From b196825ab3ec3c480f0b159fc45cc96fcc5b7378 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Wed, 8 Jan 2025 17:33:29 +0100
Subject: [PATCH] feat: extend XSS protection to all forms

---
 src/Form/BookingType.php                |  1 +
 src/Form/Extension/AntiXssExtension.php | 45 +++++++++++++++++++++++++
 src/Form/ParticipantType.php            |  1 +
 src/Form/PersonalDataType.php           |  8 +++++
 src/Form/RegistrationType.php           |  1 +
 5 files changed, 56 insertions(+)
 create mode 100644 src/Form/Extension/AntiXssExtension.php

diff --git a/src/Form/BookingType.php b/src/Form/BookingType.php
index ed28bcd..9f06924 100644
--- a/src/Form/BookingType.php
+++ b/src/Form/BookingType.php
@@ -68,6 +68,7 @@ final class BookingType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => BookingData::class,
+            'anti_xss' => true,
         ]);
     }
 }
\ No newline at end of file
diff --git a/src/Form/Extension/AntiXssExtension.php b/src/Form/Extension/AntiXssExtension.php
new file mode 100644
index 0000000..6712b2f
--- /dev/null
+++ b/src/Form/Extension/AntiXssExtension.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Form\Extension;
+
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use voku\helper\AntiXSS;
+
+class AntiXssExtension extends AbstractTypeExtension
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        if (false === $options['anti_xss']) {
+            return;
+        }
+
+        $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
+            $data = $event->getData();
+            if (null === $data) {
+                return;
+            }
+            $antiXss = new AntiXSS();
+            foreach ($data as $key => $value) {
+                $data[$key] = $antiXss->xss_clean($value);
+            }
+            $event->setData($data);
+        });
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => false,
+        ]);
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+}
diff --git a/src/Form/ParticipantType.php b/src/Form/ParticipantType.php
index f2a9205..532fa0b 100644
--- a/src/Form/ParticipantType.php
+++ b/src/Form/ParticipantType.php
@@ -268,6 +268,7 @@ class ParticipantType extends AbstractType
             'additional_services_mutable' => true,
             'transportation_services_mutable' => true,
             'pickups_mutable' => true,
+            'anti_xss' => true,
         ]);
     }
 }
\ No newline at end of file
diff --git a/src/Form/PersonalDataType.php b/src/Form/PersonalDataType.php
index 63b1d27..4cd3686 100644
--- a/src/Form/PersonalDataType.php
+++ b/src/Form/PersonalDataType.php
@@ -9,6 +9,7 @@ use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\EmailType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class PersonalDataType extends AbstractType
 {
@@ -65,4 +66,11 @@ class PersonalDataType extends AbstractType
             ])
         ;
     }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => true,
+        ]);
+    }
 }
\ No newline at end of file
diff --git a/src/Form/RegistrationType.php b/src/Form/RegistrationType.php
index f8d52ff..a56f2bc 100644
--- a/src/Form/RegistrationType.php
+++ b/src/Form/RegistrationType.php
@@ -40,6 +40,7 @@ class RegistrationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => RegistrationData::class,
+            'anti_xss' => true,
         ]);
     }
 }
\ No newline at end of file