<?php
/**
 * Safe SVG uploads for icons.
 *
 * @package KarmaDocs
 */

namespace KarmaDocs;

defined( 'ABSPATH' ) || exit;

/**
 * SVG uploads are allowed only from the docs icon picker, only for users who can
 * upload files, and every file is cleaned with an allow-list sanitizer
 * (enshrined/svg-sanitize) before WordPress stores it: scripts, event handlers,
 * foreign objects and external references are removed. A file that can't be
 * cleaned is rejected.
 *
 * The rest of the site keeps WordPress' default (no SVG uploads).
 */
class Svg {

	/**
	 * Upload request flag sent by the icon picker's media frame.
	 */
	const FLAG = 'kdocs_svg';

	/**
	 * Largest SVG accepted, in bytes (icons are small).
	 */
	const MAX_BYTES = 512000;

	/**
	 * Hooks.
	 */
	public function register() {
		add_filter( 'upload_mimes', array( $this, 'mimes' ) );
		add_filter( 'wp_check_filetype_and_ext', array( $this, 'filetype' ), 10, 4 );
		add_filter( 'wp_handle_upload_prefilter', array( $this, 'prefilter' ) );
	}

	/**
	 * Whether this upload comes from the icon picker of a user allowed to upload.
	 *
	 * @return bool
	 */
	private static function allowed() {
		return ! empty( $_REQUEST[ self::FLAG ] ) && current_user_can( 'upload_files' ); // phpcs:ignore WordPress.Security.NonceVerification -- async-upload.php checks the media nonce.
	}

	/**
	 * Adds the SVG type for icon uploads.
	 *
	 * @param array $mimes Allowed types.
	 * @return array
	 */
	public function mimes( $mimes ) {
		if ( self::allowed() ) {
			$mimes['svg'] = 'image/svg+xml';
		}
		return $mimes;
	}

	/**
	 * WordPress can't sniff SVG with getimagesize(); trust the extension for icon
	 * uploads (the content is sanitized in prefilter()).
	 *
	 * @param array  $data     Type data.
	 * @param string $file     Temp file.
	 * @param string $filename Original name.
	 * @param array  $mimes    Allowed types.
	 * @return array
	 */
	public function filetype( $data, $file, $filename, $mimes ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter -- Hook signature.
		if ( self::allowed() && 'svg' === strtolower( pathinfo( (string) $filename, PATHINFO_EXTENSION ) ) ) {
			$data['ext']  = 'svg';
			$data['type'] = 'image/svg+xml';
		}
		return $data;
	}

	/**
	 * Sanitizes an uploaded SVG in place, or rejects it.
	 *
	 * @param array $file Upload ($_FILES entry).
	 * @return array
	 */
	public function prefilter( $file ) {
		$is_svg = 'svg' === strtolower( pathinfo( (string) ( $file['name'] ?? '' ), PATHINFO_EXTENSION ) );
		if ( ! $is_svg || ! self::allowed() ) {
			return $file;
		}
		if ( (int) ( $file['size'] ?? 0 ) > self::MAX_BYTES ) {
			$file['error'] = __( 'This SVG is too large for an icon (500 KB maximum).', 'karma-docs' );
			return $file;
		}
		$clean = self::sanitize( (string) file_get_contents( $file['tmp_name'] ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		if ( '' === $clean ) {
			$file['error'] = __( 'This SVG could not be made safe, so it was not uploaded.', 'karma-docs' );
			return $file;
		}
		file_put_contents( $file['tmp_name'], $clean ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
		$file['size'] = strlen( $clean );
		return $file;
	}

	/**
	 * Cleans SVG markup with the allow-list sanitizer.
	 *
	 * @param string $svg Markup.
	 * @return string Clean markup, or '' when it isn't a usable SVG.
	 */
	public static function sanitize( $svg ) {
		self::load_library();
		if ( ! class_exists( '\enshrined\svgSanitize\Sanitizer' ) || '' === trim( $svg ) ) {
			return '';
		}
		$sanitizer = new \enshrined\svgSanitize\Sanitizer();
		$sanitizer->removeRemoteReferences( true );
		$sanitizer->removeXMLTag( true );
		$sanitizer->minify( true );
		$clean = $sanitizer->sanitize( $svg );
		if ( ! is_string( $clean ) || false === stripos( $clean, '<svg' ) ) {
			return '';
		}
		// The library keeps style attributes as they are: drop url() other than
		// local "#id" references, and anything script-like.
		return (string) preg_replace_callback(
			'/\sstyle=(["\'])(.*?)\1/is',
			static function ( $m ) {
				$style = preg_replace( '/url\(\s*(?![\'"]?#)[^)]*\)/i', 'none', $m[2] );
				return preg_match( '/javascript:|expression\s*\(|@import|behavior\s*:/i', $style ) ? '' : ' style=' . $m[1] . $style . $m[1];
			},
			$clean
		);
	}

	/**
	 * Inline markup of an uploaded SVG attachment (sanitized again, cached).
	 *
	 * Inline SVG can inherit the text color; files are re-sanitized on output too, so
	 * SVGs that reached the media library some other way are safe as well.
	 *
	 * @param int $id Attachment id.
	 * @return string
	 */
	public static function inline( $id ) {
		if ( ! $id || 'image/svg+xml' !== get_post_mime_type( $id ) ) {
			return '';
		}
		$file  = get_attached_file( $id );
		$mtime = $file && is_readable( $file ) ? filemtime( $file ) : 0;
		if ( ! $mtime ) {
			return '';
		}
		$key    = 'svg:' . $id . ':' . $mtime;
		$cached = wp_cache_get( $key, Cache::GROUP );
		if ( false !== $cached ) {
			return $cached;
		}
		$svg = self::sanitize( (string) file_get_contents( $file ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		if ( $svg ) {
			// Size by CSS, and keep it out of the accessibility tree like other icons.
			$svg = preg_replace( '/<svg\b/i', '<svg class="kdocs-ico-svg" aria-hidden="true" focusable="false"', $svg, 1 );
		}
		wp_cache_set( $key, (string) $svg, Cache::GROUP, DAY_IN_SECONDS );
		return (string) $svg;
	}

	/**
	 * Maps the sanitizer's namespace to its folder (the plugin doesn't load
	 * Composer's autoloader at runtime).
	 */
	private static function load_library() {
		static $registered = false;
		if ( $registered || class_exists( '\enshrined\svgSanitize\Sanitizer', false ) ) {
			return;
		}
		$registered = true;
		$base       = KDOCS_PATH . 'vendor/enshrined/svg-sanitize/src/';
		spl_autoload_register(
			static function ( $class ) use ( $base ) {
				$prefix = 'enshrined\\svgSanitize\\';
				if ( 0 !== strpos( $class, $prefix ) ) {
					return;
				}
				$file = $base . str_replace( '\\', '/', substr( $class, strlen( $prefix ) ) ) . '.php';
				if ( is_readable( $file ) ) {
					require $file;
				}
			}
		);
	}
}