voku/anti-xss

[+]: optimize performance

• add more js events e.g. "onbeforetoggle"

[*]: update the changelog

[+]: fix false positive on self-close tags (issue #111)

[*]: update the changelog

[*]: update the changelog v2

[*]: update the changelog

[*]: update the changelog

[*]: update the changelog

• allow e.g. "< 1 year" (issue 83)
• fix false-positive issue (issue 85 | thx @gharlan)

• fix errors in large strings
• fix "_xss_found" if xss string was found in array value

• micro-optimize performance
• optimize phpdocs + use phpstan-syntax

• optimize performance (thx @staabm)
• update vendor lib (Portable UTF-8)

• update vendor lib (Portable UTF-8)

• allow e.g. "<35%" (issue #62)
• allow to skip some html tags from auto closing (issue #63)
• run tests with PHP 8.0 rc3

• fix allow base64 encoded images in <img>-tags (issue #61)
• fix performance issue of regex with "preg_match_all"

• allow e.g. "< $2.20" (issue #60)
• optimize protection against HTML "script" tag stripping evasion
• auto-generate the api documentation into the README

• allow base64 encoded images in <img>-tags (issue #59)

• fix false-positive (issue #58)

• allow to change the "_never_allowed_str_afterwards" (issue #56)
• fix false-positive (issue #55)

• use some more bad strings from "https://github.com/s0md3v/AwesomeXSS"
• optimize some regex (use strpos before the regex)

• fix false-positive (issue #54)
• optimize internal caching of strings

• fix false-positive (issue #53)
• fix for "server-sent events"
• optimize regex for encoded script-tags (%3C && %3E)

• fix additional false positives in string (issue #52)
• remove support for "Netscape 4 JS entities"

• keep more non XSS content from html input

• fix open tags problem e.g. "<img/"

• add "addNeverAllowedRegex()"
• add "removeNeverAllowedRegex()"

• fix replacing of "-->" (issue #50)
• update vendor lib (Portable UTF-8)

• optimize regex
• update vendor lib (Portable UTF-8)

• add "removeNeverAllowedOnEventsAfterwards()" && "addNeverAllowedOnEventsAfterwards()"
• update "_never_allowed_on_events_afterwards" -> add "onTouchend" + "onTouchLeave" + "onTouchMove" (thx @DmytroChymyrys)
• optimize phpdoc for array => string[]

• fix replacing of false-positive xss words e.g. "script@gmail.com" (issue #44)

• fix replacing of false-positive xss words e.g. "video@gmail.com" (issue #44)

• fix replacing of false-positive xss words e.g. "styler_tester@gmail.com" (issue #44)

• fix replacing of false-positive xss words e.g. "ANAMNESI E VAL!DEFINITE BREVI ORTO" (issue #43)

• optimize the spacing regex

• fix replacing of false-positive xss words e.g. "MONDRAGÓN" (issue #43)

• fix replacing of false-positive xss words e.g. "DE VAL HERNANDEZ" (issue #43)

• fix replacing of false-positive xss words e.g. "Mondragon" (issue #43)

• fix issue with "()" in some html attributes (issue #41)

• use new version of "Portable UTF8"

• fix for url-decoded stored-xss
• fix return type (?string -> string)

• use new version of "Portable UTF8"
• add some more event listener
• use PHPStan

• "UTF7 repack corrected" | thx @alechner #34

• keep the input value (+ encoding), if no xss was detected #32

• fix "href is getting stripped" #30

• fix "URL escaping bug" #29

• fix usage of "Portable UTF8"

• update "Portable UTF8" from v4 -> v5

  -> this is a breaking change without API-changes - but the requirement from "Portable UTF8" has been changed (it no longer requires all polyfills from Symfony)

• add "_evil_html_tags" -> so you can remove / add html-tags

• "php": ">=7.0"
  • use "strict_types"
• simplify a regex

• "php": ">=7.0"
  • drop support for PHP < 7.0