Remove DOMDocument post-processing by using html-sanitizer fully

composer · Jun 14, 2024 · a9dc0cb · a9dc0cb
1 parent a68427a
commit a9dc0cb
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 82 deletions.
diff --git a/src/Package/Updater.php b/src/Package/Updater.php
@@ -14,6 +14,8 @@
 
 use App\Entity\Dependent;
 use App\Entity\PackageFreezeReason;
+use App\HtmlSanitizer\ReadmeImageSanitizer;
+use App\HtmlSanitizer\ReadmeLinkSanitizer;
 use App\Util\HttpDownloaderOptionsFactory;
 use cebe\markdown\GithubMarkdown;
 use Composer\Package\AliasPackage;
@@ -39,7 +41,6 @@
 use Doctrine\DBAL\Connection;
 use App\Service\VersionCache;
 use Composer\Package\CompletePackageInterface;
-use DOMElement;
 use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
 use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;
 use Symfony\Component\Mailer\MailerInterface;
@@ -758,76 +759,19 @@ private function prepareReadme(string $readme, ?string $host = null, ?string $ow
             ->allowAttribute('align', ['th', 'td', 'p', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6'])
             ->allowAttribute('class', '*')
             ->allowLinkSchemes(['https', 'http', 'mailto'])
+            ->forceAttribute('a', 'rel', 'nofollow noindex noopener external ugc')
+            ->withAttributeSanitizer(new ReadmeLinkSanitizer($host, $owner.'/'.$repo, $basePath))
+            ->withAttributeSanitizer(new ReadmeImageSanitizer($host, $owner.'/'.$repo, $basePath))
             ->allowRelativeLinks()
             ->allowRelativeMedias()
             ->withMaxInputLength(10_000_000);
 
         $sanitizer = new HtmlSanitizer($config);
         $readme = $sanitizer->sanitizeFor('body', $readme);
 
-        libxml_use_internal_errors(true);
-        $dom = new \DOMDocument();
-        $dom->loadHTML('<?xml encoding="UTF-8">' . $readme);
-
-        // Links can not be trusted, mark them nofollow and convert relative to absolute links
-        $links = $dom->getElementsByTagName('a');
-        /** @var DOMElement $link */
-        foreach ($links as $link) {
-            $link->setAttribute('rel', 'nofollow noindex noopener external ugc');
-            if ('#' === substr($link->getAttribute('href'), 0, 1)) {
-                $link->setAttribute('href', '#user-content-'.substr($link->getAttribute('href'), 1));
-            } elseif ('mailto:' === substr($link->getAttribute('href'), 0, 7)) {
-                // do nothing
-            } elseif ($host === 'github.com' && !str_contains($link->getAttribute('href'), '//')) {
-                $link->setAttribute(
-                    'href',
-                    'https://github.com/'.$owner.'/'.$repo.'/blob/HEAD/'.$basePath.$link->getAttribute('href')
-                );
-            } elseif ($host === 'gitlab.com' && !str_contains($link->getAttribute('href'), '//')) {
-                $link->setAttribute(
-                    'href',
-                    'https://gitlab.com/'.$owner.'/'.$repo.'/-/blob/HEAD/'.$basePath.$link->getAttribute('href')
-                );
-            }
-            if ($link->getAttribute('target') !== '' && $link->getAttribute('target') !== '_blank') {
-                $link->setAttribute('target', '_blank');
-            }
-        }
-
-        // embed images of selected hosts by converting relative links to accessible URLs
-        if (in_array($host, ['github.com', 'gitlab.com', 'bitbucket.org'], true)) {
-            $images = $dom->getElementsByTagName('img');
-            /** @var DOMElement $img */
-            foreach ($images as $img) {
-                if (!str_contains($img->getAttribute('src'), '//')) {
-                    $imgSrc = match ($host) {
-                        'github.com' => 'https://raw.github.com/'.$owner.'/'.$repo.'/HEAD/'.$basePath.$img->getAttribute('src'),
-                        'gitlab.com' => 'https://gitlab.com/'.$owner.'/'.$repo.'/-/raw/HEAD/'.$basePath.$img->getAttribute('src'),
-                        'bitbucket.org' => 'https://bitbucket.org/'.$owner.'/'.$repo.'/raw/HEAD/'.$basePath.$img->getAttribute('src'),
-                    };
-                    $img->setAttribute('src', $imgSrc);
-                }
-            }
-        }
-
         // remove first page element if it's a <h1> or <h2>, because it's usually
         // the project name or the `README` string which we don't need
-        $first = $dom->getElementsByTagName('body')->item(0);
-        if ($first) {
-            $first = $first->childNodes->item(0);
-        }
-
-        if ($first && ('h1' === $first->nodeName || 'h2' === $first->nodeName)) {
-            $first->parentNode?->removeChild($first);
-        }
-
-        $readme = $dom->saveHTML();
-        Assert::string($readme);
-        $readme = substr($readme, strpos($readme, '<body>') + 6);
-        $readme = substr($readme, 0, strrpos($readme, '</body>') ?: PHP_INT_MAX);
-
-        libxml_use_internal_errors(false);
-        libxml_clear_errors();
+        $readme = Preg::replace('{^<(h[12])>.*</(?1)>}', '', $readme);
 
         return str_replace("\r\n", "\n", $readme);
     }