symfony · Neirda24 · Jan 1, 2023 · stof · Apr 4, 2023
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -2271,6 +2271,10 @@ private function addHtmlSanitizerSection(ArrayNodeDefinition $rootNode, callable
                                         ->info('Allows all static elements and attributes from the W3C Sanitizer API standard.')
                                         ->defaultFalse()
                                     ->end()
+                                    ->booleanNode('block_body_elements')
+                                        ->info('Blocks all static body elements and remove attributes.')
+                                        ->defaultFalse()
+                                    ->end()
                                     ->arrayNode('allow_elements')
                                         ->info('Configures the elements that the sanitizer should retain from the input. The element name is the key, the value is either a list of allowed attributes for this element or "*" to allow the default set of attributes (https://wicg.github.io/sanitizer-api/#default-configuration).')
                                         ->example(['i' => '*', 'a' => ['title'], 'span' => 'class'])

diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -2931,6 +2931,10 @@ private function registerHtmlSanitizerConfiguration(array $config, ContainerBuil
                 $def->addMethodCall('allowStaticElements', [], true);
             }
 
+            if ($sanitizerConfig['block_body_elements']) {
+                $def->addMethodCall('blockBodyElements', [], true);
+            }
+
             // Configures elements
             foreach ($sanitizerConfig['allow_elements'] as $element => $attributes) {
                 $def->addMethodCall('allowElement', [$element, $attributes], true);

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/html_sanitizer.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/html_sanitizer.php
@@ -5,6 +5,7 @@
     'html_sanitizer' => [
         'sanitizers' => [
             'custom' => [
+                'block_body_elements' => true,
                 'allow_safe_elements' => true,
                 'allow_static_elements' => true,
                 'allow_elements' => [

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/html_sanitizer.xml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/html_sanitizer.xml
@@ -8,6 +8,7 @@
     <config xmlns="http://symfony.com/schema/dic/symfony" http-method-override="false">
         <html-sanitizer>
             <sanitizer name="custom"
+                block-body-elements="true"
                 allow-safe-elements="true"
                 allow-static-elements="true"
                 force-https-urls="true"

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/html_sanitizer.yml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/html_sanitizer.yml
@@ -3,6 +3,7 @@ framework:
     html_sanitizer:
         sanitizers:
             custom:
+                block_body_elements: true
                 allow_safe_elements: true
                 allow_static_elements: true
                 allow_elements:

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTestCase.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTestCase.php
@@ -2175,6 +2175,7 @@ public function testHtmlSanitizer()
             [
                 ['allowSafeElements', [], true],
                 ['allowStaticElements', [], true],
+                ['blockBodyElements', [], true],
                 ['allowElement', ['iframe', 'src'], true],
                 ['allowElement', ['custom-tag', ['data-attr', 'data-attr-1']], true],
                 ['allowElement', ['custom-tag-2', '*'], true],

diff --git a/src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php b/src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php
@@ -151,6 +151,23 @@ public function allowSafeElements(): static
         return $clone;
     }
 
+    /**
+     * Blocks all static body elements and remove attributes.
+     *
+     * All scripts will be removed.
+     */
+    public function blockBodyElements(): static
+    {
+        $elements = array_keys(W3CReference::BODY_ELEMENTS);
+
+        $clone = clone $this;
+        foreach ($elements as $element) {
+            $clone = $clone->blockElement($element, '*');
+        }
+
+        return $clone;
+    }
+
     /**
      * Allows only a given list of schemes to be used in links href attributes.
      *

diff --git a/src/Symfony/Component/HtmlSanitizer/README.md b/src/Symfony/Component/HtmlSanitizer/README.md
@@ -14,6 +14,10 @@ use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
 // By default, an element not added to the allowed or blocked elements
 // will be dropped, including its children
 $config = (new HtmlSanitizerConfig())
+    // Blocks all static body elements and remove attributes.
+    // All scripts will be removed.
+    ->blockBodyElements()
+
     // Allow "safe" elements and attributes. All scripts will be removed
     // as well as other dangerous behaviors like CSS injection
     ->allowSafeElements()

diff --git a/src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerCustomTest.php b/src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerCustomTest.php
@@ -393,6 +393,18 @@ public function testAllowMediasRelative()
         );
     }
 
+    public function testBlockBodyElements()
+    {
+        $config = (new HtmlSanitizerConfig())
+            ->blockBodyElements()
+        ;
+
+        $this->assertSame(
+            'If you need help : Visit Symfony',
+            $this->sanitize($config, '<head><title>Hello World</title></head><body><p><span class="red" data-info="info">If you need help : </span><a href="https://symfony.com"/>Visit Symfony</a></p><script>prompt("test");</script></body>')
+        );
+    }
+
     public function testCustomAttributeSanitizer()
     {
         $config = (new HtmlSanitizerConfig())