sms.php

<?php

/**
 * Validates sms (for text messaging).
 *
 * The relevant specification for this protocol is RFC 5724.
 * This class normalizes SMS numbers so that they only include
 * digits, optionally with a leading plus for international numbers.
 *
 * According to RFC 5724, SMS URIs support the 'body' parameter
 * using the format: sms:number?body=message
 * However, the format: sms:number&body=message is commonly used on
 * the web, so it is also supported here.
 */

class HTMLPurifier_URIScheme_sms extends HTMLPurifier_URIScheme
{
    /**
     * @type bool
     */
    public $browsable = false;

    /**
     * @type bool
     */
    public $may_omit_host = true;

    /**
     * @param HTMLPurifier_URI $uri
     * @param HTMLPurifier_Config $config
     * @param HTMLPurifier_Context $context
     * @return bool
     */
    public function doValidate(&$uri, $config, $context)
    {
        $uri->userinfo = null;
        $uri->host     = null;
        $uri->port     = null;

        // Extract phone number and parameters from path and query
        $phone_number = $uri->path;
        $body_content = null;

        // Check if path contains &param= syntax (non-standard but common)
        if (strpos($phone_number, '&') !== false) {
            // Split by & to get phone number and parameters
            $parts = explode('&', $phone_number);
            $phone_number = array_shift($parts); // First part is the phone number

            // Parse parameters from path
            foreach ($parts as $param) {
                if (strpos($param, '=') !== false) {
                    list($param_name, $param_value) = explode('=', $param, 2);
                    if ($param_name === 'body') {
                        $body_content = $param_value;
                    }
                    // Other parameters (subject, invalid, etc.) are ignored/stripped
                }
            }
        }

        // Also check query string for body parameter (standard ?body= syntax)
        // Query takes precedence if present (parser converts &body= to ?body=)
        // The query may contain multiple parameters like "body=Hello&subject=Test"
        if (!is_null($uri->query)) {
            // Parse query parameters
            $query_parts = explode('&', $uri->query);
            foreach ($query_parts as $query_param) {
                if (strpos($query_param, '=') !== false) {
                    list($param_name, $param_value) = explode('=', $query_param, 2);
                    if ($param_name === 'body') {
                        $body_content = $param_value;
                        break; // Only take the first body parameter
                    }
                }
            }
        }

        // Clean the phone number part
        $phone_number = preg_replace(
            '/(?!^\+)[^\d]/',
            '',
            rawurldecode($phone_number)
        );

        // Sanitize the body content if present
        if ($body_content !== null) {
            $body_content = $this->sanitizeBody($body_content);
        }

        // Reconstruct the path with &body= syntax (non-standard but common format)
        if ($body_content !== null) {
            // Always include &body= even if empty (per test expectations)
            $uri->path = $phone_number . '&body=' . $body_content;
        } else {
            $uri->path = $phone_number;
        }

        // Clear query since we're using &body= in path format
        $uri->query = null;

        return true;
    }

    /**
     * Sanitizes SMS body content
     * @param string $body
     * @return string
     */
    private function sanitizeBody($body)
    {
        // Decode URL encoding first so encoded payloads are caught
        $decoded = rawurldecode($body);

        // Angle brackets are the primary HTML injection vector — reject the
        // entire body if they appear rather than trying to strip them partially
        if (strpos($decoded, '<') !== false || strpos($decoded, '>') !== false) {
            return '';
        }

        // Strip quote characters that could break HTML attribute context
        $sanitized = preg_replace('/[\'"]/', '', $decoded);

        // Re-encode so the value is safe for embedding in a URL attribute
        return rawurlencode($sanitized);
    }
}