requires changes within the

+ * given $changeMap array.

+ */

+ protected function updateLinks(HtmlDocument $doc, array $changeMap): void

+ {

+ if (empty($changeMap)) {

+ return;

+ }

+

+ $links = $doc->queryXPath('//body//*//*[@href]');

+ /** @var DOMElement $domElem */

+ foreach ($links as $domElem) {

+ $href = ltrim($domElem->getAttribute('href'), '#');

+ $newHref = $changeMap[$href] ?? null;

+ if ($newHref) {

+ $domElem->setAttribute('href', '#' . $newHref);

+ }

}

/**

* Set a unique id on the given DOMElement.

}

/**

* Set a unique id on the given DOMElement.

- * A map for existing ID's should be passed in to check for current existence.

- * Returns a pair of strings in the format [old_id, new_id]

+ * A map for existing ID's should be passed in to check for current existence,

+ * and this will be updated with any new IDs set upon elements.

+ * Returns a pair of strings in the format [old_id, new_id].

*/

- protected function setUniqueId(\DOMNode $element, array &$idMap): array

+ protected function setUniqueId(DOMNode $element, array &$idMap): array

{

- if (get_class($element) !== 'DOMElement') {

+ if (!$element instanceof DOMElement) {

return ['', ''];

}

// Stop if there's an existing valid id that has not already been used.

$existingId = $element->getAttribute('id');

return ['', ''];

}

// Stop if there's an existing valid id that has not already been used.

$existingId = $element->getAttribute('id');

- if (strpos($existingId, 'bkmrk') === 0 && !isset($idMap[$existingId])) {

+ if (str_starts_with($existingId, 'bkmrk') && !isset($idMap[$existingId])) {

$idMap[$existingId] = true;

+

return [$existingId, $existingId];

}

return [$existingId, $existingId];

}

- // Create an unique id for the element

+ // Create a unique id for the element

// Uses the content as a basis to ensure output is the same every time

// the same content is passed through.

$contentId = 'bkmrk-' . mb_substr(strtolower(preg_replace('/\s+/', '-', trim($element->nodeValue))), 0, 20);

$newId = urlencode($contentId);

// Uses the content as a basis to ensure output is the same every time

// the same content is passed through.

$contentId = 'bkmrk-' . mb_substr(strtolower(preg_replace('/\s+/', '-', trim($element->nodeValue))), 0, 20);

$newId = urlencode($contentId);

- $loopIndex = 0;

+ $loopIndex = 1;

while (isset($idMap[$newId])) {

$newId = urlencode($contentId . '-' . $loopIndex);

while (isset($idMap[$newId])) {

$newId = urlencode($contentId . '-' . $loopIndex);

$element->setAttribute('id', $newId);

$idMap[$newId] = true;

$element->setAttribute('id', $newId);

$idMap[$newId] = true;

+

return [$existingId, $newId];

}

return [$existingId, $newId];

}

protected function toPlainText(): string

{

$html = $this->render(true);

protected function toPlainText(): string

{

$html = $this->render(true);

+

return html_entity_decode(strip_tags($html));

}

/**

return html_entity_decode(strip_tags($html));

}

/**

- * Render the page for viewing

+ * Render the page for viewing.

*/

- public function render(bool $blankIncludes = false) : string

+ public function render(bool $blankIncludes = false): string

{

- $content = $this->page->html;

+ $html = $this->page->html ?? '';

- if (!config('app.allow_content_scripts')) {

- $content = $this->escapeScripts($content);

+ if (empty($html)) {

+ return $html;

}

- if ($blankIncludes) {

- $content = $this->blankPageIncludes($content);

- } else {

- $content = $this->parsePageIncludes($content);

+ $doc = new HtmlDocument($html);

+ $contentProvider = $this->getContentProviderClosure($blankIncludes);

+ $parser = new PageIncludeParser($doc, $contentProvider);

+

+ $nodesAdded = 1;

+ for ($includeDepth = 0; $includeDepth < 3 && $nodesAdded !== 0; $includeDepth++) {

+ $nodesAdded = $parser->parse();

}

- return $content;

+ if ($includeDepth > 1) {

+ $idMap = [];

+ $changeMap = [];

+ $this->updateIdsRecursively($doc->getBody(), 0, $idMap, $changeMap);

+ }

+

+ if (!config('app.allow_content_scripts')) {

+ HtmlContentFilter::removeScriptsFromDocument($doc);

+ }

+

+ return $doc->getBodyInnerHtml();

}

/**

}

/**

- * Parse the headers on the page to get a navigation menu

+ * Get the closure used to fetch content for page includes.

+ */

+ protected function getContentProviderClosure(bool $blankIncludes): Closure

+ {

+ $contextPage = $this->page;

+ $queries = $this->pageQueries;

+

+ return function (PageIncludeTag $tag) use ($blankIncludes, $contextPage, $queries): PageIncludeContent {

+ if ($blankIncludes) {

+ return PageIncludeContent::fromHtmlAndTag('', $tag);

+ }

+

+ $matchedPage = $queries->findVisibleById($tag->getPageId());

+ $content = PageIncludeContent::fromHtmlAndTag($matchedPage->html ?? '', $tag);

+

+ if (Theme::hasListeners(ThemeEvents::PAGE_INCLUDE_PARSE)) {

+ $themeReplacement = Theme::dispatch(

+ ThemeEvents::PAGE_INCLUDE_PARSE,

+ $tag->tagContent,

+ $content->toHtml(),

+ clone $contextPage,

+ $matchedPage ? (clone $matchedPage) : null,

+ );

+

+ if ($themeReplacement !== null) {

+ $content = PageIncludeContent::fromInlineHtml(strval($themeReplacement));

+ }

+

+ return $content;

+ };

+ }

+

+ /**

+ * Parse the headers on the page to get a navigation menu.

*/

public function getNavigation(string $htmlContent): array

{

*/

public function getNavigation(string $htmlContent): array

{

return [];

}

return [];

}

- libxml_use_internal_errors(true);

- $doc = new DOMDocument();

- $doc->loadHTML(mb_convert_encoding($htmlContent, 'HTML-ENTITIES', 'UTF-8'));

- $xPath = new DOMXPath($doc);

- $headers = $xPath->query("//h1|//h2|//h3|//h4|//h5|//h6");

+ $doc = new HtmlDocument($htmlContent);

+ $headers = $doc->queryXPath('//h1|//h2|//h3|//h4|//h5|//h6');

- return $headers ? $this->headerNodesToLevelList($headers) : [];

+ return $headers->count() === 0 ? [] : $this->headerNodesToLevelList($headers);

}

/**

}

/**

*/

protected function headerNodesToLevelList(DOMNodeList $nodeList): array

{

*/

protected function headerNodesToLevelList(DOMNodeList $nodeList): array

{

- $tree = collect($nodeList)->map(function ($header) {

- $text = trim(str_replace("\xc2\xa0", '', $header->nodeValue));

+ $tree = collect($nodeList)->map(function (DOMElement $header) {

+ $text = trim(str_replace("\xc2\xa0", ' ', $header->nodeValue));

$text = mb_substr($text, 0, 100);

return [

'nodeName' => strtolower($header->nodeName),

$text = mb_substr($text, 0, 100);

return [

'nodeName' => strtolower($header->nodeName),

- 'level' => intval(str_replace('h', '', $header->nodeName)),

- 'link' => '#' . $header->getAttribute('id'),

- 'text' => $text,

+ 'level' => intval(str_replace('h', '', $header->nodeName)),

+ 'link' => '#' . $header->getAttribute('id'),

+ 'text' => $text,

];

})->filter(function ($header) {

return mb_strlen($header['text']) > 0;

];

})->filter(function ($header) {

return mb_strlen($header['text']) > 0;

$levelChange = ($tree->pluck('level')->min() - 1);

$tree = $tree->map(function ($header) use ($levelChange) {

$header['level'] -= ($levelChange);

$levelChange = ($tree->pluck('level')->min() - 1);

$tree = $tree->map(function ($header) use ($levelChange) {

$header['level'] -= ($levelChange);

+

return $header;

});

return $tree->toArray();

}

return $header;

});

return $tree->toArray();

}

-

- /**

- * Remove any page include tags within the given HTML.

- */

- protected function blankPageIncludes(string $html) : string

- {

- return preg_replace("/{{@\s?([0-9].*?)}}/", '', $html);

- }

-

- /**

- * Parse any include tags "{{@<page_id>#section}}" to be part of the page.

- */

- protected function parsePageIncludes(string $html) : string

- {

- $matches = [];

- preg_match_all("/{{@\s?([0-9].*?)}}/", $html, $matches);

-

- foreach ($matches[1] as $index => $includeId) {

- $fullMatch = $matches[0][$index];

- $splitInclude = explode('#', $includeId, 2);

-

- // Get page id from reference

- $pageId = intval($splitInclude[0]);

- if (is_nan($pageId)) {

- continue;

- }

-

- // Find page and skip this if page not found

- $matchedPage = Page::visible()->find($pageId);

- if ($matchedPage === null) {

- $html = str_replace($fullMatch, '', $html);

- continue;

- }

-

- // If we only have page id, just insert all page html and continue.

- if (count($splitInclude) === 1) {

- $html = str_replace($fullMatch, $matchedPage->html, $html);

- continue;

- }

-

- // Create and load HTML into a document

- $innerContent = $this->fetchSectionOfPage($matchedPage, $splitInclude[1]);

- $html = str_replace($fullMatch, trim($innerContent), $html);

- }

-

- return $html;

- }

-

- /**

- * Fetch the content from a specific section of the given page.

- */

- protected function fetchSectionOfPage(Page $page, string $sectionId): string

- {

- $topLevelTags = ['table', 'ul', 'ol'];

- $doc = new DOMDocument();

- libxml_use_internal_errors(true);

- $doc->loadHTML(mb_convert_encoding('<body>'.$page->html.'</body>', 'HTML-ENTITIES', 'UTF-8'));

-

- // Search included content for the id given and blank out if not exists.

- $matchingElem = $doc->getElementById($sectionId);

- if ($matchingElem === null) {

- return '';

- }

-

- // Otherwise replace the content with the found content

- // Checks if the top-level wrapper should be included by matching on tag types

- $innerContent = '';

- $isTopLevel = in_array(strtolower($matchingElem->nodeName), $topLevelTags);

- if ($isTopLevel) {

- $innerContent .= $doc->saveHTML($matchingElem);

- } else {

- foreach ($matchingElem->childNodes as $childNode) {

- $innerContent .= $doc->saveHTML($childNode);

- }

- libxml_clear_errors();

-

- return $innerContent;

- }

-

- /**

- * Escape script tags within HTML content.

- */

- protected function escapeScripts(string $html) : string

- {

- if (empty($html)) {

- return $html;

- }

-

- libxml_use_internal_errors(true);

- $doc = new DOMDocument();

- $doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));

- $xPath = new DOMXPath($doc);

-

- // Remove standard script tags

- $scriptElems = $xPath->query('//script');

- foreach ($scriptElems as $scriptElem) {

- $scriptElem->parentNode->removeChild($scriptElem);

- }

-

- // Remove clickable links to JavaScript URI

- $badLinks = $xPath->query('//*[contains(@href, \'javascript:\')]');

- foreach ($badLinks as $badLink) {

- $badLink->parentNode->removeChild($badLink);

- }

-

- // Remove forms with calls to JavaScript URI

- $badForms = $xPath->query('//*[contains(@action, \'javascript:\')] | //*[contains(@formaction, \'javascript:\')]');

- foreach ($badForms as $badForm) {

- $badForm->parentNode->removeChild($badForm);

- }

-

- // Remove meta tag to prevent external redirects

- $metaTags = $xPath->query('//meta[contains(@content, \'url\')]');

- foreach ($metaTags as $metaTag) {

- $metaTag->parentNode->removeChild($metaTag);

- }

-

- // Remove data or JavaScript iFrames

- $badIframes = $xPath->query('//*[contains(@src, \'data:\')] | //*[contains(@src, \'javascript:\')] | //*[@srcdoc]');

- foreach ($badIframes as $badIframe) {

- $badIframe->parentNode->removeChild($badIframe);

- }

-

- // Remove 'on*' attributes

- $onAttributes = $xPath->query('//@*[starts-with(name(), \'on\')]');

- foreach ($onAttributes as $attr) {

- /** @var \DOMAttr $attr*/

- $attrName = $attr->nodeName;

- $attr->parentNode->removeAttribute($attrName);

- }

-

- $html = '';

- $topElems = $doc->documentElement->childNodes->item(0)->childNodes;

- foreach ($topElems as $child) {

- $html .= $doc->saveHTML($child);

- }

-

- return $html;

- }

}