10000 bug #48602 [HtmlSanitizer] Fix HtmlSanitizer default configuration be… · symfony/symfony@f14901e · GitHub
[go: up one dir, main page]
Skip to content

Commit f14901e

Browse files
nicolas-grekasnicolas-grekas
committed
bug #48602 [HtmlSanitizer] Fix HtmlSanitizer default configuration behavior for allowed schemes (Titouan Galopin)
This PR was merged into the 6.1 branch. Discussion ---------- [HtmlSanitizer] Fix HtmlSanitizer default configuration behavior for allowed schemes | Q | A | ------------- | --- | Branch? | 6.1 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #48556 | License | MIT | Doc PR | - This issue happened not in the component but in the default configuration behavior (array was passed instead of null). Commits ------- 93e5160 Fix HtmlSanitizer default configuration behavior for allowed schemes
2 parents 7ed7e92 + 93e5160 commit f14901e

File tree

3 files changed

+35
-2
lines changed

3 files changed

+35
-2
lines changed

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2738,10 +2738,14 @@ private function registerHtmlSanitizerConfiguration(array $config, ContainerBuil
27382738

27392739
// Settings
27402740
$def->addMethodCall('forceHttpsUrls', [$sanitizerConfig['force_https_urls']], true);
2741-
$def->addMethodCall('allowLinkSchemes', [$sanitizerConfig['allowed_link_schemes']], true);
2741+
if ($sanitizerConfig['allowed_link_schemes']) {
2742+
$def->addMethodCall('allowLinkSchemes', [$sanitizerConfig['allowed_link_schemes']], true);
2743+
}
27422744
$def->addMethodCall('allowLinkHosts', [$sanitizerConfig['allowed_link_hosts']], true);
27432745
$def->addMethodCall('allowRelativeLinks', [$sanitizerConfig['allow_relative_links']], true);
2744-
$def->addMethodCall('allowMediaSchemes', [$sanitizerConfig['allowed_media_schemes']], true);
2746+
if ($sanitizerConfig['allowed_media_schemes']) {
2747+
$def->addMethodCall('allowMediaSchemes', [$sanitizerConfig['allowed_media_schemes']], true);
2748+
}
27452749
$def->addMethodCall('allowMediaHosts', [$sanitizerConfig['allowed_media_hosts']], true);
27462750
$def->addMethodCall('allowRelativeMedias', [$sanitizerConfig['allow_relative_medias']], true);
27472751

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2140,7 +2140,9 @@ public function testHtmlSanitizerDefaultNullAllowedLinkMediaHost()
21402140

21412141
$calls = $container->getDefinition('html_sanitizer.config.custom_default')->getMethodCalls();
21422142
$this->assertContains(['allowLinkHosts', [null], true], $calls);
2143+
$this->assertContains(['allowRelativeLinks', [false], true], $calls);
21432144
$this->assertContains(['allowMediaHosts', [null], true], $calls);
2145+
$this->assertContains(['allowRelativeMedias', [false], true], $calls);
21442146
}
21452147

21462148
public function testHtmlSanitizerDefaultConfig()

‎src/Symfony/Component/HtmlSanitizer/Tests/TextSanitizer/UrlSanitizerTest.php‎

Lines changed: 27 additions & 0 deletions
< 63C5 td data-grid-cell-id="diff-ccb34e3556187cec9fcfc4791f30dfec37ef25adb1092a50fed15e090b28af18-47-70-1" data-selected="false" role="gridcell" style="background-color:var(--diffBlob-additionNum-bgColor, var(--diffBlob-addition-bgColor-num));text-align:center" tabindex="-1" valign="top" class="focusable-grid-cell diff-line-number position-relative left-side">70
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,33 @@ public function provideSanitize()
4545
'output' => null,
4646
];
4747

48+
yield [
49+
'input' => 'http://trusted.com/link.php',
50+
'allowedSchemes' => null,
51+
'allowedHosts' => null,
52+
'forceHttps' => false,
53+
'allowRelative' => false,
54+
'output' => 'http://trusted.com/link.php',
55+
];
56+
57+
yield [
58+
'input' => 'https://trusted.com/link.php',
59+
'allowedSchemes' => null,
60+
'allowedHosts' => null,
61+
'forceHttps' => false,
62+
'allowRelative' => false,
63+
'output' => 'https://trusted.com/link.php',
64+
];
65+
66+
yield [
67+
'input' => 'data:text/plain;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',
68+
'allowedSchemes' => null,
69+
'allowedHosts' => null,
+
'forceHttps' => false,
71+
'allowRelative' => false,
72+
'output' => 'data:text/plain;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',
73+
];
74+
4875
yield [
4976
'input' => 'https://trusted.com/link.php',
5077
'allowedSchemes' => ['https'],

0 commit comments

Comments
 (0)
0