<?php

namespace FlexifyBlocks\Core;

use FlexifyBlocks\Trait\Singleton;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * SVG support for the Media Library.
 *
 * Lets users upload .svg files as regular attachments and cleans every one of
 * them before it lands in the uploads folder. It also tells wp_kses_post()
 * which SVG markup is safe, so icon blocks keep their output on the front end.
 *
 * The Icon Picker control doesn't use any of this. It reads files in the
 * browser and sanitizes them in utils/sanitize-svg.js, so nothing it handles
 * ever becomes an attachment.
 */
class SupportSvg {
	use Singleton;

	/** Largest file we'll even try to parse. Matches the limit on the JS side. */
	private const MAX_BYTES = 100000;
	private const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';

	public function __construct() {
		add_filter( 'upload_mimes', array( $this, 'allowSvgMimeType' ) );
		add_filter( 'wp_check_filetype_and_ext', array( $this, 'trustSvgExtension' ), 10, 4 );
		add_filter( 'wp_prepare_attachment_for_js', array( $this, 'fixSvgThumbnail' ) );
		add_filter( 'wp_kses_allowed_html', array( $this, 'allowSvgInPosts' ), 10, 2 );

		add_filter( 'wp_handle_upload_prefilter', array( $this, 'validateSvgUpload' ) );
		add_filter( 'wp_handle_sideload_prefilter', array( $this, 'validateSvgUpload' ) );
	}

	/* ---------------------------------------------------------------------
	 * Upload handling
	 * ------------------------------------------------------------------ */

	/**
	 * Add .svg to the list of uploadable types.
	 */
	public function allowSvgMimeType( array $mimes ): array {
		$mimes['svg'] = 'image/svg+xml';
		return $mimes;
	}

	/**
	 * Core sniffs the real file type and usually reports SVGs as text/plain,
	 * which makes it refuse the upload. Trust the extension instead, but only
	 * for .svg. The content is checked in validateSvgUpload(), which runs
	 * before this does. Every other file type keeps core's normal checks.
	 */
	public function trustSvgExtension( $data, $file, $filename, $mimes ) {
		if ( ! $this->hasSvgExtension( $filename ) ) {
			return $data;
		}

		// Respect it if something else removed svg from the allowed list.
		$allowed = is_array( $mimes ) ? $mimes : get_allowed_mime_types();
		if ( ! isset( $allowed['svg'] ) ) {
			return $data;
		}

		return array(
			'ext'             => 'svg',
			'type'            => 'image/svg+xml',
			'proper_filename' => $data['proper_filename'] ?? false,
		);
	}

	/**
	 * Sanitize an uploaded SVG in place, before WordPress moves it.
	 *
	 * We look at the filename and not $file['type']. That value comes from
	 * the browser's Content-Type header, so anyone can fake it.
	 */
	public function validateSvgUpload( array $file ): array {
		if ( ! $this->hasSvgExtension( $file['name'] ?? '' ) ) {
			return $file;
		}

		$tmp_name = isset( $file['tmp_name'] ) && is_string( $file['tmp_name'] )
			? $file['tmp_name']
			: '';
		$file_size = '' !== $tmp_name ? wp_filesize( $tmp_name ) : false;

		if ( false === $file_size ) {
			$file['error'] = __( 'Unable to read SVG file.', 'flexify-blocks' );
			return $file;
		}

		if ( $file_size > self::MAX_BYTES ) {
			$file['error'] = __( 'SVG file is too large.', 'flexify-blocks' );
			return $file;
		}

		$source = file_get_contents( $tmp_name );
		if ( false === $source ) {
			$file['error'] = __( 'Unable to read SVG file.', 'flexify-blocks' );
			return $file;
		}

		$clean = $this->sanitize( $source );
		if ( is_wp_error( $clean ) ) {
			$file['error'] = $clean->get_error_message();
			return $file;
		}

		if ( false === file_put_contents( $tmp_name, $clean ) ) {
			$file['error'] = __( 'Unable to save sanitized SVG file.', 'flexify-blocks' );
		}

		return $file;
	}

	/* ---------------------------------------------------------------------
	 * Sanitizing
	 * ------------------------------------------------------------------ */

	/**
	 * Validate an SVG string and return a cleaned copy, or a WP_Error if the
	 * file should be rejected.
	 *
	 * @return string|\WP_Error
	 */
	private function sanitize( string $svg ) {
		if ( '' === trim( $svg ) ) {
			return new \WP_Error( 'svg_empty', __( 'Unable to read SVG file.', 'flexify-blocks' ) );
		}

		if ( strlen( $svg ) > self::MAX_BYTES ) {
			return new \WP_Error( 'svg_too_large', __( 'SVG file is too large.', 'flexify-blocks' ) );
		}

		// Cheap early exit. External DTDs and entities are how XXE attacks
		// work, so any DOCTYPE is refused rather than parsed "safely".
		if ( preg_match( '/<!doctype/i', $svg ) ) {
			return $this->doctypeError();
		}

		$doc = $this->parse( $svg );

		if (
			! $doc ||
			! $doc->documentElement ||
			'svg' !== strtolower( $doc->documentElement->localName ) ||
			( $doc->documentElement->namespaceURI && self::SVG_NAMESPACE !== $doc->documentElement->namespaceURI )
		) {
			return new \WP_Error( 'svg_invalid', __( 'Invalid SVG markup.', 'flexify-blocks' ) );
		}

		// The string check above can't see through other encodings (UTF-16,
		// for one), so check the parsed document as well.
		if ( null !== $doc->doctype ) {
			return $this->doctypeError();
		}

		// A script means the file is hostile or badly made. Reject it
		// instead of quietly stripping it. The wildcard namespace catches
		// prefixed variants too.
		if ( $doc->getElementsByTagNameNS( '*', 'script' )->length > 0 ) {
			return new \WP_Error( 'svg_script', __( 'SVG contains a <script> tag and was rejected.', 'flexify-blocks' ) );
		}

		$this->cleanElement( $doc->documentElement, true );

		// Saving only the root element drops the XML declaration and anything
		// sitting outside <svg>, such as stylesheet processing instructions.
		$output = $doc->saveXML( $doc->documentElement );
		if ( false === $output ) {
			return new \WP_Error( 'svg_save', __( 'Unable to save sanitized SVG file.', 'flexify-blocks' ) );
		}

		return $output;
	}

	/**
	 * Sanitize one SVG value for block output. Invalid values render as empty.
	 */
	public function sanitizeIconMarkup( $svg ): string {
		if ( ! is_string( $svg ) ) {
			return '';
		}

		$clean = $this->sanitize( $svg );
		if ( is_wp_error( $clean ) ) {
			return '';
		}

		// KSES has its own CSS property list. Extend it only during this SVG
		// sanitization pass so the safe SVG presentation styles above survive.
		add_filter( 'safe_style_css', array( $this, 'allowSafeSvgStyleProperties' ) );
		try {
			return wp_kses( $clean, $this->allowedSvgTags() );
		} finally {
			remove_filter( 'safe_style_css', array( $this, 'allowSafeSvgStyleProperties' ) );
		}
	}

	/** Allow SVG CSS properties already validated by this class through KSES. */
	public function allowSafeSvgStyleProperties( $properties ) {
		if ( ! is_array( $properties ) ) {
			return $properties;
		}

		$svg_properties = array(
			'color', 'fill', 'fill-opacity', 'fill-rule', 'stroke', 'stroke-width',
			'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-dasharray',
			'stroke-dashoffset', 'stroke-opacity', 'clip-rule', 'clip-path', 'mask',
			'opacity', 'transform', 'transform-origin', 'vector-effect', 'paint-order',
			'shape-rendering', 'color-rendering', 'display', 'visibility', 'overflow',
			'stop-color', 'stop-opacity',
		);

		return array_values( array_unique( array_merge( $properties, $svg_properties ) ) );
	}

	/**
	 * Sanitize SVG fragments in saved block markup while preserving its wrapper.
	 */
	public function sanitizeBlockMarkup( $markup ): string {
		if ( ! is_string( $markup ) || '' === $markup ) {
			return '';
		}

		$pattern = '~<svg\b(?:[^>"\']|"[^"]*"|\'[^\']*\')*(?:/\s*>|>.*?</svg\s*>)~is';
		$cleaned = preg_replace_callback(
			$pattern,
			function ( $matches ) {
				return $this->sanitizeIconMarkup( $matches[0] );
			},
			$markup
		);

		return is_string( $cleaned ) ? $cleaned : '';
	}

	/**
	 * Parse untrusted XML without letting libxml touch the network, the
	 * filesystem, or entity definitions. No LIBXML_NOENT or LIBXML_DTDLOAD,
	 * on purpose.
	 */
	private function parse( string $svg ): ?\DOMDocument {
		// Keep libxml quiet, then put its error mode back the way we found
		// it so we don't change behavior for other plugins.
		$previous = libxml_use_internal_errors( true );

		$doc    = new \DOMDocument();
		$loaded = $doc->loadXML( $svg, LIBXML_NONET );

		libxml_clear_errors();
		libxml_use_internal_errors( $previous );

		return $loaded ? $doc : null;
	}

	/**
	 * Walk the tree and keep only supported SVG elements and attributes.
	 * Unknown elements are removed with their entire subtree.
	 */
	private function cleanElement( \DOMElement $element, bool $is_root = false ): void {
		$tag_name       = strtolower( $element->localName );
		$allowed_svg    = $this->allowedSvgTags();
		$allowed_attrs  = $allowed_svg[ $tag_name ] ?? null;

		if ( ! is_array( $allowed_attrs ) ) {
			return;
		}

		// Copy the node list first, since we remove nodes while looping.
		foreach ( iterator_to_array( $element->childNodes ) as $child ) {
			if ( $child instanceof \DOMElement ) {
				$child_name = strtolower( $child->localName );
				if (
					'svg' === $child_name ||
					! isset( $allowed_svg[ $child_name ] ) ||
					( $child->namespaceURI && self::SVG_NAMESPACE !== $child->namespaceURI )
				) {
					$element->removeChild( $child );
				} else {
					$this->cleanElement( $child );
				}
			} elseif ( $child instanceof \DOMComment || $child instanceof \DOMProcessingInstruction ) {
				$element->removeChild( $child );
			}
		}

		foreach ( iterator_to_array( $element->attributes ) as $attribute ) {
			if ( $this->isUnsafeAttribute( $element, $attribute, $allowed_attrs ) ) {
				$element->removeAttributeNode( $attribute );
			}
		}
	}

	/**
	 * Only explicitly supported attributes and local definition references pass.
	 */
	private function isUnsafeAttribute( \DOMElement $element, \DOMAttr $attribute, array $allowed_attrs ): bool {
		$name = strtolower( $attribute->nodeName );
		if ( ! array_key_exists( $name, $allowed_attrs ) ) {
			return true;
		}

		if ( 'style' === $name ) {
			$safe_style = $this->sanitizeStyleAttribute( $element, $attribute->value );
			if ( '' === $safe_style ) {
				return true;
			}

			$element->setAttribute( 'style', $safe_style );
			return false;
		}

		if ( 'id' === $name && ! preg_match( '/^[A-Za-z_][A-Za-z0-9_.:-]*$/D', $attribute->value ) ) {
			return true;
		}

		$value = preg_replace( '/[\x00-\x20]+/', '', $attribute->value );
		if ( preg_match( '/javascript:|data:/i', $value ) ) {
			return true;
		}

		if ( preg_match( '/url\s*\(/i', $attribute->value ) ) {
			return ! $this->isSafeLocalReference( $element, $name, $value );
		}

		return false;
	}

	/** Keep safe SVG presentation declarations and drop unsupported CSS. */
	private function sanitizeStyleAttribute( \DOMElement $element, string $style ): string {
		$safe_properties = array(
			'color', 'fill', 'fill-opacity', 'fill-rule', 'stroke', 'stroke-width',
			'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-dasharray',
			'stroke-dashoffset', 'stroke-opacity', 'clip-rule', 'clip-path', 'mask',
			'opacity', 'transform', 'transform-origin', 'vector-effect', 'paint-order',
			'shape-rendering', 'color-rendering', 'display', 'visibility', 'overflow',
			'stop-color', 'stop-opacity',
		);
		$safe_functions = array(
			'rgb', 'rgba', 'hsl', 'hsla',
			'matrix', 'translate', 'translatex', 'translatey', 'translatez', 'translate3d',
			'scale', 'scalex', 'scaley', 'scalez', 'scale3d',
			'rotate', 'rotatex', 'rotatey', 'rotatez', 'rotate3d',
			'skew', 'skewx', 'skewy', 'url',
		);
		$declarations = array();

		foreach ( explode( ';', $style ) as $declaration ) {
			$separator = strpos( $declaration, ':' );
			if ( false === $separator || 0 === $separator ) {
				continue;
			}

			$property = strtolower( trim( substr( $declaration, 0, $separator ) ) );
			$value    = trim( substr( $declaration, $separator + 1 ) );
			if (
				! in_array( $property, $safe_properties, true ) ||
				'' === $value ||
				strlen( $value ) > 256 ||
				! preg_match( '/^[a-zA-Z0-9#(),.%+\-\/\s]+$/D', $value )
			) {
				continue;
			}

			$normalized = preg_replace( '/[\x00-\x20]+/', '', $value );
			if ( preg_match( '/javascript:|data:/i', $normalized ) ) {
				continue;
			}

			if ( preg_match_all( '/([a-z][a-z0-9-]*)\s*\(/i', $value, $function_matches ) ) {
				$has_unsafe_function = false;
				foreach ( $function_matches[1] as $function_name ) {
					if ( ! in_array( strtolower( $function_name ), $safe_functions, true ) ) {
						$has_unsafe_function = true;
						break;
					}
				}
				if ( $has_unsafe_function ) {
					continue;
				}
			}

			if (
				preg_match( '/url\s*\(/i', $value ) &&
				! $this->isSafeLocalReference( $element, $property, $normalized )
			) {
				continue;
			}

			$declarations[] = $property . ':' . $value;
		}

		return implode( ';', $declarations );
	}

	/** Permit only same-document references to the matching safe definition. */
	private function isSafeLocalReference( \DOMElement $element, string $attribute_name, string $value ): bool {
		$reference_targets = array(
			'fill'      => array( 'lineargradient', 'radialgradient' ),
			'stroke'    => array( 'lineargradient', 'radialgradient' ),
			'clip-path' => array( 'clippath' ),
			'mask'      => array( 'mask' ),
		);

		if ( ! isset( $reference_targets[ $attribute_name ] ) ) {
			return false;
		}

		if ( ! preg_match( '/^url\((["\']?)#([A-Za-z_][A-Za-z0-9_.:-]*)\1\)$/i', $value, $matches ) ) {
			return false;
		}

		$root = $element->ownerDocument ? $element->ownerDocument->documentElement : null;
		if ( ! $root ) {
			return false;
		}

		foreach ( $root->getElementsByTagName( '*' ) as $candidate ) {
			if (
				$candidate instanceof \DOMElement &&
				$matches[2] === $candidate->getAttribute( 'id' ) &&
				in_array( strtolower( $candidate->localName ), $reference_targets[ $attribute_name ], true )
			) {
				return true;
			}
		}

		return false;
	}

	/* ---------------------------------------------------------------------
	 * Front end rendering
	 * ------------------------------------------------------------------ */

	/**
	 * Let basic SVG markup through wp_kses_post() so icon blocks render.
	 * Only shapes, safe presentation attributes, and sanitized inline styles.
	 */
	public function allowSvgInPosts( array $tags, string $context ): array {
		if ( 'post' !== $context ) {
			return $tags;
		}

		// Replace SVG tag entries so other global filters cannot add unchecked
		// attributes such as event handlers to the SVG allowlist.
		foreach ( $this->allowedSvgTags() as $tag => $attributes ) {
			$tags[ $tag ] = $attributes;
		}

		return $tags;
	}

	/** Shared SVG tag and attribute allowlist for parsing and KSES output. */
	private function allowedSvgTags(): array {
		$common = array(
			'class'           => true,
			'style'           => true,
			'fill'            => true,
			'fill-rule'       => true,
			'clip-rule'       => true,
			'stroke'          => true,
			'stroke-width'    => true,
			'stroke-linecap'  => true,
			'stroke-linejoin' => true,
			'fill-opacity'    => true,
			'stroke-opacity'  => true,
			'opacity'         => true,
			'transform'       => true,
			'clip-path'       => true,
			'mask'            => true,
		);

		return array(
			'svg'            => array_merge(
				$common,
				array(
					'viewbox'             => true,
					'preserveaspectratio' => true,
					'xmlns'               => true,
					'width'               => true,
					'height'              => true,
					'aria-hidden'         => true,
					'aria-label'          => true,
					'role'                => true,
					'focusable'           => true,
				)
			),
			'g'              => $common,
			'path'           => array_merge( $common, array( 'd' => true ) ),
			'circle'         => array_merge( $common, array( 'cx' => true, 'cy' => true, 'r' => true ) ),
			'ellipse'        => array_merge( $common, array( 'cx' => true, 'cy' => true, 'rx' => true, 'ry' => true ) ),
			'rect'           => array_merge( $common, array( 'x' => true, 'y' => true, 'width' => true, 'height' => true, 'rx' => true, 'ry' => true ) ),
			'line'           => array_merge( $common, array( 'x1' => true, 'y1' => true, 'x2' => true, 'y2' => true ) ),
			'polyline'       => array_merge( $common, array( 'points' => true ) ),
			'polygon'        => array_merge( $common, array( 'points' => true ) ),
			'defs'           => array(),
			'lineargradient' => array( 'style' => true, 'id' => true, 'gradientunits' => true, 'x1' => true, 'y1' => true, 'x2' => true, 'y2' => true, 'gradienttransform' => true, 'spreadmethod' => true ),
			'radialgradient' => array( 'style' => true, 'id' => true, 'gradientunits' => true, 'cx' => true, 'cy' => true, 'r' => true, 'fx' => true, 'fy' => true, 'fr' => true, 'gradienttransform' => true, 'spreadmethod' => true ),
			'stop'           => array( 'style' => true, 'offset' => true, 'stop-color' => true, 'stop-opacity' => true ),
			'clippath'       => array( 'style' => true, 'id' => true, 'clippathunits' => true, 'transform' => true ),
			'mask'           => array( 'style' => true, 'id' => true, 'maskunits' => true, 'maskcontentunits' => true, 'x' => true, 'y' => true, 'width' => true, 'height' => true ),
			'title'          => array(),
			'desc'           => array(),
		);
	}

	/**
	 * SVGs have no generated sizes, so the Media Library grid shows a broken
	 * thumbnail unless we point every size at the original file.
	 */
	public function fixSvgThumbnail( array $response ): array {
		if ( 'image/svg+xml' !== ( $response['mime'] ?? '' ) || empty( $response['url'] ) ) {
			return $response;
		}

		$response['sizes'] = array(
			'full' => array(
				'url'    => $response['url'],
				'width'  => $response['width'] ?? 100,
				'height' => $response['height'] ?? 100,
			),
		);

		return $response;
	}

	/* ---------------------------------------------------------------------
	 * Helpers
	 * ------------------------------------------------------------------ */

	private function hasSvgExtension( string $filename ): bool {
		return 'svg' === strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
	}

	private function doctypeError(): \WP_Error {
		return new \WP_Error( 'svg_doctype', __( 'SVG files with a DOCTYPE are not allowed.', 'flexify-blocks' ) );
	}
}