<?php
namespace Akram;

defined( 'ABSPATH' ) || exit;

/**
 * Safe SVG uploads: whitelist-based sanitizer (no scripts, event handlers or external references).
 */
final class Svg {

	const TAGS  = array(
		'svg', 'g', 'path', 'circle', 'ellipse', 'rect', 'line', 'polyline', 'polygon', 'text', 'tspan',
		'textpath', 'defs', 'lineargradient', 'radialgradient', 'stop', 'clippath', 'mask', 'pattern',
		'symbol', 'use', 'title', 'desc', 'filter', 'fegaussianblur', 'feoffset', 'feblend', 'fecolormatrix',
		'femerge', 'femergenode', 'feflood', 'fecomposite',
	);
	const ATTRS = array(
		'id', 'class', 'd', 'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
		'stroke-miterlimit', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-opacity', 'fill-opacity',
		'fill-rule', 'clip-rule', 'opacity', 'transform', 'viewbox', 'width', 'height', 'x', 'y', 'x1', 'x2',
		'y1', 'y2', 'cx', 'cy', 'r', 'rx', 'ry', 'points', 'offset', 'stop-color', 'stop-opacity',
		'gradientunits', 'gradienttransform', 'patternunits', 'clip-path', 'mask', 'xmlns', 'xmlns:xlink',
		'version', 'preserveaspectratio', 'href', 'xlink:href', 'font-size', 'font-family', 'font-weight',
		'text-anchor', 'dominant-baseline', 'style', 'stddeviation', 'in', 'in2', 'result', 'mode', 'values',
		'type', 'dx', 'dy', 'flood-color', 'flood-opacity', 'operator', 'filter', 'filterunits', 'color',
	);

	public static function init() {
		if ( ! Options::get( 'svg_uploads', true ) ) {
			return;
		}
		add_filter( 'upload_mimes', array( __CLASS__, 'mimes' ) );
		add_filter( 'wp_check_filetype_and_ext', array( __CLASS__, 'filetype' ), 10, 4 );
		add_filter( 'wp_handle_upload_prefilter', array( __CLASS__, 'prefilter' ) );
	}

	public static function mimes( $mimes ) {
		if ( current_user_can( 'upload_files' ) && Plugin::can_build() ) {
			$mimes['svg'] = 'image/svg+xml';
		}
		return $mimes;
	}

	public static function filetype( $data, $file, $filename, $mimes ) {
		if ( 'svg' === strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) ) && isset( $mimes['svg'] ) ) {
			$data['ext']  = 'svg';
			$data['type'] = 'image/svg+xml';
		}
		return $data;
	}

	public static function prefilter( $file ) {
		if ( 'svg' !== strtolower( pathinfo( $file['name'], PATHINFO_EXTENSION ) ) ) {
			return $file;
		}
		$raw   = file_get_contents( $file['tmp_name'] );
		$clean = self::sanitize( (string) $raw );
		if ( ! $clean ) {
			$file['error'] = __( 'This SVG could not be sanitized and was rejected.', 'akram' );
			return $file;
		}
		file_put_contents( $file['tmp_name'], $clean );
		return $file;
	}

	public static function sanitize( $svg ) {
		if ( ! class_exists( 'DOMDocument' ) || '' === trim( $svg ) || preg_match( '/<!ENTITY/i', $svg ) ) {
			return '';
		}
		$prev = libxml_use_internal_errors( true );
		$doc  = new \DOMDocument();
		$ok   = $doc->loadXML( $svg, LIBXML_NONET | LIBXML_NOBLANKS );
		libxml_use_internal_errors( $prev );
		if ( ! $ok || ! $doc->documentElement || 'svg' !== strtolower( $doc->documentElement->localName ) ) {
			return '';
		}
		self::walk( $doc->documentElement );
		return $doc->saveXML( $doc->documentElement );
	}

	private static function walk( \DOMElement $el ) {
		foreach ( iterator_to_array( $el->childNodes ) as $child ) {
			if ( $child instanceof \DOMElement ) {
				if ( ! in_array( strtolower( $child->localName ), self::TAGS, true ) ) {
					$el->removeChild( $child );
					continue;
				}
				self::walk( $child );
			} elseif ( $child instanceof \DOMProcessingInstruction || $child instanceof \DOMComment ) {
				$el->removeChild( $child );
			}
		}
		foreach ( iterator_to_array( $el->attributes ) as $attr ) {
			$name = strtolower( $attr->nodeName );
			$val  = (string) $attr->nodeValue;
			$bad  = ! in_array( $name, self::ATTRS, true ) || 0 === strpos( $name, 'on' );
			if ( in_array( $name, array( 'href', 'xlink:href' ), true ) && '#' !== substr( ltrim( $val ), 0, 1 ) ) {
				$bad = true;
			}
			if ( preg_match( '/javascript:|expression\(|url\(\s*[\'"]?\s*(?!#)/i', $val ) ) {
				$bad = true;
			}
			if ( $bad ) {
				$el->removeAttributeNode( $attr );
			}
		}
	}
}