From e960a4ad53af1beb56a072b88bb5c8fdc42c0beb Mon Sep 17 00:00:00 2001
From: Pierre Goiffon <pierre.goiffon@combodo.com>
Date: Thu, 23 Feb 2023 18:38:03 +0100
Subject: [PATCH] =?UTF-8?q?N=C2=B06023=20Fix=20cannot=20load=20SVG=20files?=
 =?UTF-8?q?=20in=20AttributeImage=20since=203.0.0=20(#449)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Caused by merge error in ddd6bf2

Co-authored-by: Molkobain <lajarige.guillaume@free.fr>
---
 core/htmlsanitizer.class.inc.php              | 34 +++++++++++--------
 .../core/sanitizer/SvgDOMSanitizerTest.php    | 22 +++++++-----
 2 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/core/htmlsanitizer.class.inc.php b/core/htmlsanitizer.class.inc.php
index 8d8b14dbf..2f9f44280 100644
--- a/core/htmlsanitizer.class.inc.php
+++ b/core/htmlsanitizer.class.inc.php
@@ -34,32 +34,36 @@ abstract class HTMLSanitizer
 
 	/**
 	 * Sanitize an HTML string with the configured sanitizer, falling back to HTMLDOMSanitizer in case of Exception or invalid configuration
+	 *
 	 * @param string $sHTML
+	 * @param string $sConfigKey eg. 'html_sanitizer', 'svg_sanitizer'
+	 *
 	 * @return string
 	 */
-	public static function Sanitize($sHTML)
+	public static function Sanitize($sHTML, $sConfigKey = 'html_sanitizer')
 	{
-		$sSanitizerClass = MetaModel::GetConfig()->Get('html_sanitizer');
-		if(!class_exists($sSanitizerClass))
-		{
+		$sSanitizerClass = utils::GetConfig()->Get($sConfigKey);
+		if (!class_exists($sSanitizerClass)) {
 			IssueLog::Warning('The configured "html_sanitizer" class "'.$sSanitizerClass.'" is not a valid class. Will use HTMLDOMSanitizer as the default sanitizer.');
 			$sSanitizerClass = 'HTMLDOMSanitizer';
-		}
-		else if(!is_subclass_of($sSanitizerClass, 'HTMLSanitizer'))
-		{
-			IssueLog::Warning('The configured "html_sanitizer" class "'.$sSanitizerClass.'" is not a subclass of HTMLSanitizer. Will use HTMLDOMSanitizer as the default sanitizer.');
-			$sSanitizerClass = 'HTMLDOMSanitizer';
+		} else if (!is_subclass_of($sSanitizerClass, 'HTMLSanitizer')) {
+			if ($sConfigKey === 'html_sanitizer') {
+				IssueLog::Warning('The configured "'.$sConfigKey.'" class "'.$sSanitizerClass.'" is not a subclass of HTMLSanitizer. Will use HTMLDOMSanitizer as the default sanitizer.');
+				$sSanitizerClass = 'HTMLDOMSanitizer';
+			}
+			if ($sConfigKey === 'svg_sanitizer') {
+				IssueLog::Error('The configured "'.$sConfigKey.'" class "'.$sSanitizerClass.'" is not a subclass of '.HTMLSanitizer::class.' ! Won\'t sanitize string.');
+
+				return $sHTML;
+			}
 		}
 
-		try
-		{
+		try {
 			$oSanitizer = new $sSanitizerClass();
 			$sCleanHTML = $oSanitizer->DoSanitize($sHTML);
 		}
-		catch(Exception $e)
-		{
-			if($sSanitizerClass != 'HTMLDOMSanitizer')
-			{
+		catch (Exception $e) {
+			if ($sSanitizerClass != 'HTMLDOMSanitizer') {
 				IssueLog::Warning('Failed to sanitize an HTML string with "'.$sSanitizerClass.'". The following exception occured: '.$e->getMessage());
 				IssueLog::Warning('Will try to sanitize with HTMLDOMSanitizer.');
 				// try again with the HTMLDOMSanitizer
diff --git a/tests/php-unit-tests/unitary-tests/core/sanitizer/SvgDOMSanitizerTest.php b/tests/php-unit-tests/unitary-tests/core/sanitizer/SvgDOMSanitizerTest.php
index b86424a20..28618a19f 100644
--- a/tests/php-unit-tests/unitary-tests/core/sanitizer/SvgDOMSanitizerTest.php
+++ b/tests/php-unit-tests/unitary-tests/core/sanitizer/SvgDOMSanitizerTest.php
@@ -2,6 +2,7 @@
 
 namespace Combodo\iTop\Test\UnitTest\Core\Sanitizer;
 
+use HTMLSanitizer;
 use SVGDOMSanitizer;
 
 
@@ -22,7 +23,7 @@ class SVGDOMSanitizerTest extends AbstractDOMSanitizerTest
 		$sOutputHtml = $this->RemoveNewLines($sOutputHtml);
 
 		$oSanitizer = new SVGDOMSanitizer();
-		$sRes = $oSanitizer->DoSanitize($sInputHtml);
+		$sResFromSvgSanitizer = $oSanitizer->DoSanitize($sInputHtml);
 
 		// Removing newlines as the parser gives different results depending on the PHP version
 		// Didn't manage to get it right :
@@ -30,19 +31,22 @@ class SVGDOMSanitizerTest extends AbstractDOMSanitizerTest
 		// - playing with the parser preserveWhitespace/formatOutput parser options didn't help
 		// So we're removing new lines on both sides :/
 		$sOutputHtml = $this->RemoveNewLines($sOutputHtml);
-		$sRes = $this->RemoveNewLines($sRes);
+		$sResFromSvgSanitizer = $this->RemoveNewLines($sResFromSvgSanitizer);
 
-		$this->debug($sRes);
-		$this->assertEquals($sOutputHtml, $sRes);
+		$this->debug($sResFromSvgSanitizer);
+		$this->assertEquals($sOutputHtml, $sResFromSvgSanitizer);
+
+		// N°6023 checking call through the factory is working as well
+		$sResFromSanitizerFactory = HTMLSanitizer::Sanitize($sInputHtml, 'svg_sanitizer');
+		$sResFromSanitizerFactory = $this->RemoveNewLines($sResFromSanitizerFactory);
+		$this->assertEquals($sOutputHtml, $sResFromSanitizerFactory);
 	}
 
 	public function DoSanitizeProvider()
 	{
-		return array(
-			array(
-				'scripts.svg',
-			),
-		);
+		return [
+			['scripts.svg'],
+		];
 	}
 }