Re: is there a way to stop HTMLPurifier/CSStidy from forcing input CSS into all lowercase?

On Thu, May 31, 2012 at 11:17 PM, Govinda <govinda.webdnatalk@gmail.com> wrote: >> >> You need to get better tools.  I found this with Notepad++ for Windows >> searching "case" within *.php files filter within the root directory >> of the extracted zip/tarball: >> >>  H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\Font.php >> (6 hits) >>       Line 45:         $lowercase_string = strtolower($string); >>       Line 46:         if (isset($system_fonts[$lowercase_string])) { >>       Line 47:             return $lowercase_string; >>       Line 61:                 case 0: >>       Line 77:                 case 1: >>       Line 131:                 case 2: >> >> Haven't looked at the entire file or source code but that looks close >> enough to me... ;) > > Thanks a lot for taking a look Tommy, > > I do have a decent text editor I use to code with... and had searched for possible places where > is the culprit strtolower() ... and so far no matter which instances(s) I comment out, I cannot seem > to turn off the behavior of the library as a whole (either of them, or both) which is forcing the > input CSS to lowercase. > Perhaps you should spend some time looking for a better text editor for your OS. :) When the current tools I use does not give satisfactory progress in what I'd like to do, I replace the tool(s). > For example, I also just tried the exact place you suggested: this one: > > [snip]htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\Font.php > > ...and changed line 45 to this: > >        //$lowercase_string = strtolower($string);//Govinda hack >        $lowercase_string = $string; > > but still no luck. > > >>> Have you tried http://htmlpurifier.org/phorum/ and did >>> you noticed >>> "Since the project has been suspended, please only contact me if you >>> intend to continue maintaining it." for CSSTidy? > > I hadn't posted on http://htmlpurifier.org/phorum because > last time I did that when I has also posted on stackoverlfow (SO), then the developer of > HTMLpurifier scolded me for the dupe ;-) ..  and he has already posted a comment on my (this new) > SO post, saying just, "Hmm, that's silly of CSS Tidy. Maybe we should change that > default.".  I assume he probably has a lot on his plate, to the point that his answers are > incredibly terse and not necessarily very helpful. > > I did see the message about CSStidy no longer being developed (if that is the meaning behind > "suspended").  Yet when i was researching it, many people were still recommending it. >  No?  Do you know/prefer something else for the purpose of cleaning user-input CSS bound for an > external style sheet? > > Thanks > -Govinda Are you sure you fixed ALL of the offending lines containing strtolower? This is what Notepad++ returns when I search for "strtolower": Search "strtolower" (48 hits in 28 files) H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\Background.php (1 hits) Line 35: $bits = explode(' ', strtolower($string)); // bits to process H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\BackgroundPosition.php (1 hits) Line 80: $lbit = ctype_lower($bit) ? $bit : strtolower($bit); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\Color.php (1 hits) Line 17: $lower = strtolower($color); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\Font.php (1 hits) Line 45: $lowercase_string = strtolower($string); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\ListStyle.php (1 hits) Line 30: $bits = explode(' ', strtolower($string)); // bits to process H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS\TextDecoration.php (1 hits) Line 19: $string = strtolower($this->parseCDATA($string)); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\CSS.php (2 hits) Line 51: $property = strtolower($property); Line 59: if (strtolower(trim($value)) !== 'inherit') { H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\Enum.php (2 hits) Line 7: * built-in strtolower and ctype_lower functions, which may Line 40: $string = ctype_lower($string) ? $string : strtolower($string); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\HTML\Color.php (1 hits) Line 17: if (isset($colors[strtolower($string)])) return $colors[$string]; H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\HTML\LinkTypes.php (1 hits) Line 39: $part = strtolower(trim($part)); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrDef\Lang.php (3 hits) Line 35: $subtags[0] = strtolower($subtags[0]); Line 50: if (!ctype_lower($subtags[1])) $subtags[1] = strtolower($subtags[1]); Line 62: $subtags[$i] = strtolower($subtags[$i]); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrTransform\EnumToCSS.php (1 hits) Line 44: if (!$this->caseSensitive) $value = strtolower($value); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\AttrTransform\Input.php (1 hits) Line 17: else $t = strtolower($attr['type']); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\Encoder..php (1 hits) Line 507: $lenc = strtolower($encoding); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\Filter\ExtractStyleBlocks.php (1 hits) Line 194: if ($y === '*' || isset($html_definition->info[$y = strtolower($y)])) { H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\HTMLModule.php (1 hits) Line 197: $content_model_type = strtolower(trim($content_model_type)); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\Length.php (1 hits) Line 62: if (!ctype_lower($this->unit)) $this->unit = strtolower($this->unit); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\Lexer\PH5P.php (8 hits) Line 328: 'name' => strtolower($char), Line 368: $next_node = strtolower($this->characters('A-Za-z', $this->char + 1)); Line 410: 'name' => strtolower($char), Line 479: $this->token['name'] .= strtolower($char); Line 525: 'name' => strtolower($char), Line 578: $this->token['attr'][$last]['name'] .= strtolower($char); Line 630: 'name' => strtolower($char), Line 848: } elseif(strtolower($this->character($this->char + 1, 7)) === 'doctype') { H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\Printer..php (2 hits) Line 138: if (!$five) $prefix = strtolower($prefix); Line 140: $lclass = strtolower($class); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\Token\Tag.php (2 hits) Line 37: $this->name = ctype_lower($name) ? $name : strtolower($name); Line 41: $new_key = strtolower($key); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\URI.php (1 hits) Line 20: $this->scheme = is_null($scheme) || ctype_lower($scheme) ? $scheme : strtolower($scheme); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\library\HTMLPurifier\VarParser.php (1 hits) Line 79: if ($type == self::ISTRING || $type == self::ITEXT) $var = strtolower($var); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\maintenance\PH5P.php (8 hits) Line 266: 'name' => strtolower($char), Line 306: $next_node = strtolower($this->characters('A-Za-z', $this->char + 1)); Line 348: 'name' => strtolower($char), Line 417: $this->token['name'] .= strtolower($char); Line 463: 'name' => strtolower($char), Line 516: $this->token['attr'][$last]['name'] .= strtolower($char); Line 568: 'name' => strtolower($char), Line 785: } elseif(strtolower($this->character($this->char + 1, 7)) === 'doctype') { H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\maintenance\update-freshmeat..php (1 hits) Line 110: else $method .= '_' . strtolower($v); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\plugins\phorum\config.default.php (1 hits) Line 53: if (strtolower($GLOBALS['PHORUM']['DATA']['CHARSET']) !== 'utf-8') { H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\plugins\phorum\settings\migrate-sigs.php (1 hits) Line 7: if (!isset($_POST['confirmation']) || strtolower($_POST['confirmation']) !== 'yes') { H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\tests\common.php (1 hits) Line 104: $lopt = strtolower($opt); H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\tests\HTMLPurifier\Harness.php (1 hits) Line 80: if (strtolower(substr($method, 0, 10)) == '__onlytest') { Given the above filenames, that pretty much takes care of all CSS... Searching without file filters gives this in addition to above: Search "strtolower" (51 hits in 30 files) H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\docs\dev-code-quality.txt (1 hits) Line 13: a lot of strtolower() calls, no legit casing H:\data\Downloads\dev\PHP\htmlpurifier-4.4.0\docs\enduser-utf8.html (2 hits) Line 1006: <li>...convert case (strtolower, strtoupper, ucfirst, ucwords)</li> Line 1019: <code>strtolower</code> (HTML Purifier uses this function.)</p> Those above 2 filenames seems rather interesting... Then there's the csstidy search for strtolower: Search "strtolower" (12 hits in 4 files) H:\data\Downloads\dev\PHP\csstidy-1.3\class.csstidy.php (3 hits) Line 706: $this->selector = strtolower($this->selector); Line 708: $this->property = strtolower($this->property); Line 977: $istring = strtolower(trim(substr($istring,0,$pos))); H:\data\Downloads\dev\PHP\csstidy-1.3\class.csstidy_optimise.php (6 hits) Line 300: if(strtolower(substr($color,0,4)) == 'rgb(') Line 325: if(isset($replace_colors[strtolower($color)])) Line 327: $color = $replace_colors[strtolower($color)]; Line 333: $color_temp = strtolower($color); Line 340: switch(strtolower($color)) Line 408: if (strpos(strtolower($temp[$l]),$units[$m]) !== FALSE) H:\data\Downloads\dev\PHP\csstidy-1.3\class.csstidy_print.php (2 hits) Line 169: if($this->parser->get_cfg('lowercase_s')) $token[1] = strtolower($token[1]); Line 176: if($this->parser->get_cfg('case_properties') == 1) $token[1] = strtolower($token[1]); H:\data\Downloads\dev\PHP\csstidy-1.3\lang.inc.php (1 hits) Line 6: $l = strtolower(substr($l,0,2)); HTH, Tommy