フロント入力項目のサニタイズ

app/config/eccube/bundles.php

@@ -29,4 +29,5 @@
     Symfony\Bundle\MakerBundle\MakerBundle::class => ['dev' => true],
     SunCat\MobileDetectBundle\MobileDetectBundle::class => ['all' => true],
     Knp\Bundle\PaginatorBundle\KnpPaginatorBundle::class => ['all' => true],
+    Exercise\HTMLPurifierBundle\ExerciseHTMLPurifierBundle::class => ['all' => true],
 ];

app/config/eccube/services.yaml

@@ -201,3 +201,9 @@ services:
           - { name: mobile_detect.mobile_detector.default }
           - { name: mobile_detect.mobile_detector }
         public: true
+
+    Eccube\Form\Extension\HTMLPurifierTextTypeExtension:
+        arguments:
+            - '@Eccube\Request\Context'
+        tags:
+            - { name: form.type_extension, priority: -99, extended_type: Symfony\Component\Form\Extension\Core\Type\TextType }

composer.json

@@ -35,6 +35,7 @@
         "easycorp/easy-log-handler": "^1.0",
         "ec-cube/plugin-installer": "^2.0",
         "egulias/email-validator": "^2.1",
+        "exercise/htmlpurifier-bundle": "^3.1",
         "friendsofphp/php-cs-fixer": "^2.16",
         "guzzlehttp/guzzle": "^6.3",
         "knplabs/knp-paginator-bundle": "^2.7",

src/Eccube/Form/EventListener/HTMLPurifierListener.php

@@ -0,0 +1,37 @@
+<?php
+
+/*
+ * This file is part of EC-CUBE
+ *
+ * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
+ *
+ * http://www.ec-cube.co.jp/
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Eccube\Form\EventListener;
+
+
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+
+class HTMLPurifierListener implements EventSubscriberInterface
+{
+    /**
+     * @return array[]
+     */
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            FormEvents::PRE_SUBMIT => ['purifySubmittedData', /* as soon as possible */ 1000001],
+        ];
+    }
+
+    public function purifySubmittedData(FormEvent $event): void
+    {
+        $event->setData(str_replace(['<', '>', '&'], ['＜', '＞', '＆'], $event->getData()));
+    }
+}

src/Eccube/Form/Extension/HTMLPurifierTextTypeExtension.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+ * This file is part of EC-CUBE
+ *
+ * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
+ *
+ * http://www.ec-cube.co.jp/
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Eccube\Form\Extension;
+
+
+use Eccube\Form\EventListener\HTMLPurifierListener;
+use Eccube\Request\Context;
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+class HTMLPurifierTextTypeExtension extends AbstractTypeExtension
+{
+    /**
+     * @var Context
+     */
+    private $context;
+
+    public function __construct(Context $context)
+    {
+        $this->context = $context;
+    }
+
+    public function configureOptions(OptionsResolver $resolver)
+    {
+        if ($this->context->isFront()) {
+            $resolver->setDefault('purify_html', true);
+        }
+    }
+
+    /**
+     * @return string
+     */
+    public function getExtendedType(): string
+    {
+        return TextType::class;
+    }
+
+    /**
+     * @return iterable
+     */
+    public static function getExtendedTypes(): iterable
+    {
+        yield TextType::class;
+    }
+
+    public function buildForm(FormBuilderInterface $builder, array $options)
+    {
+        if ($options['purify_html']) {
+            $builder->addEventSubscriber(
+                new HTMLPurifierListener()
+            );
+        }
+    }
+}

symfony.lock

@@ -140,6 +140,18 @@
     "egulias/email-validator": {
         "version": "1.2.14"
     },
+    "exercise/htmlpurifier-bundle": {
+        "version": "3.0",
+        "recipe": {
+            "repo": "github.com/symfony/recipes-contrib",
+            "branch": "master",
+            "version": "3.0",
+            "ref": "4667fd2103dc4645d234591e1c85f727c6fe0d11"
+        }
+    },
+    "ezyang/htmlpurifier": {
+        "version": "v4.13.0"
+    },
     "friendsofphp/php-cs-fixer": {
         "version": "2.2",
         "recipe": {

tests/Eccube/Tests/Web/ContactControllerTest.php

@@ -125,12 +125,12 @@ public function testCompleteWithSanitize()
         $this->actual = $Message->getSubject();
         $this->verify();
 
-        $this->assertContains('＜Sanitize&＞', $Message->getBody(), 'テキストメールがサニタイズされている');
+        $this->assertContains('＜Sanitize＆＞', $Message->getBody(), 'テキストメールがサニタイズされている');
 
         $MultiPart = $Message->getChildren();
         foreach ($MultiPart as $Part) {
             if ($Part->getContentType() == 'text/html') {
-                $this->assertContains('<Sanitize&>', $Part->getBody(), 'HTMLメールがサニタイズされている');
+                $this->assertContains('＜Sanitize＆＞', $Part->getBody(), 'HTMLメールがサニタイズされている');
             }
         }
     }

tests/Eccube/Tests/Web/EntryControllerTest.php

@@ -190,12 +190,12 @@ public function testCompleteWithActivateWithMultipartSanitize()
         $this->actual = $Message->getSubject();
         $this->verify();
 
-        $this->assertContains('＜Sanitize&＞', $Message->getBody(), 'テキストメールがサニタイズされている');
+        $this->assertContains('＜Sanitize＆＞', $Message->getBody(), 'テキストメールがサニタイズされている');
 
         $MultiPart = $Message->getChildren();
         foreach ($MultiPart as $Part) {
             if ($Part->getContentType() == 'text/html') {
-                $this->assertContains('<Sanitize&>', $Part->getBody(), 'HTMLメールがサニタイズされている');
+                $this->assertContains('＜Sanitize＆＞', $Part->getBody(), 'HTMLメールがサニタイズされている');
             }
         }
     }
@@ -275,4 +275,38 @@ public function testActivateWithAbort()
         $this->actual = $this->client->getResponse()->getStatusCode();
         $this->verify();
     }
+
+    public function testConfirmWithDangerousText()
+    {
+        $formData = $this->createFormData();
+        $formData['company_name'] = '<script>alert()</script>';
+
+        $crawler = $this->client->request('POST',
+            $this->generateUrl('entry'),
+            [
+                'entry' => $formData,
+                'mode' => 'confirm',
+            ]
+        );
+
+        self::assertEquals('新規会員登録(確認)', $crawler->filter('.ec-pageHeader > h1')->text());
+        self::assertEquals('＜script＞alert()＜/script＞', $crawler->filter('#entry_company_name')->attr('value'));
+    }
+
+    public function testConfirmWithAmpersand()
+    {
+        $formData = $this->createFormData();
+        $formData['company_name'] = '&';
+
+        $crawler = $this->client->request('POST',
+            $this->generateUrl('entry'),
+            [
+                'entry' => $formData,
+                'mode' => 'confirm',
+            ]
+        );
+
+        self::assertEquals('新規会員登録(確認)', $crawler->filter('.ec-pageHeader > h1')->text());
+        self::assertEquals('＆', $crawler->filter('#entry_company_name')->attr('value'));
+    }
 }