From 3aa9714c8dc1ebe5536e8166f6ce60b0d9631112 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Bouc=CC=8Cek?= <pan@jakubboucek.cz>
Date: Mon, 26 Sep 2022 14:38:10 +0200
Subject: [PATCH] Add htmlHref()

---
 README.md            |  1 +
 src/Escape.php       | 31 ++++++++++++++++++++++++++++
 tests/EscapeTest.php | 49 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 81 insertions(+)

diff --git a/README.md b/README.md
index afacc90..2d126b2 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,7 @@ Package is substrate of [Latte package](https://github.com/nette/latte/)
 
 - Escape HTML
 - Escape HTML attributes
+- Escape HTML href attributes
 - Escape HTML comments
 - Escape XML
 - Escape JS
diff --git a/src/Escape.php b/src/Escape.php
index e41eddc..fc5b8d5 100644
--- a/src/Escape.php
+++ b/src/Escape.php
@@ -56,6 +56,16 @@ public static function htmlAttr($data): string
         return self::html($data);
     }
 
+    /**
+     * Escapes string for use inside HTML attribute `href` or `src` which contains URL string.
+     * @param string|mixed $data
+     * @return string
+     */
+    public static function htmlHref($data): string
+    {
+        return self::htmlAttr(self::safeUrl($data));
+    }
+
     /**
      * Escapes string for use inside HTML comments.
      * @param string|mixed $data
@@ -140,6 +150,27 @@ public static function url($data): string
         return urlencode($data);
     }
 
+    /**
+     * Sanitizes string for use inside href attribute.
+     * @param string|mixed $data
+     * @param bool $warning
+     * @return string
+     *
+     * @link https://api.nette.org/2.4/source-Latte.Runtime.Filters.php.html#_safeUrl
+     */
+    public static function safeUrl($data, bool $warning = false):string
+    {
+        if (preg_match('~^(?:(?:https?|ftp)://[^@]+(?:/.*)?|(?:mailto|tel|sms):.+|[/?#].*|[^:]+)$~Di', (string)$data)) {
+            return (string)$data;
+        }
+
+        if($warning) {
+            trigger_error('URL was removed because is invalid or unsafe: ' . $data, E_USER_WARNING);
+        }
+
+        return '';
+    }
+
     /**
      * Just returns argument as is without any escaping.
      * Method is useful to mark code as intentionally unescaped as opposed to simple neglected.
diff --git a/tests/EscapeTest.php b/tests/EscapeTest.php
index 8a84a2c..b83647e 100644
--- a/tests/EscapeTest.php
+++ b/tests/EscapeTest.php
@@ -86,6 +86,23 @@ public function testHtmlAttr(string $expected, $data): void
         Assert::same($expected, Escape::htmlAttr($data));
     }
 
+    public function getHtmlHrefArgs(): array
+    {
+        return [
+            ['', ''],
+            ['http://example.com/foo/bar.txt?par=var', 'http://example.com/foo/bar.txt?par=var'],
+            ['', 'javascript:alert(1)'],
+        ];
+    }
+
+    /**
+     * @dataProvider getHtmlHrefArgs
+     */
+    public function testHtmlHref(string $expected, $data): void
+    {
+        Assert::same($expected, Escape::htmlHref($data));
+    }
+
     public function getHtmlCommentArgs(): array
     {
         return [
@@ -232,6 +249,38 @@ public function testUrl(string $expected, $data): void
         Assert::same($expected, Escape::url($data));
     }
 
+    public function getSafeUrlArgs(): array
+    {
+        return [
+            ['', null],
+            ['', ''],
+            ['', 'http://'],
+            ['http://x', 'http://x'],
+            ['http://x:80', 'http://x:80'],
+            ['', 'http://nette.org@1572395127'],
+            ['https://x', 'https://x'],
+            ['ftp://x', 'ftp://x'],
+            ['mailto:x', 'mailto:x'],
+            ['/', '/'],
+            ['/a:b', '/a:b'],
+            ['//x', '//x'],
+            ['#aa:b', '#aa:b'],
+            ['', 'data:'],
+            ['', 'javascript:'],
+            ['', ' javascript:'],
+            ['javascript', 'javascript'],
+            ['http://example.com', Html::fromHtml('http://example.com')],
+        ];
+    }
+
+    /**
+     * @dataProvider getSafeUrlArgs
+     */
+    public function testSafeUrl(string $expected, $data): void
+    {
+        Assert::same($expected, Escape::safeUrl($data));
+    }
+
     public function getNoescapeArgs(): array
     {
         return [