mirror of
https://github.com/HDInnovations/UNIT3D-Community-Edition.git
synced 2026-01-14 16:00:59 -06:00
ad716d7cc3
We've been mostly relying on the 3rd party xss cleaner to make sure user submitted content is clean. This PR fixes up any leftover holes in the bbcode parser that allow xss vulnerabilities, and as a result, the 3rd party library isn't needed anymore. It cleans responsibly by first, running `htmlspecialchars()` over the content, followed by sanitizing the untrusted urls and whitelisting their protocol.
59 lines
1.5 KiB
PHP
59 lines
1.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* NOTICE OF LICENSE.
|
|
*
|
|
* UNIT3D Community Edition is open-sourced software licensed under the GNU Affero General Public License v3.0
|
|
* The details is bundled with this project in the file LICENSE.txt.
|
|
*
|
|
* @project UNIT3D Community Edition
|
|
*
|
|
* @author Raordom <roardom@protonmail.com>
|
|
* @license https://www.gnu.org/licenses/agpl-3.0.en.html/ GNU Affero General Public License v3.0
|
|
*/
|
|
|
|
namespace App\Http\Livewire;
|
|
|
|
use App\Helpers\Bbcode;
|
|
use Livewire\Component;
|
|
|
|
class BbcodeInput extends Component
|
|
{
|
|
public string $label = '';
|
|
|
|
public string $name = '';
|
|
|
|
public bool $isPreviewEnabled = false;
|
|
|
|
public bool $isRequired = false;
|
|
|
|
public string $contentBbcode = '';
|
|
|
|
public string $contentHtml = '';
|
|
|
|
final public function mount(string $name, string $label, bool $required = false, string $content = null): void
|
|
{
|
|
$this->name = $name;
|
|
$this->label = $label;
|
|
$this->isRequired = $required;
|
|
$this->contentBbcode = $content ?? old($name) ?? '';
|
|
}
|
|
|
|
final public function updatedIsPreviewEnabled(): void
|
|
{
|
|
if ($this->isPreviewEnabled) {
|
|
$this->contentHtml = (new Bbcode())->parse($this->contentBbcode);
|
|
}
|
|
}
|
|
|
|
final public function render(): \Illuminate\Contracts\View\Factory|\Illuminate\Contracts\View\View|\Illuminate\Contracts\Foundation\Application
|
|
{
|
|
return view('livewire.bbcode-input', [
|
|
'contentHtml' => $this->contentHtml,
|
|
'label' => $this->label,
|
|
]);
|
|
}
|
|
}
|