symfony · fabpot · Apr 16, 2022 · Apr 15, 2022
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -2243,6 +2243,10 @@ private function addHtmlSanitizerSection(ArrayNodeDefinition $rootNode, callable
                                         ->info('Unregisters custom attribute sanitizers.')
                                         ->scalarPrototype()->end()
                                     ->end()
+                                    ->integerNode('max_input_length')
+                                        ->info('The maximum length allowed for the sanitized input.')
+                                        ->defaultValue(0)
+                                    ->end()
                                 ->end()
                             ->end()
                         ->end()

diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -2734,6 +2734,10 @@ private function registerHtmlSanitizerConfiguration(array $config, ContainerBuil
                 $def->addMethodCall('withoutAttributeSanitizer', [new Reference($serviceName)], true);
             }
 
+            if ($sanitizerConfig['max_input_length']) {
+                $def->addMethodCall('withMaxInputLength', [$sanitizerConfig['max_input_length']], true);
+            }
+
             // Create the sanitizer and link its config
             $sanitizerId = 'html_sanitizer.sanitizer.'.$sanitizerName;
             $container->register($sanitizerId, HtmlSanitizer::class)->addArgument(new Reference($configId));

diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd b/src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd
@@ -850,6 +850,7 @@
         <xsd:attribute name="force-https-urls" type="xsd:boolean" />
         <xsd:attribute name="allow-relative-links" type="xsd:boolean" />
         <xsd:attribute name="allow-relative-medias" type="xsd:boolean" />
+        <xsd:attribute name="max-input-length" type="xsd:positiveInteger" />
     </xsd:complexType>
 
     <xsd:complexType name="element-option">

diff --git a/src/Symfony/Component/HtmlSanitizer/HtmlSanitizer.php b/src/Symfony/Component/HtmlSanitizer/HtmlSanitizer.php
@@ -25,18 +25,16 @@
 final class HtmlSanitizer implements HtmlSanitizerInterface
 {
     private HtmlSanitizerConfig $config;
-    private int $maxInputLength;
     private ParserInterface $parser;
 
     /**
      * @var array<string, DomVisitor>
      */
     private array $domVisitors = [];
 
-    public function __construct(HtmlSanitizerConfig $config, int $maxInputLength = 20000, ParserInterface $parser = null)
+    public function __construct(HtmlSanitizerConfig $config, ParserInterface $parser = null)
     {
         $this->config = $config;
-        $this->maxInputLength = $maxInputLength;
         $this->parser = $parser ?? new MastermindsParser();
     }
 
@@ -64,8 +62,8 @@ private function sanitizeWithContext(string $context, string $input): string
         $this->domVisitors[$context] ??= $this->createDomVisitorForContext($context);
 
         // Prevent DOS attack induced by extremely long HTML strings
-        if (\strlen($input) > $this->maxInputLength) {
-            $input = substr($input, 0, $this->maxInputLength);
+        if (\strlen($input) > $this->config->getMaxInputLength()) {
+            $input = substr($input, 0, $this->config->getMaxInputLength());
         }
 
         // Only operate on valid UTF-8 strings. This is necessary to prevent cross

diff --git a/src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php b/src/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php
@@ -92,6 +92,8 @@ class HtmlSanitizerConfig
      */
     private array $attributeSanitizers;
 
+    private int $maxInputLength = 20_000;
+
     public function __construct()
     {
         $this->attributeSanitizers = [
@@ -405,6 +407,19 @@ public function withoutAttributeSanitizer(AttributeSanitizerInterface $sanitizer
         return $clone;
     }
 
+    public function withMaxInputLength(int $maxInputLength): static
+    {
+        $clone = clone $this;
+        $clone->maxInputLength = $maxInputLength;
+
+        return $clone;
+    }
+
+    public function getMaxInputLength(): int
+    {
+        return $this->maxInputLength;
+    }
+
     /**
      * @return array<string, array<string, true>>
      */