feature symfony#46335 [Form][FrameworkBundle][TwigBundle] Add Twig filter, form-type extension and improve service definitions for HtmlSanitizer (nicolas-grekas)

This PR was merged into the 6.1 branch. Discussion ---------- [Form][FrameworkBundle][TwigBundle] Add Twig filter, form-type extension and improve service definitions for HtmlSanitizer | Q | A | ------------- | --- | Branch? | 6.1 | Bug fix? | no | New feature? | yes | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - This PR borrows the twig filter and the form-type extension from https://github.com/tgalopin/html-sanitizer-bundle/ Given the form builder (the input), it allows doing: ```php $builder ->add('content', TextareaType::class, ['sanitize_html' => true]) ; ``` And on the template side (the output), it allows doing: ```jinja <div> {{ html|sanitize_html }} </div> ``` In order to be able to wire the corresponding services, I had to change the way html-sanitizer is wired by framework-bundle: What we need here is a default name that we can rely on. By making the default name configurable, the current way to configure html_sanitizer makes it hard for other bundles (twig-bundle here) to know what the default name is. Eg here I would have to make the bundle read the config settings of framework-bundle. I solved this issue by making the default name non-configurable - aka I'm creating a convention: the default name is "default", and this "default" sanitizer is the one aliased to the html_sanitizer service, or to the non-named autowiring alias. I'm submitting this PR to 6.1 because html-sanitizer is new. If we prefer merging this in 6.2, the updated service wiring must be merged into 6.1 at least. Commits ------- 0ea89e5 [FrameworkBundle][TwigBundle][Form] Add Twig filter, form-type extension and improve service definitions for HtmlSanitizer

Author: fabpot

src/Symfony/Bridge/Twig/Extension/HtmlSanitizerExtension.php

@@ -0,0 +1,40 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bridge\Twig\Extension;
+
+use Psr\Container\ContainerInterface;
+use Twig\Extension\AbstractExtension;
+use Twig\TwigFilter;
+
+/**
+ * @author Titouan Galopin <galopintitouan@gmail.com>
+ */
+final class HtmlSanitizerExtension extends AbstractExtension
+{
+ public function __construct(
+ private ContainerInterface $sanitizers,
+ private string $defaultSanitizer = 'default',
+ ) {
+ }
+
+ public function getFilters(): array
+ {
+ return [
+ new TwigFilter('sanitize_html', $this->sanitize(...), ['is_safe' => ['html']]),
+ ];
+ }
+
+ public function sanitize(string $html, string $sanitizer = null): string
+ {
+ return $this->sanitizers->get($sanitizer ?? $this->defaultSanitizer)->sanitize($html);
+ }
+}

src/Symfony/Bridge/Twig/Tests/Extension/HtmlSanitizerExtensionTest.php

@@ -0,0 +1,52 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bridge\Twig\Tests\Extension;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Bridge\Twig\Extension\HtmlSanitizerExtension;
+use Symfony\Component\DependencyInjection\ServiceLocator;
+use Symfony\Component\HtmlSanitizer\HtmlSanitizerInterface;
+use Twig\Environment;
+use Twig\Loader\ArrayLoader;
+
+class HtmlSanitizerExtensionTest extends TestCase
+{
+ public function testSanitizeHtml()
+ {
+ $loader = new ArrayLoader([
+ 'foo' => '{{ "foobar"|sanitize_html }}',
+ 'bar' => '{{ "foobar"|sanitize_html("bar") }}',
+ ]);
+
+ $twig = new Environment($loader, ['debug' => true, 'cache' => false, 'autoescape' => 'html', 'optimizations' => 0]);
+
+ $fooSanitizer = $this->createMock(HtmlSanitizerInterface::class);
+ $fooSanitizer->expects($this->once())
+ ->method('sanitize')
+ ->with('foobar')
+ ->willReturn('foo');
+
+ $barSanitizer = $this->createMock(HtmlSanitizerInterface::class);
+ $barSanitizer->expects($this->once())
+ ->method('sanitize')
+ ->with('foobar')
+ ->willReturn('bar');
+
+ $twig->addExtension(new HtmlSanitizerExtension(new ServiceLocator([
+ 'foo' => fn () => $fooSanitizer,
+ 'bar' => fn () => $barSanitizer,
+ ]), 'foo'));
+
+ $this->assertSame('foo', $twig->render('foo'));
+ $this->assertSame('bar', $twig->render('bar'));
+ }
+}

src/Symfony/Bridge/Twig/UndefinedCallableHandler.php

@@ -24,6 +24,7 @@ class UndefinedCallableHandler
  private const FILTER_COMPONENTS = [
  'humanize' => 'form',
  'trans' => 'translation',
+ 'sanitize_html' => 'html-sanitizer',
  'yaml_encode' => 'yaml',
  'yaml_dump' => 'yaml',
  ];
@@ -61,6 +62,7 @@ class UndefinedCallableHandler
  ];
 
  private const FULL_STACK_ENABLE = [
+ 'html-sanitizer' => 'enable "framework.html_sanitizer"',
  'form' => 'enable "framework.form"',
  'security-core' => 'add the "SecurityBundle"',
  'security-http' => 'add the "SecurityBundle"',

src/Symfony/Bridge/Twig/composer.json

@@ -28,6 +28,7 @@
  "symfony/dependency-injection": "^5.4|^6.0",
  "symfony/finder": "^5.4|^6.0",
  "symfony/form": "^6.1",
+ "symfony/html-sanitizer": "^6.1",
  "symfony/http-foundation": "^5.4|^6.0",
  "symfony/http-kernel": "^5.4|^6.0",
  "symfony/intl": "^5.4|^6.0",
@@ -65,6 +66,7 @@
  "symfony/finder": "",
  "symfony/asset": "For using the AssetExtension",
  "symfony/form": "For using the FormExtension",
+ "symfony/html-sanitizer": "For using the HtmlSanitizerExtension",
  "symfony/http-kernel": "For using the HttpKernelExtension",
  "symfony/routing": "For using the RoutingExtension",
  "symfony/translation": "For using the TranslationExtension",

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Compiler/UnusedTagsPass.php

@@ -49,6 +49,7 @@ class UnusedTagsPass implements CompilerPassInterface
  'form.type',
  'form.type_extension',
  'form.type_guesser',
+ 'html_sanitizer',
  'http_client.client',
  'kernel.cache_clearer',
  'kernel.cache_warmer',

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

@@ -2129,10 +2129,6 @@ private function addHtmlSanitizerSection(ArrayNodeDefinition $rootNode, callable
  ->{$enableIfStandalone('symfony/html-sanitizer', HtmlSanitizerInterface::class)}()
  ->fixXmlConfig('sanitizer')
  ->children()
- ->scalarNode('default')
- ->defaultNull()
- ->info('Default sanitizer to use when injecting without named binding.')
- ->end()
  ->arrayNode('sanitizers')
  ->useAttributeAsKey('name')
  ->arrayPrototype()

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

@@ -69,6 +69,7 @@
 use Symfony\Component\ExpressionLanguage\ExpressionLanguage;
 use Symfony\Component\Finder\Finder;
 use Symfony\Component\Form\ChoiceList\Factory\CachingFactoryDecorator;
+use Symfony\Component\Form\Extension\HtmlSanitizer\Type\TextTypeHtmlSanitizerExtension;
 use Symfony\Component\Form\Form;
 use Symfony\Component\Form\FormTypeExtensionInterface;
 use Symfony\Component\Form\FormTypeGuesserInterface;
@@ -485,6 +486,9 @@ public function load(array $configs, ContainerBuilder $container)
  $container->removeDefinition('form.type_extension.form.validator');
  $container->removeDefinition('form.type_guesser.validator');
  }
+ if (!$this->isConfigEnabled($container, $config['html_sanitizer']) || !class_exists(TextTypeHtmlSanitizerExtension::class)) {
+ $container->removeDefinition('form.type_extension.form.html_sanitizer');
+ }
  } else {
  $container->removeDefinition('console.command.form_debug');
  }
@@ -2740,13 +2744,14 @@ private function registerHtmlSanitizerConfiguration(array $config, ContainerBuil
 
  // Create the sanitizer and link its config
  $sanitizerId = 'html_sanitizer.sanitizer.'.$sanitizerName;
- $container->register($sanitizerId, HtmlSanitizer::class)->addArgument(new Reference($configId));
+ $container->register($sanitizerId, HtmlSanitizer::class)
+ ->addTag('html_sanitizer', ['sanitizer' => $sanitizerName])
+ ->addArgument(new Reference($configId));
 
- $container->registerAliasForArgument($sanitizerId, HtmlSanitizerInterface::class, $sanitizerName);
+ if ('default' !== $sanitizerName) {
+ $container->registerAliasForArgument($sanitizerId, HtmlSanitizerInterface::class, $sanitizerName);
+ }
  }
-
- $default = $config['default'] ? 'html_sanitizer.sanitizer.'.$config['default'] : 'html_sanitizer';
- $container->setAlias(HtmlSanitizerInterface::class, new Reference($default));
  }
 
  private function resolveTrustedHeaders(array $headers): int

src/Symfony/Bundle/FrameworkBundle/Resources/config/form.php

@@ -19,8 +19,10 @@
 use Symfony\Component\Form\Extension\Core\Type\FileType;
 use Symfony\Component\Form\Extension\Core\Type\FormType;
 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\Extension\Core\Type\TransformationFailureExtension;
 use Symfony\Component\Form\Extension\DependencyInjection\DependencyInjectionExtension;
+use Symfony\Component\Form\Extension\HtmlSanitizer\Type\TextTypeHtmlSanitizerExtension;
 use Symfony\Component\Form\Extension\HttpFoundation\HttpFoundationRequestHandler;
 use Symfony\Component\Form\Extension\HttpFoundation\Type\FormTypeHttpFoundationExtension;
 use Symfony\Component\Form\Extension\Validator\Type\FormTypeValidatorExtension;
@@ -113,6 +115,10 @@
  ->args([service('translator')->ignoreOnInvalid()])
  ->tag('form.type_extension', ['extended-type' => FormType::class])
 
+ ->set('form.type_extension.form.html_sanitizer', TextTypeHtmlSanitizerExtension::class)
+ ->args([tagged_locator('html_sanitizer', 'sanitizer')])
+ ->tag('form.type_extension', ['extended-type' => TextType::class])
+
  ->set('form.type_extension.form.http_foundation', FormTypeHttpFoundationExtension::class)
  ->args([service('form.type_extension.form.request_handler')])
  ->tag('form.type_extension')

src/Symfony/Bundle/FrameworkBundle/Resources/config/html_sanitizer.php

@@ -13,13 +13,18 @@
 
 use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
 use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;
+use Symfony\Component\HtmlSanitizer\HtmlSanitizerInterface;
 
 return static function (ContainerConfigurator $container) {
  $container->services()
- ->set('html_sanitizer.config', HtmlSanitizerConfig::class)
+ ->set('html_sanitizer.config.default', HtmlSanitizerConfig::class)
  ->call('allowSafeElements')
 
- ->set('html_sanitizer', HtmlSanitizer::class)
+ ->set('html_sanitizer.sanitizer.default', HtmlSanitizer::class)
  ->args([service('html_sanitizer.config')])
+ ->tag('html_sanitizer', ['name' => 'default'])
+
+ ->alias('html_sanitizer', 'html_sanitizer.sanitizer.default')
+ ->alias(HtmlSanitizerInterface::class, 'html_sanitizer')
  ;
 };

src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd

@@ -826,7 +826,6 @@
  <xsd:element name="sanitizer" type="sanitizer" minOccurs="0" maxOccurs="unbounded" />
  </xsd:sequence>
  <xsd:attribute name="enabled" type="xsd:boolean" />
- <xsd:attribute name="default" type="xsd:string" />
  </xsd:complexType>
 
  <xsd:complexType name="sanitizer">