fix(formatter): prevent stored XSS by disabling default HTML safety

Formatters no longer treat their output as HTML safe by default. This closes a stored XSS vector where unsanitized user input could inject script content.

Existing formatters must now explicitly implement isHtmlSafe() to return true *and* ensure proper escaping/sanitization before claiming safety.

BREAKING CHANGE: Default formatter behavior changed; outputs are now considered unsafe HTML unless explicitly marked safe. Audit custom formatter implementations.

Author: tuxes3

.github/workflows/ci.yaml

@@ -45,7 +45,7 @@ jobs:
                   SYMFONY_REQUIRE: ${{ matrix.symfony }}
               uses: ramsey/composer-install@v2
             - name: Run test suite on PHP ${{ matrix.php }} and Symfony ${{ matrix.symfony }}
-              run: vendor/bin/simple-phpunit
+              run: vendor/bin/phpunit
             - name: Run ECS
               run: vendor/bin/ecs
             - name: Run PHPStan

Makefile

@@ -35,6 +35,6 @@ phpstan:
 
 ## PHP Unit tests
 phpunit:
-	vendor/bin/simple-phpunit
+	vendor/bin/phpunit
 
 

composer.json

@@ -27,7 +27,6 @@
         "symfony/translation": "^6.4|^7.0",
         "symfony/form": "^6.4|^7.0",
         "symfony/stopwatch": "^6.4|^7.0",
-        "symfony/test-pack": "^1.1.0",
         "symfony/orm-pack": "^2.4.1"
     },
     "require-dev": {
@@ -38,7 +37,10 @@
         "doctrine/doctrine-bundle": "^2.5.5",
         "whatwedo/php-coding-standard": "^1.0",
         "symfony/twig-bundle": "^6.4|^7.0",
-        "phpstan/phpstan": "^1.7"
+        "phpstan/phpstan": "^1.7",
+        "phpunit/phpunit": "^10",
+        "symfony/test-pack": "^1.0",
+        "slevomat/coding-standard": "8.22.1"
     },
     "autoload": {
         "psr-4": {

src/Formatter/AbstractFormatter.php

@@ -8,6 +8,8 @@
 
 abstract class AbstractFormatter implements FormatterInterface
 {
+    public const OPT_HTML_SAFE = 'html_safe';
+
     /**
      * @var array<string, mixed>
      */
@@ -34,7 +36,18 @@ public function processOptions(array $options = []): void
         $this->options = $resolver->resolve($options);
     }
 
+    public function isHtmlSafe(): bool
+    {
+        return (bool) ($this->options[self::OPT_HTML_SAFE] ?? false);
+    }
+
+    protected function escapeHTML(string $value): string
+    {
+        return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+    }
+
     protected function configureOptions(OptionsResolver $resolver): void
     {
+        $resolver->setDefault(self::OPT_HTML_SAFE, false);
     }
 }

src/Formatter/BadgeFormatter.php

@@ -26,7 +26,7 @@ public function getHtml(mixed $value): string
     {
         $this->processOptions(($this->options[self::OPT_CONFIGURATION])($value, $this->options));
         return $this->twig->render($this->options[self::OPT_TEMPLATE], [
-            'value' => $this->getString($value),
+            'value' => $this->escapeHTML($this->getString($value)),
             'type' => $this->options[self::OPT_TYPE],
             'background_color_class' => $this->options[self::OPT_BACKGROUND_COLOR_CLASS],
             'background_color_hex' => $this->options[self::OPT_BACKGROUND_COLOR_HEX],
@@ -43,6 +43,7 @@ protected function configureOptions(OptionsResolver $resolver): void
             self::OPT_TYPE => 'neutral',
             self::OPT_LINK => null,
             self::OPT_CONFIGURATION => static fn (mixed $value, array $options): array => $options,
+            self::OPT_HTML_SAFE => true,
         ]);
         $resolver->setAllowedTypes(self::OPT_BACKGROUND_COLOR_CLASS, ['string', 'null']);
         $resolver->setAllowedTypes(self::OPT_BACKGROUND_COLOR_HEX, ['string', 'null']);

src/Formatter/CollectionFormatter.php

@@ -5,6 +5,7 @@
 namespace araise\CoreBundle\Formatter;
 
 use Doctrine\Common\Collections\Collection;
+use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class CollectionFormatter extends AbstractFormatter
 {
@@ -29,9 +30,15 @@ public function getHtml(mixed $value): string
         }
         $str = '<ul>';
         foreach ($value as $singleValue) {
-            $str .= '<li>'.$singleValue.'</li>';
+            $str .= '<li>'.$this->escapeHTML($singleValue).'</li>';
         }
 
         return $str.'</ul>';
     }
+
+    protected function configureOptions(OptionsResolver $resolver): void
+    {
+        parent::configureOptions($resolver);
+        $resolver->setDefault(self::OPT_HTML_SAFE, true);
+    }
 }

src/Formatter/EmailFormatter.php

@@ -27,9 +27,9 @@ public function getHtml(mixed $value): string
 
         return $value ? sprintf(
             '<a href="mailto:%s" title="%s">%s</a>',
-            $value,
-            $title,
-            $value
+            $this->escapeHTML($value),
+            $this->escapeHTML($title),
+            $this->escapeHTML($value)
         ) : '';
     }
 }

src/Formatter/Nl2brFormatter.php

@@ -4,6 +4,8 @@
 
 namespace araise\CoreBundle\Formatter;
 
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
 class Nl2brFormatter extends AbstractFormatter
 {
     public function getString(mixed $value): string
@@ -13,6 +15,12 @@ public function getString(mixed $value): string
 
     public function getHtml(mixed $value): string
     {
-        return nl2br($value);
+        return nl2br($this->escapeHTML($value));
+    }
+
+    protected function configureOptions(OptionsResolver $resolver): void
+    {
+        parent::configureOptions($resolver);
+        $resolver->setDefault(self::OPT_HTML_SAFE, true);
     }
 }

src/Formatter/TwigFormatter.php

@@ -57,5 +57,6 @@ protected function configureOptions(OptionsResolver $resolver): void
     {
         $resolver->setRequired(self::OPT_TEMPLATE);
         $resolver->setAllowedTypes(self::OPT_TEMPLATE, 'string');
+        $resolver->setDefault(self::OPT_HTML_SAFE, true);
     }
 }

src/Formatter/WysiwygFormatter.php

@@ -29,6 +29,8 @@
 
 namespace araise\CoreBundle\Formatter;
 
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
 class WysiwygFormatter extends AbstractFormatter
 {
     public function getString(mixed $value): string
@@ -42,4 +44,10 @@ public function getHtml(mixed $value): string
 
         return $value ? sprintf('<blockquote>%s</blockquote>', $value) : '';
     }
+
+    protected function configureOptions(OptionsResolver $resolver): void
+    {
+        parent::configureOptions($resolver);
+        $resolver->setDefault(self::OPT_HTML_SAFE, true);
+    }
 }