From 51c7e10483b9fbef2e2a9e0118a0ee2034d6d985 Mon Sep 17 00:00:00 2001
From: Hugo Sales <hugo@hsal.es>
Date: Thu, 16 Sep 2021 16:50:02 +0100
Subject: [PATCH] [UTIL][HTML] Allow specifying `options: [raw => bool]`,
 whether to escape the provided inner HTML or not. Use with care

---
 src/Util/HTML.php | 39 +++++++++++++++++++++++++--------------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/src/Util/HTML.php b/src/Util/HTML.php
index a6a24e2fa1..76a51cc52b 100644
--- a/src/Util/HTML.php
+++ b/src/Util/HTML.php
@@ -31,10 +31,12 @@ use Functional as F;
 
 abstract class HTML
 {
-    const ALLOWED_TAGS         = ['p', 'br', 'a'];
-    const FORBIDDEN_ATTRIBUTES = ['onerror', 'form', 'onforminput', 'onbeforescriptexecute', 'formaction', 'onfocus', 'onload',
+    const ALLOWED_TAGS         = ['p', 'br', 'a', 'span'];
+    const FORBIDDEN_ATTRIBUTES = [
+        'onerror', 'form', 'onforminput', 'onbeforescriptexecute', 'formaction', 'onfocus', 'onload',
         'data', 'event', 'autofocus', 'onactivate', 'onanimationstart', 'onwebkittransitionend', 'onblur', 'poster',
-        'onratechange', 'ontoggle', 'onscroll', 'actiontype', 'dirname', 'srcdoc', ];
+        'onratechange', 'ontoggle', 'onscroll', 'actiontype', 'dirname', 'srcdoc',
+    ];
 
     /**
      * Creates an HTML tag without attributes
@@ -77,6 +79,7 @@ abstract class HTML
      * Attribute with given optional value
      *
      * @param array $attrs
+     * @param array $options=[] ['forbidden_attributes' => string[]]
      *
      * @return string
      */
@@ -92,39 +95,47 @@ abstract class HTML
                                            || str_starts_with($val, 'javascript:')) {
                                            throw new \InvalidArgumentException("HTML::html: Attribute {$key} is not allowed");
                                        }
-                                       $val = htmlspecialchars($val, flags: ENT_QUOTES | ENT_SUBSTITUTE, double_encode: false);
+                                       if (!($options['raw'] ?? false)) {
+                                           $val = htmlspecialchars($val, flags: ENT_QUOTES | ENT_SUBSTITUTE, double_encode: false);
+                                       }
                                        return "{$key}=\"{$val}\"";
-        }));
+                                   }));
     }
 
     /**
      * @param array|string $html    The input to convert to HTML
-     * @param array        $options = [] ['allowed_tags' => ['a', 'p']]
+     * @param array        $options = [] ['allowed_tags' => string[], 'forbidden_attributes' => string[], 'raw' => bool]
      *
      * @return string
      */
-    public static function html(string|array $html, array $options = []): string
+    public static function html(string|array $html, array $options = [], int $indent = 1): string
     {
         if (is_string($html)) {
-            return $html;
+            if ($options['raw'] ?? false) {
+                return $html;
+            } else {
+                return htmlspecialchars($html, flags: ENT_QUOTES | ENT_SUBSTITUTE, double_encode: false);
+            }
         } else {
             $out = '';
             foreach ($html as $tag => $contents) {
-                if ($contents == 'empty' || isset($contents['empty'])) {
+                if ($contents['empty'] ?? false) {
                     $out .= "<{$tag}/>";
                 } else {
-                    $attrs  = isset($contents['attrs']) ? self::attr(array_shift($contents)) : '';
+                    $attrs  = isset($contents['attrs']) ? self::attr(array_shift($contents), $options) : '';
                     $is_tag = preg_match('/[A-Za-z][A-Za-z0-9]*/', $tag);
-                    $inner  = self::html($contents);
+                    $inner  = self::html($contents, $options, $indent + 1);
                     if ($is_tag) {
                         if (!in_array($tag, array_merge($options['allowed_tags'] ?? [], self::ALLOWED_TAGS))) {
                             throw new \InvalidArgumentException("HTML::html: Tag {$tag} is not allowed");
                         }
-                        $inner = $inner != '' ? "\n{$inner}\n" : '';
-                        $inner = Formatting::indent($inner);
+                        if (!empty($inner)) {
+                            $inner = "\n" . Formatting::indent($inner, $indent) . "\n";
+                        }
                         $out .= "<{$tag}{$attrs}>{$inner}</{$tag}>";
+                    } else {
+                        $out .= $inner;
                     }
-                    $out .= $inner;
                 }
             }
             return $out;