private function sanitizeAttributes(DOMNode $child)
    {
        // Compile a list of attributes that should be removed
        $remove_attributes = array();
        foreach ($child->attributes as $attrib)
        {
            $name = $attrib->name;
            if (!isset($this->allowed_attributes[$name]))
            {
                $remove_attributes[] = $attrib;
            }
            elseif ($name === "href")
            {
                $val = $attrib->nodeValue;

                $is_allowed = false;
                $proto_pos = strpos($val, ":");
                if ($proto_pos !== false)
                {
                    $proto = strtolower(substr($val, 0, $proto_pos));
                    if (isset($this->allowed_protocols[$proto]))
                        $is_allowed = true;
                }
                elseif (substr($val, 0, 2) === '//')
                { // External link with same protocol
                    if (isset($this->allowed_protocols['https']))
                        $is_allowed = true;
                }
                else 
                { // Internal link
                    $is_allowed = true;
                }

                if (!$is_allowed)
                    $remove_attributes[] = $attrib;
            }
        }

        // Remove all nodes selected for removal
        foreach ($remove_attributes as $attrib)
            $child->removeAttributeNode($attrib);
    }
private function sanitizeAttributes(DOMNode $child)
    {
        // Compile a list of attributes that should be removed
        $remove_attributes = array();
        foreach ($child->attributes as $attrib)
        {
            $name = $attrib->name;
            if (!isset($this->allowed_attributes[$name]))
            {
                $remove_attributes[] = $attrib;
            }
            elseif ($name === "href")
            {
                $val = $attrib->nodeValue;

                $is_allowed = false;
                $proto_pos = strpos($val, ":");
                if ($proto_pos !== false)
                {
                    $proto = strtolower(substr($val, 0, $proto_pos));
                    if (isset($this->allowed_protocols[$proto]))
                        $is_allowed = true;
                }
                elseif (substr($val, 0, 2) === '//')
                { // External link with same protocol
                    if (isset($this->allowed_protocols['https']))
                        $is_allowed = true;
                }
                else 
                { // Internal link
                    $is_allowed = true;
                }

                if (!$is_allowed)
                    $remove_attributes[] = $attrib;
            }
        }

        // Remove all nodes selected for removal
        foreach ($remove_attributes as $attrib)
            $child->removeAttributeNode($attrib);
    }
private function sanitizeAttributes ( DOMNode $ child ) { // Compile a list of attributes that should be removed $ remove_attributes = array ( ) ; foreach ( $ child -> attributes as $ attrib ) { $ name = $ attrib -> name ; if ( ! isset ( $ this -> allowed_attributes [ $ name ] ) ) { $ remove_attributes [ ] = $ attrib ; } elseif ( $ name === "href" ) { $ val = $ attrib -> nodeValue ; $ is_allowed = false ; $ proto_pos = strpos ( $ val , ":" ) ; if ( $ proto_pos !== false ) { $ proto = strtolower ( substr ( $ val , 0 , $ proto_pos ) ) ; if ( isset ( $ this -> allowed_protocols [ $ proto ] ) ) $ is_allowed = true ; } elseif ( substr ( $ val , 0 , 2 ) === '//' ) { // External link with same protocol if ( isset ( $ this -> allowed_protocols [ 'https' ] ) ) $ is_allowed = true ; } else { // Internal link $ is_allowed = true ; } if ( ! $ is_allowed ) $ remove_attributes [ ] = $ attrib ; } } // Remove all nodes selected for removal foreach ( $ remove_attributes as $ attrib ) $ child -> removeAttributeNode ( $ attrib ) ; }
Helper function to sanitize the attributes for the specified node.
@param $child DOMNode the child to examine
Helper function to sanitize the attributes for the specified node .