You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Revised and enhanced descriptions in both English and Portuguese README.
- Expanded usage examples for better clarity.
- Added more details about sanitizer configuration options.
- Updated integration and registry explanation sections.
A robust and flexible data sanitization component for PHP, part of the KaririCode Framework. It utilizes configurable processors and native functions to ensure data integrity and security in your applications.
8
4
9
5
## Table of Contents
@@ -14,6 +10,9 @@ A robust and flexible data sanitization component for PHP, part of the KaririCod
14
10
-[Basic Usage](#basic-usage)
15
11
-[Advanced Usage: Blog Post Sanitization](#advanced-usage-blog-post-sanitization)
16
12
-[Available Sanitizers](#available-sanitizers)
13
+
-[Input Sanitizers](#input-sanitizers)
14
+
-[Domain Sanitizers](#domain-sanitizers)
15
+
-[Security Sanitizers](#security-sanitizers)
17
16
-[Configuration](#configuration)
18
17
-[Integration with Other KaririCode Components](#integration-with-other-kariricode-components)
19
18
-[Development and Testing](#development-and-testing)
@@ -30,6 +29,9 @@ A robust and flexible data sanitization component for PHP, part of the KaririCod
30
29
- Support for fallback values in case of sanitization failures
This example demonstrates how to use the KaririCode Sanitizer to clean and secure blog post data, including handling of Markdown content, HTML purification, and protection against XSS attacks.
171
+
-**PhoneSanitizer**: Formats and validates phone numbers, including international support and custom formatting options.
220
172
221
-
## Available Sanitizers
173
+
-**Configuration Options**:
174
+
-`applyFormat`: Boolean to apply formatting. Default is `false`.
175
+
-`format`: Custom format pattern for phone numbers.
176
+
-`placeholder`: Placeholder character used in formatting.
222
177
223
-
The Sanitizer component provides various built-in sanitizers:
178
+
-**AlphanumericSanitizer**: Removes non-alphanumeric characters, with configurable options to allow certain special characters.
224
179
225
-
### Input Sanitizers
180
+
-**Configuration Options**:
181
+
-`allowSpace`, `allowUnderscore`, `allowDash`, `allowDot`: Boolean options to allow specific characters.
182
+
-`preserveCase`: Boolean to maintain case sensitivity.
183
+
184
+
-**UrlSanitizer**: Validates and normalizes URLs, ensuring proper protocol and structure.
185
+
186
+
-**Configuration Options**:
187
+
-`enforceProtocol`: Enforces a specific protocol, e.g., 'https://'.
188
+
-`defaultProtocol`: The protocol to apply if none is present.
189
+
-`removeTrailingSlash`: Boolean to remove trailing slash.
226
190
227
-
- TrimSanitizer: Removes whitespace from the beginning and end of a string
228
-
- HtmlSpecialCharsSanitizer: Converts special characters to HTML entities
229
-
- NormalizeLineBreaksSanitizer: Standardizes line breaks across different operating systems
230
-
- StripTagsSanitizer: Removes HTML and PHP tags from a string
191
+
-**NumericSanitizer**: Ensures that the input is a numeric value, with options for decimal and negative numbers.
192
+
193
+
-**Configuration Options**:
194
+
-`allowDecimal`, `allowNegative`: Boolean options to allow decimals and negative values.
195
+
-`decimalSeparator`: Specifies the character used for decimals.
196
+
197
+
-**StripTagsSanitizer**: Removes HTML and PHP tags from input, with configurable options for allowed tags.
198
+
-**Configuration Options**:
199
+
-`allowedTags`: List of HTML tags to keep.
200
+
-`keepSafeAttributes`: Boolean to keep certain safe attributes.
201
+
-`safeAttributes`: Array of attributes to preserve.
231
202
232
203
### Domain Sanitizers
233
204
234
-
- HtmlPurifierSanitizer: Sanitizes HTML content using the HTML Purifier library
235
-
- JsonSanitizer: Validates and prettifies JSON strings
236
-
- MarkdownSanitizer: Sanitizes Markdown content
205
+
-**HtmlPurifierSanitizer**: Sanitizes HTML content by removing unsafe tags and attributes, ensuring safe HTML rendering.
206
+
207
+
-**Configuration Options**:
208
+
-`allowedTags`: Specifies which tags are allowed.
209
+
-`allowedAttributes`: Defines allowed attributes for each tag.
210
+
-`removeEmptyTags`, `removeComments`: Boolean to remove empty tags or HTML comments.
211
+
-`htmlEntities`: Convert characters to HTML entities. Default is `true`.
212
+
213
+
-**JsonSanitizer**: Validates and prettifies JSON strings, removes invalid characters, and ensures proper JSON structure.
214
+
215
+
-**Configuration Options**:
216
+
-`prettyPrint`: Boolean to format JSON for readability.
217
+
-`removeInvalidCharacters`: Boolean to remove invalid characters from JSON.
218
+
-`validateUnicode`: Boolean to validate Unicode characters.
219
+
220
+
-**MarkdownSanitizer**: Processes and sanitizes Markdown content, escaping special characters and preserving the Markdown structure.
221
+
-**Configuration Options**:
222
+
-`allowedElements`: Specifies allowed Markdown elements (e.g., 'p', 'h1', 'a').
223
+
-`escapeSpecialCharacters`: Boolean to escape special characters like '\*', '\_', etc.
224
+
-`preserveStructure`: Boolean to maintain Markdown formatting.
237
225
238
226
### Security Sanitizers
239
227
240
-
- FilenameSanitizer: Ensures filenames are safe for use in file systems
241
-
- SqlInjectionSanitizer: Protects against SQL injection attacks
-**FilenameSanitizer**: Ensures filenames are safe for use in file systems by removing unsafe characters and validating extensions.
229
+
230
+
-**Configuration Options**:
231
+
-`replacement`: Character used to replace unsafe characters. Default is `'-'`.
232
+
-`preserveExtension`: Boolean to keep the file extension.
233
+
-`blockDangerousExtensions`: Boolean to block extensions like '.exe', '.js'.
234
+
-`allowedExtensions`: Array of allowed extensions.
235
+
236
+
-**SqlInjectionSanitizer**: Protects against SQL injection attacks by escaping special characters and removing potentially harmful content.
243
237
244
-
For detailed information on each sanitizer, including configuration options and usage examples, please refer to the [documentation](https://kariricode.org/docs/sanitizer).
238
+
-**Configuration Options**:
239
+
-`escapeMap`: Array of characters to escape.
240
+
-`removeComments`: Boolean to strip SQL comments.
241
+
-`escapeQuotes`: Boolean to escape quotes in SQL queries.
242
+
243
+
-**XssSanitizer**: Prevents Cross-Site Scripting (XSS) attacks by removing malicious scripts, attributes, and ensuring safe HTML output.
244
+
-**Configuration Options**:
245
+
-`removeScripts`: Boolean to remove `<script>` tags.
246
+
-`removeEventHandlers`: Boolean to remove 'on\*' event handlers.
247
+
-`encodeHtmlEntities`: Boolean to encode unsafe characters.
245
248
246
249
## Configuration
247
250
@@ -269,26 +272,36 @@ The Sanitizer component is designed to work seamlessly with other KaririCode com
269
272
-**KaririCode\ProcessorPipeline**: Utilized for building and executing sanitization pipelines.
270
273
-**KaririCode\PropertyInspector**: Used for analyzing and processing object properties with sanitization attributes.
271
274
272
-
Example of integration:
275
+
## Registry Explanation
273
276
274
-
```php
275
-
use KaririCode\ProcessorPipeline\ProcessorRegistry;
276
-
use KaririCode\ProcessorPipeline\ProcessorBuilder;
277
-
use KaririCode\PropertyInspector\AttributeAnalyzer;
278
-
use KaririCode\PropertyInspector\AttributeHandler;
279
-
use KaririCode\PropertyInspector\Utility\PropertyInspector;
280
-
use KaririCode\Sanitizer\Sanitizer;
277
+
The registry is a core part of how sanitizers are managed within the KaririCode Framework. It acts as a centralized location to register and configure all sanitizers you plan to use in your application.
281
278
282
-
$registry = new ProcessorRegistry();
283
-
// Register sanitizers...
279
+
Here's how you can create and configure the registry:
284
280
285
-
$builder = new ProcessorBuilder($registry);
286
-
$attributeHandler = new AttributeHandler('sanitizer', $builder);
287
-
$propertyInspector = new PropertyInspector(new AttributeAnalyzer(Sanitize::class));
281
+
```php
282
+
// Create and configure the registry
283
+
$registry = new ProcessorRegistry();
288
284
289
-
$sanitizer = new Sanitizer($registry);
285
+
// Register all required processors
286
+
$registry->register('sanitizer', 'trim', new TrimSanitizer());
287
+
$registry->register('sanitizer', 'html_special_chars', new HtmlSpecialCharsSanitizer());
288
+
$registry->register('sanitizer', 'normalize_line_breaks', new NormalizeLineBreaksSanitizer());
289
+
$registry->register('sanitizer', 'html_purifier', new HtmlPurifierSanitizer());
290
+
$registry->register('sanitizer', 'markdown', new MarkdownSanitizer());
291
+
$registry->register('sanitizer', 'numeric_sanitizer', new NumericSanitizer());
292
+
$registry->register('sanitizer', 'email_sanitizer', new EmailSanitizer());
293
+
$registry->register('sanitizer', 'phone_sanitizer', new PhoneSanitizer());
294
+
$registry->register('sanitizer', 'url_sanitizer', new UrlSanitizer());
295
+
$registry->register('sanitizer', 'alphanumeric_sanitizer', new AlphanumericSanitizer());
296
+
$registry->register('sanitizer', 'filename_sanitizer', new FilenameSanitizer());
297
+
$registry->register('sanitizer', 'json_sanitizer', new JsonSanitizer());
298
+
$registry->register('sanitizer', 'xss_sanitizer', new XssSanitizer());
299
+
$registry->register('sanitizer', 'sql_injection', new SqlInjectionSanitizer());
300
+
$registry->register('sanitizer', 'strip_tags', new StripTagsSanitizer());
290
301
```
291
302
303
+
This code demonstrates how to register various sanitizers with the registry, allowing you to easily manage which sanitizers are available throughout your application. Each sanitizer is given a unique identifier, which can then be referenced in attributes to apply specific sanitization rules.
304
+
292
305
## Development and Testing
293
306
294
307
For development and testing purposes, this package uses Docker and Docker Compose to ensure consistency across different environments. A Makefile is provided for convenience.
@@ -321,6 +334,7 @@ For development and testing purposes, this package uses Docker and Docker Compos
0 commit comments