Hi,

Recently, I worked with CodeIgniter's guys and we have added some changes in the CodeIgniter's xss_clean function. I found some bypasses and support has been added plus addition of some new naughty elements.

The details can be found here: https://github.com/EllisLab/CodeIgniter/issues/2667

Would you also please upgrade this Laravel-Security port? Thanks!

It won't save a copy pasted doc it just saves blank I have to convert to utf8 for it to save, thus stripping most of the formatting. Let me know if I could help any further.

This change allows definition of which attributes should be considered evil and which not.

You have to publish configuration file in order to customize tag list.

dear @GrahamCampbell i install package with composer , do it automatically add xss security in my app ? or need aditional work ? composer require graham-campbell/security

Hi Graham,

I've noticed that something seems to be broken with the parsing of % signs in text. I think this bug was introduced the last time you synced your package with codeIgniter.

Input: 100% received Expected: 100% received Actual: 100%received

Input: 100% better Expected: 100% better Actual: 100¾tter

It seems that because on line 103 spaces are removed from the input when a % sign is present in the string, 100% better => the urlDecodeSpaces method receives % be, and this gets converted to %be, and then converted by rawurldecode to ¾

I'm not sure what this part of the code is actually supposed to be doing so sadly I can't think of any way to fix it short of commenting it out.

Argument 1 passed to GrahamCampbellSecuritySecurity::process() must be of the type string, null given, called in /var/www/umb2b/vendor/graham-campbell/security/src/Security.php on line 82 The middleware Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull (Laravel 5.5) converts empty strings to NULL values. This forces you to define (sometimes messy) exceptions using Request::except() in order to use Security::*. Is there a need for the type-hint string in process()?

Symfony\Component\Debug\Exception\FatalErrorException …/­vendor/­graham-campbell/­security/­src/­GrahamCampbell/­Security/­Classes/­Security.php106

syntax error, unexpected ')'

php version: 5.4.17.

Please fix it .

PHP version: 8.0.9

Description If the project doesn't have a security config, false positives are happening in some cases. For example the string 'attribute1 <= 1 and attribute2 = 2' becomes 'attribute1 <= 1 and attribute2 '

How to reproduce If the project doesn't have a security config, then a value from vendor/graham-campbell/security/config/security.php:26 is used. A small example, which emulates this situation.

        $query = 'attribute1 <= 1 and attribute2 = 2';
        $security = Security::create([
            'attributes' => null,
            'tags'       => null,
        ]);
        $cleanQuery= $security->clean($query);

        var_dump(html_entity_decode($cleanQuery));  // string(31) "attribute1 <= 1 and attribute2 "
        var_dump($query === html_entity_decode($cleanQuery));  // bool(false)

Hi,

I don't understand how to use this package. i have installed, but i don't know where to use security facade, website link not working https://gjcampbell.co.uk/

Please guide me how to use this package.

Thanks,

• Update Travis conf to add tests for versions 7.1 and 7.2 of PHP
• Update README
• Update Laravel version in composer conf
• Update PHPUnit in composer conf to support 6.5 and 7.0

Hello Graham,

I am trying to use your class under php 5.4, but i see in the composer.json file that you require php 5.5

Is php 5.5 really necessary as requirement?

I cannot install the lib with php 5.4. It gives me the following error on composer install

  Problem 1
    - graham-campbell/security v3.1.0 requires php >=5.5.9 -> your PHP version (5.4.22) does not satisfy that requirement.
    - graham-campbell/security 3.1.x-dev requires php >=5.5.9 -> your PHP version (5.4.22) does not satisfy that requirement.
    - Installation request for graham-campbell/security ~3.1 -> satisfiable by graham-campbell/security[3.1.x-dev, v3.1.0].

I manually downloaded the Security.php file from https://github.com/GrahamCampbell/Laravel-Security/blob/master/src/Security.php and its working fine on php 5.4

If php 5.5 is not really required, can you reduce the version to 5.4, so i can include this as dependency in my composer.json

Cheers :)