Distilleries\Security\Helpers\Security::xss_clean()

Complexity

Conditions	4
Paths	5

Size

Total Lines	132
Code Lines	36

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	26
CRAP Score	4.0008

Importance

Changes	5
Bugs	0	Features	0

<?php
    public function xss_clean($str, $is_image = false, $evilAttribute = true)
    {
        /*
           * Is the string an array?
           *
           */
        if (is_array($str)) {
            return $this->xssCleanFromArray($str, $is_image, $evilAttribute);
        }

        //Remove Invisible Characters
        $str = $this->remove_invisible_characters($str);

        // Validate Entities in URLs
        $str = $this->_validate_entities($str);

        /**
         * URL Decode
         *
         * Just in case stuff like this is submitted:
         *
         * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
         *
         * Note: Use rawurldecode() so it does not remove plus signs
         *
         **/
        $str = rawurldecode($str);

        /**
         * Convert character entities to ASCII
         *
         * This permits our tests below to work reliably.
         * We only convert entities that are within tags since
         * these are the ones that will pose security problems.
         *
         **/

        $str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", [$this, '_convert_attribute'], $str);
        $str = preg_replace_callback("/<\w+.*?(?=>|<|$)/si", [$this, '_decode_entity'], $str);

        /**
         * Remove Invisible Characters Again!
         **/
        $str = $this->remove_invisible_characters($str);

        /**
         * Convert all tabs to spaces
         *
         * This prevents strings like this: ja    vascript
         * NOTE: we deal with spaces between characters later.
         * NOTE: preg_replace was found to be amazingly slow here on
         * large blocks of data, so we use str_replace.
         **/
        if (strpos($str, "\t") !== false) {
            $str = str_replace("\t", ' ', $str);
        }

        // Remove Strings that are never allowed
        $str = $this->_do_never_allowed($str);

        /*
           * Makes PHP tags safe
           *
           * Note: XML tags are inadvertently replaced too:
           *
           * <?xml
           *
           * But it doesn't seem to pose a problem.
           */
        if ($is_image === true) {
            // Images have a tendency to have the PHP short opening and
            // closing tags every so often so we skip those and only
            // do the long opening tags.
            $str = preg_replace('/<\?(php)/i', "&lt;?\\1", $str);
        } else {
            $str = str_replace(['<?', '?'.'>'], ['&lt;?', '?&gt;'], $str);
        }

        $str = $this->compactedWords([
            'javascript',
            'expression',
            'vbscript',
            'script',
            'applet',
            'alert',
            'document',
            'write',
            'cookie',
            'window'
        ], $str);


        $str = $this->disallowedJavascriptInLinks($str);

        // Remove evil attributes such as style, onclick and xmlns
        $str = $this->_remove_evil_attributes($str, $is_image, $evilAttribute);

        /*
           * Sanitize naughty HTML elements
           *
           * If a tag containing any of the words in the list
           * below is found, the tag gets converted to entities.
           *
           * So this: <blink>
           * Becomes: &lt;blink&gt;
           */
        $naughty = 'alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|isindex|layer|link|meta|object|plaintext|style|script|textarea|title|video|xml|xss';
        $str = preg_replace_callback('#<(/*\s*)('.$naughty.')([^><]*)([><]*)#is', [$this, '_sanitize_naughty_html'],
            $str);

        /*
           * Sanitize naughty scripting elements
           *
           * Similar to above, only instead of looking for
           * tags it looks for PHP and JavaScript commands
           * that are disallowed.  Rather than removing the
           * code, it simply converts the parenthesis to entities
           * rendering the code un-executable.
           *
           * For example:	eval('some code')
           * Becomes:		eval&#40;'some code'&#41;
           */
        $str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
            "\\1\\2&#40;\\3&#41;", $str);


        // Final clean up
        // This adds a bit of extra precaution in case
        // something got through the above filters
        $str = $this->_do_never_allowed($str);

        return $str;
    }
}