feat: add XSS protection by implementing form data filtering

src/Form/AddressType.php

@@ -33,6 +33,7 @@ class AddressType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Address::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/ApplicationStatusType.php

@@ -41,6 +41,7 @@ class ApplicationStatusType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => ApplicationStatusDto::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/AssignmentType.php

@@ -12,7 +12,6 @@ use Doctrine\ORM\EntityRepository;
 use Symfony\Bridge\Doctrine\Form\Type\EntityType;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
-use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\CollectionType;
 use Symfony\Component\Form\Extension\Core\Type\IntegerType;
 use Symfony\Component\Form\Extension\Core\Type\TextareaType;
@@ -24,13 +23,6 @@ class AssignmentType extends AbstractType
     public function buildForm(FormBuilderInterface $builder, array $options): void
     {
         $builder
-            ->add('status', ChoiceType::class, [
-                'label' => 'Status',
-                'choices' => [
-                    'offen' => Assignment::STATUS_OPEN,
-                    'geschlossen' => Assignment::STATUS_CLOSED,
-                ],
-            ])
             ->add('availableDispositions', IntegerType::class, [
                 'label' => 'zu vergeben',
                 'required' => false,
@@ -144,6 +136,7 @@ class AssignmentType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Assignment::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/AvailabilityType.php

@@ -32,6 +32,7 @@ class AvailabilityType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Availability::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/BankAccountType.php

@@ -32,6 +32,7 @@ class BankAccountType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => BankAccount::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/CommunicationType.php

@@ -30,6 +30,7 @@ class CommunicationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Communication::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/ContactType.php

@@ -33,7 +33,8 @@ class ContactType extends AbstractType
     {
         $resolver
             ->setDefaults([
-            'data_class' => Contact::class,
+                'data_class' => Contact::class,
+                'anti_xss' => true,
             ])
             ->setRequired(['upload_session'])
             ->setAllowedTypes('upload_session', UploadSessionDto::class)

src/Form/DocumentCheckType.php

@@ -46,6 +46,7 @@ class DocumentCheckType extends AbstractType
                         'abgelehnt' => Upload::STATUS_REJECTED,
                     ],
                 ],
+                'anti_xss' => true,
             ])
             ->setRequired(['document_type'])
             ->setAllowedTypes('document_type', 'string')

src/Form/Extension/AntiXssExtension.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Form\Extension;
+
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use voku\helper\AntiXSS;
+
+class AntiXssExtension extends AbstractTypeExtension
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        parent::buildForm($builder, $options);
+
+        if (true === $options['anti_xss']) {
+            $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
+                $data = $event->getData();
+                $antiXss = new AntiXSS();
+                foreach ($data as $key => $value) {
+                    $data[$key] = $antiXss->xss_clean($value);
+                }
+                $event->setData($data);
+            });
+        }
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => false,
+        ]);
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+}

src/Form/FaqType.php

@@ -28,6 +28,7 @@ class FaqType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Faq::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/FeeType.php

@@ -32,6 +32,7 @@ class FeeType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Fee::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/FeedbackType.php

@@ -41,6 +41,7 @@ class FeedbackType extends AbstractType
         $resolver
             ->setDefaults([
                 'data_class' => Feedback::class,
+                'anti_xss' => true,
             ])
             ->setRequired(['feedback_set'])
             ->setAllowedTypes('feedback_set', FeedbackSet::class)

src/Form/JobProfileType.php

@@ -50,7 +50,7 @@ class JobProfileType extends AbstractType
                 'label' => 'Feedback-Vorlage',
                 'class' => FeedbackSet::class,
                 'choice_label' => 'name',
-                'placeholder' => '',
+                'placeholder' => 'Kein Feedback',
             ])
         ;
     }
@@ -59,6 +59,7 @@ class JobProfileType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => JobProfile::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerApplicationType.php

@@ -61,6 +61,7 @@ class TeamerApplicationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Application::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerJobProfileType.php

@@ -80,6 +80,7 @@ class TeamerJobProfileType extends AbstractType
             'data_class' => Teamer::class,
             'job_profiles' => [],
             'selectable_job_profiles' => [],
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/TeamerProfileType.php

@@ -113,6 +113,7 @@ class TeamerProfileType extends AbstractType
                 'validation_groups' => [
                     'profile',
                 ],
+                'anti_xss' => true,
             ])
             ->setRequired(['upload_session'])
             ->setAllowedTypes('upload_session', UploadSessionDto::class)

src/Form/TrainingType.php

@@ -23,6 +23,7 @@ class TrainingType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => Training::class,
+            'anti_xss' => true,
         ]);
     }
 }