<commit_before><?php
/**
 * OWASP Enterprise Security API (ESAPI)
 *
 * This file is part of the Open Web Application Security Project (OWASP)
 * Enterprise Security API (ESAPI) project. For details, please see
 * <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
 *
 * Copyright (c) 2007 - 2009 The OWASP Foundation
 *
 * The ESAPI is published by OWASP under the BSD license. You should read and accept the
 * LICENSE before you use, modify, and/or redistribute this software.
 *
 * @author <NAME> <a href="http://www.jds.net.au">JDS Australia</a>
 * @created 2009
 * @since 1.6
 */

require_once dirname(__FILE__).'/../Encoder.php';
//require_once dirname(__FILE__).'/../codecs/Base64Codec.php';
require_once dirname(__FILE__).'/../codecs/CSSCodec.php';
require_once dirname(__FILE__).'/../codecs/HTMLEntityCodec.php';
require_once dirname(__FILE__).'/../codecs/JavaScriptCodec.php';
//require_once dirname(__FILE__).'/../codecs/LDAPCodec.php';
require_once dirname(__FILE__).'/../codecs/PercentCodec.php';
require_once dirname(__FILE__).'/../codecs/VBScriptCodec.php';

class DefaultEncoder implements Encoder {

//  private $base64Codec     = null;
    private $cssCodec        = null;
    private $htmlCodec       = null;
    private $javascriptCodec = null;
//  private $ldapCodec       = null;
    private $percentCodec    = null;
    private $vbscriptCodec   = null;

    /**
     *  Character sets that define characters (in addition to alphanumerics) that are
     * immune from encoding in various formats
     */
    private $immune_html      = array( ',', '.', '-', '_', ' ' );
    private $immune_htmlattr  = array( ',', '.', '-', '_' );
    private $immune_css       = array();
    private $immune_javascript= array( ',', '.', '_' );
    private $immune_vbscript  = array( ',', '.', '_' );
    private $immune_xml       = array( ',', '.', '-', '_', ' ' );
    private $immune_sql       = array( ' ' );
    private $immune_os        = array( '-' );
    private $immune_xmlattr   = array( ',', '.', '-', '_' );
    private $immune_xpath     = array( ',', '.', '-', '_', ' ' );
    private $immune_url       = array( '.', '-', '*', '_');
    private $codecs=array();

    function __construct()
    {
        // initialise codecs
//      $this->base64Codec     = new Base64Codec();
        $this->cssCodec        = new CSSCodec();
        $this->htmlCodec       = new HTMLEntityCodec();
        $this->javascriptCodec = new JavaScriptCodec();
//      $this->ldapCodec       = new LDAPCodec();
        $this->percentCodec    = new PercentCodec();
        $this->vbscriptCodec   = new VBScriptCodec();
        
        // initialise array of codecs for use by canonicalize
        array_push($this->codecs, $this->percentCodec);
        array_push($this->codecs, $this->htmlCodec);
        array_push($this->codecs, $this->javascriptCodec);
        // leaving css and vbs codecs out - they eat / and " chars respectively
        // array_push($this->codecs,$this->cssCodec);
        // array_push($this->codecs,$this->vbscriptCodec);
        
    }

    /**
     * This method performs canonicalization on data received to ensure that it
     * has been reduced to its most basic form before validation. For example,
     * URL-encoded data received from ordinary "application/x-www-url-encoded"
     * forms so that it may be validated properly.
     * <p>
     * Canonicalization is simply the operation of reducing a possibly encoded
     * string down to its simplest form. This is important, because attackers
     * frequently use encoding to change their input in a way that will bypass
     * validation filters, but still be interpreted properly by the target of<commit_msg>Allow an array of codec instances to be passed to the constructor of DefaultEncoder.<commit_after><?php
/**
 * OWASP Enterprise Security API (ESAPI)
 *
 * This file is part of the Open Web Application Security Project (OWASP)
 * Enterprise Security API (ESAPI) project. For details, please see
 * <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
 *
 * Copyright (c) 2007 - 2009 The OWASP Foundation
 *
 * The ESAPI is published by OWASP under the BSD license. You should read and accept the
 * LICENSE before you use, modify, and/or redistribute this software.
 *
 * @author <NAME> <a href="http://www.jds.net.au">JDS Australia</a>
 * @created 2009
 * @since 1.6
 */

require_once dirname(__FILE__).'/../Encoder.php';
//require_once dirname(__FILE__).'/../codecs/Base64Codec.php';
require_once dirname(__FILE__).'/../codecs/CSSCodec.php';
require_once dirname(__FILE__).'/../codecs/HTMLEntityCodec.php';
require_once dirname(__FILE__).'/../codecs/JavaScriptCodec.php';
//require_once dirname(__FILE__).'/../codecs/LDAPCodec.php';
require_once dirname(__FILE__).'/../codecs/PercentCodec.php';
require_once dirname(__FILE__).'/../codecs/VBScriptCodec.php';

class DefaultEncoder implements Encoder {

//  private $base64Codec     = null;
    private $cssCodec        = null;
    private $htmlCodec       = null;
    private $javascriptCodec = null;
//  private $ldapCodec       = null;
    private $percentCodec    = null;
    private $vbscriptCodec   = null;

    /**
     *  Character sets that define characters (in addition to alphanumerics) that are
     * immune from encoding in various formats
     */
    private $immune_html      = array( ',', '.', '-', '_', ' ' );
    private $immune_htmlattr  = array( ',', '.', '-', '_' );
    private $immune_css       = array();
    private $immune_javascript= array( ',', '.', '_' );
    private $immune_vbscript  = array( ',', '.', '_' );
    private $immune_xml       = array( ',', '.', '-', '_', ' ' );
    private $immune_sql       = array( ' ' );
    private $immune_os        = array( '-' );
    private $immune_xmlattr   = array( ',', '.', '-', '_' );
    private $immune_xpath     = array( ',', '.', '-', '_', ' ' );
    private $immune_url       = array( '.', '-', '*', '_');
    private $codecs=array();

    function __construct($codecArrayForCanonicalizer=null)
    {
        // initialise codecs
//      $this->base64Codec     = new Base64Codec();
        $this->cssCodec        = new CSSCodec();
        $this->htmlCodec       = new HTMLEntityCodec();
        $this->javascriptCodec = new JavaScriptCodec();
//      $this->ldapCodec       = new LDAPCodec();
        $this->percentCodec    = new PercentCodec();
        $this->vbscriptCodec   = new VBScriptCodec();
        
        // initialise array of codecs for use by canonicalize
        if ($codecArrayForCanonicalizer === null)
        {
            array_push($this->codecs, $this->percentCodec);
            array_push($this->codecs, $this->htmlCodec);
            array_push($this->codecs, $this->javascriptCodec);
            // leaving css and vbs codecs out - they eat / and " chars respectively
            // array_push($this->codecs,$this->cssCodec);
            // array_push($this->codecs,$this->vbscriptCodec);
        }
        elseif (! is_array($codecArrayForCanonicalizer))
        {
            throw new Exception('Invalid Argument. Codec list must be of type Array.');
        }
        else
        {
            // check array only contains codec instances
            foreach ($codecArrayForCanonicalizer as $codec)
            {
                if (! is_a($codec, 'Codec')) throw new Exception('Invalid Argument. Codec list must contain only Codec instances.');
            }
            $this->codecs = array_merge($this->codecs, $codecArrayForCanonicalizer);
        }
        
    }

    /**
     * This method performs canonicalization on data received to ensure that it
     * has been reduced to its most basic form before validation. For example,
     * URL-encoded data received from ordinary "application/x-www-url-encoded"
     * forms so that it may be validated properly.
     * <p>
     * Canonicalization is simply the operation of reducing a possibly encoded
     * string down to its simplest form. This is important, because attackers
     * frequently use encoding to change their input in a way that will bypass
     * validation filters, but still be interpreted properly by the target of
{'fraction_non_alphanumeric': 0.14007782101167315, 'fraction_numerical': 0.005350194552529183, 'mean_word_length': 2.728467815049864, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 51, 'https://': 0, 'lorem ipsum': 0, 'www.': 8, 'xml': 4}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '906739', 'n_tokens_mistral': 2430, 'n_tokens_neox': 2394, 'n_words': 652}