From d3780c5d126dfe732ab8cb4e515673c1398e8325 Mon Sep 17 00:00:00 2001 From: plfort Date: Mon, 4 Jul 2022 21:57:03 +0200 Subject: [PATCH] [HtmlSanitizer] Allow null for sanitizer option `allowed_link_hosts` and `allowed_media_hosts` --- .../DependencyInjection/Configuration.php | 18 +++++++++++++----- ...er_default_allowed_link_and_media_hosts.php | 10 ++++++++++ ...er_default_allowed_link_and_media_hosts.xml | 13 +++++++++++++ ...er_default_allowed_link_and_media_hosts.yml | 5 +++++ .../FrameworkExtensionTest.php | 9 +++++++++ 5 files changed, 50 insertions(+), 5 deletions(-) create mode 100644 src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/html_sanitizer_default_allowed_link_and_media_hosts.php create mode 100644 src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/html_sanitizer_default_allowed_link_and_media_hosts.xml create mode 100644 src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/html_sanitizer_default_allowed_link_and_media_hosts.yml diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php index 43f268db06707..5c953034faf70 100644 --- a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php +++ b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php @@ -1912,7 +1912,7 @@ private function addHttpClientRetrySection() ->integerNode('max_delay')->defaultValue(0)->min(0)->info('Max time in ms that a retry should ever be delayed (0 = infinite)')->end() ->floatNode('jitter')->defaultValue(0.1)->min(0)->max(1)->info('Randomness in percent (between 0 and 1) to apply to the delay')->end() ->end() - ; + ; } private function addMailerSection(ArrayNodeDefinition $rootNode, callable $enableIfStandalone) @@ -2223,9 +2223,13 @@ private function addHtmlSanitizerSection(ArrayNodeDefinition $rootNode, callable ->info('Allows only a given list of schemes to be used in links href attributes.') ->scalarPrototype()->end() ->end() - ->arrayNode('allowed_link_hosts') + ->variableNode('allowed_link_hosts') ->info('Allows only a given list of hosts to be used in links href attributes.') - ->scalarPrototype()->end() + ->defaultValue(null) + ->validate() + ->ifTrue(function ($v) { return !\is_array($v) && null !== $v; }) + ->thenInvalid('The "allowed_link_hosts" parameter must be an array or null') + ->end() ->end() ->booleanNode('allow_relative_links') ->info('Allows relative URLs to be used in links href attributes.') @@ -2235,9 +2239,13 @@ private function addHtmlSanitizerSection(ArrayNodeDefinition $rootNode, callable ->info('Allows only a given list of schemes to be used in media source attributes (img, audio, video, ...).') ->scalarPrototype()->end() ->end() - ->arrayNode('allowed_media_hosts') + ->variableNode('allowed_media_hosts') ->info('Allows only a given list of hosts to be used in media source attributes (img, audio, video, ...).') - ->scalarPrototype()->end() + ->defaultValue(null) + ->validate() + ->ifTrue(function ($v) { return !\is_array($v) && null !== $v; }) + ->thenInvalid('The "allowed_media_hosts" parameter must be an array or null') + ->end() ->end() ->booleanNode('allow_relative_medias') ->info('Allows relative URLs to be used in media source attributes (img, audio, video, ...).') diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/html_sanitizer_default_allowed_link_and_media_hosts.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/html_sanitizer_default_allowed_link_and_media_hosts.php new file mode 100644 index 0000000000000..952c066de0cc2 --- /dev/null +++ b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/html_sanitizer_default_allowed_link_and_media_hosts.php @@ -0,0 +1,10 @@ +loadFromExtension('framework', [ + 'http_method_override' => false, + 'html_sanitizer' => [ + 'sanitizers' => [ + 'custom_default' => null, + ], + ], +]); diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/html_sanitizer_default_allowed_link_and_media_hosts.xml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/html_sanitizer_default_allowed_link_and_media_hosts.xml new file mode 100644 index 0000000000000..fff1592d37e0a --- /dev/null +++ b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/html_sanitizer_default_allowed_link_and_media_hosts.xml @@ -0,0 +1,13 @@ + + + + + + + + + + diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/html_sanitizer_default_allowed_link_and_media_hosts.yml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/html_sanitizer_default_allowed_link_and_media_hosts.yml new file mode 100644 index 0000000000000..5c9ac2b475593 --- /dev/null +++ b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/html_sanitizer_default_allowed_link_and_media_hosts.yml @@ -0,0 +1,5 @@ +framework: + http_method_override: false + html_sanitizer: + sanitizers: + custom_default: ~ diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php index e0e1c51d8752d..eaf240f8a93b6 100644 --- a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php +++ b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php @@ -2103,6 +2103,15 @@ static function ($call) { $this->assertFalse($container->hasAlias(HtmlSanitizerInterface::class.' $default')); } + public function testHtmlSanitizerDefaultNullAllowedLinkMediaHost() + { + $container = $this->createContainerFromFile('html_sanitizer_default_allowed_link_and_media_hosts'); + + $calls = $container->getDefinition('html_sanitizer.config.custom_default')->getMethodCalls(); + $this->assertContains(['allowLinkHosts', [null], true], $calls); + $this->assertContains(['allowMediaHosts', [null], true], $calls); + } + public function testHtmlSanitizerDefaultConfig() { $container = $this->createContainerFromFile('html_sanitizer_default_config'); pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy