fa4893d064
The previous getSanitisedContent() method fell back to strip_tags() when HTMLPurifier was unavailable. This fallback was insecure as strip_tags() does not sanitise attributes, allowing XSS via onclick, onerror, and javascript: URLs. Changes: - Created Services/HtmlSanitiser.php using HTMLPurifier as the sole sanitiser - Added ezyang/htmlpurifier as a required dependency in composer.json - Added boot-time validation that throws RuntimeException if missing - Removed insecure strip_tags() fallback from ContentItem model - Added 30+ unit tests covering XSS attack vectors Closes SEC-002 from TODO.md Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
45 lines
1 KiB
JSON
45 lines
1 KiB
JSON
{
|
|
"name": "host-uk/core-content",
|
|
"description": "Content management and headless CMS for Laravel",
|
|
"keywords": ["laravel", "content", "cms", "headless"],
|
|
"license": "EUPL-1.2",
|
|
"require": {
|
|
"php": "^8.2",
|
|
"host-uk/core": "dev-main",
|
|
"ezyang/htmlpurifier": "^4.17"
|
|
},
|
|
"require-dev": {
|
|
"laravel/pint": "^1.18",
|
|
"orchestra/testbench": "^9.0|^10.0",
|
|
"pestphp/pest": "^3.0"
|
|
},
|
|
"autoload": {
|
|
"psr-4": {
|
|
"Core\\Mod\\Content\\": ""
|
|
}
|
|
},
|
|
"autoload-dev": {
|
|
"psr-4": {
|
|
"Core\\Mod\\Content\\Tests\\": "Tests/"
|
|
}
|
|
},
|
|
"extra": {
|
|
"laravel": {
|
|
"providers": [
|
|
"Core\\Mod\\Content\\Boot"
|
|
]
|
|
}
|
|
},
|
|
"scripts": {
|
|
"lint": "pint",
|
|
"test": "pest"
|
|
},
|
|
"config": {
|
|
"sort-packages": true,
|
|
"allow-plugins": {
|
|
"pestphp/pest-plugin": true
|
|
}
|
|
},
|
|
"minimum-stability": "dev",
|
|
"prefer-stable": true
|
|
}
|