Simple existing regex modification assistance required

[cadkins23]

I'm new to this regex stuff.. I'm sure it makes sense but I've yet to fully grasp it.
I run a site and use a HtmlPurifier to filter user input. In order to allow playlist code I had to create a regex.

One of my users mentioned losing their background image on their playlist. The reason is because I'm not checking to see if there is a background image in their playlist. Let me show you an example of what I am talking about.

Here is the usual code that the user will be pasting in my textarea:

<object width="435" height="270"> 
<param name="movie" value="http://www.musiclist.us/mc/mp3player_new.swf"></param> 
<param name="allowscriptaccess" value="never"></param> 
<param name="wmode" value="transparent"></param> 
<param name="flashvars" value="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fconfig_black_shuffle.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.musiclist.us%2Fpl.php%3Fplaylist%3D27578280%26t%3D1265099482&amp;wid=os"></param> 
<embed style="width:435px; visibility:visible; height:270px;" allowScriptAccess="never" src="http://www.musiclist.us/mc/mp3player_new.swf" flashvars="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fconfig_black_shuffle.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.musiclist.us%2Fpl.php%3Fplaylist%3D27578280%26t%3D1265099482&amp;wid=os" width="435" height="270" name="mp3player" wmode="transparent" type="application/x-shockwave-flash" border="0"/>
</object>

And here is the code if the user has a custom background image

<object width="435" height="270"> 
<param name="movie" value="http://www.playlistproject.net/mc/mp3player_new.swf"></param> 
<param name="allowscriptaccess" value="never"></param> 
<param name="wmode" value="transparent"></param> 
<param name="flashvars" value="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fskins%2Fconfig_white.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.playlistproject.net%2Fpl.php%3Fplaylist%3D27578280%26t%3D1265100408&amp;skinurl=http%3A%2F%2Fi75.photobucket.com%2Falbums%2Fi302%2Fohhbaby_iloveyou%2Fmyspace%2F250nqeu.jpg+&amp;wid=os"></param> 
<embed style="width:435px; visibility:visible; height:270px;" allowScriptAccess="never" src="http://www.playlistproject.net/mc/mp3player_new.swf" flashvars="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fskins%2Fconfig_white.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.playlistproject.net%2Fpl.php%3Fplaylist%3D27578280%26t%3D1265100408&amp;skinurl=http%3A%2F%2Fi75.photobucket.com%2Falbums%2Fi302%2Fohhbaby_iloveyou%2Fmyspace%2F250nqeu.jpg+&amp;wid=os" width="435" height="270" name="mp3player" wmode="transparent" type="application/x-shockwave-flash" border="0"/> 
</object>

The code with the background image is basically the same as the first one but has this parameter added:

skinurl=http%3A%2F%2Fi75.photobucket.com%2Falbums%2Fi302%2Fohhbaby_iloveyou%2Fmyspace%2F250nqeu.jpg

Now here is the class that I am using which includes my current regex

class HTMLPurifier_Filter_Playlist extends HTMLPurifier_Filter
{
 public $name="Playlist";

 public function preFilter($html, $config, $context) 
 {
 $pre_regex = '/<embed(.+)config_([a-zA-Z]+[_]*[a-zA-Z]*)(.+)playlist%3D([0-9]+)(.+)/';

 $pre_replace = '<span class="playlist-$2">$4</span>';
        return preg_replace($pre_regex, $pre_replace, $html);
 }

 public function postFilter($html, $config, $context) 
 {
         $post_regex = '/<span class="playlist-([a-zA-Z]+[_]*[a-zA-Z]*)">([0-9]+)<\/span>/';

$post_replace = '<object width="435" height="270"> <param name="movie" value="http://www.musiclist.us/mc/mp3player_new.swf"></param> <param name="allowscriptaccess" value="never"></param> <param name="wmode" value="transparent"></param> <param name="flashvars" value="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fconfig_$1.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.musiclist.us%2Fpl.php%3Fplaylist%3D$2%26t%3D1265099482&amp;wid=os"></param> <embed style="width:435px; visibility:visible; height:270px;" allowScriptAccess="never" src="http://www.musiclist.us/mc/mp3player_new.swf" flashvars="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fconfig_$1.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.musiclist.us%2Fpl.php%3Fplaylist%3D$2%26t%3D1265099482&amp;wid=os" width="435" height="270" name="mp3player" wmode="transparent" type="application/x-shockwave-flash" border="0"/> </object>';
         return preg_replace($post_regex, $post_replace, $html);
    }

}

If I simply change $pre_regex to include the 'skinurl' parameter then any time someone pastes code into the textarea that doesnt have the skinurl parameter the code will be wiped out since it won't match the regex requirements.

If I don't change the $pre_regex then the skinurl=xxxxxx won't be put into a variable for use if the user has a background image on their playlist.

I know there must be an easy fix that I can't think of. I'm hoping some of you more experiences coders can give me a nudge.

Thanks in advance!

[johanafm]

$p = '#somestuff(\s*skinurl=...)? morestuff#';

The ? will match 0 or 1 instance of skinurl=... which means it not being there will work fine.

But, you will also have issues if someone pastes code where things don't appear in the exact same order. Note that this is in no way a complete setup for your needs, nor is the final html for the entire object constructed. But it should give you the basis for disassembling the original code and reassembling the sanitized code.

function sanitizeEmbedAttribute($pattern, $attribVal, $attrib) {
	$out = array();
	foreach($pattern as $p) {
		$p = '#'.$p.'#';
		if (preg_match($p, $attribVal, $match)) {
			$out[] .= $match[0];
		}
	}

if (empty($out))
	return false;
return $attrib . '="' . implode(' ', $out) . '"';
}
function sanitizeFlashvars($pattern, $attribVal) {
	$out = array();
	# src=http://...&mywidth=...&...
	$parts = explode('&', $attribVal);
	foreach($parts as $part) {
		// mywidth=123, myheight=123, src=http://...
		$nameVal = explode('=', $part);
		if (isset($pattern[$nameVal[0]])) {
			$name = $nameVal[0];
			$val = $nameVal[1];

		$p = '#' . $pattern[$name] . '#';
		if (preg_match($p, $val, $match))
			$out[] = $name . '=' . $match[0];
	}
}

return 'flashvars="' . implode('&', $out) . '"';
}

$in = '<object width="435" height="270"> 
<param name="movie" value="http://www.playlistproject.net/mc/mp3player_new.swf"></param> 
<param name="allowscriptaccess" value="never"></param> 
<param name="wmode" value="transparent"></param> 
<param name="flashvars" value="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fskins%2Fconfig_white.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.playlistproject.net%2Fpl.php%3Fplaylist%3D27578280%26t%3D1265100408&amp;skinurl=http%3A%2F%2Fi75.photobucket.com%2Falbums%2Fi302%2Fohhbaby_iloveyou%2Fmyspace%2F250nqeu.jpg+&amp;wid=os"></param> 
<embed style="width:435px; visibility:visible; height:270px;" allowScriptAccess="never"
		src="http://www.playlistproject.net/mc/mp3player_new.swf"
		flashvars="config=http%3A%2F%2Fwww.indimusic.us%2Fext%2Fpc%2Fskins%2Fconfig_white.xml&amp;mywidth=435&amp;myheight=270&amp;playlist_url=http%3A%2F%2Fwww.playlistproject.net%2Fpl.php%3Fplaylist%3D27578280%26t%3D1265100408&amp;skinurl=http%3A%2F%2Fi75.photobucket.com%2Falbums%2Fi302%2Fohhbaby_iloveyou%2Fmyspace%2F250nqeu.jpg+&amp;wid=os"
		width="435" height="270" name="mp3player" wmode="transparent"
		type="application/x-shockwave-flash" border="0"/> 
</object>';

$embedPattern = '#<embed([^>]*)>#';	// get all attributes in embed tag
// pattern did not match, or the embed tag was empty: <embed>
if (!preg_match($embedPattern, $in, $embed) || count($embed) == 1)
	return '';
$attribPattern = '#([a-zA-Z]*)=(\'|")(.*?)(\2)#';

if (!preg_match_all($attribPattern, $embed[1], $attribs))
	return '';

// Add "fixed" attributes
$out[] = 'src="http://www.playlistproject.net/mc/mp3player_new.swf';
$out[] = 'width="435"';
$out[] = 'height="270"';

$okAttribs = array(
	'style' => array('width:\s*\d+px;', 'height:\s*\d+px;'),
	'flashvars' => array('config' => urlencode('http://www.indimusic.us/ext/pc/skins/').'.*?\.xml',
						'mywidth' => '\d{1,3}'
	)
);
// Go through all attribs in the embed element
for ($i = 0; $i < count($attribs[1]); ++$i) {
	// Only keep those that are in $okAttribs
	if (isset($okAttribs[$attribs[1][$i]])) {
		if ($attribs[1][$i] == 'flashvars') {
			if (!$s = sanitizeFlashvars($okAttribs['flashvars'], $attribs[3][$i]))
				return '';
			$out[] = $s;
		}
		else if ($s = sanitizeEmbedAttribute($okAttribs[$attribs[1][$i]], $attribs[3][$i], $attribs[1][$i]))
			$out[] = $s;
	}
}
echo '<pre>' . htmlentities(print_r($out,1)) . '</pre>';

Also, I really see no need for allowing style="width: ...; height: ...;" when you allready have params and embed attributes for width and height. I just included those to show the general pattern for sanitizing attributes.