3 files changed, 160 insertions, 6 deletions

diff --git a/modules/gallery/libraries/I18n.php b/modules/gallery/libraries/I18n.php
index 03a6d8f6..8dc42e04 100644
--- a/modules/gallery/libraries/I18n.php
+++ b/modules/gallery/libraries/I18n.php
@@ -84,6 +84,12 @@ class I18n_Core {
 
   /**
    * Translates a localizable message.
+   *
+   * Security:
+   * The returned string is safe for use in HTML (it contains a safe subset of HTML and
+   * interpolation parameters are converted to HTML entities).
+   * For use in JavaScript, please call ->for_js() on it.
+   *
    * @param $message String|array The message to be translated. E.g. "Hello world"
    *                 or array("one" => "One album", "other" => "%count albums")
    * @param $options array (optional) Options array for key value pairs which are used
@@ -110,7 +116,7 @@ class I18n_Core {
 
     $entry = $this->interpolate($locale, $entry, $values);
 
-    return $entry;
+    return SafeString::of($entry)->mark_html_safe();
   }
 
   private function lookup($locale, $message) {
@@ -179,17 +185,19 @@ class I18n_Core {
     return is_array($message);
   }
   
-  private function interpolate($locale, $string, $values) {
+  private function interpolate($locale, $string, $key_values) {
     // TODO: Handle locale specific number formatting.
 
     // Replace x_y before replacing x.
-    krsort($values, SORT_STRING);
+    krsort($key_values, SORT_STRING);
 
     $keys = array();
-    foreach (array_keys($values) as $key) {
+    $values = array();
+    foreach ($key_values as $key => $value) {
       $keys[] = "%$key";
+      $values[] = new SafeString($value);
     }
-    return str_replace($keys, array_values($values), $string);
+    return str_replace($keys, $values, $string);
   }
 
   private function pluralize($locale, $entry, $count) {
@@ -414,4 +422,4 @@ class I18n_Core {
         return $count == 1 ? 'one' : 'other';
     }
   }
-}
\ No newline at end of file
+}
diff --git a/modules/gallery/libraries/MY_ORM.php b/modules/gallery/libraries/MY_ORM.php
index de8adc1d..2c9ad1d7 100644
--- a/modules/gallery/libraries/MY_ORM.php
+++ b/modules/gallery/libraries/MY_ORM.php
@@ -43,6 +43,10 @@ class ORM extends ORM_Core {
       $this->original = clone $this;
     }
 
+    if ($value instanceof SafeString) {
+      $value = $value->unescaped();
+    }
+
     return parent::__set($column, $value);
   }
 
diff --git a/modules/gallery/libraries/SafeString.php b/modules/gallery/libraries/SafeString.php
new file mode 100644
index 00000000..53bcb27a
--- /dev/null
+++ b/modules/gallery/libraries/SafeString.php
@@ -0,0 +1,142 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * Safe string representation (regarding security - cross site scripting).
+ */
+class SafeString_Core {
+  private $_raw_string;
+  protected $_is_safe_html = false;
+
+  private static $_purifier = null;
+
+  /** Constructor */
+  function __construct($string) {
+    if ($string instanceof SafeString) {
+      $this->_is_safe_html = $string->_is_safe_html;
+      $string = $string->unescaped();
+    }
+    $this->_raw_string = (string) $string;
+  }
+
+  /**
+   * Factory method returning a new SafeString instance for the given string.
+   */
+  static function of($string) {
+    return new SafeString($string);
+  }
+
+  /**
+   * Marks this string as safe to be used in HTML without any escaping.
+   */
+  function mark_html_safe() {
+    $this->_is_safe_html = true;
+    return $this;
+  }
+
+  /**
+   * Safe for use in HTML.
+   * @see #for_html()
+   */
+  function __toString() {
+    if ($this->_is_safe_html) {
+      return $this->_raw_string;
+    } else {
+      return self::_escape_for_html($this->_raw_string);
+    }
+  }
+
+  /**
+   * Safe for use in HTML.
+   *
+   * Example:<pre>
+   *   <div><?= $php_var ?> 
+   * </pre>
+   * @return the string escaped for use in HTML.
+   */
+  function for_html() {
+    return $this;
+  }
+
+  /**
+   * Safe for use in JavaScript.
+   *
+   * Example:<pre>
+   *   <script type="text/javascript>"
+   *     var some_js_var = "<?= $php_var->for_js() ?>";
+   *   </script>
+   * </pre>
+   * @return the string escaped for use in JavaScript.
+   */
+  function for_js() {
+    return self::_escape_for_js($this->_raw_string);
+  }
+
+  /**
+   * Safe for use HTML (purified HTML)
+   *
+   * Example:<pre>
+   *   <div><?= $php_var->purified_html() ?> 
+   * </pre>
+   * @return the string escaped for use in HTML.
+   */
+  function purified_html() {
+    if ($this->_is_safe_html) {
+      return $this;
+    } else {
+      return SafeString::of(self::_purify_for_html($this->_raw_string), true);
+    }
+  }
+
+  /**
+   * Returns the raw, unsafe string. Do not use lightly.
+   */
+  function unescaped() {
+    return $this->_raw_string;
+  }
+
+  // Escapes special HTML chars ("<", ">", "&", etc.) to HTML entities.
+  private static function _escape_for_html($dirty_html) {
+    return html::specialchars($dirty_html);
+  }
+
+  // Escapes special chars (quotes, backslash, etc.) with a backslash sequence.
+  private static function _escape_for_js($string) {
+    // From Smarty plugins/modifier.escape.php
+    // Might want to be stricter here.
+    return strtr($string,
+		 array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/'));
+  }
+
+  // Purifies the string, removing any potentially malicious or unsafe HTML / JavaScript.
+  private static function _purify_for_html($dirty_html) {
+    if (empty(self::$_purifier)) {
+      require_once(dirname(__file__) . "/../lib/HTMLPurifier/HTMLPurifier.auto.php");
+      $config = HTMLPurifier_Config::createDefault();
+      foreach (Kohana::config('purifier') as $category => $key_value) {
+        foreach ($key_value as $key => $value) {
+          $config->set("$category.$key", $value);
+        }
+      }
+      self::$_purifier = new HTMLPurifier($config);
+    }
+    return self::$_purifier->purify($dirty_html);
+  }
+}