chore: remove antixss extension and rely on proper input escaping

composer.json

@@ -75,7 +75,6 @@
         "twig/intl-extra": "^3.7",
         "twig/string-extra": "^3.7",
         "twig/twig": "^2.12|^3.0",
-        "voku/anti-xss": "^4.1",
         "zenstruck/schedule-bundle": "^1.8"
     },
     "config": {

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "e64b0165e044f03c8d4e09161b01d2f3",
+    "content-hash": "f0504df1803c80691eea135d9f5b7ddc",
     "packages": [
         {
             "name": "beberlei/doctrineextensions",
@@ -10607,266 +10607,6 @@
             },
             "time": "2025-07-17T15:43:24+00:00"
         },
-        {
-            "name": "voku/anti-xss",
-            "version": "4.1.42",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/voku/anti-xss.git",
-                "reference": "bca1f8607e55a3c5077483615cd93bd8f11bd675"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/voku/anti-xss/zipball/bca1f8607e55a3c5077483615cd93bd8f11bd675",
-                "reference": "bca1f8607e55a3c5077483615cd93bd8f11bd675",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=7.0.0",
-                "voku/portable-utf8": "~6.0.2"
-            },
-            "require-dev": {
-                "phpunit/phpunit": "~6.0 || ~7.0 || ~9.0"
-            },
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "4.1.x-dev"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "voku\\helper\\": "src/voku/helper/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "EllisLab Dev Team",
-                    "homepage": "http://ellislab.com/"
-                },
-                {
-                    "name": "Lars Moelleken",
-                    "email": "[email protected]",
-                    "homepage": "https://www.moelleken.org/"
-                }
-            ],
-            "description": "anti xss-library",
-            "homepage": "https://github.com/voku/anti-xss",
-            "keywords": [
-                "anti-xss",
-                "clean",
-                "security",
-                "xss"
-            ],
-            "support": {
-                "issues": "https://github.com/voku/anti-xss/issues",
-                "source": "https://github.com/voku/anti-xss/tree/4.1.42"
-            },
-            "funding": [
-                {
-                    "url": "https://www.paypal.me/moelleken",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/voku",
-                    "type": "github"
-                },
-                {
-                    "url": "https://opencollective.com/anti-xss",
-                    "type": "open_collective"
-                },
-                {
-                    "url": "https://www.patreon.com/voku",
-                    "type": "patreon"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/voku/anti-xss",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2023-07-03T14:40:46+00:00"
-        },
-        {
-            "name": "voku/portable-ascii",
-            "version": "2.0.3",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/voku/portable-ascii.git",
-                "reference": "b1d923f88091c6bf09699efcd7c8a1b1bfd7351d"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/voku/portable-ascii/zipball/b1d923f88091c6bf09699efcd7c8a1b1bfd7351d",
-                "reference": "b1d923f88091c6bf09699efcd7c8a1b1bfd7351d",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=7.0.0"
-            },
-            "require-dev": {
-                "phpunit/phpunit": "~6.0 || ~7.0 || ~9.0"
-            },
-            "suggest": {
-                "ext-intl": "Use Intl for transliterator_transliterate() support"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "voku\\": "src/voku/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Lars Moelleken",
-                    "homepage": "https://www.moelleken.org/"
-                }
-            ],
-            "description": "Portable ASCII library - performance optimized (ascii) string functions for php.",
-            "homepage": "https://github.com/voku/portable-ascii",
-            "keywords": [
-                "ascii",
-                "clean",
-                "php"
-            ],
-            "support": {
-                "issues": "https://github.com/voku/portable-ascii/issues",
-                "source": "https://github.com/voku/portable-ascii/tree/2.0.3"
-            },
-            "funding": [
-                {
-                    "url": "https://www.paypal.me/moelleken",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/voku",
-                    "type": "github"
-                },
-                {
-                    "url": "https://opencollective.com/portable-ascii",
-                    "type": "open_collective"
-                },
-                {
-                    "url": "https://www.patreon.com/voku",
-                    "type": "patreon"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/voku/portable-ascii",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2024-11-21T01:49:47+00:00"
-        },
-        {
-            "name": "voku/portable-utf8",
-            "version": "6.0.13",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/voku/portable-utf8.git",
-                "reference": "b8ce36bf26593e5c2e81b1850ef0ffb299d2043f"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/voku/portable-utf8/zipball/b8ce36bf26593e5c2e81b1850ef0ffb299d2043f",
-                "reference": "b8ce36bf26593e5c2e81b1850ef0ffb299d2043f",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=7.0.0",
-                "symfony/polyfill-iconv": "~1.0",
-                "symfony/polyfill-intl-grapheme": "~1.0",
-                "symfony/polyfill-intl-normalizer": "~1.0",
-                "symfony/polyfill-mbstring": "~1.0",
-                "symfony/polyfill-php72": "~1.0",
-                "voku/portable-ascii": "~2.0.0"
-            },
-            "require-dev": {
-                "phpstan/phpstan": "1.9.*@dev",
-                "phpstan/phpstan-strict-rules": "1.4.*@dev",
-                "phpunit/phpunit": "~6.0 || ~7.0 || ~9.0",
-                "thecodingmachine/phpstan-strict-rules": "1.0.*@dev",
-                "voku/phpstan-rules": "3.1.*@dev"
-            },
-            "suggest": {
-                "ext-ctype": "Use Ctype for e.g. hexadecimal digit detection",
-                "ext-fileinfo": "Use Fileinfo for better binary file detection",
-                "ext-iconv": "Use iconv for best performance",
-                "ext-intl": "Use Intl for best performance",
-                "ext-json": "Use JSON for string detection",
-                "ext-mbstring": "Use Mbstring for best performance"
-            },
-            "type": "library",
-            "autoload": {
-                "files": [
-                    "bootstrap.php"
-                ],
-                "psr-4": {
-                    "voku\\": "src/voku/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "(Apache-2.0 or GPL-2.0)"
-            ],
-            "authors": [
-                {
-                    "name": "Nicolas Grekas",
-                    "email": "[email protected]"
-                },
-                {
-                    "name": "Hamid Sarfraz",
-                    "homepage": "http://pageconfig.com/"
-                },
-                {
-                    "name": "Lars Moelleken",
-                    "homepage": "http://www.moelleken.org/"
-                }
-            ],
-            "description": "Portable UTF-8 library - performance optimized (unicode) string functions for php.",
-            "homepage": "https://github.com/voku/portable-utf8",
-            "keywords": [
-                "UTF",
-                "clean",
-                "php",
-                "unicode",
-                "utf-8",
-                "utf8"
-            ],
-            "support": {
-                "issues": "https://github.com/voku/portable-utf8/issues",
-                "source": "https://github.com/voku/portable-utf8/tree/6.0.13"
-            },
-            "funding": [
-                {
-                    "url": "https://www.paypal.me/moelleken",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/voku",
-                    "type": "github"
-                },
-                {
-                    "url": "https://opencollective.com/portable-utf8",
-                    "type": "open_collective"
-                },
-                {
-                    "url": "https://www.patreon.com/voku",
-                    "type": "patreon"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/voku/portable-utf8",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2023-03-08T08:35:38+00:00"
-        },
         {
             "name": "webmozart/assert",
             "version": "2.1.6",

src/Form/AddressType.php

@@ -33,7 +33,6 @@ class AddressType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Address::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/AdminFeedbackType.php

@@ -103,7 +103,6 @@ class AdminFeedbackType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Feedback::class,
-                'anti_xss' => true,
                 'validation_groups' => [
                     'Default',
                     'admin',

src/Form/ApplicationStatusType.php

@@ -42,7 +42,6 @@ class ApplicationStatusType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => ApplicationStatusDto::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/AssignmentType.php

@@ -199,7 +199,6 @@ class AssignmentType extends AbstractType
         $resolver->setDefaults([
             'pickup_form_url' => null,
             'data_class' => Assignment::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/AvailabilityType.php

@@ -32,7 +32,6 @@ class AvailabilityType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Availability::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/BankAccountType.php

@@ -32,7 +32,6 @@ class BankAccountType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => BankAccount::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/CommunicationType.php

@@ -30,7 +30,6 @@ class CommunicationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Communication::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/ContactType.php

@@ -45,7 +45,6 @@ class ContactType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Contact::class,
-                'anti_xss' => true,
             ])
             ->setRequired(['upload_session'])
             ->setAllowedTypes('upload_session', UploadSessionDto::class)

src/Form/DocumentCheckType.php

@@ -60,7 +60,6 @@ class DocumentCheckType extends AbstractType
                         'abgelehnt' => Upload::STATUS_REJECTED,
                     ],
                 ],
-                'anti_xss' => true,
             ])
             ->setRequired(['document_type'])
             ->setAllowedTypes('document_type', 'string')

src/Form/DriverLicenseCheckType.php

@@ -37,7 +37,6 @@ class DriverLicenseCheckType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => DriverLicenseCheckDto::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/Extension/AntiXssExtension.php

@@ -1,42 +0,0 @@
-<?php
-
-namespace App\Form\Extension;
-
-use Symfony\Component\Form\AbstractTypeExtension;
-use Symfony\Component\Form\Extension\Core\Type\FormType;
-use Symfony\Component\Form\FormBuilderInterface;
-use Symfony\Component\Form\FormEvent;
-use Symfony\Component\Form\FormEvents;
-use Symfony\Component\OptionsResolver\OptionsResolver;
-use voku\helper\AntiXSS;
-
-class AntiXssExtension extends AbstractTypeExtension
-{
-    public function buildForm(FormBuilderInterface $builder, array $options): void
-    {
-        parent::buildForm($builder, $options);
-
-        if (true === $options['anti_xss']) {
-            $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
-                $data = $event->getData();
-                $antiXss = new AntiXSS();
-                foreach ($data as $key => $value) {
-                    $data[$key] = $antiXss->xss_clean($value);
-                }
-                $event->setData($data);
-            });
-        }
-    }
-
-    public function configureOptions(OptionsResolver $resolver): void
-    {
-        $resolver->setDefaults([
-            'anti_xss' => false,
-        ]);
-    }
-
-    public static function getExtendedTypes(): iterable
-    {
-        return [FormType::class];
-    }
-}

src/Form/FaqType.php

@@ -27,7 +27,6 @@ class FaqType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Faq::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/FeeType.php

@@ -32,7 +32,6 @@ class FeeType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Fee::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/FeedbackType.php

@@ -41,7 +41,6 @@ class FeedbackType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Feedback::class,
-                'anti_xss' => true,
             ])
             ->setRequired(['feedback_set'])
             ->setAllowedTypes('feedback_set', FeedbackSet::class)

src/Form/JobProfileType.php

@@ -73,7 +73,6 @@ class JobProfileType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => JobProfile::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerApplicationType.php

@@ -72,7 +72,6 @@ class TeamerApplicationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Application::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerJobProfileType.php

@@ -76,7 +76,6 @@ class TeamerJobProfileType extends AbstractType
             'job_profiles' => [],
             'selectable_job_profiles' => [],
             'admin_mode' => false,
-            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerProfileType.php

@@ -128,7 +128,6 @@ class TeamerProfileType extends AbstractType
                 'validation_groups' => [
                     'profile',
                 ],
-                'anti_xss' => true,
                 'verification_mode' => false,
             ])
             ->setRequired(['upload_session'])

src/Form/TrainingType.php

@@ -23,7 +23,6 @@ class TrainingType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Training::class,
-            'anti_xss' => true,
         ]);
     }
 }

src/Twig/AppRuntime.php

@@ -167,9 +167,9 @@ class AppRuntime implements RuntimeExtensionInterface
 
         $list = '<ul class="'.$class.'">';
         foreach ($items as $item) {
-            $list .= '<li>'.$item.'</li>';
+            $list .= '<li>'.htmlspecialchars($item, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8').'</li>';
         }
-        $list .= '<ul>';
+        $list .= '</ul>';
 
         return $list;
     }