voku/anti-xss

[*]: update the changelog

• add more modern DOM event handlers to the blacklist (e.g. "onAppInstalled", "onBeforeInstallPrompt", "onFormData", "onGamepadConnected/Disconnected", "onMessageError", "onScrollEnd", "onSecurityPolicyViolation", "onSlotChange", "onVRDisplay*", ...)
• harden detection of hyphen-/colon-suffixed event-handler lookalikes (e.g. "onmessageerror-foo") so the whole attribute is removed instead of leaving a broken attribute with leftover payload text
• fix regression: the lookalike-hardening above could also strip the value of unrelated, legitimate compound attributes that merely contain an event name after a hyphen (e.g. "data-onchange-debounce="300""); only real handler-lookalikes are removed now
• harden CSS "expression(...)" detection, incl. escaped and uppercase variants, and fix a regex backtracking risk
• add a hard cap on internal sanitization retry-loops (throws "RuntimeException" instead of looping forever if a loop can't converge)
• preserve custom / removed "_never_allowed_regex" entries across "setReplacement()" calls
• fix: several tag/attribute-stripping steps silently wiped the whole string to "" when "preg_replace()"/"preg_replace_callback()" hit "pcre.backtrack_limit" (or its fallback also failed); they now fail closed via a bounded, non-regex removal of the specific dangerous tag/attribute instead of discarding unrelated content or falling back to the still-dangerous raw input
• add regression test for issue #201 (template + slot "onslotchange" XSS)
• add mutation testing (Infection) to CI with a diff MSI gate

[+]: optimize performance

• 10-50% better performance
• add "addNaughtyJavascriptPatterns()"
• add "setKeepPreAndCodeTagContent()" to preserve content inside "pre" and "code" tags
• fix regression when sanitizing text inside "pre" / "code" tags
• fix false-positives for valid "href" / "src" URLs and plain text such as "system (...)", "behavior:", "< abc" and "< 35kg"
• improve detection of obfuscated style / attribute payloads and JSON-escaped HTML attributes
• keep valid base64 payloads ending with "==" and avoid blank output if "preg_replace()" returns "null"
• update "portable-utf8" to "~6.1.0"
• improve CI / test compatibility (incl. PHP 8.5 + PHPUnit 12)

• add more js events e.g. "onbeforetoggle"

[*]: update the changelog

• remove debug call (thx @gharlan [Gregor Harlan]

[+]: fix false positive on self-close tags (issue #111)

• fix xss bypass (issue 115 | thx @thanosgn [Thanos Giannopoulos])
• add more blacklisted js calls (thx @peter-mw [Peter Ivanov])
• fix false positive on self-close tags (issue 111 | thx @genetus [Maxim Antonov])

[*]: update the changelog

• "To people of Russia": There is a war in Ukraine right now. The forces of the Russian Federation are attacking civilians.

[*]: update the changelog v2

• optimize "_sanitize_naughty_javascript" (issue 99 | thx @Fahl-Design)
• optimize "_do_never_allowed_afterwards", at least for strings in tags

[*]: update the changelog

• move more static data into the object
  • allow to modify the "_never_allowed_call_strings"-data"
  • allow to modify the "_never_allowed_js_callback_regex"-data"

[*]: update the changelog

• update "portable-utf8"

[*]: update the changelog

• update "portable-utf8"

• allow e.g. "< 1 year" (issue 83)
• fix false-positive issue (issue 85 | thx @gharlan)

• fix errors in large strings
• fix "_xss_found" if xss string was found in array value

• micro-optimize performance
• optimize phpdocs + use phpstan-syntax

• optimize performance (thx @staabm)
• update vendor lib (Portable UTF-8)

• update vendor lib (Portable UTF-8)

• allow e.g. "<35%" (issue #62)
• allow to skip some html tags from auto closing (issue #63)
• run tests with PHP 8.0 rc3

• fix allow base64 encoded images in <img>-tags (issue #61)
• fix performance issue of regex with "preg_match_all"

• allow e.g. "< $2.20" (issue #60)
• optimize protection against HTML "script" tag stripping evasion
• auto-generate the api documentation into the README

• allow base64 encoded images in <img>-tags (issue #59)

• fix false-positive (issue #58)

• allow to change the "_never_allowed_str_afterwards" (issue #56)
• fix false-positive (issue #55)

• use some more bad strings from "https://github.com/s0md3v/AwesomeXSS"
• optimize some regex (use strpos before the regex)

• fix false-positive (issue #54)
• optimize internal caching of strings

• fix false-positive (issue #53)
• fix for "server-sent events"
• optimize regex for encoded script-tags (%3C && %3E)

• fix additional false positives in string (issue #52)
• remove support for "Netscape 4 JS entities"

• keep more non XSS content from html input

• fix open tags problem e.g. "<img/"

• add "addNeverAllowedRegex()"
• add "removeNeverAllowedRegex()"

• fix replacing of "-->" (issue #50)
• update vendor lib (Portable UTF-8)

• optimize regex
• update vendor lib (Portable UTF-8)

• add "removeNeverAllowedOnEventsAfterwards()" && "addNeverAllowedOnEventsAfterwards()"
• update "_never_allowed_on_events_afterwards" -> add "onTouchend" + "onTouchLeave" + "onTouchMove" (thx @DmytroChymyrys)
• optimize phpdoc for array => string[]

• fix replacing of false-positive xss words e.g. "[email protected]" (issue #44)

• fix replacing of false-positive xss words e.g. "[email protected]" (issue #44)

• fix replacing of false-positive xss words e.g. "[email protected]" (issue #44)

• fix replacing of false-positive xss words e.g. "ANAMNESI E VAL!DEFINITE BREVI ORTO" (issue #43)

• optimize the spacing regex

• fix replacing of false-positive xss words e.g. "MONDRAGÓN" (issue #43)

• fix replacing of false-positive xss words e.g. "DE VAL HERNANDEZ" (issue #43)

• fix replacing of false-positive xss words e.g. "Mondragon" (issue #43)

• fix issue with "()" in some html attributes (issue #41)

• use new version of "Portable UTF8"

• fix for url-decoded stored-xss
• fix return type (?string -> string)

• use new version of "Portable UTF8"
• add some more event listener
• use PHPStan

• "UTF7 repack corrected" | thx @alechner #34

• keep the input value (+ encoding), if no xss was detected #32

• fix "href is getting stripped" #30

• fix "URL escaping bug" #29

• fix usage of "Portable UTF8"

• update "Portable UTF8" from v4 -> v5

  -> this is a breaking change without API-changes - but the requirement from "Portable UTF8" has been changed (it no longer requires all polyfills from Symfony)

• add "_evil_html_tags" -> so you can remove / add html-tags

• "php": ">=7.0"
  • use "strict_types"
• simplify a regex

• "php": ">=7.0"
  • drop support for PHP < 7.0