devtoolboxuk\soteria\handlers\Xss

Complexity

Total Complexity

41

Size/Duplication

Total Lines	374
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	10

Test Coverage

Coverage

77.52%

Importance

Changes

0

15 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	4	1
A	init()	0	17	1
A	setString()	0	4	1
A	cleanArray()	0	4	1
A	isXssFound()	0	4	1
A	_get_data()	0	5	1
A	cleanString()	0	4	1
A	clean()	0	17	3
A	process()	0	16	3
B	_do()	0	66	6
A	decodeString()	0	19	3
A	decodeEntity()	0	24	5
B	_entity_decode()	0	100	6
B	cleanUrl()	0	25	6
A	result()	0	8	2

<?php

namespace devtoolboxuk\soteria\handlers;

use devtoolboxuk\soteria\models\SoteriaModel;
use devtoolboxuk\soteria\voku\Resources\Attributes;

use devtoolboxuk\soteria\voku\Resources\Exploded;
use devtoolboxuk\soteria\voku\Resources\Html;
use devtoolboxuk\soteria\voku\Resources\JavaScript;
use devtoolboxuk\soteria\voku\Resources\NeverAllowed;

use devtoolboxuk\soteria\voku\Resources\System;
use devtoolboxuk\soteria\voku\Resources\Utf7;
use devtoolboxuk\soteria\voku\Resources\Utf8;
use devtoolboxuk\soteria\voku\Resources\StringResource;


class Xss

The property $_xss_found is not named in camelCase.

{

    private $_xss_found = null;
    private $neverAllowed;
    private $exploded;
    private $string;
    private $attributes;
    private $javascript;
    private $html;
    private $utf7;
    private $utf8;
    private $strings;
    private $system;
    private $input;
    private $output;


    function __construct()

It is generally recommended to explicitly declare the visibility for methods.

It is recommend to declare an explicit visibility for __construct.

    {
        $this->init();
    }

    function init()

It is generally recommended to explicitly declare the visibility for methods.

It is recommend to declare an explicit visibility for init.

    {
        $this->neverAllowed = new NeverAllowed();

        $this->exploded = new Exploded();

        $this->attributes = new Attributes();
        $this->javascript = new JavaScript();
        $this->html = new Html();

        $this->system = new System();

        $this->utf7 = new Utf7();
        $this->utf8 = new Utf8();

        $this->strings = new StringResource();
    }


    function setString($str)

It is generally recommended to explicitly declare the visibility for methods.

It is recommend to declare an explicit visibility for setString.

    {
        $this->string = $str;
    }

    public function cleanArray($array)
    {
        return $this->clean($array);
    }

    /**
     * @param $str
     * @return array|mixed
     */
    public function clean($str)
    {
        // reset
        $this->_xss_found = null;

        // check for an array of strings
        if (\is_array($str)) {
            foreach ($str as $key => $value) {
                $str[$key] = $this->clean($value);
            }
            return $str;
        }

        $this->input = $str;
        $this->output = $this->process($str);
        return $this->output;
    }

    private function process($str)

The variable $old_str is not named in camelCase.

    {

        // process
        do {
            $old_str = $str;
            $str = $this->_do($str);
        } while ($old_str !== $str);

        // keep the old value, if there wasn't any XSS attack
        if ($this->_xss_found !== true) {
            $str = $this->input;
        }

        return $str;
    }

    /**
     * @param StringResource $str
     *
     * @return mixed
     */
    private function _do($str)

The method _do is not named in camelCase.

The variable $str_backup is not named in camelCase.

This operation has 10 execution paths which exceeds the configured maximum of 10.

    {
        $str = (string)$str;
        $strInt = (int)$str;
        $strFloat = (float)$str;
        if (!$str || (string)$strInt === $str || (string)$strFloat === $str) {

Blank line found at start of control structure

            // no xss found
            if ($this->_xss_found !== true) {
                $this->_xss_found = false;
            }

            return $str;
        }

        // remove the BOM from UTF-8 / UTF-16 / UTF-32 strings
        $str = $this->utf8->remove_bom($str);

        // replace the diamond question mark (�) and invalid-UTF8 chars
        $str = $this->utf8->replace_diamond_question_mark($str, '');

        // replace invisible characters with one single space
        $str = $this->utf8->remove_invisible_characters($str, true, ' ');

        $str = $this->utf8->normalize_whitespace($str);
        $str = $this->strings->replace($str);

        // decode UTF-7 characters
        $str = $this->utf7->repack($str);

        // decode the string
        $str = $this->decodeString($str); // RW Partly DONE

        // backup the string (for later comparision)
        $str_backup = $str;

        // remove strings that are never allowed
        $str = $this->neverAllowed->doNeverAllowed($str); //RW DONE

        // corrects words before the browser will do it
        $str = $this->exploded->compactExplodedString($str); //RW DONE

        // remove disallowed javascript calls in links, images etc.
        $str = $this->javascript->removeDisallowedJavascript($str);

        // remove evil attributes such as style, onclick and xmlns
        $str = $this->attributes->removeEvilAttributes($str);

        // sanitize naughty JavaScript elements
        $str = $this->javascript->naughtyJavascript($str);

        // sanitize naughty HTML elements
        $str = $this->html->naughtyHtml($str);

        // final clean up
        //
        // -> This adds a bit of extra precaution in case something got through the above filters.
        $str = $this->neverAllowed->doNeverAllowedAfterwards($str);

        // check for xss
        if ($this->_xss_found !== true) {
            $this->_xss_found = !($str_backup === $str);
        }

        return $str;
    }

    public function decodeString($str)
    {
        // init
        $regExForHtmlTags = '/<\p{L}+.*+/us';

        if (strpos($str, '<') !== false && preg_match($regExForHtmlTags, $str, $matches) === 1) {
            $str = (string)preg_replace_callback(
                $regExForHtmlTags,
                function ($matches) {
                    return $this->decodeEntity($matches);
                },
                $str
            );
        } else {

The method decodeString uses an else expression. Else is never necessary and you can simplify the code to work without else.

            $str = $this->utf8->rawurldecode($str);
        }

        return $str;
    }

    private function decodeEntity(array $match)
    {
        // init
        $str = $match[0];

        // protect GET variables without XSS in URLs
        if (preg_match_all("/[\?|&]?[\\p{L}0-9_\-\[\]]+\s*=\s*(?<wrapped>\"|\042|'|\047)(?<attr>[^\\1]*?)\\g{wrapped}/ui", $str, $matches)) {
            if (isset($matches['attr'])) {
                foreach ($matches['attr'] as $matchInner) {
                    $tmpAntiXss = clone $this;
                    $urlPartClean = $tmpAntiXss->clean($matchInner);

                    if ($tmpAntiXss->isXssFound() === true) {
                        $this->_xss_found = true;
                        $str = \str_replace($matchInner, $this->utf8->rawurldecode($urlPartClean), $str);
                    }
                }
            }
        } else {

The method decodeEntity uses an else expression. Else is never necessary and you can simplify the code to work without else.

            $str = $this->_entity_decode($this->utf8->rawurldecode($str));
        }

        return $str;
    }

    /**
     * @return null
     */
    public function isXssFound()
    {
        return $this->_xss_found;
    }

    /**
     * Entity-decoding.
     *
     * @param StringResource $str
     *
     * @return StringResource
     */
    private function _entity_decode($str)

The method _entity_decode is not named in camelCase.

The variable $HTML_ENTITIES_CACHE is not named in camelCase.

This operation has 13 execution paths which exceeds the configured maximum of 10.

Method name "Xss::_entity_decode" is not in camel caps format

    {
        static $HTML_ENTITIES_CACHE;

        $flags = ENT_QUOTES | ENT_HTML5 | ENT_DISALLOWED | ENT_SUBSTITUTE;

        // decode
        $str = html_entity_decode($str, $flags);


        // decode-again, for e.g. HHVM or miss configured applications ...
        if (preg_match_all('/(?<html_entity>&[A-Za-z]{2,}[;]{0})/', $str, $matches)) {
            if ($HTML_ENTITIES_CACHE === null) {

Blank line found at start of control structure

                // links:
                // - http://dev.w3.org/html5/html-author/charref
                // - http://www.w3schools.com/charsets/ref_html_entities_n.asp
                $entitiesSecurity = [
                    '�' => '',
                    '�' => '',
                    '' => '',
                    '' => '',
                    '>⃒' => '',
                    '' => '',
                    '' => '',
                    '­' => '',
                    '­' => '',
                    '­' => '',
                    ':' => ':',
                    ':' => ':',
                    ':' => ':',
                    '(' => '(',
                    '(' => '(',
                    '(' => '(',
                    ')' => ')',
                    ')' => ')',
                    ')' => ')',
                    '?' => '?',
                    '?' => '?',
                    '?' => '?',
                    '/' => '/',
                    '/' => '/',
                    '/' => '/',
                    ''' => '\'',
                    ''' => '\'',
                    ''' => '\'',
                    ''' => '\'',
                    ''' => '\'',
                    '\' => '\'',
                    '\' => '\\',
                    '\' => '\\',
                    ',' => ',',
                    ',' => ',',
                    ',' => ',',
                    '.' => '.',
                    '.' => '.',
                    '"' => '"',
                    '"' => '"',
                    '"' => '"',
                    '"' => '"',
                    '`' => '`',
                    '`' => '`',
                    '`' => '`',
                    '`' => '`',
                    '.' => '.',
                    '=' => '=',
                    '=' => '=',
                    '=' => '=',
                    '&newline;' => "\n",
                    '
' => "\n",
                    '
' => "\n",
                    '&tab;' => "\t",
                    '	' => "\t",
                    '	' => "\t",
                ];

                $HTML_ENTITIES_CACHE = \array_merge(
                    $entitiesSecurity,
                    \array_flip(\get_html_translation_table(HTML_ENTITIES, $flags)),
                    \array_flip($this->_get_data('entities_fallback'))
                );
            }

            $search = [];
            $replace = [];
            foreach ($matches['html_entity'] as $match) {
                $match .= ';';
                if (isset($HTML_ENTITIES_CACHE[$match])) {
                    $search[$match] = $match;
                    $replace[$match] = $HTML_ENTITIES_CACHE[$match];
                }
            }

            if (\count($replace) > 0) {
                $str = \str_replace($search, $replace, $str);
            }
        }

        return $str;
    }

    private function _get_data($file)

The method _get_data is not named in camelCase.

Method name "Xss::_get_data" is not in camel caps format

    {
        /** @noinspection PhpIncludeInspection */
        return include __DIR__ . '/../voku/Data/' . $file . '.php';
    }

    public function cleanString($str)
    {
        return $this->clean($str);
    }

    /**
     * @param $str
     * @return array|mixed
     */
    public function cleanUrl($str)

The variable $decode_str is not named in camelCase.

This operation has 18 execution paths which exceeds the configured maximum of 10.

    {
        $this->input = $str;
        $str = $this->clean($str);

        if (is_numeric($str) || is_null($str)) {
            return $str;
        }

        if (is_array($str)) {
            foreach ($str as $key => $value) {
                $str[$key] = $this->cleanUrl($value);
            }
            return $str;
        }

        do {
            $decode_str = rawurldecode($str);
            $str = $this->_do($str);

$str is of type object|string|boolean, but the function expects a object<devtoolboxuk\soteria\voku\Resources\StringResource>.

        } while ($decode_str !== $str);

        $this->output = $str;

        return $str;
    }

    function result()

It is generally recommended to explicitly declare the visibility for methods.

It is recommend to declare an explicit visibility for result.

    {
        $valid = false;
        if (!$this->_xss_found) {

The expression $this->_xss_found of type null|boolean is loosely compared to false; this is ambiguous if the boolean can be false. You might want to explicitly use !== null instead.

            $valid = true;
        }
        return new SoteriaModel($this->input, $this->output, $valid);
    }
}