feature symfony#52166 [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document (lyrixx)

nicolas-grekas · nicolas-grekas · commit 5301b00c235e · 2023-10-19T17:00:06.000+02:00
This PR was merged into the 6.4 branch. Discussion ---------- [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | no | New feature? | yes | Deprecations? | no | Tickets | | License | MIT  Commits ------- 738450f [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document
diff --git a/src/Symfony/Component/HtmlSanitizer/CHANGELOG.md b/src/Symfony/Component/HtmlSanitizer/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+6.4
+---
+
+ * Add support for sanitizing unlimited length of HTML document
+
 6.1
 ---
 
diff --git a/src/Symfony/Component/HtmlSanitizer/HtmlSanitizer.php b/src/Symfony/Component/HtmlSanitizer/HtmlSanitizer.php
@@ -60,7 +60,7 @@ private function sanitizeWithContext(string $context, string $input): string
         $this->domVisitors[$context] ??= $this->createDomVisitorForContext($context);
 
         // Prevent DOS attack induced by extremely long HTML strings
-        if (\strlen($input) > $this->config->getMaxInputLength()) {
+        if (-1 !== $this->config->getMaxInputLength() && \strlen($input) > $this->config->getMaxInputLength()) {
             $input = substr($input, 0, $this->config->getMaxInputLength());
         }
 
diff --git a/src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php b/src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php
@@ -405,8 +405,16 @@ public function withoutAttributeSanitizer(AttributeSanitizerInterface $sanitizer
         return $clone;
     }
 
+    /**
+     * @param int $maxInputLength The maximum length of the input string in bytes
+     *                            -1 means no limit
+     */
     public function withMaxInputLength(int $maxInputLength): static
     {
+        if ($maxInputLength < -1) {
+            throw new \InvalidArgumentException(sprintf('The maximum input length must be greater than -1, "%d" given.', $maxInputLength));
+        }
+
         $clone = clone $this;
         $clone->maxInputLength = $maxInputLength;
 
diff --git a/src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerAllTest.php b/src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerAllTest.php
@@ -561,4 +561,15 @@ public static function provideSanitizeBody()
             yield $case[0] => $case;
         }
     }
+
+    public function testUnlimitedLength()
+    {
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));
+
+        $input = str_repeat('a', 10_000_000);
+
+        $sanitized = $sanitizer->sanitize($input);
+
+        $this->assertSame(\strlen($input), \strlen($sanitized));
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,7 @@ private function sanitizeWithContext(string $context, string $input): string`
`60`	`60`	`$this->domVisitors[$context] ??= $this->createDomVisitorForContext($context);`
`61`	`61`
`62`	`62`	`// Prevent DOS attack induced by extremely long HTML strings`
`63`		`- if (\strlen($input) > $this->config->getMaxInputLength()) {`
	`63`	`+ if (-1 !== $this->config->getMaxInputLength() && \strlen($input) > $this->config->getMaxInputLength()) {`
`64`	`64`	`$input = substr($input, 0, $this->config->getMaxInputLength());`
`65`	`65`	`}`
`66`	`66`
Original file line number	Diff line number	Diff line change
`@@ -561,4 +561,15 @@ public static function provideSanitizeBody()`
`561`	`561`	`yield $case[0] => $case;`
`562`	`562`	`}`
`563`	`563`	`}`
	`564`	`+`
	`565`	`+ public function testUnlimitedLength()`
	`566`	`+ {`
	`567`	`+ $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));`
	`568`	`+`
	`569`	`+ $input = str_repeat('a', 10_000_000);`
	`570`	`+`
	`571`	`+ $sanitized = $sanitizer->sanitize($input);`
	`572`	`+`
	`573`	`+ $this->assertSame(\strlen($input), \strlen($sanitized));`
	`574`	`+ }`
`564`	`575`	`}`