feat: extend XSS protection to all forms

src/Form/Extension/AntiXssExtension.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Form\Extension;
+
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use voku\helper\AntiXSS;
+
+class AntiXssExtension extends AbstractTypeExtension
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        if (false === $options['anti_xss']) {
+            return;
+        }
+
+        $builder->addEventListener(FormEvents::PRE_SUBMIT, function (FormEvent $event) {
+            $data = $event->getData();
+            if (null === $data) {
+                return;
+            }
+            $antiXss = new AntiXSS();
+            foreach ($data as $key => $value) {
+                $data[$key] = $antiXss->xss_clean($value);
+            }
+            $event->setData($data);
+        });
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'anti_xss' => false,
+        ]);
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+}