feat: add XSS protection by implementing form data filtering

src/Form/Extension/AntiXssExtension.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Form\Extension;
+
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use voku\helper\AntiXSS;
+
+class AntiXssExtension extends AbstractTypeExtension
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        parent::buildForm($builder, $options);
+
+        if (true === $options['anti_xss']) {
+            $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
+                $data = $event->getData();
+                $antiXss = new AntiXSS();
+                foreach ($data as $key => $value) {
+                    $data[$key] = $antiXss->xss_clean($value);
+                }
+                $event->setData($data);
+            });
+        }
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => false,
+        ]);
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+}