Laravel 4 XSS 解决方案 HTMLPurifier for Laravel 4

The Problem

XSS 一直是 Web 开发安全里面的一个大话题, 更多信息请见这里 Xss(跨站)漏洞 . 

PHPHub 是个算是一个论坛软件, 由大量 UGC (User Generated Content) 驱动, 面临的 XSS 巨大的威胁, 使用 Markdown 来撰写内容, 减小了 XSS 的威胁, 但是, 像以下问题还是会出现: 

[some text](javascript:alert('xss'))

更详细的 Markdown 和 XSS 的信息请见这里 ->  Markdown and XSS . 

没有绝对的安全, 这里讨论的是怎么通过 HTMLPurifier for Laravel 4 来减小 XSS 的安全危害.

The Solution

HTMLPurifier

HTMLPurifier 本身就是一个独立的项目, 运用白名单的机制 (稍后看下 config 文件就知道了) 对文本信息进行 XSS 过滤. 

HTMLPurifier for Laravel 4

HTMLPurifier for Laravel 4 是对 HTMLPurifier 针对 Laravel 4 的一个封装. 

安装 HTMLPurifier for Laravel 4

在 composer.json 里的 require 节点下增加: 

"mews/purifier": "dev-master"

然后命令行运行: 

composer update

app/config/app.php 里 providers 数组添加以下

'Mews\Purifier\PurifierServiceProvider',

app/config/app.php 里 aliases 数组添加: 

'Purifier' => 'Mews\Purifier\Facades\Purifier',

配置 HTMLPurifier for Laravel 4

命令行下运行 

$ php artisan config:publish mews/purifier

打开 app/config/packages/mews/purifier/config.php , 默认的配置有以下: 

/*
 * This file is part of HTMLPurifier Bundle.
 * (c) 2012 Maxime Dizerens
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

return array(
    'encoding' => 'UTF-8',
    'finalize' => true,
    'preload'  => false,
    'settings' => array(
        'default' => array(
            'HTML.Doctype'             => 'XHTML 1.0 Strict',
            'HTML.Allowed'             => 'div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',
            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
            'AutoFormat.AutoParagraph' => true,
            'AutoFormat.RemoveEmpty'   => true,
        ),
    ),
);

这个时候就可以使用如下的调用进行过滤了

Purifier::clean(Input::get('inputname'));

扩展设置

为了方便扩展性, 我将 config 文件如以下: 

/*
 * This file is part of HTMLPurifier Bundle.
 * (c) 2012 Maxime Dizerens
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

return array(
    'encoding' => 'UTF-8',
    'finalize' => true,
    'preload'  => false,
    'settings' => array(
        'default' => array(
            'HTML.Doctype'             => 'XHTML 1.0 Strict',
            'HTML.Allowed'             => 'div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',
            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
            'AutoFormat.AutoParagraph' => true,
            'AutoFormat.RemoveEmpty'   => true,
        ),
        'user_topic_body' => array(
            'HTML.Doctype'             => 'XHTML 1.0 Strict',
            'HTML.Allowed'             => 'div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src],pre,code',
            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
            'AutoFormat.AutoParagraph' => true,
            'AutoFormat.RemoveEmpty'   => true,
        ),
    ),
);

注意到多了一个 user_topic_body 的节点, 这样的话, 我就可以针对性的调用, 如以下, 注意第二个传参: 

Purifier::clean($html_data, 'user_topic_body');

--- EOF ---

reference : https://phphub.org/topics/36