english/libraries/joomla/filter/filterinput.php
/**
	 * Internal method to strip a tag of certain attributes
	 *
	 * @param   array  $attrSet	Array of attribute pairs to filter
	 *
	 * @return  array  Filtered array of attribute pairs
	 *
	 * @since   11.1
	 */
Internal method to strip a tag of certain attributes
@param   array  $attrSet     Array of attribute pairs to filter

@return  array  Filtered array of attribute pairs


Internal method to strip a tag of certain attributes @param array $attrSet Array of attribute pairs to filter @return array Filtered array of attribute pairs
protected function _cleanAttributes($attrSet)
	{
		$newSet = array();
		$count = count($attrSet);
		for ($i = 0; $i < $count; $i ++) {
			if (!$attrSet[$i]) {
				continue;
			}
			$attrSubSet = explode('=', trim($attrSet[$i]), 2);
			$attrSubSet[0] = array_pop(explode(' ', trim($attrSubSet[0])));
			if ((!preg_match('/[a-z]*$/i', $attrSubSet[0])) || (($this->xssAuto) && ((in_array(strtolower($attrSubSet[0]), $this->attrBlacklist)) || (substr($attrSubSet[0], 0, 2) == 'on')))) {
				continue;
			}
			if (isset($attrSubSet[1])) {
				$attrSubSet[1] = trim($attrSubSet[1]);
				$attrSubSet[1] = str_replace('&#', '', $attrSubSet[1]);
				$attrSubSet[1] = preg_replace('/[\n\r]/', '', $attrSubSet[1]);
				$attrSubSet[1] = str_replace('"', '', $attrSubSet[1]);
				if ((substr($attrSubSet[1], 0, 1) == "'") && (substr($attrSubSet[1], (strlen($attrSubSet[1]) - 1), 1) == "'")) {
					$attrSubSet[1] = substr($attrSubSet[1], 1, (strlen($attrSubSet[1]) - 2));
				}
				$attrSubSet[1] = stripslashes($attrSubSet[1]);
			} else {
				continue;
			}
			if (self::checkAttribute($attrSubSet)) {
				continue;
			}
						$attrFound = in_array(strtolower($attrSubSet[0]), $this->attrArray);
			if ((!$attrFound && $this->attrMethod) || ($attrFound && !$this->attrMethod)) {
								if (empty($attrSubSet[1]) === false) {
					$newSet[] = $attrSubSet[0].'="'.$attrSubSet[1].'"';
				} else if ($attrSubSet[1] === "0") {
					 					$newSet[] = $attrSubSet[0].'="0"';
				} else {
					$newSet[] = $attrSubSet[0].'=""';
				}
			}
		}
		return $newSet;
	}
protected function _cleanAttributes ( $ attrSet ) { $ newSet = array ( ) ; $ count = count ( $ attrSet ) ; for ( $ i = 0 ; $ i < $ count ; $ i ++ ) { if ( ! $ attrSet [ $ i ] ) { continue ; } $ attrSubSet = explode ( '=' , trim ( $ attrSet [ $ i ] ) , 2 ) ; $ attrSubSet [ 0 ] = array_pop ( explode ( ' ' , trim ( $ attrSubSet [ 0 ] ) ) ) ; if ( ( ! preg_match ( '/[a-z]*$/i' , $ attrSubSet [ 0 ] ) ) || ( ( $ this -> xssAuto ) && ( ( in_array ( strtolower ( $ attrSubSet [ 0 ] ) , $ this -> attrBlacklist ) ) || ( substr ( $ attrSubSet [ 0 ] , 0 , 2 ) == 'on' ) ) ) ) { continue ; } if ( isset ( $ attrSubSet [ 1 ] ) ) { $ attrSubSet [ 1 ] = trim ( $ attrSubSet [ 1 ] ) ; $ attrSubSet [ 1 ] = str_replace ( '&#' , '' , $ attrSubSet [ 1 ] ) ; $ attrSubSet [ 1 ] = preg_replace ( '/[\n\r]/' , '' , $ attrSubSet [ 1 ] ) ; $ attrSubSet [ 1 ] = str_replace ( '"' , '' , $ attrSubSet [ 1 ] ) ; if ( ( substr ( $ attrSubSet [ 1 ] , 0 , 1 ) == " ' " ) && ( substr ( $ attrSubSet [ 1 ] , ( strlen ( $ attrSubSet [ 1 ] ) - 1 ) , 1 ) == " ' " ) ) { $ attrSubSet [ 1 ] = substr ( $ attrSubSet [ 1 ] , 1 , ( strlen ( $ attrSubSet [ 1 ] ) - 2 ) ) ; } $ attrSubSet [ 1 ] = stripslashes ( $ attrSubSet [ 1 ] ) ; } else { continue ; } if ( self :: checkAttribute ( $ attrSubSet ) ) { continue ; } $ attrFound = in_array ( strtolower ( $ attrSubSet [ 0 ] ) , $ this -> attrArray ) ; if ( ( ! $ attrFound && $ this -> attrMethod ) || ( $ attrFound && ! $ this -> attrMethod ) ) { if ( empty ( $ attrSubSet [ 1 ] ) === false ) { $ newSet [ ] = $ attrSubSet [ 0 ] . '="' . $ attrSubSet [ 1 ] . '"' ; } else if ( $ attrSubSet [ 1 ] === " 0 " ) { $ newSet [ ] = $ attrSubSet [ 0 ] . '="0"' ; } else { $ newSet [ ] = $ attrSubSet [ 0 ] . '=""' ; } } } return $ newSet ; }
Internal method to strip a tag of certain attributes
 @param   array  $attrSet     Array of attribute pairs to filter
Internal method to strip a tag of certain attributes @param array $attrSet Array of attribute pairs to filter
// Initialise variables. // Iterate through attribute pairs // Skip blank spaces // Split into name/value pairs // Take the last attribute in case there is an attribute with no value // Remove all "non-regular" attribute names // AND blacklisted attributes // XSS attribute value filtering // trim leading and trailing spaces // strips unicode, hex, etc // Strip normal newline within attr value // Strip double quotes // Convert single quotes from either side to doubles (Single quotes shouldn't be used to pad attr values) // Strip slashes // Autostrip script tags // Is our attribute in the user input array?
 // If the tag is allowed lets keep it // Does the attribute have a value?
 // Special Case // Is the value 0?
 // Leave empty attributes alone