default modifiers に HTMLPurifier を適用する

nanasess · Nov 22, 2024 · f942d2b · f942d2b
1 parent 9f29fb7
commit f942d2b
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/data/smarty_extends/modifier.script_escape.php b/data/smarty_extends/modifier.script_escape.php
@@ -1,4 +1,5 @@
 <?php
+require_once __DIR__ . '/../vendor/ezyang/htmlpurifier/library/HTMLPurifier.auto.php';
 /**
  * Scriptタグをエスケープする
  *
@@ -50,5 +51,10 @@ function smarty_modifier_script_escape($value)
         $value = preg_replace($pattern, $convert, $value);
     }
 
-    return $value;
+    // 念のために HTMLPurifier でサニタイズ
+    $config = HTMLPurifier_Config::createDefault();
+    $config->set('Cache.SerializerPath', __DIR__ . '/../cache');
+    $purify = new HTMLPurifier($config);
+
+    return $purify->purify($value ?? '');
 }