feat: extend XSS protection to all forms

src/Form/BookingType.php

@@ -68,6 +68,7 @@ final class BookingType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => BookingData::class,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/Extension/AntiXssExtension.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Form\Extension;
+
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use voku\helper\AntiXSS;
+
+class AntiXssExtension extends AbstractTypeExtension
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        if (false === $options['anti_xss']) {
+            return;
+        }
+
+        $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
+            $data = $event->getData();
+            if (null === $data) {
+                return;
+            }
+            $antiXss = new AntiXSS();
+            foreach ($data as $key => $value) {
+                $data[$key] = $antiXss->xss_clean($value);
+            }
+            $event->setData($data);
+        });
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => false,
+        ]);
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+}

src/Form/ParticipantType.php

@@ -268,6 +268,7 @@ class ParticipantType extends AbstractType
             'additional_services_mutable' => true,
             'transportation_services_mutable' => true,
             'pickups_mutable' => true,
+            'anti_xss' => true,
         ]);
     }
 }

src/Form/PersonalDataType.php

@@ -9,6 +9,7 @@ use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\EmailType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class PersonalDataType extends AbstractType
 {
@@ -65,4 +66,11 @@ class PersonalDataType extends AbstractType
             ])
         ;
     }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => true,
+        ]);
+    }
 }

src/Form/RegistrationType.php

@@ -40,6 +40,7 @@ class RegistrationType extends AbstractType
     {
         $resolver->setDefaults([
             'data_class' => RegistrationData::class,
+            'anti_xss' => true,
         ]);
     }
 }