Security Fix for Cross-site Scripting (XSS) - huntr.dev

app/Helpers/AuditLogHelper.php

@@ -31,17 +31,16 @@ public static function getCollectionOfAuditForSettings($logs): Collection
                         'logs.settings_log_'.$log->action.'_with_name_with_link',
                         [
                             'link' => '/people/'.$contact->hashId(),
-                            'name' => $contact->name,
+                            'name' => htmlentities($contact->name, ENT_QUOTES, 'utf-8'),
                         ]
                     );
                 } catch (ModelNotFoundException $e) {
                     // the contact doesn't exist anymore, we don't need a link, we'll only display a name
-                    $description = trans('logs.settings_log_'.$log->action.'_with_name', ['name' => $log->object->{'contact_name'}]);
+                    $description = trans('logs.settings_log_'.$log->action.'_with_name', ['name' =>  htmlentities($log->object->{'contact_name'}, ENT_QUOTES, 'utf-8')]);
                 }
             } else {
-                $description = trans('logs.settings_log_'.$log->action, ['name' => $log->object->{'name'}]);
+                $description = trans('logs.settings_log_'.$log->action, ['name' => htmlentities($log->object->{'name'}, ENT_QUOTES, 'utf-8')]);
             }
-
             $logsCollection->push([
                 'author_name' => ($log->author) ? $log->author->name : $log->author_name,
                 'description' => $description,

app/Http/Controllers/JournalController.php

@@ -160,7 +160,7 @@ public function save(Request $request)
 
         $entry = new Entry;
         $entry->account_id = $request->user()->account_id;
-        $entry->post = $request->input('entry');
+        $entry->post = htmlentities($request->input('entry'), ENT_QUOTES, 'utf-8');
 
         if ($request->input('title') != '') {
             $entry->title = $request->input('title');
@@ -206,7 +206,7 @@ public function update(Request $request, Entry $entry)
                 ->withErrors($validator);
         }
 
-        $entry->post = $request->input('entry');
+        $entry->post = htmlentities($request->input('entry'), ENT_QUOTES, 'utf-8');
 
         if ($request->input('title') != '') {
             $entry->title = $request->input('title');

app/Http/Kernel.php

@@ -19,6 +19,7 @@ class Kernel extends HttpKernel
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,
         \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
+        \App\Http\Middleware\SanitizeInput::class,
     ];
 
     /**

app/Http/Middleware/SanitizeInput.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\TransformsRequest as Middleware;
+
+class SanitizeInput extends Middleware
+{
+    /**
+     * Extends TransformsRequest to clean input from XSS
+     *
+     */
+    protected function transform($key, $value)
+    {
+        // Ignore excepted ones
+        if (in_array($key, $this->except, true)) {
+            return $value;
+        }
+
+        // Strip Html tags and encode missed ones
+        if (is_string($value) && $value !== '') {
+            $value = strip_tags($value);
+            $value = htmlentities($value, ENT_QUOTES, 'utf-8');
+        }
+        return $value;
+    }
+
+    /**
+     * The names of the attributes that should not be trimmed.
+     *
+     * @var array
+     */
+    protected $except = [
+        'password',
+        'password_confirmation',
+        '_token',
+        ''
+    ];
+
+}
+

resources/views/people/introductions/index.blade.php

@@ -13,7 +13,7 @@
       @if ($introducer = $contact->getIntroducer())
       <li>
         <i class="fa fa-sign-language"></i>
-        {!! trans('people.introductions_met_through', ['url' => route('people.show', $introducer), 'name' => $introducer->name]) !!}
+        {!! trans('people.introductions_met_through', ['url' => route('people.show', $introducer), 'name' => htmlentities($introducer->name, ENT_QUOTES, 'utf-8')]) !!}
       </li>
       @endif