Skip to content

Replace usage of FILTER_SANITIZE_STRING #5263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 1, 2021
Merged

Replace usage of FILTER_SANITIZE_STRING #5263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions system/HTTP/CLIRequest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,6 @@
use RuntimeException;

/**
* Class CLIRequest
*
* Represents a request from the command-line. Provides additional
* tools to interact with that request since CLI requests are not
* static like HTTP requests might be.
Expand Down Expand Up @@ -172,17 +170,17 @@ protected function parseCommand()
if ($optionValue) {
$optionValue = false;
} else {
$this->segments[] = filter_var($arg, FILTER_SANITIZE_STRING);
$this->segments[] = esc(strip_tags($arg));
}

continue;
}

$arg = filter_var(ltrim($arg, '-'), FILTER_SANITIZE_STRING);
$arg = esc(strip_tags(ltrim($arg, '-')));
$value = null;

if (isset($args[$i + 1]) && mb_strpos($args[$i + 1], '-') !== 0) {
$value = filter_var($args[$i + 1], FILTER_SANITIZE_STRING);
$value = esc(strip_tags($args[$i + 1]));
$optionValue = true;
}

Expand Down
12 changes: 3 additions & 9 deletions system/HTTP/CURLRequest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,7 @@
use InvalidArgumentException;

/**
* Class OutgoingRequest
*
* A lightweight HTTP client for sending synchronous HTTP requests
* via cURL.
* A lightweight HTTP client for sending synchronous HTTP requests via cURL.
*/
class CURLRequest extends Request
{
Expand Down Expand Up @@ -84,10 +81,7 @@ class CURLRequest extends Request
public function __construct(App $config, URI $uri, ?ResponseInterface $response = null, array $options = [])
{
if (! function_exists('curl_version')) {
// we won't see this during travis-CI
// @codeCoverageIgnoreStart
throw HTTPException::forMissingCurl();
// @codeCoverageIgnoreEnd
throw HTTPException::forMissingCurl(); // @codeCoverageIgnore
}

parent::__construct($config);
Expand All @@ -110,7 +104,7 @@ public function request($method, string $url, array $options = []): ResponseInte

$url = $this->prepareURL($url);

$method = filter_var($method, FILTER_SANITIZE_STRING);
$method = esc(strip_tags($method));

$this->send($method, $url);

Expand Down
8 changes: 4 additions & 4 deletions system/Router/RouteCollection.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,6 @@
use InvalidArgumentException;

/**
* Class RouteCollection
*
* @todo Implement nested resource routing (See CakePHP)
*/
class RouteCollection implements RouteCollectionInterface
Expand Down Expand Up @@ -663,10 +661,11 @@ public function resource(string $name, ?array $options = null): RouteCollectionI
// resources are sent to, we need to have a new name
// to store the values in.
$newName = implode('\\', array_map('ucfirst', explode('/', $name)));

// If a new controller is specified, then we replace the
// $name value with the name of the new controller.
if (isset($options['controller'])) {
$newName = ucfirst(filter_var($options['controller'], FILTER_SANITIZE_STRING));
$newName = ucfirst(esc(strip_tags($options['controller'])));
}

// In order to allow customization of allowed id values
Expand Down Expand Up @@ -756,10 +755,11 @@ public function presenter(string $name, ?array $options = null): RouteCollection
// resources are sent to, we need to have a new name
// to store the values in.
$newName = implode('\\', array_map('ucfirst', explode('/', $name)));

// If a new controller is specified, then we replace the
// $name value with the name of the new controller.
if (isset($options['controller'])) {
$newName = ucfirst(filter_var($options['controller'], FILTER_SANITIZE_STRING));
$newName = ucfirst(esc(strip_tags($options['controller'])));
}

// In order to allow customization of allowed id values
Expand Down