[Validator] Add the DataUri constraint for validating Data URI content
#58201
Conversation
|
You may want to check |
|
@alexandre-daubois @nicolas-grekas Regading this comment #53360 (comment) : Can we consider that this constraint is validating a format from an RFC (RFC-2397). Otherwise we can close this PR then. |
| (?:;[\w\W]*?[^;])* # parameters | ||
| (;base64)? # encoding | ||
| , | ||
| [^$]+ # data |
There was a problem hiding this comment.
I don't think this is correct: the data part cannot be "anything-but-$"
Here is another regexp for your consideration:
{^data:
(?:([a-zA-Z]++/[-a-zA-Z0-9.+]++)?
(?:;[-a-zA-Z]++=[-a-zA-Z0-9.+]++)*+
(?:;?base64)?
,(?:[-a-zA-Z0-9!$&',()*+;=._~:@/?%\s]*+)
$}
There was a problem hiding this comment.
@nicolas-grekas thank you so much, I'll have a go...
There was a problem hiding this comment.
Note that I'm not sure my regexp is correct. I often see data URI with html tags in them and this wouldn't be allowed. Looks like carefully reading the RFC might be needed :)
|
My opinion on this PR: it's complex. Even validating only the format is difficult: what's allowed in the data part? looks like whole html documents are possible here, with just some special chars to be careful about (eh double quotes so that the data uri can be embeded in an html attribute). E.g. https://github.com/alchemy-fr/PHP-dataURI/blob/master/src/DataURI/Parser.php accepts any data here. And last but not least, we accept data URIs but we don't validate the content? This looks useless to me, nice vector for arbitrary data injection. One should validate that this is e.g an image. What would be useful is pairing this validator with other constraints that validate the content of the URI. |
|
@nicolas-grekas I understand your concerns. You are right, at the end this constraint will just be a static |
Purpose
Inspired by the Yaml constraint, I've added a new feature to the Validator component for validating DataUri (RFC-2397) content with a dedicated constraint.
Real world use case: Having an image content encoded in base64 within a database. With this new feature, you can validate the integrity of these data, ensuring the data Uri is valid.
Exemple