From 240b0116f7136da677a6e93d1dc6f1e97a899d74 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Thu, 4 Sep 2025 09:25:46 +0200
Subject: [PATCH] Http Input : remove harming tag from raw

---
 include/lib/http_input.class.php         | 23 ++++++--
 unit-test/include/lib/http_inputTest.php | 74 ++++++++++++++++++++++++
 2 files changed, 92 insertions(+), 5 deletions(-)
 create mode 100644 unit-test/include/lib/http_inputTest.php

diff --git a/include/lib/http_input.class.php b/include/lib/http_input.class.php
index 2b4c53e70..519580b14 100644
--- a/include/lib/http_input.class.php
+++ b/include/lib/http_input.class.php
@@ -162,7 +162,14 @@ class HttpInput
                 if (array_key_exists($p_name,$this->array) )
                 {
                     $this->check_type($p_name, $p_type);
- 		    if ($p_type != 'raw' && is_string($this->array[$p_name]) ) return preg_replace("/</","< ", $this->array[$p_name]);
+ 		    if ($p_type != 'raw' && is_string($this->array[$p_name]) ) {
+                        return preg_replace("/</","<.", $this->array[$p_name]);
+                    }elseif ($p_type == 'raw') {
+                        $a=preg_replace("/<script/","<.", $this->array[$p_name]);
+                        $a=preg_replace("/<iframe/i","<.", $this->array[$p_name]);
+                        return $a;
+                        
+                    }
 		    return $this->array[$p_name];
                 }
                 else
@@ -176,7 +183,13 @@ class HttpInput
                 EXC_PARAM_VALUE);
             }
             $this->check_type($p_name, $p_type);
-	    if ( is_string($this->array[$p_name]) ) return  preg_replace("/</","< ", $this->array[$p_name]);
+	    if ( $p_type == 'string' && is_string($this->array[$p_name]) ) return  preg_replace("/</","<.", $this->array[$p_name]);
+	    if ( $p_type == 'raw'  ) {
+                $a=preg_replace("/<script/","<.", $this->array[$p_name]);
+                $a=preg_replace("/<iframe/i","<.", $this->array[$p_name]);
+                $a=preg_replace("/<frame/i","<.", $this->array[$p_name]);
+                return $a; 
+            }
 	    return $this->array[$p_name];
         }
         catch (Exception $e)
@@ -187,9 +200,9 @@ class HttpInput
 
     /**
      * @brief Retrieve from $_GET
-     * @param $p_name name of the variable
-     * @param $p_type type of the variable , opt. default string
-     * @param $p_default default value is variable is not set
+     * @param $p_name string of the variable
+     * @param $p_type string of the variable , opt. default string
+     * @param $p_default mixed default value is variable is not set
      * @throws Exception if invalid
      */
     function get($p_name, $p_type="string", $p_default="")
diff --git a/unit-test/include/lib/http_inputTest.php b/unit-test/include/lib/http_inputTest.php
new file mode 100644
index 000000000..2ea183aa7
--- /dev/null
+++ b/unit-test/include/lib/http_inputTest.php
@@ -0,0 +1,74 @@
+<?php
+
+/*
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ *
+ * 
+ * Author : Dany De Bontridder danydb@noalyss.eu
+ * Copyright (C) 2025 Dany De Bontridder <dany@alchimerys.be>
+ * 
+ */
+
+/**
+ * @file
+ * @brief noalyss
+ */
+
+use PHPUnit\Framework\TestCase;
+
+require DIRTEST . '/global.php';
+
+/**
+ * @testdox test http input
+ * @coversDefaultClass
+ */
+class Http_InputTest extends TestCase {
+
+   
+
+    /**
+     * @brief Data simulation
+
+     * @return array
+     */
+    function dataHttpInput() {
+        return array(
+            [ ['value'=>'<script'], '<.script']
+            , [['value'=>'Test <script'], 'Test <.script']
+            , [['value'=>'<Script>'], '<.Script>']
+            , [['value'=>6], 6]
+            , [['value'=>'<iframe src'], '<.iframe src']
+            , [['value'=>'Test <IFRAME src'], 'Test <.IFRAME src']
+        );
+    }
+
+    
+
+    /**
+     * @testdox Check the removal of bad tags
+     * @covers security
+     * @dataProvider dataHttpInput
+     * @global $g_connection
+     */
+    function testRemoveHarmingString($array,$result) {
+        $http=new \HttpInput();
+//        print "value = ".print_r($value,true);
+        $http->set_array($array);
+        $this->assertEquals($result,$http->get_value('value','string')
+                ," can get [$result] from ".print_r($array,true)."\n");
+        
+    }
+}