Add URL sanitizer method

src/Toolbox/URL.php

@@ -0,0 +1,63 @@
+<?php
+
+/**
+ * ---------------------------------------------------------------------
+ *
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ *
+ * http://glpi-project.org
+ *
+ * @copyright 2015-2022 Teclib' and contributors.
+ * @copyright 2003-2014 by the INDEPNET Development Team.
+ * @licence   https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ---------------------------------------------------------------------
+ */
+
+namespace Glpi\Toolbox;
+
+final class URL
+{
+    /**
+     * Sanitize URL to prevent XSS.
+     * /!\ This method only prevent links on javascript scheme. To be sure that no XSS is possible, value have to be
+     * HTML encoded when it is printed in a HTML page.
+     *
+     * @param null|string $url
+     *
+     * @return string|null
+     */
+    final public static function sanitizeURL(?string $url): string
+    {
+        if ($url === null) {
+            return '';
+        }
+
+        $url = trim($url);
+
+        if (preg_match('/^javascript:/i', $url)) {
+            return '';
+        }
+
+        return $url;
+    }
+}

tests/units/Glpi/Toolbox/URL.php

@@ -0,0 +1,84 @@
+<?php
+
+/**
+ * ---------------------------------------------------------------------
+ *
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ *
+ * http://glpi-project.org
+ *
+ * @copyright 2015-2022 Teclib' and contributors.
+ * @copyright 2003-2014 by the INDEPNET Development Team.
+ * @licence   https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ---------------------------------------------------------------------
+ */
+
+namespace tests\units\Glpi\Toolbox;
+
+class URL extends \GLPITestCase
+{
+    protected function urlProvider(): iterable
+    {
+        yield [
+            'url'      => null,
+            'expected' => '',
+        ];
+        yield [
+            'url'      => '',
+            'expected' => '',
+        ];
+
+        // Javascript URL
+        yield [
+            'url'      => 'javascript:alert(1);',
+            'expected' => '',
+        ];
+        yield [
+            'url'      => 'jAvAscrIPt:alert(1);',
+            'expected' => '',
+        ];
+        yield [
+            'url'      => 'javascript:alert(1);" title="XSS!"',
+            'expected' => '',
+        ];
+
+        // Sane URL
+        yield [
+            'url'      => 'http://www.domain.tld/test',
+            'expected' => 'http://www.domain.tld/test',
+        ];
+        yield [
+            'url'      => '/test?abc=12',
+            'expected' => '/test?abc=12',
+        ];
+    }
+
+    /**
+     * @dataProvider urlProvider
+     */
+    public function testSanitizeURL(?string $url, string $expected): void
+    {
+        $this->newTestedInstance();
+        $this->string($this->testedInstance->sanitizeURL($url))->isEqualTo($expected);
+    }
+}