plugins/LanguagesManager/TranslationWriter/Validate/NoScripts.php


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

<?php

/**
 * Matomo - free/libre analytics platform
 *
 * @link https://matomo.org
 * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
 *
 */

namespace Piwik\Plugins\LanguagesManager\TranslationWriter\Validate;

class NoScripts extends ValidateAbstract
{
    /**
     * Validates the given translations
     *  * No script like parts should be present in any part of the translations
     *
     * @param array $translations
     *
     * @return boolean
     */
    public function isValid($translations)
    {
        $this->message = null;

        // check if any translation contains restricted script tags
        $serializedStrings = serialize($translations);
        $invalids = ['/<script/i', '/javascript:[^"]/i', '/src=/i', '/background=/i', '/onload=/i'];

        foreach ($invalids as $invalid) {
            if (preg_match($invalid, $serializedStrings) > 0) {
                $this->message = 'script tags restricted for language files';
                return false;
            }
        }

        return true;
    }
}