protected function checkElementNode(DOMElement $element, Tag $tag)
	{
		$xpath = new DOMXPath($element->ownerDocument);

		// If current node is not an <xsl:attribute/> element, we exclude descendants
		// with an <xsl:attribute/> ancestor so that content such as:
		//   <script><xsl:attribute name="id"><xsl:value-of/></xsl:attribute></script>
		// would not trigger a false-positive due to the presence of an <xsl:value-of/>
		// element in a <script>
		$predicate = ($element->localName === 'attribute') ? '' : '[not(ancestor::xsl:attribute)]';

		// Test the select expression of <xsl:value-of/> nodes
		$query = './/xsl:value-of' . $predicate;
		foreach ($xpath->query($query, $element) as $valueOf)
		{
			$this->checkSelectNode($valueOf->getAttributeNode('select'), $tag);
		}

		// Reject all <xsl:apply-templates/> nodes
		$query = './/xsl:apply-templates' . $predicate;
		foreach ($xpath->query($query, $element) as $applyTemplates)
		{
			throw new UnsafeTemplateException('Cannot allow unfiltered data in this context', $applyTemplates);
		}
	}
protected function checkElementNode(DOMElement $element, Tag $tag)
	{
		$xpath = new DOMXPath($element->ownerDocument);

		// If current node is not an <xsl:attribute/> element, we exclude descendants
		// with an <xsl:attribute/> ancestor so that content such as:
		//   <script><xsl:attribute name="id"><xsl:value-of/></xsl:attribute></script>
		// would not trigger a false-positive due to the presence of an <xsl:value-of/>
		// element in a <script>
		$predicate = ($element->localName === 'attribute') ? '' : '[not(ancestor::xsl:attribute)]';

		// Test the select expression of <xsl:value-of/> nodes
		$query = './/xsl:value-of' . $predicate;
		foreach ($xpath->query($query, $element) as $valueOf)
		{
			$this->checkSelectNode($valueOf->getAttributeNode('select'), $tag);
		}

		// Reject all <xsl:apply-templates/> nodes
		$query = './/xsl:apply-templates' . $predicate;
		foreach ($xpath->query($query, $element) as $applyTemplates)
		{
			throw new UnsafeTemplateException('Cannot allow unfiltered data in this context', $applyTemplates);
		}
	}
protected function checkElementNode ( DOMElement $ element , Tag $ tag ) { $ xpath = new DOMXPath ( $ element -> ownerDocument ) ; // If current node is not an <xsl:attribute/> element, we exclude descendants // with an <xsl:attribute/> ancestor so that content such as: //   <script><xsl:attribute name="id"><xsl:value-of/></xsl:attribute></script> // would not trigger a false-positive due to the presence of an <xsl:value-of/> // element in a <script> $ predicate = ( $ element -> localName === 'attribute' ) ? '' : '[not(ancestor::xsl:attribute)]' ; // Test the select expression of <xsl:value-of/> nodes $ query = './/xsl:value-of' . $ predicate ; foreach ( $ xpath -> query ( $ query , $ element ) as $ valueOf ) { $ this -> checkSelectNode ( $ valueOf -> getAttributeNode ( 'select' ) , $ tag ) ; } // Reject all <xsl:apply-templates/> nodes $ query = './/xsl:apply-templates' . $ predicate ; foreach ( $ xpath -> query ( $ query , $ element ) as $ applyTemplates ) { throw new UnsafeTemplateException ( 'Cannot allow unfiltered data in this context' , $ applyTemplates ) ; } }
Test whether an element node is safe

@param  DOMElement $element Element
@param  Tag        $tag     Reference tag
@return void
Test whether an element node is safe