purifier 1차 적용

.gitignore

@@ -43,3 +43,4 @@ test.php
 /twe
 
 phpinfo.php
+vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/*

hwe/b_dipcenter.php

@@ -217,8 +217,8 @@ if ($budgetricediff > 0) {
 <form name=form1 method=post action=c_dipcenter.php>
     <tr><td colspan=2 height=10></td></tr>
     <tr><td colspan=2 align=center bgcolor=orange>국 가 방 침 &amp; 임관 권유 메세지</td></tr>
-    <tr><td colspan=2 class=bg1>국가 방침 <textarea <?=$read?> maxlength=1000 rows="5" style="color:white;background-color:black;width:830px;" name=msg><?=$nation['msg']?></textarea><input type=<?=$btn?> name=btn value=국가방침></td></tr>
-    <tr><td colspan=2 class=bg1>임관 권유 <input type=text <?=$read?> maxlength=500 style=color:white;background-color:black;width:830px; name=scoutmsg value='<?=$nation['scoutmsg']?>'><input type=<?=$btn?> name=btn value=임관권유></td></tr>
+    <tr><td colspan=2 class=bg1>국가 방침 <textarea <?=$read?> maxlength=16000 rows="5" style="color:white;background-color:black;width:830px;" name=msg><?=$nation['msg']?></textarea><input type=<?=$btn?> name=btn value=국가방침></td></tr>
+    <tr><td colspan=2 class=bg1>임관 권유 <input type=text <?=$read?> maxlength=1000 style=color:white;background-color:black;width:830px; name=scoutmsg value='<?=$nation['scoutmsg']?>'><input type=<?=$btn?> name=btn value=임관권유></td></tr>
     <tr><td colspan=2>870 x 200px 넘는 크기를 점유할 시 통보없이 제한될 수 있습니다.</td></tr>
     <tr><td colspan=2 height=10></td></tr>
     <tr><td colspan=2 align=center bgcolor=green>예 산 &amp; 정 책</td></tr>

hwe/c_dipcenter.php

@@ -19,11 +19,8 @@ $session = Session::requireGameLogin()->setReadOnly();
 $userID = Session::getUserID();
 
 $db = DB::db();
-$connect=$db->get();
 
-$query = "select no,nation,level from general where owner='{$userID}'";
-$result = MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
-$me = MYDB_fetch_array($result);
+$me = $db->queryFirstRow('SELECT `no`,nation,`level` FROM general WHERE `owner`=%i', $userID);
 
 //내가 수뇌부이어야함
 if($me['level'] < 5) {
@@ -32,21 +29,21 @@ if($me['level'] < 5) {
 }
 
 if($btn == "국가방침") {
-    $msg == mb_substr($msg, 0, 1000);
+    $msg = mb_substr($msg, 0, 16384);
     //$msg = StringUtil::
     $db->update('nation', [
-        'msg'=>BadTag2Code($msg)
+        'msg'=>WebUtil::htmlPurify($msg)
     ], 'nation=%i',$me['nation']);
 } elseif($btn == "임관권유") {
-    $scoutmsg == mb_substr($msg, 0, 500);
+    $scoutmsg = mb_substr($scoutmsg, 0, 1000);
     $db->update('nation', [
-        'scoutmsg'=>BadTag2Code($scoutmsg)
+        'scoutmsg'=>WebUtil::htmlPurify($scoutmsg)
     ], 'nation=%i',$me['nation']);
 } elseif($btn == "세율") {
-    if($rate < 5)  { $rate = 5; }
-    if($rate > 30) { $rate = 30; }
-    $query = "update nation set rate='$rate' where nation='{$me['nation']}'";
-    MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
+    $rate = Util::valueFit($rate, 5, 30);
+    $db->update('nation', [
+        'rate'=>$rate,
+    ], 'nation=%i', $me['nation']);
 } elseif($btn == "지급율") {
     $bill = Util::valueFit($bill, 20, 200);
     $db->update('nation', [
@@ -70,8 +67,9 @@ if($btn == "국가방침") {
         'war'=>1
     ], 'nation=%i',$me['nation']);
 } elseif($btn == "전쟁 허가") {
-    $query = "update nation set war='0' where nation='{$me['nation']}'";
-    MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
+    $db->update('nation', [
+        'war'=>0
+    ], 'nation=%i',$me['nation']);
 }
 
 header('location:b_dipcenter.php');

hwe/c_vote.php

@@ -58,14 +58,14 @@ if(!$isVoteAdmin){
 
 if($btn == "수정") {
     if($title != "") {
-        $gameStor->vote_title = $title;
+        $gameStor->vote_title = WebUtil::htmlPurify($title);
     }
 } elseif($btn == "추가") {
     if($str != "") {
         if(!$admin['vote']){
             $admin['vote'] = [];
         }
-        $admin['vote'][] = $str;
+        $admin['vote'][] = WebUtil::htmlPurify($str);
         $gameStor->vote=$admin['vote'];
     }
 } elseif($btn == "리셋") {

hwe/func_string.php

@@ -24,13 +24,6 @@ function Tag2Code(string $str) {
     return nl2br($str);
 }
 
-function BadTag2Code(string $str) {
-    /* FIXME: 제대로된 tag 변환 코드 사용 */
-    $str = str_replace("<script", "<sorry", $str);
-    $str = str_replace("</script", "</sorry", $str);
-    return $str;
-}
-
 function tab(string $str, $maxsize, $ch) {
     $size = strlen($str);
 

hwe/processing.php

@@ -991,11 +991,14 @@ function command_25($turn, $command) {
     for($i=1; $i <= $count; $i++) {
         $nation = MYDB_fetch_array($result);
 
-        if($nation['scoutmsg'] == "") {
-            $scoutStr .= "<tr><td align=center width=130 style=color:".newColor($nation['color']).";background-color:{$nation['color']};>{$nation['name']}</td><td width=870 style=color:".newColor($nation['color']).";background-color:{$nation['color']}>-</td></tr>";
-        } else {
-            $scoutStr .= "<tr><td align=center width=130 style=color:".newColor($nation['color']).";background-color:{$nation['color']};>{$nation['name']}</td><td width=870 style=color:".newColor($nation['color']).";background-color:{$nation['color']}>".$nation['scoutmsg']."</td></tr>";
-        }
+        $scoutStr .= 
+            "<tr>"
+            ."<td align=center width=130 style=color:".newColor($nation['color']).";background-color:{$nation['color']};>"
+            .$nation['name']
+            ."</td>"
+            ."<td width=870 style='color:".newColor($nation['color']).";background-color:{$nation['color']};overflow:hidden;max-width:870px;max-height:200px'>"
+            .($nation['scoutmsg']?:'-')
+            .'</td></tr>';
 
         if($gameStor->year < $gameStor->startyear+3 && $nation['gennum'] >= GameConst::$initialNationGenLimit) {
             echo "

src/sammo/WebUtil.php

@@ -125,4 +125,14 @@ class WebUtil
         }
         return "<link rel='stylesheet' type='text/css' href='{$path}{$tail}' />\n";
     }
+
+    public static function htmlPurify(?string $text): string{
+        if(!$text){
+            return '';
+        }
+
+        $config = \HTMLPurifier_HTML5Config::createDefault();
+        $purifier = new \HTMLPurifier($config);
+        return $purifier->purify($text);
+    }
 }