-
-
Notifications
You must be signed in to change notification settings - Fork 8
Open
Description
Hi!
I'm really missing an option / configuration to enable some of the properties or tags. In current case I really need to enable inline style properties. Underlying voku/anti-xss has proper configuration options. For now I'm forced to overwrite middleware like this to get what I need:
<?php
namespace App\Http\Middleware;
use GrahamCampbell\SecurityCore\Security;
use ProtoneMedia\LaravelXssProtection\Cleaners\BladeEchoes;
use voku\helper\AntiXSS;
class XssCleanInput extends \ProtoneMedia\LaravelXssProtection\Middleware\XssCleanInput
{
public function __construct(BladeEchoes $bladeEchoCleaner)
{
$antiXss = new AntiXSS();
$replacement = config('xss-protection.anti_xss.replacement');
if ($replacement !== null) {
$antiXss->setReplacement($replacement);
}
$evil = config('xss-protection.anti_xss.evil');
if (isset($evil['attributes']) || isset($evil['tags'])) {
$antiXss->addEvilAttributes($evil['attributes'] ?? []);
$antiXss->addEvilHtmlTags($evil['tags'] ?? []);
} else {
$antiXss->addEvilAttributes($evil);
}
$antiXss->removeEvilAttributes(['style']); // All this to allow inline styles in input
$security = new Security($antiXss);
parent::__construct($security, $bladeEchoCleaner);
}
}I'm happy to prepare PR with appropriate changes in the library itself to handle config options. Or if you can prepare it I would really appreciate.
Metadata
Metadata
Assignees
Labels
No labels