From aac8493fda973dd49a283a70b5d9ecbb72a412ee Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Mon, 26 Sep 2016 00:47:01 +0200
Subject: [PATCH] Discarding invalid tables w/o content

---
 .../input/node/HtmlInputNodeTable.class.php   | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTable.class.php

diff --git a/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTable.class.php b/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTable.class.php
new file mode 100644
index 0000000000..ae0fdd4bad
--- /dev/null
+++ b/wcfsetup/install/files/lib/system/html/input/node/HtmlInputNodeTable.class.php
@@ -0,0 +1,55 @@
+<?php
+namespace wcf\system\html\input\node;
+use wcf\system\html\node\AbstractHtmlNodeProcessor;
+use wcf\util\DOMUtil;
+
+/**
+ * Processes `<table>` and removes invalid tables. This action can
+ * be done safely, because completely messed up tables have already
+ * been crippled by HTMLPurifier.
+ *
+ * @author      Alexander Ebert
+ * @copyright   2001-2016 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\System\Html\Input\Node
+ * @since       3.0
+ */
+class HtmlInputNodeWoltlabTable extends AbstractHtmlInputNode {
+	/**
+	 * @inheritDoc
+	 */
+	protected $tagName = 'table';
+	
+	/**
+	 * @inheritDoc
+	 */
+	public function isAllowed(AbstractHtmlNodeProcessor $htmlNodeProcessor) {
+		return [];
+	}
+	
+	/**
+	 * @inheritDoc
+	 */
+	public function process(array $elements, AbstractHtmlNodeProcessor $htmlNodeProcessor) {
+		/** @var \DOMElement $element */
+		foreach ($elements as $element) {
+			$trs = [];
+			/** @var \DOMElement $tr */
+			foreach ($element->getElementsByTagName('tr') as $tr) {
+				$trs[] = $tr;
+			}
+			
+			// check if each `<tr>` has at least one `<td>`
+			foreach ($trs as $tr) {
+				if ($tr->getElementsByTagName('td')->length === 0) {
+					DOMUtil::removeNode($tr);
+				}
+			}
+			
+			if ($element->getElementsByTagName('tr')->length === 0) {
+				// garbage table, remove
+				DOMUtil::removeNode($element);
+			}
+		}
+	}
+}
-- 
2.20.1