Effiziente Dateifilterung in PHP mit Open-Source-Tools

composer require ezyang/htmlpurifier:^4.19

<?php
require_once 'vendor/autoload.php';

$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Allowed', 'p');
$purifier = new HTMLPurifier($config);

$dirty_html = '<script>alert("XSS Attack!");</script><p style="color: blue;" onclick="alert(\'another attack\')">This is safe content.</p>';
$clean_html = $purifier->purify($dirty_html);

echo $clean_html; // Outputs: <p>This is safe content.</p>
// The allowlist removes scripts, event handlers, and styles.
?>

<?php
require_once 'vendor/autoload.php';

$config = HTMLPurifier_Config::createDefault();

// Allow only specific HTML elements and attributes
$config->set('HTML.Allowed', 'p[style],b,i,em,strong,a[href|title],ul,ol,li,br');

// Ensure links open in a new tab and add rel="noopener noreferrer"
$config->set('HTML.TargetBlank', true);
$config->set('HTML.Nofollow', true); // Adds rel="nofollow"
$config->set('HTML.TargetNoreferrer', true); // Adds rel="noreferrer"
$config->set('HTML.TargetNoopener', true); // Adds rel="noopener"


// Allow specific CSS properties (e.g., text-align)
$config->set('CSS.AllowedProperties', 'text-align');

// Create custom definitions if needed (advanced)
// $def = $config->getHTMLDefinition(true);
// $def->addAttribute('a', 'data-custom', 'Text'); // Example: Allow a custom data attribute

$purifier = new HTMLPurifier($config);

$dirty_html = '<a href="http://example.com" onclick="badJs()" title="Example">Click Me</a><p style="text-align:center; color:red;">Centered text</p>';
$clean_html = $purifier->purify($dirty_html);

// Outputs something like:
// <a href="http://example.com" title="Example" target="_blank" rel="nofollow noopener noreferrer">Click Me</a><p style="text-align:center;">Centered text</p>
echo $clean_html;
?>

composer require respect/validation:^2.4

<?php
require_once 'vendor/autoload.php';
use Respect\Validation\Validator as v;
use Respect\Validation\Exceptions\NestedValidationException;

// Basic string validation
$username = 'johndoe123';
try {
    v::alnum()->noWhitespace()->length(3, 15)->assert($username);
    echo "Username is valid.\n";
} catch (NestedValidationException $exception) {
    echo "Username validation failed: " . $exception->getFullMessage() . "\n";
}

// Email validation
$email = 'invalid-email';
if (v::email()->validate($email)) {
    echo "Email is valid.\n";
} else {
    echo "Email is invalid.\n";
}

// Numeric validation with range
$age = 17;
if (v::numericVal()->positive()->between(18, 99)->validate($age)) {
    echo "Age is valid.\n";
} else {
    echo "Age is invalid (must be between 18 and 99).\n";
}

// Basic file property validation (checks if path exists and is a file)
$filePath = '/path/to/your/file.txt'; // Replace with an actual path for testing
if (v::file()->validate($filePath)) {
    echo "File path points to a file.\n";
} else {
    echo "File path is not a valid file.\n";
}

// More specific file validation (e.g., check extension, mimetype, size)
// Note: These often require checking properties from $_FILES in a web context
$allowedExtensions = ['jpg', 'png', 'gif'];
$fileExtension = 'jpg';
if (v::in($allowedExtensions)->validate($fileExtension)) {
    echo "File extension is allowed.\n";
}
?>

<?php
require_once 'vendor/autoload.php';
use Respect\Validation\Validator as v;
use Respect\Validation\Exceptions\NestedValidationException;

$userData = [
    'username' => 'john_doe',
    'email' => 'john@example.com',
    'age' => 28,
    'homepage' => 'invalid-url'
];

$userValidator = v::key('username', v::stringType()->length(3, 32))
                  ->key('email', v::email())
                  ->key('age', v::numericVal()->between(18, 99))
                  ->keyNested('homepage', v::url(), false); // 'false' makes homepage optional

try {
    $userValidator->assert($userData);
    echo "User data is valid!\n";
} catch (NestedValidationException $exception) {
    echo "User data validation failed:\n";
    // Get specific error messages
    print_r($exception->getMessages());
    /* Example Output:
    Array
    (
        [homepage] => "invalid-url" must be a valid URL
    )
    */
}
?>

composer require symfony/validator:^7.4 symfony/mime:^7.4

<?php
require_once 'vendor/autoload.php';

use Symfony\Component\Validator\Constraints as Assert;
use Symfony\Component\Validator\Validation;

class User
{
    #[Assert\NotBlank(message: "Username cannot be blank.")]
    #[Assert\Length(min: 3, max: 32, minMessage: "Username must be at least {{ limit }} characters long.")]
    private string $username = '';

    #[Assert\NotBlank]
    #[Assert\Email(message: "The email '{{ value }}' is not a valid email.")]
    private string $email = '';

    #[Assert\Range(min: 18, max: 99, notInRangeMessage: "Age must be between {{ min }} and {{ max }}.")]
    private ?int $age = null; // Use nullable type for optional fields

    // --- Getters and Setters ---
    public function getUsername(): string { return $this->username; }
    public function setUsername(string $username): void { $this->username = $username; }
    public function getEmail(): string { return $this->email; }
    public function setEmail(string $email): void { $this->email = $email; }
    public function getAge(): ?int { return $this->age; }
    public function setAge(?int $age): void { $this->age = $age; }
}

// Create validator instance
$validator = Validation::createValidatorBuilder()
    ->enableAttributeMapping()
    ->getValidator();

$user = new User();
$user->setUsername('jo'); // Too short
$user->setEmail('invalid-email');
$user->setAge(15); // Too young

$violations = $validator->validate($user);

if (count($violations) > 0) {
    echo "Validation failed:\n";
    foreach ($violations as $violation) {
        echo "- Property '{$violation->getPropertyPath()}': {$violation->getMessage()}\n";
    }
} else {
    echo "User object is valid!\n";
}
?>

<?php
require_once 'vendor/autoload.php';

use Symfony\Component\Validator\Constraints as Assert;
use Symfony\Component\Validator\Validation;

// Assume $file is an instance of UploadedFile from a request
// For standalone usage, you might validate SplFileInfo objects or paths directly
class Document
{
    #[Assert\File(
        maxSize: '5M', // 5 Megabytes
        mimeTypes: ['application/pdf', 'application/x-pdf'],
        mimeTypesMessage: 'Please upload a valid PDF document (max 5MB).'
    )]
    // In a real app, this would likely be an UploadedFile object or SplFileInfo
    public $file;
}

$validator = Validation::createValidatorBuilder()
    ->enableAttributeMapping()
    ->getValidator();

$doc = new Document();
// Simulate an invalid file (e.g., wrong type or too large)
// In a real scenario, you'd pass the actual UploadedFile object or SplFileInfo
// For demonstration, let's validate a path to a non-PDF file:
$doc->file = new \SplFileInfo(__FILE__); // Using this script file as an example

$violations = $validator->validate($doc);

if (count($violations) > 0) {
    echo "File validation failed:\n";
    foreach ($violations as $violation) {
        echo "- Property '{$violation->getPropertyPath()}': {$violation->getMessage()}\n";
    }
} else {
    echo "File is valid!\n";
}
?>

<?php
require_once 'vendor/autoload.php';
use Respect\Validation\Validator as v;
use Respect\Validation\Exceptions\NestedValidationException;

function validateUploadedFile(array $file): ?string {
    // Basic checks for upload errors and existence
    if (($file['error'] ?? null) !== UPLOAD_ERR_OK
        || !is_string($file['tmp_name'] ?? null)
        || !is_uploaded_file($file['tmp_name'])) {
        return null;
    }

    $validator = v::key('tmp_name', v::file()->readable());

    try {
        $validator->assert($file);
        v::intType()->positive()->max(5 * 1024 * 1024)->assert(filesize($file['tmp_name']));
        $mime = (new finfo(FILEINFO_MIME_TYPE))->file($file['tmp_name']);
        $extensions = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'image/gif' => 'gif'];
        return $extensions[$mime] ?? null;
    } catch (NestedValidationException $exception) {
        error_log('Invalid uploaded file properties');
        return null;
    } catch (\Throwable $e) {
        error_log('File validation failed');
        return null;
    }
}

// --- Example Usage ---
// Simulate a POST request with a file upload
// In a real script, you'd use $_FILES directly.
/*
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['upload'])) {
    $extension = validateUploadedFile($_FILES['upload']);
    if ($extension !== null) {
        // Provision this private directory outside the webroot, writable only by the app.
        $directory = '/var/lib/myapp/uploads';
        $safe_filename = bin2hex(random_bytes(16)) . '.' . $extension;
        $destination = $directory . '/' . $safe_filename;
        if (move_uploaded_file($_FILES['upload']['tmp_name'], $destination)) {
            echo 'File uploaded successfully.';
        } else {
            error_log("Failed to move uploaded file '{$_FILES['upload']['tmp_name']}' to '$destination'");
            echo "Error processing file upload.";
        }
    } else {
        echo "Invalid file upload detected.";
    }
} else {
     // Handle cases where the form wasn't submitted correctly or file wasn't uploaded
     // echo "No file uploaded or invalid request.";
}
*/
?>

<?php
require_once 'vendor/autoload.php';
use Respect\Validation\Validator as v;
use Respect\Validation\Exceptions\NestedValidationException;

// Setup HTML Purifier
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Allowed', 'p,b,i,em,strong,br'); // Allow only basic formatting
$purifier = new HTMLPurifier($config);

// Simulate POST data
$postData = [
    'username' => ' test_user ', // Contains extra whitespace
    'email' => 'test@example.com',
    'bio' => '<script>alert("bad")</script>This is a <strong>bio</strong> with <a href="#">link</a>.'
];

// Define validation rules
$validator = v::keySet(
    v::key('username', v::stringType()->alnum('_-')->noWhitespace()->length(3, 20)),
    v::key('email', v::email()),
    v::key('bio', v::stringType()->length(0, 500)) // Validate length before sanitizing
);

try {
    $postData['username'] = trim($postData['username']);
    // Validate the normalized input.
    $validator->assert($postData);

    // 2. Sanitize/Normalize data after validation passes
    $validatedData = [
        'username' => trim($postData['username']), // Trim whitespace
        'email' => $postData['email'], // Already validated format
        'bio' => $purifier->purify($postData['bio']) // Sanitize HTML
    ];

    // Store with prepared statements, and escape plain text when rendering it.
    echo "User data validated and sanitized successfully!\n";
    print_r($validatedData);
    // Example: $db->insert('users', $validatedData);

} catch (NestedValidationException $exception) {
    echo "Invalid user data:\n";
    // Log the detailed errors for debugging, show generic message to user
    error_log("Validation errors: " . $exception->getFullMessage());
}
?>

{
  "steps": {
    ":original": {
      "robot": "/upload/handle"
    },
    "filter_images": {
      "use": ":original",
      "robot": "/file/filter",
      "condition_type": "and",
      "accepts": [
        ["${file.mime}", "regex", "image"],
        ["${file.meta.width}", ">=", 100]
      ],
      "declines": [["${file.size}", ">", 10485760]]
    }
  }
}

{
  "accepts": "${file.meta.width > file.meta.height && file.size < 500000}"
}