Ticket #9059: protect_source.patch

plugins/htmldataprocessor/plugin.js

@@ -93 +93 @@
         // We just avoid filler in <pre> right now.
         // TODO: Support filler for <pre>, line break is also occupy line height.
         delete blockLikeTags.pre;
+
+    function wrapAsComment(element)
+    {
+        var writer = new CKEDITOR.htmlParser.basicWriter();
+        element.writeHtml( writer );
+        var html = writer.getHtml();
+        return new CKEDITOR.htmlParser.comment(protectedSourceMarker +
+            encodeURIComponent(html).replace(/--/g,
+                "%2D%2D"));
+    }
+
         var defaultDataFilterRules =
         {
-                elements : {},
+                elements : {
+            // protect source using html parser
+            script:wrapAsComment,
+            noscript:wrapAsComment
+        },
                 attributeNames :
                 [
                         // Event attributes (onXYZ) must not be directly set. They can become
@@ -245 +260 @@
                                         // Remove all class names starting with "cke_".
                                         return CKEDITOR.tools.ltrim( value.replace( /(?:^|\s+)cke_[^\s]*/g, '' ) ) || false;
                                 }
-                        }
+                        },
+            comment:function(contents){
+                // If this is a comment for protected source.
+                // unprotect source using html parser
+                if (contents.substr(0, protectedSourceMarker.length) == protectedSourceMarker) {
+                    contents = decodeURIComponent(contents.substr(protectedSourceMarker.length));
+                    var el = CKEDITOR.htmlParser.fragment.fromHtml(contents).children[0];
+                    if(el.children&&el.children[0])
+                    {
+                        el.children[0].value=CKEDITOR.tools.trim(el.children[0].value);
+                    }
+                    return el;
+                }
+                return contents;
+            }
                 };
 
         if ( CKEDITOR.env.ie )
@@ -294 +323 @@
         var protectElementsRegex = /(?:<style(?=[ >])[^>]*>[\s\S]*<\/style>)|(?:<(:?link|meta|base)[^>]*>)/gi,
                 encodedElementsRegex = /<cke:encoded>([^<]*)<\/cke:encoded>/gi;
 
-        var protectElementNamesRegex = /(<\/?)((?:object|embed|param|html|body|head|title)[^>]*>)/gi,
-                unprotectElementNamesRegex = /(<\/?)cke:((?:html|body|head|title)[^>]*>)/gi;
+        var protectElementNamesRegex = /(<\/?)((?:object|embed|param|html|body|head|title|script|noscript)[^>]*>)/gi,
+                unprotectElementNamesRegex = /(<\/?)cke:((?:object|embed|param|html|body|head|title|script|noscript)[^>]*>)/gi;
 
         var protectSelfClosingRegex = /<cke:(param|embed)([^>]*?)\/?>(?!\s*<\/cke:\1)/gi;
 
@@ -351 +380 @@
                 return html.replace( /(<pre\b[^>]*>)(\r\n|\n)/g, '$1$2$2' );
         }
 
-        function protectRealComments( html )
-        {
-                return html.replace( /<!--(?!{cke_protected})[\s\S]+?-->/g, function( match )
-                        {
-                                return '<!--' + protectedSourceMarker +
-                                                '{C}' +
-                                                encodeURIComponent( match ).replace( /--/g, '%2D%2D' ) +
-                                                '-->';
-                        });
-        }
-
-        function unprotectRealComments( html )
-        {
-                return html.replace( /<!--\{cke_protected\}\{C\}([\s\S]+?)-->/g, function( match, data )
-                        {
-                                return decodeURIComponent( data );
-                        });
-        }
-
-        function unprotectSource( html, editor )
-        {
-                var store = editor._.dataStore;
-
-                return html.replace( /<!--\{cke_protected\}([\s\S]+?)-->/g, function( match, data )
-                        {
-                                return decodeURIComponent( data );
-                        }).replace( /\{cke_protected_(\d+)\}/g, function( match, id )
-                        {
-                                return store && store[ id ] || '';
-                        });
-        }
-
-        function protectSource( data, editor )
-        {
-                var protectedHtml = [],
-                        protectRegexes = editor.config.protectedSource,
-                        store = editor._.dataStore || ( editor._.dataStore = { id : 1 } ),
-                        tempRegex = /<\!--\{cke_temp(comment)?\}(\d*?)-->/g;
-
-                var regexes =
-                        [
-                                // Script tags will also be forced to be protected, otherwise
-                                // IE will execute them.
-                                ( /<script[\s\S]*?<\/script>/gi ),
-
-                                // <noscript> tags (get lost in IE and messed up in FF).
-                                /<noscript[\s\S]*?<\/noscript>/gi
-                        ]
-                        .concat( protectRegexes );
-
-                // First of any other protection, we must protect all comments
-                // to avoid loosing them (of course, IE related).
-                // Note that we use a different tag for comments, as we need to
-                // transform them when applying filters.
-                data = data.replace( (/<!--[\s\S]*?-->/g), function( match )
-                        {
-                                return  '<!--{cke_tempcomment}' + ( protectedHtml.push( match ) - 1 ) + '-->';
-                        });
-
-                for ( var i = 0 ; i < regexes.length ; i++ )
-                {
-                        data = data.replace( regexes[i], function( match )
-                                {
-                                        match = match.replace( tempRegex,               // There could be protected source inside another one. (#3869).
-                                                function( $, isComment, id )
-                                                {
-                                                        return protectedHtml[ id ];
-                                                }
-                                        );
-
-                                        // Avoid protecting over protected, e.g. /\{.*?\}/
-                                        return ( /cke_temp(comment)?/ ).test( match ) ? match
-                                                : '<!--{cke_temp}' + ( protectedHtml.push( match ) - 1 ) + '-->';
-                                });
-                }
-                data = data.replace( tempRegex, function( $, isComment, id )
-                        {
-                                return '<!--' + protectedSourceMarker +
-                                                ( isComment ? '{C}' : '' ) +
-                                                encodeURIComponent( protectedHtml[ id ] ).replace( /--/g, '%2D%2D' ) +
-                                                '-->';
-                        }
-                );
-
-                // Different protection pattern is used for those that
-                // live in attributes to avoid from being HTML encoded.
-                return data.replace( /(['"]).*?\1/g, function ( match )
-                {
-                        return match.replace( /<!--\{cke_protected\}([\s\S]+?)-->/g, function( match, data )
-                        {
-                                store[ store.id ] = decodeURIComponent( data );
-                                return '{cke_protected_'+ ( store.id++ )  + '}';
-                        });
-                });
-        }
-
         CKEDITOR.plugins.add( 'htmldataprocessor',
         {
                 requires : [ 'htmlwriter' ],
@@ -487 +420 @@
         {
                 toHtml : function( data, fixForBody )
                 {
-                        // The source data is already HTML, but we need to clean
-                        // it up and apply the filter.
 
-                        data = protectSource( data, this.editor );
-
                         // Before anything, we must protect the URL attributes as the
                         // browser may changing them when setting the innerHTML later in
                         // the code.
@@ -529 +458 @@
 
                         data = unprotectElements( data );
 
-                        // Restore the comments that have been protected, in this way they
-                        // can be properly filtered.
-                        data = unprotectRealComments( data );
-
                         // Now use our parser to make further fixes to the structure, as
                         // well as apply the filter.
                         var fragment = CKEDITOR.htmlParser.fragment.fromHtml( data, fixForBody ),
@@ -541 +466 @@
                         fragment.writeHtml( writer, this.dataFilter );
                         data = writer.getHtml( true );
 
-                        // Protect the real comments again.
-                        data = protectRealComments( data );
-
                         return data;
                 },
 
@@ -558 +480 @@
 
                         var data = writer.getHtml( true );
 
-                        // Restore those non-HTML protected source. (#4475,#4880)
-                        data = unprotectRealComments( data );
-                        data = unprotectSource( data, this.editor );
-
                         return data;
                 }
         };