mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-17 22:35:19 +00:00
6d1816bd1b
The app/Services/ directory had grown into 22 flat files at the root plus 7 uneven subdirectories — finding anything required scrolling through an alphabetical mix of small CRUD services, infrastructure drivers, and install-time utilities. This commit groups services by domain, folds Backup into a new Storage namespace, and moves framework-infrastructure and install-time helpers out of Services and into Support where they belong. New Services layout: Documents/ (Invoice, Estimate, RecurringInvoice, Payment, Expense, Transaction, DocumentItem, SerialNumber, Currency — matches the 'Documents' navigation group); Company/ (Company, Member, Invitation); Mail/ (MailConfiguration, CompanyMailConfig); Storage/ (FileDisk, plus Backup folded in). ExchangeRateProviderService moves next to its drivers in ExchangeRate/; FontService moves into Pdf/ where it belongs. CustomerService, ItemService, CustomFieldService stay at the Services root as standalone single-file domains. Moves to Support/: Hashids/ (library wrapper — not business logic); Setup/ (one-shot install-time utilities — stateless helpers); Pdf/ (ImageUtils, PdfTemplateUtils, plus the existing PdfHtmlSanitizer consolidated into the same subdir). These are all framework infrastructure and stateless utilities — the 'service' label never really fit them. Namespace declarations in 29 moved files updated to match new paths. 62 consumer files (controllers, other services, tests, database factories, seeders, routes, bootstrap/providers.php) have their use statements rewritten via a literal-string replacement script — no regex meant no risk of half-matching. Three Documents services needed an explicit 'use App\Services\Mail\CompanyMailConfigService' added because the same-namespace short reference they relied on no longer resolves after the split. Verified: composer dump-autoload, 350 tests pass (850 assertions), vendor/bin/pint clean, npm run build succeeds.
90 lines
2.4 KiB
PHP
90 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Support\Pdf;
|
|
|
|
use DOMDocument;
|
|
use DOMElement;
|
|
use DOMXPath;
|
|
|
|
final class PdfHtmlSanitizer
|
|
{
|
|
/**
|
|
* Sanitize HTML that will be rendered inside Dompdf. Removes tags that can trigger
|
|
* network requests (SSRF) or carry executable handlers, while keeping common
|
|
* text-formatting markup used in invoice/estimate/payment notes.
|
|
*/
|
|
public static function sanitize(string $html): string
|
|
{
|
|
if ($html === '') {
|
|
return '';
|
|
}
|
|
|
|
// Legacy/invalid `</br>` is dropped by libxml and collapses lines in PDF output; normalize to `<br />`.
|
|
$html = str_replace('</br>', '<br />', $html);
|
|
|
|
$allowedTags = '<br><br/><p><b><strong><i><em><u><ol><ul><li><table><tr><td><th><thead><tbody><tfoot><h1><h2><h3><h4><blockquote>';
|
|
$html = strip_tags($html, $allowedTags);
|
|
|
|
$previous = libxml_use_internal_errors(true);
|
|
|
|
$doc = new DOMDocument;
|
|
$wrapped = '<?xml encoding="UTF-8"?><div id="__pdf_notes">'.$html.'</div>';
|
|
$doc->loadHTML($wrapped, LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);
|
|
libxml_clear_errors();
|
|
libxml_use_internal_errors($previous);
|
|
|
|
$xpath = new DOMXPath($doc);
|
|
$root = $xpath->query('//*[@id="__pdf_notes"]')->item(0);
|
|
|
|
if (! $root instanceof DOMElement) {
|
|
return $html;
|
|
}
|
|
|
|
foreach ($xpath->query('.//*', $root) as $element) {
|
|
if (! $element instanceof DOMElement) {
|
|
continue;
|
|
}
|
|
|
|
$toRemove = [];
|
|
|
|
foreach ($element->attributes as $attr) {
|
|
if (self::shouldRemoveAttribute($attr->name)) {
|
|
$toRemove[] = $attr->name;
|
|
}
|
|
}
|
|
|
|
foreach ($toRemove as $name) {
|
|
$element->removeAttribute($name);
|
|
}
|
|
}
|
|
|
|
$result = '';
|
|
|
|
foreach ($root->childNodes as $child) {
|
|
$result .= $doc->saveHTML($child);
|
|
}
|
|
|
|
return $result;
|
|
}
|
|
|
|
private static function shouldRemoveAttribute(string $name): bool
|
|
{
|
|
$lower = strtolower($name);
|
|
|
|
if (str_starts_with($lower, 'on')) {
|
|
return true;
|
|
}
|
|
|
|
return in_array($lower, [
|
|
'style',
|
|
'src',
|
|
'href',
|
|
'srcset',
|
|
'srcdoc',
|
|
'poster',
|
|
'formaction',
|
|
'xlink:href',
|
|
], true);
|
|
}
|
|
}
|