Fix XSS vulnerability #128

Author: Coderberg

src/Service/User/PropertyService.php

@@ -68,6 +68,8 @@ public function sanitizeHtml(Property $property, bool $isHtmlAllowed): Property
         if (!$isHtmlAllowed) {
             $property = $this->propertyTransformer->contentToPlainText($property);
             $property = $this->propertyTransformer->contentToHtml($property);
+        } else {
+            $property = $this->propertyTransformer->removeScriptsFromHtml($property);
         }
 
         return $property;

src/Transformer/PropertyTransformer.php

@@ -11,20 +11,25 @@ final class PropertyTransformer
 {
     public function contentToHtml(Property $property): Property
     {
-        $htmlContent = HtmlHelper::text2Html($property->getPropertyDescription()->getContent());
-        $property->setPropertyDescription(
-            $property->getPropertyDescription()->setContent($htmlContent)
-        );
-
-        return $property;
+        return $this->transformContent($property, HtmlHelper::text2Html(...));
     }
 
     public function contentToPlainText(Property $property): Property
     {
-        $htmlContent = $property->getPropertyDescription()->getContent();
-        $textContent = HtmlHelper::html2Text($htmlContent);
+        return $this->transformContent($property, HtmlHelper::html2Text(...));
+    }
+
+    public function removeScriptsFromHtml(Property $property): Property
+    {
+        return $this->transformContent($property, HtmlHelper::removeScriptsFromHtml(...));
+    }
+
+    private function transformContent(Property $property, callable $transformFunction): Property
+    {
+        $content = $property->getPropertyDescription()->getContent();
+        $transformedContent = \call_user_func($transformFunction, $content);
         $property->setPropertyDescription(
-            $property->getPropertyDescription()->setContent($textContent)
+            $property->getPropertyDescription()->setContent($transformedContent)
         );
 
         return $property;

src/Utils/HtmlHelper.php

@@ -17,4 +17,12 @@ public static function text2Html(string $text): string
     {
         return preg_replace("/\r\n|\r|\n/", '<br>', $text);
     }
+
+    public static function removeScriptsFromHtml(string $html): string
+    {
+        $sanitizedHtml = preg_replace('#<script(.*?)>(.*?)</script>#is', '', $html);
+        $sanitizedHtml = preg_replace('# on\w+="[^"]*"#i', '', (string) $sanitizedHtml);
+
+        return preg_replace("# on\w+='[^']*'#i", '', (string) $sanitizedHtml);
+    }
 }