<commit_before><?php

/**
* @package   s9e\TextFormatter
* @copyright Copyright (c) 2010-2015 The s9e Authors
* @license   http://www.opensource.org/licenses/mit-license.php The MIT License
*/
namespace s9e\TextFormatter\Configurator\TemplateChecks;

use DOMElement;
use DOMNode;
use DOMXPath;
use s9e\TextFormatter\Configurator\Exceptions\UnsafeTemplateException;
use s9e\TextFormatter\Configurator\Items\Tag;
use s9e\TextFormatter\Configurator\TemplateCheck;

/**
* NOTE: when this check is enabled, DisallowObjectParamsWithGeneratedName should be enabled too.
*       Otherwise, <param/> elements with a dynamic 'name' attribute could be used to bypass this
*       restriction. For the same reason, DisallowCopy, DisallowDisableOutputEscaping,
*       DisallowDynamicAttributeNames, DisallowDynamicElementNames and DisallowUnsafeCopyOf should
*       all be enabled too
*/
abstract class AbstractFlashRestriction extends TemplateCheck
{
	/**
	* @var string Name of the default setting
	*/
	public $defaultSetting;

	/**
	* @var string Name of the highest setting allowed
	*/
	public $maxSetting;

	/**
	* @var bool Whether this restriction applies only to elements using any kind of dynamic markup:
	*           XSL elements or attribute value templates
	*/
	public $onlyIfDynamic;

	/**
	* @var string Name of the restricted setting
	*/
	protected $settingName;

	/**
	* @var array Valid settings
	*/
	protected $settings;

	/**
	* Constructor
	*
	* @param  string $maxSetting    Max setting allowed
	* @param  bool   $onlyIfDynamic Whether this restriction applies only to elements using any kind
	*                               of dynamic markup: XSL elements or attribute value templates
	* @return void
	*/
	public function __construct($maxSetting, $onlyIfDynamic = false)
	{
		$this->maxSetting    = $maxSetting;
		$this->onlyIfDynamic = $onlyIfDynamic;
	}

	/**
	* Test for the set Flash restriction
	*
	* @param  DOMElement $template <xsl:template/> node
	* @param  Tag        $tag      Tag this template belongs to
	* @return void
	*/
	public function check(DOMElement $template, Tag $tag)
	{
		$dom         = $template->ownerDocument;
		$settingName = strtolower($this->settingName);

		// Test <embed/> elements
		foreach ($dom->getElementsByTagName('embed') as $embed)
		{
			if ($this->onlyIfDynamic && !$this->isDynamic($embed))
			{
				continue;
			}

			$useDefault  = true;

			// Test the element's attributes
			foreach ($embed->attributes as $attribute)
			{
				$attrName = strtolower($attribute->name);

				if ($attrName === $settingName)
				{
					$this->checkSetting($attribute, $attribute->value);
					$useDefault = false;
				}
			}

			if ($useDefault)
			{
				$this->checkSetting($embed, $this->defaultSetting);
			}

			// Test <xsl:attribute/> descendants
			$nodes = $embed->getElementsByTagNameNS(self::XMLNS_XSL, 'attribute');

			foreach ($nodes as $attribute)
			{
				$attrName = strtolower($attribute->getAttribute('name'));

				if ($attrName === $settingName)
				{
					throw new UnsafeTemplateException('Cannot assess the safety of dynamic attributes', $attribute);
				}
			}
		}

		// Test <object/> elements
		foreach ($template->getElementsByTagName('object') as $object)
		{
			if ($this->onlyIfDynamic && !$this->isDynamic($object))
			{
				continue;
			}

			$useDefault = true;

			// Test the element's <param/> descendants
			foreach ($template->getElementsByTagName('param') as $param)
			{
				$paramName = strtolower($param->getAttribute('name'));

				if ($paramName === $settingName)
				{
					$this->checkSetting($param, $param->getAttribute('value'));

					// Test for a dynamic "value" attribute
					$nodes = $param->getElementsByTagNameNS(self::XMLNS_XSL, 'attribute');
					foreach ($nodes as $attribute)
					{
						if (strtolower($attribute->getAttribute('name')) === 'value')
						{
							throw new UnsafeTemplateException('Cannot assess the safety of dynamic attributes', $attribute);
						}
					}

					// Test whether this <param/> is a child of this object. If it's not, it might
					// actually apply to another <object/> descendant used as fallback, or perhaps
					// it's in an <xsl:if/> condition
					if ($param->parentNode->isSameNode($object))
					{
						$useDefault = false;
					}
				}
			}

			if ($useDefault)
			{
				if (!$this->onlyIfDynamic || $this->isDynamic($object))
				{
					$this->checkSetting($object, $this->defaultSetting);
				}
			}
		}
	}

	/**
	* Test whether given setting is allowed
	*
	* @param  DOMNode $node    Target node
	* @param  string  $setting Setting
	* @return void
	*/
	protected function checkSetting(DOMNode $node, $setting)
	{
		if (!isset($this->settings[strtolower($setting)]))
		{
			// Test whether the value contains an odd number of {
			if (preg_match('/(?<!\\{)\\{(?:\\{\\{)*(?!\\{)/', $setting))
			{
				throw new UnsafeTemplateException('Cannot assess ' . $this->settingName . " setting '" . $setting . "'", $node);<commit_msg>Reorganized AbstractFlashRestriction<commit_after><?php

/**
* @package   s9e\TextFormatter
* @copyright Copyright (c) 2010-2015 The s9e Authors
* @license   http://www.opensource.org/licenses/mit-license.php The MIT License
*/
namespace s9e\TextFormatter\Configurator\TemplateChecks;

use DOMElement;
use DOMNode;
use DOMXPath;
use s9e\TextFormatter\Configurator\Exceptions\UnsafeTemplateException;
use s9e\TextFormatter\Configurator\Items\Tag;
use s9e\TextFormatter\Configurator\TemplateCheck;

/**
* NOTE: when this check is enabled, DisallowObjectParamsWithGeneratedName should be enabled too.
*       Otherwise, <param/> elements with a dynamic 'name' attribute could be used to bypass this
*       restriction. For the same reason, DisallowCopy, DisallowDisableOutputEscaping,
*       DisallowDynamicAttributeNames, DisallowDynamicElementNames and DisallowUnsafeCopyOf should
*       all be enabled too
*/
abstract class AbstractFlashRestriction extends TemplateCheck
{
	/**
	* @var string Name of the default setting
	*/
	public $defaultSetting;

	/**
	* @var string Name of the highest setting allowed
	*/
	public $maxSetting;

	/**
	* @var bool Whether this restriction applies only to elements using any kind of dynamic markup:
	*           XSL elements or attribute value templates
	*/
	public $onlyIfDynamic;

	/**
	* @var string Name of the restricted setting
	*/
	protected $settingName;

	/**
	* @var array Valid settings
	*/
	protected $settings;

	/**
	* Constructor
	*
	* @param  string $maxSetting    Max setting allowed
	* @param  bool   $onlyIfDynamic Whether this restriction applies only to elements using any kind
	*                               of dynamic markup: XSL elements or attribute value templates
	* @return void
	*/
	public function __construct($maxSetting, $onlyIfDynamic = false)
	{
		$this->maxSetting    = $maxSetting;
		$this->onlyIfDynamic = $onlyIfDynamic;
	}

	/**
	* Test for the set Flash restriction
	*
	* @param  DOMElement $template <xsl:template/> node
	* @param  Tag        $tag      Tag this template belongs to
	* @return void
	*/
	public function check(DOMElement $template, Tag $tag)
	{
		$this->checkEmbed($template);
		$this->checkObject($template);
	}

	/**
	* Check embed elements in given template
	*
	* @param  DOMElement $template <xsl:template/> node
	* @return void
	*/
	protected function checkEmbed(DOMElement $template)
	{
		$settingName = strtolower($this->settingName);
		foreach ($template->ownerDocument->getElementsByTagName('embed') as $embed)
		{
			if ($this->onlyIfDynamic && !$this->isDynamic($embed))
			{
				continue;
			}

			// Test <xsl:attribute/> descendants
			$nodes = $embed->getElementsByTagNameNS(self::XMLNS_XSL, 'attribute');
			foreach ($nodes as $attribute)
			{
				$attrName = strtolower($attribute->getAttribute('name'));
				if ($attrName === $settingName)
				{
					throw new UnsafeTemplateException('Cannot assess the safety of dynamic attributes', $attribute);
				}
			}

			// Test the element's attributes
			$useDefault  = true;
			foreach ($embed->attributes as $attribute)
			{
				$attrName = strtolower($attribute->name);

				if ($attrName === $settingName)
				{
					$this->checkSetting($attribute, $attribute->value);
					$useDefault = false;
				}
			}
			if ($useDefault)
			{
				$this->checkSetting($embed, $this->defaultSetting);
			}
		}
	}

	/**
	* Check object elements in given template
	*
	* @param  DOMElement $template <xsl:template/> node
	* @return void
	*/
	protected function checkObject(DOMElement $template)
	{
		$settingName = strtolower($this->settingName);
		foreach ($template->getElementsByTagName('object') as $object)
		{
			if ($this->onlyIfDynamic && !$this->isDynamic($object))
			{
				continue;
			}

			// Test the element's <param/> descendants
			$useDefault = true;
			foreach ($template->getElementsByTagName('param') as $param)
			{
				$paramName = strtolower($param->getAttribute('name'));

				if ($paramName === $settingName)
				{
					$this->checkSetting($param, $param->getAttribute('value'));

					// Test for a dynamic "value" attribute
					$nodes = $param->getElementsByTagNameNS(self::XMLNS_XSL, 'attribute');
					foreach ($nodes as $attribute)
					{
						if (strtolower($attribute->getAttribute('name')) === 'value')
						{
							throw new UnsafeTemplateException('Cannot assess the safety of dynamic attributes', $attribute);
						}
					}

					// Test whether this <param/> is a child of this object. If it's not, it might
					// actually apply to another <object/> descendant used as fallback, or perhaps
					// it's in an <xsl:if/> condition
					if ($param->parentNode->isSameNode($object))
					{
						$useDefault = false;
					}
				}
			}
			if ($useDefault)
			{
				$this->checkSetting($object, $this->defaultSetting);
			}
		}
	}

	/**
	* Test whether given setting is allowed
	*
	* @param  DOMNode $node    Target node
	* @param  string  $setting Setting
	* @return void
	*/
	protected function checkSetting(DOMNode $node, $setting)
	{
		if (!isset($this->settings[strtolower($setting)]))
		{
			// Test whether the value contains an odd number of {
			if (preg_match('/(?<!\\{)\\{(?:\\{\\{)*(?!\\{)/', $setting))
			{
				throw new UnsafeTemplateException('Cannot assess ' . $this->settingName . " setting '" . $setting . "'", $node);
{'fraction_non_alphanumeric': 0.13009708737864079, 'fraction_numerical': 0.0027184466019417475, 'mean_word_length': 3.4362618432385874, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 86, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '136101', 'n_tokens_mistral': 3559, 'n_tokens_neox': 3038, 'n_words': 833}