admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Http Input : remove harming tag from raw

Browse source
This commit is contained in:
sparkyx 2025-09-04 09:25:46 +02:00
parent 497501456d
commit 95a79ae252
2 changed files with 92 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
include/lib/http_input.class.php
View file

@ -162,7 +162,14 @@ class HttpInput
if (array_key_exists($p_name,$this->array) )
{
$this->check_type($p_name, $p_type);
if ($p_type != 'raw' && is_string($this->array[$p_name]) ) return preg_replace("/</","< ", $this->array[$p_name]);
if ($p_type != 'raw' && is_string($this->array[$p_name]) ) {
return preg_replace("/</","<.", $this->array[$p_name]);
}elseif ($p_type == 'raw') {
$a=preg_replace("/<script/","<.", $this->array[$p_name]);
$a=preg_replace("/<iframe/i","<.", $this->array[$p_name]);
return $a;
}
return $this->array[$p_name];
}
else
@ -176,7 +183,13 @@ class HttpInput
EXC_PARAM_VALUE);
}
$this->check_type($p_name, $p_type);
if ( is_string($this->array[$p_name]) ) return preg_replace("/</","< ", $this->array[$p_name]);
if ( $p_type == 'string' && is_string($this->array[$p_name]) ) return preg_replace("/</","<.", $this->array[$p_name]);
if ( $p_type == 'raw' ) {
$a=preg_replace("/<script/","<.", $this->array[$p_name]);
$a=preg_replace("/<iframe/i","<.", $this->array[$p_name]);
$a=preg_replace("/<frame/i","<.", $this->array[$p_name]);
return $a;
}
return $this->array[$p_name];
}
catch (Exception $e)
@ -187,9 +200,9 @@ class HttpInput
/**
* @brief Retrieve from $_GET
* @param $p_name name of the variable
* @param $p_type type of the variable , opt. default string
* @param $p_default default value is variable is not set
* @param $p_name string of the variable
* @param $p_type string of the variable , opt. default string
* @param $p_default mixed default value is variable is not set
* @throws Exception if invalid
*/
function get($p_name, $p_type="string", $p_default="")

74
unit-test/include/lib/http_inputTest.php Normal file
View file

@ -0,0 +1,74 @@
<?php
/*
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
*
* Author : Dany De Bontridder danydb@noalyss.eu
* Copyright (C) 2025 Dany De Bontridder <dany@alchimerys.be>
*
*/
/**
* @file
* @brief noalyss
*/
use PHPUnit\Framework\TestCase;
require DIRTEST . '/global.php';
/**
* @testdox test http input
* @coversDefaultClass
*/
class Http_InputTest extends TestCase {
/**
* @brief Data simulation
* @return array
*/
function dataHttpInput() {
return array(
[ ['value'=>'<script'], '<.script']
, [['value'=>'Test <script'], 'Test <.script']
, [['value'=>'<Script>'], '<.Script>']
, [['value'=>6], 6]
, [['value'=>'<iframe src'], '<.iframe src']
, [['value'=>'Test <IFRAME src'], 'Test <.IFRAME src']
);
}
/**
* @testdox Check the removal of bad tags
* @covers security
* @dataProvider dataHttpInput
* @global $g_connection
*/
function testRemoveHarmingString($array,$result) {
$http=new \HttpInput();
// print "value = ".print_r($value,true);
$http->set_array($array);
$this->assertEquals($result,$http->get_value('value','string')
," can get [$result] from ".print_r($array,true)."\n");
}
}