Changeset 648 for trunk/system/libraries/Input.php

Timestamp:

10/04/2007 03:32:31 PM (14 months ago)

Author:

Shadowhand

Message:

Updated Input, replacing xss_clean() with a function by Christian Stocker. This function is blazing fast and does most of the right stuff.

Other changes are spit shine.

Files:

• trunk/system/libraries/Input.php (modified) (2 diffs)

trunk/system/libraries/Input.php

@@ -19 +19 @@
  * @orig_license     http://www.codeigniter.com/user_guide/license.html
  * @filesource
+ *
  * $Id$
  */
@@ -377 +378 @@
         /**
          * XSS Clean implemented by HTML Purifier
-         * 
+         *
          * Note: This function should only be used to deal with data upon submission.
          * It's not something that should be used for general runtime processing
          * since it requires a fair amount of processing overhead.
-         * 
-         * @access      public
-         * @param       string
-         * @return      string
-         */
-        public function xss_clean($str)
-        {
-                require SYSPATH.'vendor/htmlpurifier/HTMLPurifier.auto.php';
-                require 'HTMLPurifier.func.php';
-                
-                $config = HTMLPurifier_Config::createDefault();
-                $config->set('HTML', 'TidyLevel', 'none'); // Only XSS cleaning now
-                
-                return HTMLPurifier($str, $config);
+         *
+         * @access      public
+         * @param       string
+         * @return      string
+         */
+        public function xss_clean($string)
+        {
+                // http://svn.bitflux.ch/repos/public/popoon/trunk/classes/externalinput.php
+                // +----------------------------------------------------------------------+
+                // | Copyright (c) 2001-2006 Bitflux GmbH                                 |
+                // +----------------------------------------------------------------------+
+                // | Licensed under the Apache License, Version 2.0 (the "License");      |
+                // | you may not use this file except in compliance with the License.     |
+                // | You may obtain a copy of the License at                              |
+                // | http://www.apache.org/licenses/LICENSE-2.0                           |
+                // | Unless required by applicable law or agreed to in writing, software  |
+                // | distributed under the License is distributed on an "AS IS" BASIS,    |
+                // | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or      |
+                // | implied. See the License for the specific language governing         |
+                // | permissions and limitations under the License.                       |
+                // +----------------------------------------------------------------------+
+                // | Author: Christian Stocker <chregu@bitflux.ch>                        |
+                // +----------------------------------------------------------------------+
+                //
+                // Kohana Modifications:
+                // * Changed double quotes to single quotes, changed indenting and spacing
+                //
+                if (get_magic_quotes_gpc())
+                {
+                        $string = stripslashes($string);
+                }
+                $string = str_replace(array('&amp;','&lt;','&gt;'), array('&amp;amp;','&amp;lt;','&amp;gt;'), $string);
+                // fix &entitiy\n;
+
+                $string = preg_replace('#(&\#*\w+)[\x00-\x20]+;#u', '$1;', $string);
+                $string = preg_replace('#(&\#x*)([0-9A-F]+);*#iu', '$1$2;', $string);
+                $string = html_entity_decode($string, ENT_COMPAT, 'UTF-8');
+
+                // remove any attribute starting with "on" or xmlns
+                $string = preg_replace('#(<[^>]+[\x00-\x20\"\'])(on|xmlns)[^>]*>#iUu', '$1>', $string);
+                // remove javascript: and vbscript: protocol
+                $string = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*)[\\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iUu', '$1=$2nojavascript...', $string);
+                $string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'\"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iUu', '$1=$2novbscript...', $string);
+                $string = preg_replace('#([a-z]*)[\x00-\x20]*=([\'\"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#Uu', '$1=$2nomozbinding...', $string);
+                //<span style="width: expression(alert('Ping!'));"></span> 
+                // only works in ie...
+                $string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*).*expression[\x00-\x20]*\([^>]*>#iU', '$1>', $string);
+                $string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*).*behaviour[\x00-\x20]*\([^>]*>#iU', '$1>', $string);
+                $string = preg_replace('#(<[^>]+)style[\x00-\x20]*=[\x00-\x20]*([\`\'\"]*).*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*>#iUu', '$1>', $string);
+                //remove namespaced elements (we do not need them...)
+                $string = preg_replace('#</*\w+:\w[^>]*>#i', '',$string);
+                //remove really unwanted tags
+
+                do {
+                        $oldstring = $string;
+                        $string = preg_replace('#</*(applet|meta|xml|blink|link|style|script|embed|object|iframe|frame|frameset|ilayer|layer|bgsound|title|base)[^>]*>#i',"",$string);
+                } while ($oldstring != $string);
+
+                return $string;
         }