business-decision/query-security-bundle

Symfony QuerySecurityBundle

1.0 2023-12-04 10:46 UTC

Requires

• symfony/dependency-injection: ^4.2|^5.0
• symfony/http-kernel: ^4.2|^5.0

Requires (Dev)

• phpunit/php-code-coverage: *
• phpunit/phpunit: *
• symfony/class-loader: ^3.4
• symfony/phpunit-bridge: *

MIT

• Alexande Magnier
• Sébastien Thibault
• Business&Decision

• security
• xss

README

WIP : Bundle

Instalation

Composer require

Configuration

File path : config/packages/query_security.yaml

parameters:
  # All Fields protection
  render_response_on_exception: true # render response instead of Exception (exception in kernel.request event are not catched)
  html_escaped: true # all field are passed to strip_tags function
  denied: ['<script>','javascript', 'http', '//']  # banned word in field value
  escaped: ['redirect']  ## word removed from value

  # per query parameters configuration
  parameters:
     fieldname:
        denied: ['<script>','javascript', 'http', '//']
        
        #Can be a static method or a function set in bootstrap.php
        validator: ['callbackFunctionName']

        #can access submit field if field is array
        subfield:
            html_escaped: false

## Todo

[ ] Better Configuration