devtoolboxuk\soteria\voku\Resources\JavaScript

Complexity

Total Complexity

23

Size/Duplication

Total Lines	147
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	1

Test Coverage

Coverage

79.49%

Importance

Changes

0

5 Methods

Rating	Name	Duplication	Size	Complexity
B	removeDisallowedJavascript()	0	67	8
A	jsLinkRemovalCallback()	0	4	1
A	jsSrcRemovalCallback()	0	4	1
A	naughtyJavascript()	0	9	1
C	jsRemovalCallback()	0	53	12

<?php

namespace devtoolboxuk\soteria\voku\Resources;

class JavaScript extends Resources

The property $ANTI_XSS_STYLE is not named in camelCase.

{
    private $ANTI_XSS_STYLE = 'anti-xss::STYLE';

    public function removeDisallowedJavascript($str)

This operation has 65 execution paths which exceeds the configured maximum of 10.

    {
        do {
            $original = $str;

            if (stripos($str, '<a') !== false) {
                $str = (string)preg_replace_callback(
                    '#<a[^a-z0-9>]+([^>]*?)(?:>|$)#i',
                    function ($matches) {
                        return $this->jsLinkRemovalCallback($matches);
                    },
                    $str
                );
            }

            if (stripos($str, '<img') !== false) {
                $str = (string)preg_replace_callback(
                    '#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#i',
                    function ($matches) {
                        return $this->jsSrcRemovalCallback($matches);
                    },
                    $str
                );
            }

            if (stripos($str, '<audio') !== false) {
                $str = (string)preg_replace_callback(
                    '#<audio[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#i',
                    function ($matches) {
                        return $this->jsSrcRemovalCallback($matches);
                    },
                    $str
                );
            }

            if (stripos($str, '<video') !== false) {
                $str = (string)preg_replace_callback(
                    '#<video[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#i',
                    function ($matches) {
                        return $this->jsSrcRemovalCallback($matches);
                    },
                    $str
                );
            }

            if (stripos($str, '<source') !== false) {
                $str = (string)preg_replace_callback(
                    '#<source[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#i',
                    function ($matches) {
                        return $this->jsSrcRemovalCallback($matches);
                    },
                    $str
                );
            }

            if (stripos($str, 'script') !== false) {
                // US-ASCII: ¼ === <
                $str = (string)preg_replace(
                    '#(?:¼|<)/*(?:script).*(?:¾|>)#isuU',
                    $this->_replacement,
                    $str
                );
            }
        } while ($original !== $str);

        return (string)$str;
    }

    private function jsLinkRemovalCallback(array $match)
    {
        return $this->jsRemovalCallback($match, 'href');
    }

    private function jsRemovalCallback(array $match, $search)

This operation has 240 execution paths which exceeds the configured maximum of 200.

The variable $match_style_matched is not named in camelCase.

The variable $match_style is not named in camelCase.

    {
        if (!$match[0]) {
            return '';
        }

        // init
        $match_style_matched = false;
        $match_style = [];

        // hack for style attributes v1
        if ($search === 'href' && stripos($match[0], 'style') !== false) {
            preg_match('/style=".*?"/i', $match[0], $match_style);
            $match_style_matched = (count($match_style) > 0);
            if ($match_style_matched) {
                $match[0] = str_replace($match_style[0], $this->ANTI_XSS_STYLE, $match[0]);
            }
        }

        $replacer = $this->_filter_attributes(str_replace(['<', '>'], '', $match[1]));

        // filter for "(.*)" but only in the "$search"-attribute
        if (stripos($replacer, $search) !== false) {
            $pattern = '#' . $search . '=(?<wrapper>(?:\'|\047)|(?:"|\042)).*(?:\g{wrapper})#isU';
            $matchInner = [];
            $foundSomethingBad = false;
            preg_match($pattern, $match[1], $matchInner);
            if (count($matchInner) > 0 && preg_match('#(?:\(.*([^\)]*?)(?:\)))#s', $matchInner[0])) {
                $foundSomethingBad = true;

                $replacer = (string)preg_replace($pattern, $search . '="' . $this->_replacement . '"', $replacer);
            }

            if (!$foundSomethingBad) {
                // filter for javascript
                $pattern = '#' . $search . '=.*(?:javascript:|view-source:|livescript:|wscript:|vbscript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|<script|d\s*a\s*t\s*a\s*:)#ius';
                $matchInner = [];
                preg_match($pattern, $match[1], $matchInner);
                if (count($matchInner) > 0) {
                    $replacer = (string)preg_replace($pattern, $search . '="' . $this->_replacement . '"', $replacer);
                }
            }
        }

        $return = str_ireplace($match[1], $replacer, (string)$match[0]);

        // hack for style attributes v2
        if ($match_style_matched && $search === 'href') {
            $return = str_replace($this->ANTI_XSS_STYLE, $match_style[0], $return);
        }

        return $return;
    }

    private function jsSrcRemovalCallback(array $match)
    {
        return $this->jsRemovalCallback($match, 'src');
    }

    public function naughtyJavascript($str)
    {
        $str = (string) preg_replace(
            '#(alert|eval|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*)\)#uisU',
            '\\1\\2&#40;\\3&#41;',
            $str
        );
        return (string)$str;
    }

}