Skip to content

Commit

Permalink
Change general approach from trying to target explicit types, to igno…
Browse files Browse the repository at this point in the history
…ring purification for all non string types
  • Loading branch information
incentify-dev committed Mar 23, 2021
1 parent cf47484 commit 9f7d0cf
Show file tree
Hide file tree
Showing 4 changed files with 18 additions and 12 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ Config file `config/purifier.php` should like this
return [
'encoding' => 'UTF-8',
'finalize' => true,
'passThruNullValues' => false,
'ignoreNonStrings' => false,
'cachePath' => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings' => [
Expand Down
2 changes: 1 addition & 1 deletion config/purifier.php
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
return [
'encoding' => 'UTF-8',
'finalize' => true,
'passThruNullValues' => false,
'ignoreNonStrings' => false,
'cachePath' => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings' => [
Expand Down
12 changes: 5 additions & 7 deletions src/Purifier.php
Original file line number Diff line number Diff line change
Expand Up @@ -273,13 +273,11 @@ public function clean($dirty, $config = null, \Closure $postCreateConfigHook = n
}
}

//If $dirty is explicit NULL, bypass purification assuming configuration allows this
$passThruNullValues = $this->config->get('purifier.passThruNullValues', false);
if($passThruNullValues !== false && $dirty === null) {
return null;
}
if($passThruNullValues !== false && $dirty === false) {
return false;
//If $dirty is not an explicit string, bypass purification assuming configuration allows this
$ignoreNonStrings = $this->config->get('purifier.ignoreNonStrings', false);
$stringTest = is_string($dirty);
if($stringTest === false && $ignoreNonStrings === true) {
return $dirty;
}

return $this->purifier->purify($dirty, $configObject);
Expand Down
14 changes: 11 additions & 3 deletions tests/PurifierTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ public function testCleaningNullPassThru() {
$purifier = new Purifier(new Filesystem(), $configRepo);

//test default config value is expected
$this->assertEquals(false, $configRepo->get('purifier.passThruNullValues'));
$this->assertEquals(false, $configRepo->get('purifier.ignoreNonStrings'));

//Test default behavior is unchanged without nullPassThru Config value of true
$html = null;
Expand All @@ -134,21 +134,25 @@ public function testCleaningNullPassThru() {
'bad'=>'<script>alert(\'XSS\');</script>',
'empty'=>null,
'bool'=>false,
'bool2'=>true,
'float'=>4.321,
];
$expectedHtml = [
'good'=>'<p><span>This is my H1 title</span></p>',
'bad'=>'',
'empty'=>'',
'bool'=>'',
'bool2'=>'<p>1</p>',
'float'=>'<p>4.321</p>'
];
$pureHtml = $purifier->clean($html);
$this->assertEquals($expectedHtml, $pureHtml);


//Test behavior as expected with nullPassThru Config value of true
$configRepo->set('purifier.passThruNullValues', true);
$configRepo->set('purifier.ignoreNonStrings', true);
$purifier = new Purifier(new Filesystem(), $configRepo);
$this->assertEquals(true, $configRepo->get('purifier.passThruNullValues'));
$this->assertEquals(true, $configRepo->get('purifier.ignoreNonStrings'));

$html = null;
$pureHtml = $purifier->clean($html);
Expand All @@ -164,13 +168,17 @@ public function testCleaningNullPassThru() {
'empty'=>null,
'emptyStr'=>'',
'bool'=>false,
'bool2'=>true,
'float'=>4.321,
];
$expectedHtml = [
'good'=>'<p><span>This is my H1 title</span></p>',
'bad'=>'',
'empty'=>null,
'emptyStr'=>'',
'bool'=>false,
'bool2'=>true,
'float'=>4.321,
];
$pureHtml = $purifier->clean($html);
$this->assertEquals($expectedHtml, $pureHtml);
Expand Down

0 comments on commit 9f7d0cf

Please sign in to comment.