EP/myep-team
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: remove antixss extension and rely on proper input escaping

Browse Source
This commit is contained in:
Björn Fromme
2026-03-15 12:42:28 +01:00
parent f21b8229e4
commit 317142afc9
22 changed files with 3 additions and 324 deletions
Download Patch File Download Diff File Expand all files Collapse all files
composer.json
-1
View File
@@ -75,7 +75,6 @@
"twig/intl-extra": "^3.7",
"twig/string-extra": "^3.7",
"twig/twig": "^2.12|^3.0",
"voku/anti-xss": "^4.1",
"zenstruck/schedule-bundle": "^1.8"
},
"config": {
composer.lock
Generated
+1 -261
View File
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
"content-hash": "e64b0165e044f03c8d4e09161b01d2f3",
"content-hash": "f0504df1803c80691eea135d9f5b7ddc",
"packages": [
{
"name": "beberlei/doctrineextensions",
@@ -10607,266 +10607,6 @@
},
"time": "2025-07-17T15:43:24+00:00"
},
{
"name": "voku/anti-xss",
"version": "4.1.42",
"source": {
"type": "git",
"url": "https://github.com/voku/anti-xss.git",
"reference": "bca1f8607e55a3c5077483615cd93bd8f11bd675"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/voku/anti-xss/zipball/bca1f8607e55a3c5077483615cd93bd8f11bd675",
"reference": "bca1f8607e55a3c5077483615cd93bd8f11bd675",
"shasum": ""
},
"require": {
"php": ">=7.0.0",
"voku/portable-utf8": "~6.0.2"
},
"require-dev": {
"phpunit/phpunit": "~6.0 || ~7.0 || ~9.0"
},
"type": "library",
"extra": {
"branch-alias": {
"dev-master": "4.1.x-dev"
}
},
"autoload": {
"psr-4": {
"voku\\helper\\": "src/voku/helper/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "EllisLab Dev Team",
"homepage": "http://ellislab.com/"
},
{
"name": "Lars Moelleken",
"email": "[email protected]",
"homepage": "https://www.moelleken.org/"
}
],
"description": "anti xss-library",
"homepage": "https://github.com/voku/anti-xss",
"keywords": [
"anti-xss",
"clean",
"security",
"xss"
],
"support": {
"issues": "https://github.com/voku/anti-xss/issues",
"source": "https://github.com/voku/anti-xss/tree/4.1.42"
},
"funding": [
{
"url": "https://www.paypal.me/moelleken",
"type": "custom"
},
{
"url": "https://github.com/voku",
"type": "github"
},
{
"url": "https://opencollective.com/anti-xss",
"type": "open_collective"
},
{
"url": "https://www.patreon.com/voku",
"type": "patreon"
},
{
"url": "https://tidelift.com/funding/github/packagist/voku/anti-xss",
"type": "tidelift"
}
],
"time": "2023-07-03T14:40:46+00:00"
},
{
"name": "voku/portable-ascii",
"version": "2.0.3",
"source": {
"type": "git",
"url": "https://github.com/voku/portable-ascii.git",
"reference": "b1d923f88091c6bf09699efcd7c8a1b1bfd7351d"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/voku/portable-ascii/zipball/b1d923f88091c6bf09699efcd7c8a1b1bfd7351d",
"reference": "b1d923f88091c6bf09699efcd7c8a1b1bfd7351d",
"shasum": ""
},
"require": {
"php": ">=7.0.0"
},
"require-dev": {
"phpunit/phpunit": "~6.0 || ~7.0 || ~9.0"
},
"suggest": {
"ext-intl": "Use Intl for transliterator_transliterate() support"
},
"type": "library",
"autoload": {
"psr-4": {
"voku\\": "src/voku/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "Lars Moelleken",
"homepage": "https://www.moelleken.org/"
}
],
"description": "Portable ASCII library - performance optimized (ascii) string functions for php.",
"homepage": "https://github.com/voku/portable-ascii",
"keywords": [
"ascii",
"clean",
"php"
],
"support": {
"issues": "https://github.com/voku/portable-ascii/issues",
"source": "https://github.com/voku/portable-ascii/tree/2.0.3"
},
"funding": [
{
"url": "https://www.paypal.me/moelleken",
"type": "custom"
},
{
"url": "https://github.com/voku",
"type": "github"
},
{
"url": "https://opencollective.com/portable-ascii",
"type": "open_collective"
},
{
"url": "https://www.patreon.com/voku",
"type": "patreon"
},
{
"url": "https://tidelift.com/funding/github/packagist/voku/portable-ascii",
"type": "tidelift"
}
],
"time": "2024-11-21T01:49:47+00:00"
},
{
"name": "voku/portable-utf8",
"version": "6.0.13",
"source": {
"type": "git",
"url": "https://github.com/voku/portable-utf8.git",
"reference": "b8ce36bf26593e5c2e81b1850ef0ffb299d2043f"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/voku/portable-utf8/zipball/b8ce36bf26593e5c2e81b1850ef0ffb299d2043f",
"reference": "b8ce36bf26593e5c2e81b1850ef0ffb299d2043f",
"shasum": ""
},
"require": {
"php": ">=7.0.0",
"symfony/polyfill-iconv": "~1.0",
"symfony/polyfill-intl-grapheme": "~1.0",
"symfony/polyfill-intl-normalizer": "~1.0",
"symfony/polyfill-mbstring": "~1.0",
"symfony/polyfill-php72": "~1.0",
"voku/portable-ascii": "~2.0.0"
},
"require-dev": {
"phpstan/phpstan": "1.9.*@dev",
"phpstan/phpstan-strict-rules": "1.4.*@dev",
"phpunit/phpunit": "~6.0 || ~7.0 || ~9.0",
"thecodingmachine/phpstan-strict-rules": "1.0.*@dev",
"voku/phpstan-rules": "3.1.*@dev"
},
"suggest": {
"ext-ctype": "Use Ctype for e.g. hexadecimal digit detection",
"ext-fileinfo": "Use Fileinfo for better binary file detection",
"ext-iconv": "Use iconv for best performance",
"ext-intl": "Use Intl for best performance",
"ext-json": "Use JSON for string detection",
"ext-mbstring": "Use Mbstring for best performance"
},
"type": "library",
"autoload": {
"files": [
"bootstrap.php"
],
"psr-4": {
"voku\\": "src/voku/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"(Apache-2.0 or GPL-2.0)"
],
"authors": [
{
"name": "Nicolas Grekas",
"email": "[email protected]"
},
{
"name": "Hamid Sarfraz",
"homepage": "http://pageconfig.com/"
},
{
"name": "Lars Moelleken",
"homepage": "http://www.moelleken.org/"
}
],
"description": "Portable UTF-8 library - performance optimized (unicode) string functions for php.",
"homepage": "https://github.com/voku/portable-utf8",
"keywords": [
"UTF",
"clean",
"php",
"unicode",
"utf-8",
"utf8"
],
"support": {
"issues": "https://github.com/voku/portable-utf8/issues",
"source": "https://github.com/voku/portable-utf8/tree/6.0.13"
},
"funding": [
{
"url": "https://www.paypal.me/moelleken",
"type": "custom"
},
{
"url": "https://github.com/voku",
"type": "github"
},
{
"url": "https://opencollective.com/portable-utf8",
"type": "open_collective"
},
{
"url": "https://www.patreon.com/voku",
"type": "patreon"
},
{
"url": "https://tidelift.com/funding/github/packagist/voku/portable-utf8",
"type": "tidelift"
}
],
"time": "2023-03-08T08:35:38+00:00"
},
{
"name": "webmozart/assert",
"version": "2.1.6",
src/Form/AddressType.php
-1
View File
@@ -33,7 +33,6 @@ class AddressType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Address::class,
'anti_xss' => true,
]);
}
}
src/Form/AdminFeedbackType.php
-1
View File
@@ -103,7 +103,6 @@ class AdminFeedbackType extends AbstractType
$resolver
->setDefaults([
'data_class' => Feedback::class,
'anti_xss' => true,
'validation_groups' => [
'Default',
'admin',
src/Form/ApplicationStatusType.php
-1
View File
@@ -42,7 +42,6 @@ class ApplicationStatusType extends AbstractType
{
$resolver->setDefaults([
'data_class' => ApplicationStatusDto::class,
'anti_xss' => true,
]);
}
}
src/Form/AssignmentType.php
-1
View File
@@ -199,7 +199,6 @@ class AssignmentType extends AbstractType
$resolver->setDefaults([
'pickup_form_url' => null,
'data_class' => Assignment::class,
'anti_xss' => true,
]);
}
}
src/Form/AvailabilityType.php
-1
View File
@@ -32,7 +32,6 @@ class AvailabilityType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Availability::class,
'anti_xss' => true,
]);
}
}
src/Form/BankAccountType.php
-1
View File
@@ -32,7 +32,6 @@ class BankAccountType extends AbstractType
{
$resolver->setDefaults([
'data_class' => BankAccount::class,
'anti_xss' => true,
]);
}
}
src/Form/CommunicationType.php
-1
View File
@@ -30,7 +30,6 @@ class CommunicationType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Communication::class,
'anti_xss' => true,
]);
}
}
src/Form/ContactType.php
-1
View File
@@ -45,7 +45,6 @@ class ContactType extends AbstractType
$resolver
->setDefaults([
'data_class' => Contact::class,
'anti_xss' => true,
])
->setRequired(['upload_session'])
->setAllowedTypes('upload_session', UploadSessionDto::class)
src/Form/DocumentCheckType.php
-1
View File
@@ -60,7 +60,6 @@ class DocumentCheckType extends AbstractType
'abgelehnt' => Upload::STATUS_REJECTED,
],
],
'anti_xss' => true,
])
->setRequired(['document_type'])
->setAllowedTypes('document_type', 'string')
src/Form/DriverLicenseCheckType.php
-1
View File
@@ -37,7 +37,6 @@ class DriverLicenseCheckType extends AbstractType
{
$resolver->setDefaults([
'data_class' => DriverLicenseCheckDto::class,
'anti_xss' => true,
]);
}
}
src/Form/Extension/AntiXssExtension.php
-42
View File
@@ -1,42 +0,0 @@
<?php
namespace App\Form\Extension;
use Symfony\Component\Form\AbstractTypeExtension;
use Symfony\Component\Form\Extension\Core\Type\FormType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\Form\FormEvent;
use Symfony\Component\Form\FormEvents;
use Symfony\Component\OptionsResolver\OptionsResolver;
use voku\helper\AntiXSS;
class AntiXssExtension extends AbstractTypeExtension
{
public function buildForm(FormBuilderInterface $builder, array $options): void
{
parent::buildForm($builder, $options);
if (true === $options['anti_xss']) {
$builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
$data = $event->getData();
$antiXss = new AntiXSS();
foreach ($data as $key => $value) {
$data[$key] = $antiXss->xss_clean($value);
}
$event->setData($data);
});
}
}
public function configureOptions(OptionsResolver $resolver): void
{
$resolver->setDefaults([
'anti_xss' => false,
]);
}
public static function getExtendedTypes(): iterable
{
return [FormType::class];
}
}
src/Form/FaqType.php
-1
View File
@@ -27,7 +27,6 @@ class FaqType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Faq::class,
'anti_xss' => true,
]);
}
}
src/Form/FeeType.php
-1
View File
@@ -32,7 +32,6 @@ class FeeType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Fee::class,
'anti_xss' => true,
]);
}
}
src/Form/FeedbackType.php
-1
View File
@@ -41,7 +41,6 @@ class FeedbackType extends AbstractType
$resolver
->setDefaults([
'data_class' => Feedback::class,
'anti_xss' => true,
])
->setRequired(['feedback_set'])
->setAllowedTypes('feedback_set', FeedbackSet::class)
src/Form/JobProfileType.php
-1
View File
@@ -73,7 +73,6 @@ class JobProfileType extends AbstractType
{
$resolver->setDefaults([
'data_class' => JobProfile::class,
'anti_xss' => true,
]);
}
}
src/Form/TeamerApplicationType.php
-1
View File
@@ -72,7 +72,6 @@ class TeamerApplicationType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Application::class,
'anti_xss' => true,
]);
}
}
src/Form/TeamerJobProfileType.php
-1
View File
@@ -76,7 +76,6 @@ class TeamerJobProfileType extends AbstractType
'job_profiles' => [],
'selectable_job_profiles' => [],
'admin_mode' => false,
'anti_xss' => true,
]);
}
}
src/Form/TeamerProfileType.php
-1
View File
@@ -128,7 +128,6 @@ class TeamerProfileType extends AbstractType
'validation_groups' => [
'profile',
],
'anti_xss' => true,
'verification_mode' => false,
])
->setRequired(['upload_session'])
src/Form/TrainingType.php
-1
View File
@@ -23,7 +23,6 @@ class TrainingType extends AbstractType
{
$resolver->setDefaults([
'data_class' => Training::class,
'anti_xss' => true,
]);
}
}
src/Twig/AppRuntime.php
+2 -2
View File
@@ -167,9 +167,9 @@ class AppRuntime implements RuntimeExtensionInterface
$list = '<ul class="'.$class.'">';
foreach ($items as $item) {
$list .= '<li>'.$item.'</li>';
$list .= '<li>'.htmlspecialchars($item, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8').'</li>';
}
$list .= '<ul>';
$list .= '</ul>';
return $list;
}