Merge pull request #9156 from cakephp/strip-links

Make stripLinks a bit more thorough
cakephp · Jul 23, 2016 · ac06672 · ac06672
2 parents 5b0543e + 0bd9dc1
commit ac06672
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/src/Utility/Text.php b/src/Utility/Text.php
@@ -506,12 +506,20 @@ public static function highlight($text, $phrase, array $options = [])
     /**
      * Strips given text of all links (<a href=....).
      *
+     * *Warning* This method is not an robust solution in preventing XSS
+     * or malicious HTML.
+     *
      * @param string $text Text
      * @return string The text without links
+     * @deprecated 3.2.12 This method will be removed in 4.0.0
      */
     public static function stripLinks($text)
     {
-        return preg_replace('|<a\s+[^>]+>|im', '', preg_replace('|<\/a>|im', '', $text));
+        do {
+            $text = preg_replace('#</?a([/\s][^>]*)?(>|$)#i', '', $text, -1, $count);
+        } while ($count);
+
+        return $text;
     }
 
     /**

diff --git a/tests/TestCase/Utility/TextTest.php b/tests/TestCase/Utility/TextTest.php
@@ -809,6 +809,15 @@ public function testStripLinks()
         $expected = 'This <strong>is</strong> a test and <abbr>some</abbr> other text';
         $result = $this->Text->stripLinks($text);
         $this->assertEquals($expected, $result);
+
+        $text = '<a<a h> href=\'bla\'>test</a</a>>';
+        $this->assertEquals('test', $this->Text->stripLinks($text));
+
+        $text = '<a/href="#">test</a/>';
+        $this->assertEquals('test', $this->Text->stripLinks($text));
+
+        $text = '<a href="#"';
+        $this->assertEquals('', $this->Text->stripLinks($text));
     }
 
     /**