メールとブログの説明文について script タグを除外

lib/Baser/Lib/BcUtil.php

@@ -520,4 +520,23 @@ public static function getAdminPrefix()
 		return Configure::read('BcAuthPrefix.admin.alias');
 	}
 
+	/**
+	 * 文字列よりスクリプトタグを除去する
+	 *
+	 * @param string $value
+	 * @return string
+	 */
+	public static function stripScriptTag($value)
+	{
+		$allows = [
+			'a', 'abbr', 'address', 'area', 'b', 'blockquote', 'body', 'br', 'button', 'caption', 'cite', 'code',
+			'col', 'colgroup', 'dd', 'del', 'dfn', 'div', 'dl', 'dt', 'em', 'fieldset', 'form', 'h1', 'h2', 'h3',
+			'h4', 'h5', 'h6', 'hr', 'i', 'iframe', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'link',
+			'map', 'meta', 'noscript', 'object', 'ol', 'optgroup', 'option', 'p', 'pre', 'q', 'samp', 'select',
+			'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead',
+			'title', 'tr', 'ul', 'var', 'style'
+		];
+		return strip_tags($value, '<' . implode('><', $allows) . '>');
+	}
+
 }

lib/Baser/Plugin/Blog/View/Helper/BlogHelper.php

@@ -197,7 +197,7 @@ public function getTitle()
 	 */
 	public function getDescription()
 	{
-		return $this->blogContent['description'];
+		return BcUtil::stripScriptTag($this->blogContent['description']);
 	}
 
 	/**

lib/Baser/Plugin/Mail/View/Helper/MailHelper.php

@@ -158,7 +158,7 @@ public function getMailTemplates($siteId = 0)
 	 */
 	public function getDescription()
 	{
-		return preg_replace('/<script.*?>(.*?)<\/script>/', '', $this->mailContent['description']);
+		return BcUtil::stripScriptTag($this->mailContent['description']);
 	}
 
 	/**

lib/Baser/Test/Case/Lib/BcUtilTest.php

@@ -481,4 +481,29 @@ public function getSubDomainDataProvider()
 		];
 	}
 
+	/**
+	 * test stripScriptTag
+	 * @return void
+	 * @dataProvider stripScriptTagDataProvider
+	 */
+	public function testStripScriptTag($content, $expect)
+	{
+		$result = BcUtil::stripScriptTag($content);
+		$this->assertEquals($expect, $result, 'scriptタグを削除できません。');
+	}
+
+	public function stripScriptTagDataProvider()
+	{
+		return [
+			[
+				'content' => '<script>hoge</script>',
+				'expect' => 'hoge'
+			],
+			[
+				'content' => '<a href="http://hoge.com" class="bca-action">hoge<script>hoge</script></a>',
+				'expect' => '<a href="http://hoge.com" class="bca-action">hogehoge</a>'
+			]
+		];
+	}
+
 }