Distilleries\Security\Helpers\Security::xss_clean()

Complexity

Conditions	12
Paths	98

Size

Total Lines	180
Code Lines	52

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	36
CRAP Score	12.2614

Importance

Changes

0

<?php
    public function xss_clean($str, $is_image = false, $evilAttribute = true)
    {
        /*
           * Is the string an array?
           *
           */
        if (is_array($str)) {
            foreach ($str as $key => $value) {
                $str[$key] = $this->xss_clean($str[$key], $is_image, $evilAttribute);
            }

            return $str;

The expression return $str returns the type array which is incompatible with the documented return type string.

        }

        /*
           * Remove Invisible Characters
           */
        $str = $this->remove_invisible_characters($str);

        // Validate Entities in URLs
        $str = $this->_validate_entities($str);

        /*
           * URL Decode
           *
           * Just in case stuff like this is submitted:
           *
           * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
           *
           * Note: Use rawurldecode() so it does not remove plus signs
           *
           */
        $str = rawurldecode($str);

        /*
           * Convert character entities to ASCII
           *
           * This permits our tests below to work reliably.
           * We only convert entities that are within tags since
           * these are the ones that will pose security problems.
           *
           */

        $str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", [$this, '_convert_attribute'], $str);

        $str = preg_replace_callback("/<\w+.*?(?=>|<|$)/si", [$this, '_decode_entity'], $str);

        /*
           * Remove Invisible Characters Again!
           */
        $str = $this->remove_invisible_characters($str);

        /*
           * Convert all tabs to spaces
           *
           * This prevents strings like this: ja	vascript
           * NOTE: we deal with spaces between characters later.
           * NOTE: preg_replace was found to be amazingly slow here on
           * large blocks of data, so we use str_replace.
           */

        if (strpos($str, "\t") !== false) {
            $str = str_replace("\t", ' ', $str);
        }

        // Remove Strings that are never allowed
        $str = $this->_do_never_allowed($str);

        /*
           * Makes PHP tags safe
           *
           * Note: XML tags are inadvertently replaced too:
           *
           * <?xml
           *
           * But it doesn't seem to pose a problem.
           */
        if ($is_image === true) {
            // Images have a tendency to have the PHP short opening and
            // closing tags every so often so we skip those and only
            // do the long opening tags.
            $str = preg_replace('/<\?(php)/i', "&lt;?\\1", $str);
        } else {
            $str = str_replace(['<?', '?' . '>'], ['&lt;?', '?&gt;'], $str);
        }

        /*
           * Compact any exploded words
           *
           * This corrects words like:  j a v a s c r i p t
           * These words are compacted back to their correct state.
           */
        $words = [
            'javascript',
            'expression',
            'vbscript',
            'script',
            'applet',
            'alert',
            'document',
            'write',
            'cookie',
            'window'
        ];

        foreach ($words as $word) {
            $temp = '';

            for ($i = 0, $wordlen = strlen($word); $i < $wordlen; $i++) {
                $temp .= substr($word, $i, 1) . "\s*";
            }

            // We only want to do this when it is followed by a non-word character
            // That way valid stuff like "dealer to" does not become "dealerto"
            $str = preg_replace_callback('#(' . substr($temp, 0, -3) . ')(\W)#is', [$this, '_compact_exploded_words'],
                $str);
        }

        /*
           * Remove disallowed Javascript in links or img tags
           * We used to do some version comparisons and use of stripos for PHP5,
           * but it is dog slow compared to these simplified non-capturing
           * preg_match(), especially if the pattern exists in the string
           */
        do {
            $original = $str;

            if (preg_match("/<a/i", $str)) {
                $str = preg_replace_callback("#<a\s+([^>]*?)(>|$)#si", [$this, '_js_link_removal'], $str);
            }

            if (preg_match("/<img/i", $str)) {
                $str = preg_replace_callback("#<img\s+([^>]*?)(\s?/?>|$)#si", [$this, '_js_img_removal'], $str);
            }

            if (preg_match("/script/i", $str) OR preg_match("/xss/i", $str)) {
                $str = preg_replace("#<(/*)(script|xss)(.*?)\>#si", '[removed]', $str);
            }
        } while ($original != $str);

        unset($original);

        // Remove evil attributes such as style, onclick and xmlns
        $str = $this->_remove_evil_attributes($str, $is_image, $evilAttribute);

        /*
           * Sanitize naughty HTML elements
           *
           * If a tag containing any of the words in the list
           * below is found, the tag gets converted to entities.
           *
           * So this: <blink>
           * Becomes: &lt;blink&gt;
           */
        $naughty = 'alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|isindex|layer|link|meta|object|plaintext|style|script|textarea|title|video|xml|xss';
        $str = preg_replace_callback('#<(/*\s*)(' . $naughty . ')([^><]*)([><]*)#is', [$this, '_sanitize_naughty_html'],
            $str);

        /*
           * Sanitize naughty scripting elements
           *
           * Similar to above, only instead of looking for
           * tags it looks for PHP and JavaScript commands
           * that are disallowed.  Rather than removing the
           * code, it simply converts the parenthesis to entities
           * rendering the code un-executable.
           *
           * For example:	eval('some code')
           * Becomes:		eval&#40;'some code'&#41;
           */
        $str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
            "\\1\\2&#40;\\3&#41;", $str);


        // Final clean up
        // This adds a bit of extra precaution in case
        // something got through the above filters
        $str = $this->_do_never_allowed($str);

        return $str;
    }
}