eliseuamaro/gnu-social
1
0
Fork 0
forked from GNUsocial/gnu-social
Code Issues Pull Requests Releases Wiki Activity

[HTML][SECURITY] Harden implmentation of HTML generation

Browse Source
This commit is contained in:
Hugo Sales 2021-09-16 12:16:00 +01:00 committed by Diogo Peralta Cordeiro
parent 030f8afdf5
commit b177cb69e7
Signed by: diogo
GPG Key ID: 18D2D35001FBFAB0
1 changed files with 32 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
src/Util/HTML.php
View File

@ -28,17 +28,21 @@
namespace App\Util; namespace App\Util;
use Functional as F; use Functional as F;
use InvalidArgumentException;
abstract class HTML abstract class HTML
{ {
const ALLOWED_TAGS = ['p', 'br', 'a'];
const FORBIDDEN_ATTRIBUTES = ['onerror', 'form', 'onforminput', 'onbeforescriptexecute', 'formaction', 'onfocus', 'onload',
'data', 'event', 'autofocus', 'onactivate', 'onanimationstart', 'onwebkittransitionend', 'onblur', 'poster',
'onratechange', 'ontoggle', 'onscroll', 'actiontype', 'dirname', 'srcdoc', ];
/** /**
* Creates an HTML tag without attributes * Creates an HTML tag without attributes
* *
* @param string $tag * @param string $tag
* @param null|mixed $attrs
* @param array|string $content * @param array|string $content
* @param bool $empty_tag * @param bool $empty_tag
* @param null|mixed $attrs
* *
* @return array * @return array
*/ */
@ -76,23 +80,34 @@ abstract class HTML
* *
* @return string * @return string
*/ */
private static function attr(array $attrs): string private static function attr(array $attrs, array $options = []): string
{ {
return ' ' . implode(' ', F\map($attrs, function ($val, $key, $_) { return ' ' . implode(' ',
return "{$key}=\"{$val}\""; F\map($attrs,
/**
* Convert an attr ($key), $val pair to an HTML attribute, but validate to exclude some vectors of injection
*/
function (string $val, string $key, array $_): string {
if (in_array($key, array_merge($options['forbidden_attributes'] ?? [], self::FORBIDDEN_ATTRIBUTES))
|| str_starts_with($val, 'javascript:')) {
throw new \InvalidArgumentException("HTML::html: Attribute {$key} is not allowed");
}
$val = htmlspecialchars($val, flags: ENT_QUOTES | ENT_SUBSTITUTE, double_encode: false);
return "{$key}=\"{$val}\"";
})); }));
} }
/** /**
* @param mixed $html * @param array|string $html The input to convert to HTML
* @param array $options = [] ['allowed_tags' => ['a', 'p']]
* *
* @return string * @return string
*/ */
public static function html($html): string public static function html(string|array $html, array $options = []): string
{ {
if (is_string($html)) { if (is_string($html)) {
return $html; return $html;
} elseif (is_array($html)) { } else {
$out = ''; $out = '';
foreach ($html as $tag => $contents) { foreach ($html as $tag => $contents) {
if ($contents == 'empty' || isset($contents['empty'])) { if ($contents == 'empty' || isset($contents['empty'])) {
@ -101,13 +116,18 @@ abstract class HTML
$attrs = isset($contents['attrs']) ? self::attr(array_shift($contents)) : ''; $attrs = isset($contents['attrs']) ? self::attr(array_shift($contents)) : '';
$is_tag = preg_match('/[A-Za-z][A-Za-z0-9]*/', $tag); $is_tag = preg_match('/[A-Za-z][A-Za-z0-9]*/', $tag);
$inner = self::html($contents); $inner = self::html($contents);
$inner = $is_tag ? Formatting::indent($inner) : $inner; if ($is_tag) {
$out .= $is_tag ? "<{$tag}{$attrs}>\n{$inner}\n</{$tag}>\n" : $inner; if (!in_array($tag, array_merge($options['allowed_tags'] ?? [], self::ALLOWED_TAGS))) {
throw new \InvalidArgumentException("HTML::html: Tag {$tag} is not allowed");
}
$inner = $inner != '' ? "\n{$inner}\n" : '';
$inner = Formatting::indent($inner);
$out .= "<{$tag}{$attrs}>{$inner}</{$tag}>";
}
$out .= $inner;
} }
} }
return $out; return $out;
} else {
throw new InvalidArgumentException('HTML::html argument must be of type string or array');
} }
} }
} }