Security Helper

[lonnieezell]

This needs to be looked at in more detail, but is likely a port of the existing, while removing xss_clean.

Development Checklist:

• Component(s)
• ... with PHPdocs
• Unit testing
• ... with >80% coverage
• User guide updated
• Classmap integration?
• Securely signed commits
• Conforms to style guide

[prezire]

We seem to be missing a few methods in \CodeIgniter\Security\Security.php. Are these methods removed or moved somewhere?

• getRandomBytes()
• entityDecode()//??
• encodePHPTags()//??
• And the last one, xssClean(). This has a lot of features such as compactExplodedWords(), removeMaliciousAttributes(), sanitizeNaughtyHTML(), removeJSLink(), removeImageLink()

[lonnieezell]

The xss_clean functions are not being included since Zend/Escaper that we ship with the framework does a better, more thorough, job of handling xss protections. So some functions aren't included in that library because they were only used by the xss_clean functions.

• get_random_bytes is not needed because PHP7 has a crypotgraphically secure version of it natively now, in random_bytes().
• entity_decode seems redundant since it's primarily a copy of html_entity_decode.

[prezire]

Nice. Thanks for the infos.