improved xss patterns

Author: denisdulici

src/Abstracts/Middleware.php

@@ -175,6 +175,8 @@ public function match($pattern, $input)
         }
 
         if (!is_array($input)) {
+            $input = $this->prepareInput($input);
+
             return preg_match($pattern, $input);
         }
 
@@ -191,6 +193,8 @@ public function match($pattern, $input)
                 continue;
             }
 
+            $value = $this->prepareInput($value);
+
             if (!$result = preg_match($pattern, $value)) {
                 continue;
             }
@@ -201,6 +205,11 @@ public function match($pattern, $input)
         return $result;
     }
 
+    public function prepareInput($value)
+    {
+        return $value;
+    }
+
     public function log()
     {
         $log = Log::create([

src/Config/firewall.php

@@ -374,11 +374,19 @@
 
             'inputs' => [
                 'only' => [], // i.e. 'first_name'
-                'except' => ['password', 'password_confirmation'], // i.e. 'password'
+                'except' => [], // i.e. 'password'
             ],
 
             'patterns' => [
-                '#<[^>]*\w*\"?[^>]*>#is',
+                // Evil starting attributes
+                '#(<[^>]+[\x00-\x20\"\'\/])(form|formaction|on\w*|style|xmlns|xlink:href)[^>]*>?#iUu',
+
+				// javascript:, livescript:, vbscript:, mocha: protocols
+				'!((java|live|vb)script|mocha|feed|data):(\w)*!iUu',
+                '#-moz-binding[\x00-\x20]*:#u',
+
+				// Unneeded tags
+				'#</*(applet|meta|xml|blink|link|style|script|embed|object|iframe|frame|frameset|ilayer|layer|bgsound|title|base)[^>]*>?#i'
             ],
 
             'auto_block' => [