Skip to content

Commit 71b4727

Browse files
authored
Merge pull request #14 from protonemedia/direct-voku-dep
Make `voku/anti-xss` a direct dependency
2 parents a937bd5 + 506b203 commit 71b4727

File tree

4 files changed

+57
-12
lines changed

4 files changed

+57
-12
lines changed

README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
[![run-tests](https://github.com/protonemedia/laravel-xss-protection/actions/workflows/run-tests.yml/badge.svg)](https://github.com/protonemedia/laravel-xss-protection/actions/workflows/run-tests.yml)
55
[![Total Downloads](https://img.shields.io/packagist/dt/protonemedia/laravel-xss-protection.svg?style=flat-square)](https://packagist.org/packages/protonemedia/laravel-xss-protection)
66

7-
Laravel Middleware to protect your app against Cross-site scripting (XSS). It sanitizes request input by utilising the [Security Core](https://github.com/GrahamCampbell/Security-Core) package, and it can sanatize [Blade echo statements](https://laravel.com/docs/8.x/blade#displaying-data) as well.
7+
Laravel Middleware to protect your app against Cross-site scripting (XSS). It sanitizes request input by utilising the [voku/anti-xss](https://github.com/voku/anti-xss) package, and it can sanatize [Blade echo statements](https://laravel.com/docs/8.x/blade#displaying-data) as well. This package was inspired by the [Security Core](https://github.com/GrahamCampbell/Security-Core) package.
88

99
* PHP 8.2 and higher
1010
* Laravel 10 and higher
@@ -106,7 +106,7 @@ Event::listen(function (MaliciousInputFound $event) {
106106

107107
### Additional configuration for `voku/anti-xss`
108108

109-
As of version 1.6.0, you may provide additional configuration for the `voku/anti-xss` package. You may do this by filling the `middleware.anti_xss` key. This is similar to the [Laravel Security](https://github.com/GrahamCampbell/Laravel-Security) package, which this package used to rely on.
109+
As of version 1.6.0, you may provide additional configuration for the `voku/anti-xss` package. You may do this by filling the `middleware.anti_xss` key.
110110

111111
```php
112112
'anti_xss' => [

composer.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,10 @@
1717
],
1818
"require": {
1919
"php": "^8.2|^8.3|^8.4",
20-
"graham-campbell/security-core": "^4.0",
2120
"illuminate/contracts": "^10.0|^11.0|^12.0",
22-
"spatie/laravel-package-tools": "^1.9.2"
21+
"spatie/laravel-package-tools": "^1.9.2",
22+
"voku/anti-xss": "~4.1.42",
23+
"voku/portable-utf8": "^6.0.13"
2324
},
2425
"require-dev": {
2526
"laravel/pint": "^1.14",

src/Middleware/XssCleanInput.php

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,12 @@
33
namespace ProtoneMedia\LaravelXssProtection\Middleware;
44

55
use Closure;
6-
use GrahamCampbell\SecurityCore\Security;
76
use Illuminate\Foundation\Http\Middleware\TransformsRequest;
87
use ProtoneMedia\LaravelXssProtection\Cleaners\BladeEchoes;
98
use ProtoneMedia\LaravelXssProtection\Events\MaliciousInputFound;
109
use Symfony\Component\HttpFoundation\File\UploadedFile;
10+
use voku\helper\AntiXSS;
11+
use voku\helper\UTF8;
1112

1213
class XssCleanInput extends TransformsRequest
1314
{
@@ -53,7 +54,7 @@ class XssCleanInput extends TransformsRequest
5354
* @return void
5455
*/
5556
public function __construct(
56-
protected Security $security,
57+
protected AntiXSS $antiXss,
5758
protected BladeEchoes $bladeEchoCleaner
5859
) {
5960
//
@@ -131,7 +132,11 @@ protected function transform($key, $value)
131132
return null;
132133
}
133134

134-
$output = $this->security->clean((string) $value);
135+
$output = $this->antiXss->xss_clean((string) $value);
136+
137+
if ($this->antiXss->isXssFound() === false) {
138+
$output = $this->cleanInvisibleCharacters($output);
139+
}
135140

136141
if (! $this->enabledInConfig('allow_blade_echoes')) {
137142
$output = $this->bladeEchoCleaner->clean((string) $output);
@@ -187,4 +192,22 @@ public static function clearCallbacks()
187192

188193
static::$skipKeyCallbacks = [];
189194
}
195+
196+
/**
197+
* Clean invisible characters from the input.
198+
*
199+
* @param string|array $input
200+
*/
201+
private function cleanInvisibleCharacters($input): string|array
202+
{
203+
if (is_array($input)) {
204+
foreach ($input as $key => &$value) {
205+
$value = $this->cleanInvisibleCharacters($value);
206+
}
207+
208+
return $input;
209+
}
210+
211+
return UTF8::remove_invisible_characters($input, true);
212+
}
190213
}

src/ServiceProvider.php

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22

33
namespace ProtoneMedia\LaravelXssProtection;
44

5-
use GrahamCampbell\SecurityCore\Security;
5+
use ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput;
66
use Spatie\LaravelPackageTools\Package;
77
use Spatie\LaravelPackageTools\PackageServiceProvider;
8+
use voku\helper\AntiXSS;
89

910
class ServiceProvider extends PackageServiceProvider
1011
{
@@ -22,9 +23,29 @@ public function configurePackage(Package $package): void
2223

2324
public function packageBooted()
2425
{
25-
$this->app->singleton(Security::class, fn () => Security::create(
26-
config('xss-protection.anti_xss.evil'),
27-
config('xss-protection.anti_xss.replacement')
28-
));
26+
$this->app->when(XssCleanInput::class)
27+
->needs(AntiXSS::class)
28+
->give(function () {
29+
$antiXss = new AntiXSS;
30+
31+
$replacement = config('xss-protection.anti_xss.replacement');
32+
33+
if ($replacement !== null) {
34+
$antiXss->setReplacement($replacement);
35+
}
36+
37+
$evil = config('xss-protection.anti_xss.evil');
38+
39+
if ($evil !== null) {
40+
if (isset($evil['attributes']) || isset($evil['tags'])) {
41+
$antiXss->addEvilAttributes($evil['attributes'] ?? []);
42+
$antiXss->addEvilHtmlTags($evil['tags'] ?? []);
43+
} else {
44+
$antiXss->addEvilAttributes($evil);
45+
}
46+
}
47+
48+
return $antiXss;
49+
});
2950
}
3051
}

0 commit comments

Comments
 (0)