HTMLAttributeValue.php

Go to the documentation of this file.

<?php

declare(strict_types=1);

namespace ILIAS\Refinery\Encode\Transformation;

use ILIAS\Refinery\Transformation;
use ILIAS\Refinery\DeriveInvokeFromTransform;
use ILIAS\Refinery\DeriveApplyToFromTransform;
use ValueError;

class HTMLAttributeValue implements Transformation
{
    use DeriveInvokeFromTransform;
    use DeriveApplyToFromTransform;

    public function transform($from)
    {
        return $this->encode($from);
    }

    private function encode(string $from): string
    {
        return preg_replace_callback(
            '/[^a-z0-9,._-]/iSu',
            fn(array $m): string => $this->replace($m[0]),
            $from
        ) ?? throw new ValueError('Invalid UTF-8 string given.');
    }

    private function replace(string $utf8_char): string
    {
        $codepoint = $this->utf8CharacterToCodepoint($utf8_char);

        // All unicode control characters besides white space codepoints as well as noncharacters are not allowed in HTML attributes.
        if ($this->isNonPrintableControl($utf8_char, $codepoint) || $this->isNonCharacter($codepoint)) {
            return '&#xFFFD;'; // Unicode "replacement character", indicating a non printable character.
        }

        return match ($codepoint) {
            34 => '&quot;',
            38 => '&amp;',
            60 => '&lt;',
            62 => '&gt;',
            default => sprintf($codepoint > 255 ? '&#x%04X;' : '&#x%02X;', $codepoint),
        };
    }

    private function utf8CharacterToCodepoint(string $utf8_char): int
    {
        // UTF-32 encodes Unicode codepoints as itself. BE stands for Big Endian.
        return hexdec(bin2hex(strlen($utf8_char) > 1 ? (mb_convert_encoding($utf8_char, 'UTF-32BE', 'UTF-8')) : $utf8_char));
    }

    private function isNonPrintableControl(string $utf8_char, int $codepoint): bool
    {
        return strlen($utf8_char) === 1 ?
            ctype_cntrl($utf8_char) && !ctype_space($utf8_char) :
            $codepoint <= 0x9F;
    }

    private function isNonCharacter(int $codepoint): bool
    {
        return 0xFDD0 <= $codepoint && $codepoint <= 0xFDEF ||
               in_array($codepoint, [0xFFFE, 0xFFFF, 0x1FFFE, 0x1FFFF, 0x2FFFE, 0x2FFFF, 0x3FFFE, 0x3FFFF, 0x4FFFE, 0x4FFFF, 0x5FFFE, 0x5FFFF, 0x6FFFE, 0x6FFFF, 0x7FFFE, 0x7FFFF, 0x8FFFE, 0x8FFFF, 0x9FFFE, 0x9FFFF, 0xAFFFE, 0xAFFFF, 0xBFFFE, 0xBFFFF, 0xCFFFE, 0xCFFFF, 0xDFFFE, 0xDFFFF, 0xEFFFE, 0xEFFFF, 0xFFFFE, 0xFFFFF, 0x10FFFE,  0x10FFFF], true);
    }
}