O2System\Security\Filters\Xss::clean()

Complexity

Conditions	12
Paths	66

Size

Total Lines	227
Code Lines	84

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php

    public static function clean($string, $isImage = false)

    {

        // Is the string an array?

        if (is_array($string)) {

The condition is_array($string) is always false.

            while (list($key) = each($string)) {

The function each() has been deprecated: 7.2

                $string[ $key ] = self::clean($string[ $key ]);

            }


            return $string;

        }


        // Remove Invisible Characters

        $string = remove_invisible_characters($string);


        /*

         * URL Decode

         *

         * Just in case stuff like this is submitted:

         *

         * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>

         *

         * Note: Use rawurldecode() so it does not remove plus signs

         */

        do {

            $string = rawurldecode($string);

        } while (preg_match('/%[0-9a-f]{2,}/i', $string));


        /*

         * Convert character entities to ASCII

         *

         * This permits our tests below to work reliably.

         * We only convert entities that are within tags since

         * these are the ones that will pose security problems.

         */

        $string = preg_replace_callback(

            "/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si",

            [self::class, 'convertAttribute'],

            $string

        );


        $string = preg_replace_callback('/<\w+.*/si', [self::class, 'decodeEntity'], $string);


        // Remove Invisible Characters Again!

        $string = remove_invisible_characters($string);


        /*

         * Convert all tabs to spaces

         *

         * This prevents strings like this: ja  vascript

         * NOTE: we deal with spaces between characters later.

         * NOTE: preg_replace was found to be amazingly slow here on

         * large blocks of data, so we use str_replace.

         */

        $string = str_replace("\t", ' ', $string);


        // Capture converted string for later comparison

        $convertedString = $string;


        // Remove Strings that are never allowed

        $string = self::doNeverAllowed($string);


        /*

         * Makes PHP tags safe

         *

         * Note: XML tags are inadvertently replaced too:

         *

         * <?xml

         *

         * But it doesn't seem to pose a problem.

         */

        if ($isImage === true) {

            // Images have a tendency to have the PHP short opening and

            // closing tags every so often so we skip those and only

            // do the long opening tags.

            $string = preg_replace('/<\?(php)/i', '&lt;?\\1', $string);

        } else {

            $string = str_replace(['<?', '?' . '>'], ['&lt;?', '?&gt;'], $string);

        }


        /*

         * Compact any exploded words

         *

         * This corrects words like:  j a v a s c r i p t

         * These words are compacted back to their correct state.

         */

        $words = [

            'javascript',

            'expression',

            'vbscript',

            'jscript',

            'wscript',

            'vbs',

            'script',

            'base64',

            'applet',

            'alert',

            'document',

            'write',

            'cookie',

            'window',

            'confirm',

            'prompt',

            'eval',

        ];


        foreach ($words as $word) {

            $word = implode('\s*', str_split($word)) . '\s*';


            // We only want to do this when it is followed by a non-word character

            // That way valid stuff like "dealer to" does not become "dealerto"

            $string = preg_replace_callback(

                '#(' . substr($word, 0, -3) . ')(\W)#is',

                [self::class, 'compactExplodedWords'],

                $string

            );

        }


        /*

         * Remove disallowed Javascript in links or img tags

         * We used to do some version comparisons and use of stripos(),

         * but it is dog slow compared to these simplified non-capturing

         * preg_match(), especially if the pattern exists in the string

         *

         * Note: It was reported that not only space characters, but all in

         * the following pattern can be parsed as separators between a tag name

         * and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C]

         * ... however, remove_invisible_characters() above already strips the

         * hex-encoded ones, so we'll skip them below.

         */

        do {

            $original = $string;

            if (preg_match('/<a/i', $string)) {

                $string = preg_replace_callback(

                    '#<a[^a-z0-9>]+([^>]*?)(?:>|$)#si',

                    [self::class, 'jsLinkRemoval'],

                    $string

                );

            }

            if (preg_match('/<img/i', $string)) {

                $string = preg_replace_callback(

                    '#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#si',

                    [self::class, 'jsImgRemoval'],

                    $string

                );

            }

            if (preg_match('/script|xss/i', $string)) {

                $string = preg_replace('#</*(?:script|xss).*?>#si', '[removed]', $string);

            }

        } while ($original !== $string);

        unset($original);


        /*

         * Sanitize naughty HTML elements

         *

         * If a tag containing any of the words in the list

         * below is found, the tag gets converted to entities.

         *

         * So this: <blink>

         * Becomes: &lt;blink&gt;

         */

        $pattern = '#'

            . '<((?<slash>/*\s*)(?<tagName>[a-z0-9]+)(?=[^a-z0-9]|$)'

            // tag start and name, followed by a non-tag character

            . '[^\s\042\047a-z0-9>/=]*'

            // a valid attribute character immediately after the tag would count as a separator

            // optional attributes

            . '(?<attributes>(?:[\s\042\047/=]*'

            // non-attribute characters, excluding > (tag close) for obvious reasons

            . '[^\s\042\047>/=]+'

            // attribute characters

            // optional attribute-value

            . '(?:\s*='

            // attribute-value separator

            . '(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))'

            // single, double or non-quoted value

            . ')?'

            // end optional attribute-value group

            . ')*)'

            // end optional attributes group

            . '[^>]*)(?<closeTag>\>)?#isS';

        // Note: It would be nice to optimize this for speed, BUT

        //       only matching the naughty elements here results in

        //       false positives and in turn - vulnerabilities!

        do {

            $oldString = $string;

            $string = preg_replace_callback($pattern, [self::class, 'sanitizeNaughtyHTML'], $string);

        } while ($oldString !== $string);


        unset($oldString);


        /*

         * Sanitize naughty scripting elements

         *

         * Similar to above, only instead of looking for

         * tags it looks for PHP and JavaScript commands

         * that are disallowed. Rather than removing the

         * code, it simply converts the parenthesis to entities

         * rendering the code un-executable.

         *

         * For example: eval('some code')

         * Becomes: eval&#40;'some code'&#41;

         */

        $string = preg_replace(

            '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',

            '\\1\\2&#40;\\3&#41;',

            $string

        );


        // Final clean up

        // This adds a bit of extra precaution in case

        // something got through the above filters

        $string = self::doNeverAllowed($string);


        /*

         * Images are Handled in a Special Way

         * - Essentially, we want to know that after all of the character

         * conversion is done whether any unwanted, likely XSS, code was found.

         * If not, we return TRUE, as the image is clean.

         * However, if the string post-conversion does not matched the

         * string post-removal of XSS, then it fails, as there was unwanted XSS

         * code found and removed/changed during processing.

         */

        if ($isImage === true) {

            return ($string === $convertedString);

The expression return $string === $convertedString returns the type boolean which is incompatible with the documented return type string.

        }


        return $string;

    }

}