chore: remove antixss extension and rely on proper input escaping

src/Form/AddressType.php

@@ -33,7 +33,6 @@ class AddressType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Address::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/AdminFeedbackType.php

@@ -103,7 +103,6 @@ class AdminFeedbackType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Feedback::class,
-                'anti_xss' => true,
                 'validation_groups' => [
                     'Default',
                     'admin',

src/Form/ApplicationStatusType.php

@@ -42,7 +42,6 @@ class ApplicationStatusType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => ApplicationStatusDto::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/AssignmentType.php

@@ -199,7 +199,6 @@ class AssignmentType extends AbstractType
         $resolver->setDefaults([
             'pickup_form_url' => null,
             'data_class' => Assignment::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/AvailabilityType.php

@@ -32,7 +32,6 @@ class AvailabilityType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Availability::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/BankAccountType.php

@@ -32,7 +32,6 @@ class BankAccountType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => BankAccount::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/CommunicationType.php

@@ -30,7 +30,6 @@ class CommunicationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Communication::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/ContactType.php

@@ -45,7 +45,6 @@ class ContactType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Contact::class,
-                'anti_xss' => true,
             ])
             ->setRequired(['upload_session'])
             ->setAllowedTypes('upload_session', UploadSessionDto::class)

src/Form/DocumentCheckType.php

@@ -60,7 +60,6 @@ class DocumentCheckType extends AbstractType
                         'abgelehnt' => Upload::STATUS_REJECTED,
                     ],
                 ],
-                'anti_xss' => true,
             ])
             ->setRequired(['document_type'])
             ->setAllowedTypes('document_type', 'string')

src/Form/DriverLicenseCheckType.php

@@ -37,7 +37,6 @@ class DriverLicenseCheckType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => DriverLicenseCheckDto::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/Extension/AntiXssExtension.php

@@ -1,42 +0,0 @@
-<?php
-
-namespace App\Form\Extension;
-
-use Symfony\Component\Form\AbstractTypeExtension;
-use Symfony\Component\Form\Extension\Core\Type\FormType;
-use Symfony\Component\Form\FormBuilderInterface;
-use Symfony\Component\Form\FormEvent;
-use Symfony\Component\Form\FormEvents;
-use Symfony\Component\OptionsResolver\OptionsResolver;
-use voku\helper\AntiXSS;
-
-class AntiXssExtension extends AbstractTypeExtension
-{
-    public function buildForm(FormBuilderInterface $builder, array $options): void
-    {
-        parent::buildForm($builder, $options);
-
-        if (true === $options['anti_xss']) {
-            $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
-                $data = $event->getData();
-                $antiXss = new AntiXSS();
-                foreach ($data as $key => $value) {
-                    $data[$key] = $antiXss->xss_clean($value);
-                }
-                $event->setData($data);
-            });
-        }
-    }
-
-    public function configureOptions(OptionsResolver $resolver): void
-    {
-        $resolver->setDefaults([
-            'anti_xss' => false,
-        ]);
-    }
-
-    public static function getExtendedTypes(): iterable
-    {
-        return [FormType::class];
-    }
-}

src/Form/FaqType.php

@@ -27,7 +27,6 @@ class FaqType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Faq::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/FeeType.php

@@ -32,7 +32,6 @@ class FeeType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Fee::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/FeedbackType.php

@@ -41,7 +41,6 @@ class FeedbackType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Feedback::class,
-                'anti_xss' => true,
             ])
             ->setRequired(['feedback_set'])
             ->setAllowedTypes('feedback_set', FeedbackSet::class)

src/Form/JobProfileType.php

@@ -73,7 +73,6 @@ class JobProfileType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => JobProfile::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerApplicationType.php

@@ -72,7 +72,6 @@ class TeamerApplicationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Application::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerJobProfileType.php

@@ -76,7 +76,6 @@ class TeamerJobProfileType extends AbstractType
             'job_profiles' => [],
             'selectable_job_profiles' => [],
             'admin_mode' => false,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerProfileType.php

@@ -128,7 +128,6 @@ class TeamerProfileType extends AbstractType
                 'validation_groups' => [
                     'profile',
                 ],
-                'anti_xss' => true,
                 'verification_mode' => false,
             ])
             ->setRequired(['upload_session'])

src/Form/TrainingType.php

@@ -23,7 +23,6 @@ class TrainingType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Training::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Twig/AppRuntime.php

@@ -167,9 +167,9 @@ class AppRuntime implements RuntimeExtensionInterface
 
         $list = '<ul class="'.$class.'">';
         foreach ($items as $item) {
-            $list .= '<li>'.$item.'</li>';
+            $list .= '<li>'.htmlspecialchars($item, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8').'</li>';
         }
-        $list .= '<ul>';
+        $list .= '</ul>';
 
         return $list;
     }