feature symfony#52166 [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document (lyrixx)

This PR was merged into the 6.4 branch.

Discussion
----------

[HtmlSanitizer] Add support for sanitizing unlimited length of HTML document

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       |
| License       | MIT

<!--
Replace this notice by a description of your feature/bugfix.
This will help reviewers and should be a good start for the documentation.

Additionally (see https://symfony.com/releases):
 - Always add tests and ensure they pass.
 - Bug fixes must be submitted against the lowest maintained branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the latest branch.
 - For new features, provide some code snippets to help understand usage.
 - Changelog entry should follow https://symfony.com/doc/current/contributing/code/conventions.html#writing-a-changelog-entry
 - Never break backward compatibility (see https://symfony.com/bc).
-->

Commits
-------

738450f [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document

Author: nicolas-grekas

src/Symfony/Component/HtmlSanitizer/CHANGELOG.md

@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+6.4
+---
+
+ * Add support for sanitizing unlimited length of HTML document
+
 6.1
 ---
 

src/Symfony/Component/HtmlSanitizer/HtmlSanitizer.php

@@ -60,7 +60,7 @@ private function sanitizeWithContext(string $context, string $input): string
         $this->domVisitors[$context] ??= $this->createDomVisitorForContext($context);
 
         // Prevent DOS attack induced by extremely long HTML strings
-        if (\strlen($input) > $this->config->getMaxInputLength()) {
+        if (-1 !== $this->config->getMaxInputLength() && \strlen($input) > $this->config->getMaxInputLength()) {
             $input = substr($input, 0, $this->config->getMaxInputLength());
         }
 

src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php

@@ -405,8 +405,16 @@ public function withoutAttributeSanitizer(AttributeSanitizerInterface $sanitizer
         return $clone;
     }
 
+    /**
+     * @param int $maxInputLength The maximum length of the input string in bytes
+     *                            -1 means no limit
+     */
     public function withMaxInputLength(int $maxInputLength): static
     {
+        if ($maxInputLength < -1) {
+            throw new \InvalidArgumentException(sprintf('The maximum input length must be greater than -1, "%d" given.', $maxInputLength));
+        }
+
         $clone = clone $this;
         $clone->maxInputLength = $maxInputLength;
 

src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerAllTest.php

@@ -561,4 +561,15 @@ public static function provideSanitizeBody()
             yield $case[0] => $case;
         }
     }
+
+    public function testUnlimitedLength()
+    {
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));
+
+        $input = str_repeat('a', 10_000_000);
+
+        $sanitized = $sanitizer->sanitize($input);
+
+        $this->assertSame(\strlen($input), \strlen($sanitized));
+    }
 }