You are right, but after thought, the mess comes from the fact that I use stripHtml to strip both input search term and output results !
So for the next release I suggest the following updates:
1/ change the defaultStrip
Input to prevent js XSS by using htmlspecialChar and stripJsScript().
- $pgCharset could be ISO8859-1, UTF-8, cp1251 and some others. With an unknown page charset, ISO8859-1 will be used.
- we set double_encode (the last parameter of htmlspecialchars function) to false to avoid multiple encoding
- I add the use of the stripJsScript to strip js tags
function defaultStripInput($searchString, $pgCharset = 'UTF-8'){
if ($searchString !== ''){
// Remove escape characters
$searchString = stripslashes($searchString);
// Remove js tags
$searchString = stripJscripts($searchString);
// Remove modx sensitive tags
$searchString = stripTags($searchString);
// Strip HTML tags
$searchString = stripHtml($searchString);
// and finally prevent JS XSS
$searchString = htmlspecialchars($searchString, ENT_COMPAT, $pgCharset, False);
}
return $searchString;
}
2/ come back to a simpler stripHtml function to strip
output results
function stripHtml($text){
// remove HTML tags
return strip_tags($text);
}
