Add extra validation for text output

Mr-Kaos · Mr-Kaos · commit 1846728119d1 · 2025-10-26T18:38:46.000+11:00
diff --git a/site/private_core/controller/APIController.php b/site/private_core/controller/APIController.php
@@ -7,12 +7,14 @@
 require_once('Controller.php');
 require_once('private_core/model/APIModel.php');
 require_once('private_core/objects/IAsyncHandler.php');
+require_once('private_core/objects/DataValidators.php');
 
 /**
  * @property \RipDB\Model\APIModel $model
  */
 class APIController extends Controller implements \RipDB\Objects\IAsyncHandler
 {
+	use \RipDB\DataValidator;
 	public function __construct(string $page)
 	{
 		parent::__construct($page, new m\APIModel());
@@ -101,6 +103,7 @@ private function dropdownSearch($method): array
 				$result = $this->model->getRecords('Rips', 'RipID', 'RipName', $search, $rand);
 				break;
 		}
+		$this->cleanseDatabaseDataForOutput($result);
 		return $result;
 	}
 }
diff --git a/site/private_core/controller/ChannelController.php b/site/private_core/controller/ChannelController.php
@@ -43,6 +43,7 @@ public function performRequest(array $data = []): void
 					$_GET['search'] ?? null,
 				);
 
+				$this->cleanseDatabaseDataForOutput($records);
 				$this->setData('results', $records);
 
 				// Pagination values
@@ -67,6 +68,7 @@ public function performRequest(array $data = []): void
 					\Flight::redirect('/channels');
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($channel);
 				$this->setData('channel', $channel);
 				break;
 		}
diff --git a/site/private_core/controller/ComposerController.php b/site/private_core/controller/ComposerController.php
@@ -43,6 +43,7 @@ public function performRequest(array $data = []): void
 					$_GET['search'] ?? null,
 				);
 
+				$this->cleanseDatabaseDataForOutput($composers);
 				$this->setData('results', $composers);
 
 				// Pagination values
@@ -67,6 +68,8 @@ public function performRequest(array $data = []): void
 					\RipDB\addNotification('The specified composer does not exist.', \RipDB\NotificationPriority::Warning);
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($composer);
+
 				$this->setData('composer', $composer);
 
 				break;
diff --git a/site/private_core/controller/GameController.php b/site/private_core/controller/GameController.php
@@ -43,6 +43,7 @@ public function performRequest(array $data = []): void
 					$_GET['search'] ?? null,
 				);
 
+				$this->cleanseDatabaseDataForOutput($records);
 				$this->setData('results', $records);
 
 				// Pagination values
@@ -67,6 +68,7 @@ public function performRequest(array $data = []): void
 					\Flight::redirect('/games');
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($game);
 				$this->setData('game', $game);
 				break;
 		}
diff --git a/site/private_core/controller/JokeController.php b/site/private_core/controller/JokeController.php
@@ -47,6 +47,7 @@ public function performRequest(array $data = []): void
 					$_GET['metajokes'] ?? [],
 				);
 
+				$this->cleanseDatabaseDataForOutput($jokes);
 				$this->setData('results', $jokes);
 
 				// Pagination values
@@ -84,6 +85,8 @@ public function performRequest(array $data = []): void
 					\Flight::redirect('/jokes');
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($joke);
+
 				$this->setData('joke', $joke);
 				break;
 		}
diff --git a/site/private_core/controller/MetaController.php b/site/private_core/controller/MetaController.php
@@ -45,6 +45,7 @@ public function performRequest(array $data = []): void
 					$_GET['metas'] ?? [],
 				);
 
+				$this->cleanseDatabaseDataForOutput($records);
 				$this->setData('results', $records);
 
 				// Pagination values
@@ -80,6 +81,7 @@ public function performRequest(array $data = []): void
 					\Flight::redirect('/meta-jokes');
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($meta);
 				$this->setData('meta', $meta);
 				break;
 		}
diff --git a/site/private_core/controller/MetaJokeController.php b/site/private_core/controller/MetaJokeController.php
@@ -45,6 +45,7 @@ public function performRequest(array $data = []): void
 					$_GET['metas'] ?? [],
 				);
 
+				$this->cleanseDatabaseDataForOutput($records);
 				$this->setData('results', $records);
 
 				// Pagination values
@@ -80,6 +81,7 @@ public function performRequest(array $data = []): void
 					\Flight::redirect('/meta-jokes');
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($metaJoke);
 				$this->setData('metaJoke', $metaJoke);
 				break;
 		}
diff --git a/site/private_core/controller/PlatformController.php b/site/private_core/controller/PlatformController.php
@@ -43,6 +43,7 @@ public function performRequest(array $data = []): void
 					$_GET['search'] ?? null,
 				);
 
+				$this->cleanseDatabaseDataForOutput($platforms);
 				$this->setData('results', $platforms);
 
 				// Pagination values
@@ -67,6 +68,8 @@ public function performRequest(array $data = []): void
 					\RipDB\addNotification('The specified platform does not exist.', \RipDB\NotificationPriority::Warning);
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($platform);
+
 				$this->setData('platform', $platform);
 				break;
 		}
@@ -95,7 +98,7 @@ public function validateRequest(?array $extraData = null): array|string
 				$result = [new \RipDB\Error('Invalid form submission.')];
 				break;
 		}
-		
+
 		return $result;
 	}
 }
diff --git a/site/private_core/controller/PlaylistController.php b/site/private_core/controller/PlaylistController.php
@@ -38,7 +38,7 @@ public function performRequest(array $data = []): void
 				$id = $data['id'] ?? null;
 				if (!empty($id) && is_numeric($id)) {
 					$playlist = $this->model->getPlaylist($id);
-					
+
 					// If the playlist is not public, check if the user viewing it is the owner
 					if (($playlist['IsPublic'] == 0 && $playlist['Creator'] == $_SESSION[\RipDB\AUTH_USER]) || $playlist['IsPublic'] == 1) {
 						$this->setData('playlist', $playlist);
@@ -64,6 +64,7 @@ public function get(string $method, ?string $methodGroup = null): mixed
 					if (empty($result)) {
 						$result = 'The specified playlist does not exist.';
 					}
+					$this->cleanseDatabaseDataForOutput($result);
 				} else {
 					$result = 'You must be logged in to edit a playlist.';
 				}
@@ -176,7 +177,7 @@ public function validateRequest(?array $extraData = null): array|string
 					$validated['AccountID'] = $_SESSION[AUTH_USER];
 
 					$result = $this->submitRequest($validated, 'usp_DeletePlaylist', '', 'Playlists successfully deleted!');
-				}else {
+				} else {
 					$result = [new \RipDB\Error('The playlist does not exist.')];
 				}
 
diff --git a/site/private_core/controller/RipController.php b/site/private_core/controller/RipController.php
@@ -48,6 +48,7 @@ public function performRequest(array $data = []): void
 				$rips = [];
 				$offset = $this->getOffset($ripCount, '/rips');
 				$rips = $this->model->search($rowCount, $offset, $_GET['s'] ?? null, $_GET['search'] ?? null, $tags, $jokes, $games, $rippers, $genres, $metaJokes, $metas, $_GET['channel'] ?? null, $useAltName);
+				$this->cleanseDatabaseDataForOutput($rips);
 				$this->setData('results', $rips);
 
 				// Get search filters
@@ -111,6 +112,7 @@ public function performRequest(array $data = []): void
 						$this->setData('jokes', $this->sortJokesByTimestamp($rip['Jokes'] ?? []));
 					}
 
+					$this->cleanseDatabaseDataForOutput($rip);
 					$this->setData('rip', $rip);
 					$this->setData('hasWiki', $this->model->channelHasWiki($rip['RipChannel']));
 					if ($rip !== null) {
@@ -159,6 +161,7 @@ public function performRequest(array $data = []): void
 					}
 				}
 				$rip['Jokes'] = $temp;
+				$this->cleanseDatabaseDataForOutput($rip);
 				$this->setData('rip', $rip);
 			case 'rips/new':
 				$this->setData('rippers', $this->model->getRippers());
diff --git a/site/private_core/controller/RipperController.php b/site/private_core/controller/RipperController.php
@@ -67,6 +67,7 @@ public function performRequest(array $data = []): void
 					\Flight::redirect('/rippers');
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($ripper);
 				$this->setData('ripper', $ripper);
 				break;
 		}
diff --git a/site/private_core/controller/TagController.php b/site/private_core/controller/TagController.php
@@ -67,6 +67,7 @@ public function performRequest(array $data = []): void
 					\RipDB\addNotification('The specified tag does not exist.', \RipDB\NotificationPriority::Warning);
 					die();
 				}
+				$this->cleanseDatabaseDataForOutput($tag);
 				$this->setData('tag', $tag);
 
 				break;
diff --git a/site/private_core/objects/DataValidators.php b/site/private_core/objects/DataValidators.php
@@ -318,4 +318,19 @@ protected function validateFromList(string|array|null $value, array $list, strin
 
 		return $validated;
 	}
+
+	/**
+	 * Cleanses the given array to ensure it is safe for outputting to the client.
+	 * @param array $data the data from the database to cleanse.
+	 */
+	protected function cleanseDatabaseDataForOutput(array &$data): void
+	{
+		foreach ($data as &$var) {
+			if (is_array($var)) {
+				$this->cleanseDatabaseDataForOutput($var);
+			} else {
+				$var = htmlspecialchars($var);
+			}
+		}
+	}
 }
diff --git a/site/private_core/view/composers/edit.php b/site/private_core/view/composers/edit.php
@@ -1,5 +1,4 @@
 <?php
-
 use RipDB\Objects as o;
 ?>
 <main>
@@ -16,8 +15,8 @@
 		<fieldset>
 			<legend>Alternate Name Spelling</legend>
 			<p>Use this section for an alternate spelling of the composer's name, such as in their native language.</p>
-			<?= (new o\InputElement('First Name', o\InputTypes::text, ['name' => 'first-name-alt', 'maxlength' => 128, 'value' => $composer['ComposerFirstNameAlt']]))->buildElement() ?>
-			<?= (new o\InputElement('Last Name', o\InputTypes::text, ['name' => 'last-name-alt', 'maxlength' => 128, 'value' => $composer['ComposerLastNameAlt']]))->buildElement() ?>
+			<?= (new o\InputElement('First Name', o\InputTypes::text, ['name' => 'first-name-alt', 'maxlength' => 256, 'value' => $composer['ComposerFirstNameAlt']]))->buildElement() ?>
+			<?= (new o\InputElement('Last Name', o\InputTypes::text, ['name' => 'last-name-alt', 'maxlength' => 256, 'value' => $composer['ComposerLastNameAlt']]))->buildElement() ?>
 		</fieldset>
 		<button type="submit">Update Composer</button>
 	</form>

Original file line number	Diff line number	Diff line change
`@@ -7,12 +7,14 @@`
`7`	`7`	`require_once('Controller.php');`
`8`	`8`	`require_once('private_core/model/APIModel.php');`
`9`	`9`	`require_once('private_core/objects/IAsyncHandler.php');`
	`10`	`+require_once('private_core/objects/DataValidators.php');`
`10`	`11`
`11`	`12`	`/**`
`12`	`13`	`* @property \RipDB\Model\APIModel $model`
`13`	`14`	`*/`
`14`	`15`	`class APIController extends Controller implements \RipDB\Objects\IAsyncHandler`
`15`	`16`	`{`
	`17`	`+ use \RipDB\DataValidator;`
`16`	`18`	`public function __construct(string $page)`
`17`	`19`	`{`
`18`	`20`	`parent::__construct($page, new m\APIModel());`
`@@ -101,6 +103,7 @@ private function dropdownSearch($method): array`
`101`	`103`	`$result = $this->model->getRecords('Rips', 'RipID', 'RipName', $search, $rand);`
`102`	`104`	`break;`
`103`	`105`	`}`
	`106`	`+ $this->cleanseDatabaseDataForOutput($result);`
`104`	`107`	`return $result;`
`105`	`108`	`}`
`106`	`109`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,7 @@ public function performRequest(array $data = []): void`
`43`	`43`	`$_GET['search'] ?? null,`
`44`	`44`	`);`
`45`	`45`
	`46`	`+ $this->cleanseDatabaseDataForOutput($records);`
`46`	`47`	`$this->setData('results', $records);`
`47`	`48`
`48`	`49`	`// Pagination values`
`@@ -67,6 +68,7 @@ public function performRequest(array $data = []): void`
`67`	`68`	`\Flight::redirect('/channels');`
`68`	`69`	`die();`
`69`	`70`	`}`
	`71`	`+ $this->cleanseDatabaseDataForOutput($channel);`
`70`	`72`	`$this->setData('channel', $channel);`
`71`	`73`	`break;`
`72`	`74`	`}`
Original file line number	Diff line number	Diff line change
`@@ -47,6 +47,7 @@ public function performRequest(array $data = []): void`
`47`	`47`	`$_GET['metajokes'] ?? [],`
`48`	`48`	`);`
`49`	`49`
	`50`	`+ $this->cleanseDatabaseDataForOutput($jokes);`
`50`	`51`	`$this->setData('results', $jokes);`
`51`	`52`
`52`	`53`	`// Pagination values`
`@@ -84,6 +85,8 @@ public function performRequest(array $data = []): void`
`84`	`85`	`\Flight::redirect('/jokes');`
`85`	`86`	`die();`
`86`	`87`	`}`
	`88`	`+ $this->cleanseDatabaseDataForOutput($joke);`
	`89`	`+`
`87`	`90`	`$this->setData('joke', $joke);`
`88`	`91`	`break;`
`89`	`92`	`}`
Original file line number	Diff line number	Diff line change
`@@ -45,6 +45,7 @@ public function performRequest(array $data = []): void`
`45`	`45`	`$_GET['metas'] ?? [],`
`46`	`46`	`);`
`47`	`47`
	`48`	`+ $this->cleanseDatabaseDataForOutput($records);`
`48`	`49`	`$this->setData('results', $records);`
`49`	`50`
`50`	`51`	`// Pagination values`
`@@ -80,6 +81,7 @@ public function performRequest(array $data = []): void`
`80`	`81`	`\Flight::redirect('/meta-jokes');`
`81`	`82`	`die();`
`82`	`83`	`}`
	`84`	`+ $this->cleanseDatabaseDataForOutput($meta);`
`83`	`85`	`$this->setData('meta', $meta);`
`84`	`86`	`break;`
`85`	`87`	`}`