EP/myep
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: replace xss extension with symfony component

Browse Source
This commit is contained in:
Björn Fromme
2025-09-19 12:40:02 +02:00
parent b6f991b291
commit ddd5971c06
8 changed files with 415 additions and 573 deletions
Download Patch File Download Diff File Expand all files Collapse all files
composer.json
+3 -2
View File
@@ -21,6 +21,7 @@
"nesbot/carbon": "^3.8",
"phpdocumentor/reflection-docblock": "^5.6",
"phpstan/phpdoc-parser": "^2.0",
"spatie/blink": "^1.4",
"spatie/crypto": "^2.1",
"symfony/apache-pack": "^1.0",
"symfony/asset": "6.4.*",
@@ -32,6 +33,7 @@
"symfony/flex": "^2",
"symfony/form": "6.4.*",
"symfony/framework-bundle": "6.4.*",
"symfony/html-sanitizer": "6.4.*",
"symfony/http-client": "6.4.*",
"symfony/intl": "6.4.*",
"symfony/mailer": "6.4.*",
@@ -56,8 +58,7 @@
"twig/extra-bundle": "^2.12|^3.0",
"twig/html-extra": "^3.15",
"twig/intl-extra": "*",
"twig/twig": "^2.12|^3.0",
"voku/anti-xss": "^4.1"
"twig/twig": "^2.12|^3.0"
},
"config": {
"allow-plugins": {
composer.lock
Generated
+390 -511
View File
File diff suppressed because it is too large Load Diff
src/Form/BookingCreateParticipantType.php
+4 -4
View File
@@ -109,11 +109,11 @@ class BookingCreateParticipantType extends AbstractType
$form
->add('firstName', TextType::class, $this->mergeFieldState([
'label' => 'Vorname',
'clean_xss' => true,
'sanitize_html' => true,
], $getFieldState('firstName')))
->add('lastName', TextType::class, $this->mergeFieldState([
'label' => 'Nachname',
'clean_xss' => true,
'sanitize_html' => true,
], $getFieldState('lastName')))
->add('dateOfBirth', BirthdayType::class, $this->mergeFieldState([
'label' => 'Geburtsdatum',
@@ -139,12 +139,12 @@ class BookingCreateParticipantType extends AbstractType
->add('email', EmailType::class, $this->mergeFieldState([
'label' => 'E-Mail',
'required' => false,
'clean_xss' => true,
'sanitize_html' => true,
], $getFieldState('email')))
->add('mobile', TextType::class, $this->mergeFieldState([
'label' => 'Telefon (mobil)',
'required' => false,
'clean_xss' => true,
'sanitize_html' => true,
], $getFieldState('mobile')));
// Add body dimensions with state handling - use shouldIncludeField method
src/Form/BookingEditParticipantType.php
+8 -8
View File
@@ -51,11 +51,11 @@ class BookingEditParticipantType extends AbstractType
$form
->add('firstName', TextType::class, $this->mergeFieldState([
'label' => 'Vorname',
'clean_xss' => true,
'sanitize_html' => true,
], $getState('firstName')))
->add('lastName', TextType::class, $this->mergeFieldState([
'label' => 'Nachname',
'clean_xss' => true,
'sanitize_html' => true,
], $getState('lastName')))
->add('dateOfBirth', BirthdayType::class, $this->mergeFieldState([
'label' => 'Geburtsdatum',
@@ -81,12 +81,12 @@ class BookingEditParticipantType extends AbstractType
->add('email', EmailType::class, $this->mergeFieldState([
'label' => 'E-Mail',
'required' => false,
'clean_xss' => true,
'sanitize_html' => true,
], $getState('email')))
->add('mobile', TextType::class, $this->mergeFieldState([
'label' => 'Telefon (mobil)',
'required' => false,
'clean_xss' => true,
'sanitize_html' => true,
], $getState('mobile')))
->add('bodyDimensions', BodyDimensionsType::class);
@@ -301,13 +301,13 @@ class BookingEditParticipantType extends AbstractType
// Re-apply field states by rebuilding fields with updated state
// Note: We need to store the field types and rebuild them since we cannot modify existing field configs
$fieldDefinitions = [
'firstName' => [TextType::class, ['label' => 'Vorname', 'clean_xss' => true]],
'lastName' => [TextType::class, ['label' => 'Nachname', 'clean_xss' => true]],
'firstName' => [TextType::class, ['label' => 'Vorname', 'sanitize_html' => true]],
'lastName' => [TextType::class, ['label' => 'Nachname', 'sanitize_html' => true]],
'dateOfBirth' => [BirthdayType::class, ['label' => 'Geburtsdatum', 'html5' => true, 'widget' => 'single_text', 'input' => 'datetime_immutable']],
'gender' => [ChoiceType::class, ['label' => 'Geschlecht', 'required' => false, 'placeholder' => 'keine Angabe', 'choices' => ['männlich' => 'M', 'weiblich' => 'W', 'divers' => 'D']]],
'nationality' => [CountryType::class, ['label' => 'Nationalität', 'property' => 'nationality', 'preferred_choices' => ['D', 'A', 'CH']]],
'email' => [EmailType::class, ['label' => 'E-Mail', 'required' => false, 'clean_xss' => true]],
'mobile' => [TextType::class, ['label' => 'Telefon (mobil)', 'required' => false, 'clean_xss' => true]],
'email' => [EmailType::class, ['label' => 'E-Mail', 'required' => false, 'sanitize_html' => true]],
'mobile' => [TextType::class, ['label' => 'Telefon (mobil)', 'required' => false, 'sanitize_html' => true]],
];
foreach ($personalDataFields as $field) {
src/Form/Extension/XssCleanExtension.php
-38
View File
@@ -1,38 +0,0 @@
<?php
namespace App\Form\Extension;
use App\Form\DataTransformer\XssCleanTransformer;
use Symfony\Component\Form\AbstractTypeExtension;
use Symfony\Component\Form\Extension\Core\Type\EmailType;
use Symfony\Component\Form\Extension\Core\Type\TextareaType;
use Symfony\Component\Form\Extension\Core\Type\TextType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\OptionsResolver\OptionsResolver;
class XssCleanExtension extends AbstractTypeExtension
{
public function buildForm(FormBuilderInterface $builder, array $options): void
{
if (true === $options['clean_xss']) {
$builder->addModelTransformer(new XssCleanTransformer());
}
}
public function configureOptions(OptionsResolver $resolver): void
{
$resolver->setDefaults([
'clean_xss' => false,
]);
$resolver->setAllowedTypes('clean_xss', 'bool');
}
public static function getExtendedTypes(): iterable
{
return [
TextType::class,
TextareaType::class,
EmailType::class,
];
}
}
src/Form/PersonalDataType.php
+6 -6
View File
@@ -16,17 +16,17 @@ class PersonalDataType extends AbstractType
->add('street', TextType::class, [
'label' => 'Straße',
'property_path' => 'address.street',
'clean_xss' => true,
'sanitize_html' => true,
])
->add('postCode', TextType::class, [
'label' => 'PLZ',
'property_path' => 'address.postCode',
'clean_xss' => true,
'sanitize_html' => true,
])
->add('city', TextType::class, [
'label' => 'Stadt',
'property_path' => 'address.city',
'clean_xss' => true,
'sanitize_html' => true,
])
->add('country', CountryType::class, [
'label' => 'Land',
@@ -35,18 +35,18 @@ class PersonalDataType extends AbstractType
->add('email', EmailType::class, [
'label' => 'E-Mail',
'property_path' => 'communication.email',
'clean_xss' => true,
'sanitize_html' => true,
])
->add('phone', TextType::class, [
'label' => 'Telefon',
'required' => false,
'property_path' => 'communication.phone',
'clean_xss' => true,
'sanitize_html' => true,
])
->add('mobile', TextType::class, [
'label' => 'Mobil',
'property_path' => 'communication.mobile',
'clean_xss' => true,
'sanitize_html' => true,
])
;
}
src/Form/RegistrationType.php
+2 -2
View File
@@ -25,14 +25,14 @@ class RegistrationType extends AbstractType
])
->add('firstName', TextType::class, [
'label' => 'Name',
'clean_xss' => true,
'sanitize_html' => true,
])
->add('name', TextType::class, [
'label' => 'Nachname',
])
->add('email', EmailType::class, [
'label' => 'E-Mail',
'clean_xss' => true,
'sanitize_html' => true,
])
;
}
src/Form/Service/ParticipantFieldOptionsProvider.php
+2 -2
View File
@@ -237,7 +237,7 @@ class ParticipantFieldOptionsProvider extends AbstractFieldOptionsProvider
'maxlength' => 20,
],
'help' => 'Bitte gib das Kennzeichen deines Fahrzeugs an. Du kannst es aber auch später nachreichen.',
'clean_xss' => true,
'sanitize_html' => true,
];
// Skipass field provider - provides age-appropriate skipass options from travel data filtered by date range
@@ -277,7 +277,7 @@ class ParticipantFieldOptionsProvider extends AbstractFieldOptionsProvider
$this->fieldOptionProviders['remarksRoom'] = fn (BookingDtoInterface $bookingDto, int $participantIndex, array $options = []) => [
'label' => 'Wünsche oder Anmerkungen zum Zimmer',
'required' => false,
'clean_xss' => true,
'sanitize_html' => true,
'attr' => [
'rows' => 2,
],