<?php
/**
 * A translation may change words, never add code. When the provider's answer
 * holds something that can run (script, iframe, on* handler, javascript: URL)
 * more often than the original text did, it goes through wp_kses_post().
 * Markup the author already had (an embed in an HTML block) is left alone.
 */

declare( strict_types = 1 );

namespace AddBlack\Lang\MachineTranslation;

defined( 'ABSPATH' ) || exit;

final class MarkupGuard {

	private const DANGEROUS = array(
		'/<\s*(?:script|iframe|object|embed|applet|style|link|meta|base|form|svg|math)\b/i',
		'/[\s"\'\/]on[a-z]+\s*=/i',
		'/(?:java|vb)script\s*:/i',
		'/data\s*:\s*text\/html/i',
		'/\bsrcdoc\s*=/i',
	);

	public static function clean( string $translated, string $source ): string {
		$out = self::decoded( $translated );
		$src = self::decoded( $source );
		foreach ( self::DANGEROUS as $re ) {
			if ( preg_match_all( $re, $out ) > preg_match_all( $re, $src ) ) {
				// Whole script/style elements go, not only their tags: kses would leave "alert(1)" as text.
				$translated = (string) preg_replace( '#<(script|style)\b[^>]*>.*?</\1\s*>#is', '', $translated );
				return wp_kses_post( $translated );
			}
		}
		return $translated;
	}

	/** Entities and whitespace tricks undone, so "&#106;avascript:" counts too. */
	private static function decoded( string $html ): string {
		$text = html_entity_decode( $html, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
		return (string) preg_replace( '/[\x00-\x1F]+/', '', $text );
	}
}