simplexss.php

См. документацию.

<?php
namespace Bitrix\Security\Filter\Auditor;

class SimpleXss extends Base
{
    protected $name = 'SIMPLE_XSS';
 
    private array $whiteList = array();

    public function process($value)
    {
        if (!preg_match('#[(){}\[\]=+&%<>]?#', $value))
            return false;
 
        $this->initializeFilters();
        $this->setFilteredValue('');
        $found = false;
 
        $targetValue = $value;
 
        $last = '';
        $current = $targetValue;
        while ($last != $current)
        {
            $last = $current;
            foreach ($this->filters as $searchChar => $filters)
            {
                if ($searchChar && mb_strpos($current, $searchChar) === false)
                    continue;
 
                $current = preg_replace($filters['search'], $filters['replace'], $current);
            }
        }
 
        if ($last != $targetValue)
        {
            $this->setFilteredValue($last);
            $found = true;
        }
 
        return $found;
    }
 
    protected function initializeWhiteList()
    {
        if (!$this->whiteList)
        {
            $this->whiteList = $this->getWhiteList();
        }
    }
 
    protected function getFilters()
    {
        $_M = '(?:[\x09\x0a\x0d\\\\]*)';
        $_M3 = '(?:[\x09\x0a\x0d\\\\\s]*)';
        $_M2 = '(?:(?:[\x09\x0a\x0d\\\\\s]|(?:\/\*.*?\*\/))*)';
 
        $_Al = '(?<![a-z0-9&_?-])';
 
        $_Jj = '(?:j|%[64]a|\\\\x[64]a|(?:\\\\0*[64]a))';
        $_Ja = '(?:a|%[64]1|\\\\x[64]1|(?:\\\\0*[64]1))';
        $_Jb = '(?:b|%[64]2|\\\\x[64]2|(?:\\\\0*[64]2))';
 
        $_Jv = '(?:v|%[75]6|\\\\x[75]6|(?:\\\\0*[75]6))';
        $_Js = '(?:s|%[75]3|\\\\x[75]3|(?:\\\\0*[75]3))';
        $_Jc = '(?:c|%[64]3|\\\\x[64]3|(?:\\\\0*[64]3))';
        $_Jr = '(?:r|%[75]2|\\\\x[75]2|(?:\\\\0*[75]2))';
        $_Ji = '(?:i|%[64]9|\\\\x[64]9|(?:\\\\0*[64]9))';
        $_Jp = '(?:p|%[75]0|\\\\x[75]0|(?:\\\\0*[75]0))';
        $_Jt = '(?:t|%[75]4|\\\\x[75]4|(?:\\\\0*[75]4))';
 
        $_Je = '(?:e|%[64]5|\\\\x[64]5|(?:\\\\0*[64]5))';
        $_Jx = '(?:x|%[75]8|\\\\x[75]8|(?:\\\\0*[75]8))';
        $_Jo = '(?:o|%[64]f|\\\\x[64]f|(?:\\\\0*[64]f))';
        $_Jn = '(?:n|%[64]e|\\\\x[64]e|(?:\\\\0*[64]e))';
 
        $_Jh = '(?:h|%[64]8|\\\\x[64]8|(?:\\\\0*[64]8))';
 
        $_Jdd = '(?:\\:|=|%3a|%3d|\\\\x3a|\\\\x3d|(?:\\\\0*3a)|(?:\\\\0*3d))';
        $_Jss = '(?:\\(|%28|\\\\x28|(?:\\\\0*28))';
 
        $_WS_OPT = '(?:[\\x00\\x09\\x0A\\x0B\\x0C\\x0D\\s\\\\]|\\xE2\\x80\\xA9)*'; //not modified
        $replacePattern = $this->getSplittingString(2);
        $filters = array(
            0 => array(
                'search' => array(
                    "/$_Al({$_Jb}{$_M}{$_Je}{$_M}{$_Jh}{$_M})({$_Ja}{$_M}{$_Jv}{$_M}{$_Ji}{$_M}{$_Jo}{$_M}{$_Jr}{$_WS_OPT}{$_Jdd})/is",
                    "/({$_Jj}{$_M3}{$_Ja}{$_M3}{$_Jv}{$_M3})({$_Ja}{$_M3}{$_Js}{$_M3}{$_Jc}{$_M3}{$_Jr}{$_M3}{$_Ji}{$_M3}{$_Jp}{$_M3}{$_Jt}{$_M3}{$_Jdd})/is",
                    "/({$_Jv}{$_M3}{$_Jb}{$_M3})({$_Js}{$_M3}{$_Jc}{$_M3}{$_Jr}{$_M3}{$_Ji}{$_M3}{$_Jp}{$_M3}{$_Jt}{$_M3}{$_Jdd})/is",
                    "/({$_Je}{$_M2}{$_Jx}{$_M2})({$_Jp}{$_M2}{$_Jr}{$_M2}{$_Je}{$_M2}{$_Js}{$_M2}{$_Js}{$_M2}{$_Ji}{$_M2}{$_Jo}{$_M2}{$_Jn}{$_M2}{$_Jss})/is",
                ),
                'replace' => $this->getSplittingString(2, " * ")
            ),
 
            "<" => array(
                'search' => array(
                    "/(<{$_M}s{$_M}c{$_M})(r{$_M}i{$_M}p{$_M}t)(?!\\w)/is",
                    "/(<{$_M}\\/{$_M}s{$_M}c{$_M})(r{$_M}i{$_M}p{$_M}t)/is",
                    "/(<{$_M}x{$_M}:{$_M}s{$_M}c{$_M})(r{$_M}i{$_M}p{$_M}t)(?!\\w)/is",
                    "/(<{$_M}a{$_M}p{$_M}p{$_M})(l{$_M}e{$_M}t)(?!\\w)/is",
                    "/(<{$_M}e{$_M}m{$_M}b)(e{$_M}d)(?!\\w)/is",
                    "/(<{$_M}f{$_M}r{$_M}a{$_M})(m{$_M}e)(?!\\w)/is",
                    "/(<{$_M}i{$_M}f{$_M}r{$_M})(a{$_M}m{$_M}e)(?!\\w)/is",
                    "/(<{$_M}f{$_M}o{$_M})(r{$_M}m)(?!\\w)/is",
                    "/(<{$_M}o{$_M}b{$_M})(j{$_M}e{$_M}c{$_M}t)(?!\\w)/is",
                    "/(<{$_M}i{$_M}s{$_M}i{$_M})(n{$_M}d{$_M}e{$_M}x)(?!\\w)/is",
                ),
                'replace' => $replacePattern
            ),
 
            "=" => array(
                'search' => array(
                    "/{$_Al}(f{$_M}o{$_M}r{$_M})(m{$_M}a{$_M}c{$_M}t{$_M}i{$_M}o{$_M}n{$_WS_OPT}=)/is",
                    "/{$_Al}(o{$_M}n{$_M}(?:[a-z]{$_M})*?)(([a-z]{$_M}){3}{$_WS_OPT}=)/is",
                    "/{$_Al}(s{$_M}e{$_M}e{$_M})(k{$_M}S{$_M}e{$_M}g{$_M}m{$_M}e{$_M}n{$_M}t{$_M}T{$_M}i{$_M}m{$_M}e{$_WS_OPT}=)/is",
                    "/{$_Al}(F{$_M}S{$_M}C{$_M})(o{$_M}m{$_M}m{$_M}a{$_M}n{$_M}d{$_WS_OPT}=)/is",
                ),
                'replace' => $replacePattern
            ),
 
            ":" => array(
                'search' => array(
                    "/(u{$_M}r{$_M}n{$_M2}:{$_M2}s{$_M})(c{$_M}h{$_M}e{$_M}m{$_M}a{$_M}s{$_M}-{$_M}m{$_M}i{$_M}c{$_M}r{$_M}o{$_M}s{$_M}o{$_M}f{$_M}t{$_M}-{$_M}c{$_M}o{$_M}m{$_M2}:)/",
                    "/((?:'|\"|=|:|;){$_M3}d{$_M}a{$_M}t{$_M})(a{$_M}:)(?![0-9]|image)/is",
                ),
                'replace' => $replacePattern
            ),
 
            "-" => array(
                'search' => array(
                    "/(-{$_M}m{$_M}o{$_M}z{$_M}-{$_M}b{$_M}i{$_M})(n{$_M}d{$_M}i{$_M}n{$_M}g{$_M}{$_WS_OPT}:{$_WS_OPT}{$_M}u{$_M}r{$_M}l)/is",
                ),
                'replace' => $replacePattern
            ),
 
        );
 
        return $filters;
    }
}