Re: K3 Input library "replacement"

I'm willing to seriously consider HTMLPurifier but ye gods it's 335 files
and 2MB.  It also seems to drop a 92k serialized data structure into
var/tmp - but that's a performance issue not a space issue.

Is there some way we can get its file size down?
http://htmlpurifier.org/phorum/read.php?3,1099,2283 implies that there's a
standalone version that is just as efficient but in a single file?

http://htmlpurifier.org/download has the standalone version which has the
single PHP file, but it also seems to have another 142 support files?  Not
sure how "standalone" that is.

I don't have time to investigate - but I'm definitely in favor of a fast,
simple, easy and reliable solution here...


On Sun, Mar 31, 2013 at 2:45 PM, Shad Laws <shad-xpYdmXCiSuZWk0Htik3J/[email protected]> wrote:

> Hey gang,
>
> Disclaimer: I am not a XSS pro... those with more experience are
> encouraged to correct me as needed :-).
>
> So, K3 did away with the Input module, and finding a "replacement" is
> kinda tricky.  A bit of history:
>
> v2.x: Input library handled inputs and performed a regex-based XSS
> cleaning (see Input::xss_clean_default(), for which
> Security::xss_clean() was effectively an alias).
>
> v3.0: Input library removed in favor of handling $_GET/$_POST/$_COOKIE
> directly.  XSS cleaning moved to Security::xss_clean(), which can be
> used to more-or-less get the same results as the old 2.x Input
> library.
>
> v3.0.5: Security::xss_clean() deprecated due to its inability to
> reliably clean XSS.
>
> v3.1: Security::xss_clean() removed.
>
> Whereas Kohana didn't leave a ton of documentation/discussion on the
> topic, its sister framework CodeIgniter did.  The summary: "xss_clean
> doesn't."
> http://github.com/EllisLab/CodeIgniter/issues/1705
> http://github.com/EllisLab/CodeIgniter/issues/2066
>
> There are some great links and reading in the threads above, some with
> stronger opinions than others, but with a pretty consistent consensus:
> regex-based XSS cleaning is fundamentally flawed.  So, rather than
> ship Kohana with a faulty function, the Kohana team removed it
> entirely.
>
> The consensus also seems to be that HTMLPurifier is *the* way to go.
>
> So, it seems that we have a few options:
> - Put the same XSS filter we use in 3.0.x back into 3.1.x.  We have
> history and a track record with it, and it's small and quick, but we
> also have no external support and quite a few sites that say this is
> an increasingly bad idea.
> - Roll our own beefed-up, still small and quick (e.g. likely
> regex-based) XSS filter.  If this is the option, then someone else
> will need to jump in as I certainly don't have the expertise to do
> this well.
> - Include HTMLPurifier.  This is the most highly-recommended route to
> take, is *very* actively maintained, and is quite secure.  It also
> would eliminate the need for some modules to use $_REQUEST to get
> around the filtering (see email thread with Dave).  However, it would
> increase our package size and decrease our speed a little.
>
> My current feeling is that we should bite the bullet and go with the
> last option, as it seems to be the the option that is the most secure,
> the simplest to code up, the easiest to maintain, and the most
> future-proof.
>
> Thoughts?
>
> Take care,
> Shad
>
>
> ------------------------------------------------------------------------------
> Own the Future-Intel(R) Level Up Game Demo Contest 2013
> Rise to greatness in Intel's independent game demo contest. Compete
> for recognition, cash, and the chance to get your game on Steam.
> $5K grand prize plus 10 genre and skill prizes. Submit your demo
> by 6/6/13. http://altfarm.mediaplex.com/ad/ck/12124-176961-30367-2
> __[ g a l l e r y - d e v e l ]_________________________
>
> [ list info/archive --> http://gallery.sf.net/lists.php ]
> [ gallery info/FAQ/download --> http://gallery.sf.net ]
>
>

------------------------------------------------------------------------------
Own the Future-Intel&reg; Level Up Game Demo Contest 2013
Rise to greatness in Intel's independent game demo contest.
Compete for recognition, cash, and the chance to get your game 
on Steam. $5K grand prize plus 10 genre and skill prizes. 
Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d

__[ g a l l e r y - d e v e l ]_________________________

[ list info/archive --> http://gallery.sf.net/lists.php ]
[ gallery info/FAQ/download --> http://gallery.sf.net ]