ブログコンテンツ、メールコンテンツの出力時、説明文よりスクリプトを除外

plugins/baser-core/src/Utility/BcText.php

@@ -0,0 +1,39 @@
+<?php
+/**
+ * baserCMS :  Based Website Development Project <https://basercms.net>
+ * Copyright (c) NPO baser foundation <https://baserfoundation.org/>
+ *
+ * @copyright     Copyright (c) NPO baser foundation
+ * @link          https://basercms.net baserCMS Project
+ * @since         5.0.6
+ * @license       https://basercms.net/license/index.html MIT License
+ */
+
+namespace BaserCore\Utility;
+
+/**
+ * Class BcText
+ */
+class BcText
+{
+
+	/**
+	 * 文字列よりスクリプトタグを除去する
+	 *
+	 * @param string $value
+	 * @return string
+	 */
+	public static function stripScriptTag($value)
+	{
+		$allows = [
+			'a', 'abbr', 'address', 'area', 'b', 'blockquote', 'body', 'br', 'button', 'caption', 'cite', 'code',
+			'col', 'colgroup', 'dd', 'del', 'dfn', 'div', 'dl', 'dt', 'em', 'fieldset', 'form', 'h1', 'h2', 'h3',
+			'h4', 'h5', 'h6', 'hr', 'i', 'iframe', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'link',
+			'map', 'meta', 'noscript', 'object', 'ol', 'optgroup', 'option', 'p', 'pre', 'q', 'samp', 'select',
+			'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead',
+			'title', 'tr', 'ul', 'var', 'style'
+		];
+		return strip_tags($value, '<' . implode('><', $allows) . '>');
+	}
+
+}

plugins/baser-core/tests/TestCase/Utility/BcTextTest.php

@@ -0,0 +1,48 @@
+<?php
+/**
+ * baserCMS :  Based Website Development Project <https://basercms.net>
+ * Copyright (c) NPO baser foundation <https://baserfoundation.org/>
+ *
+ * @copyright     Copyright (c) NPO baser foundation
+ * @link          https://basercms.net baserCMS Project
+ * @since         5.0.6
+ * @license       https://basercms.net/license/index.html MIT License
+ */
+
+namespace BaserCore\Test\TestCase\Utility;
+
+use BaserCore\TestSuite\BcTestCase;
+use BaserCore\Utility\BcText;
+
+/**
+ * Class BcTextTest
+ */
+class BcTextTest extends BcTestCase
+{
+
+	/**
+	 * test stripScriptTag
+	 * @return void
+	 * @dataProvider stripScriptTagDataProvider
+	 */
+	public function testStripScriptTag($content, $expect)
+	{
+		$result = BcText::stripScriptTag($content);
+		$this->assertEquals($expect, $result, 'scriptタグを削除できません。');
+	}
+
+	public function stripScriptTagDataProvider()
+	{
+		return [
+			[
+				'content' => '<script>hoge</script>',
+				'expect' => 'hoge'
+			],
+			[
+				'content' => '<a href="http://hoge.com" class="bca-action">hoge<script>hoge</script></a>',
+				'expect' => '<a href="http://hoge.com" class="bca-action">hogehoge</a>'
+			]
+		];
+	}
+
+}

plugins/bc-blog/src/View/Helper/BlogHelper.php

@@ -19,6 +19,7 @@
 use BaserCore\Service\SitesService;
 use BaserCore\Service\SitesServiceInterface;
 use BaserCore\Utility\BcContainerTrait;
+use BaserCore\Utility\BcText;
 use BaserCore\Utility\BcUtil;
 use BaserCore\View\Helper\BcBaserHelper;
 use BaserCore\View\Helper\BcContentsHelper;
@@ -252,7 +253,7 @@ public function getDescription()
      */
     public function description()
     {
-        echo $this->getDescription();
+        echo BcText::stripScriptTag($this->getDescription());
     }
 
     /**

plugins/bc-mail/src/View/Helper/MailHelper.php

@@ -12,8 +12,9 @@
 namespace BcMail\View\Helper;
 
 use BaserCore\Utility\BcContainerTrait;
+use BaserCore\Utility\BcText;
 use BaserCore\Utility\BcUtil;
-use BcMail\Service\MailContentsService;
+use BcMail\Model\Entity\MailContent;
 use BcMail\Service\MailContentsServiceInterface;
 use Cake\Core\Configure;
 use Cake\Event\Event;
@@ -43,6 +44,12 @@ class MailHelper extends Helper
      */
     public $helpers = ['BcBaser'];
 
+    /**
+     * 現在のメールコンテンツ
+     * @var MailContent
+     */
+    public $currentMailContent;
+
     /**
      * コンストラクタ
      *
@@ -63,15 +70,15 @@ public function __construct(View $view, array $config = [])
      */
     public function setMailContent($mailContentId = null)
     {
-        if (isset($this->mailContent)) {
+        if (isset($this->currentMailContent)) {
             return;
         }
         if ($mailContentId) {
             $MailContent = ClassRegistry::init('BcMail.MailContent');
             $MailContent->reduceAssociations([]);
-            $this->mailContent = Hash::extract($MailContent->read(null, $mailContentId), 'MailContent');
+            $this->currentMailContent = Hash::extract($MailContent->read(null, $mailContentId), 'MailContent');
         } elseif ($this->_View->get('mailContent')) {
-            $this->mailContent = $this->_View->get('mailContent');
+            $this->currentMailContent = $this->_View->get('mailContent');
         }
     }
 
@@ -149,7 +156,7 @@ public function getMailTemplates($siteId = 1)
      */
     public function getDescription()
     {
-        return $this->mailContent['description'];
+        return $this->currentMailContent->description;
     }
 
     /**
@@ -159,7 +166,7 @@ public function getDescription()
      */
     public function description()
     {
-        echo $this->getDescription();
+        echo BcText::stripScriptTag($this->getDescription());
     }
 
     /**
@@ -169,10 +176,9 @@ public function description()
      */
     public function descriptionExists()
     {
-        if (empty($this->mailContent['description'])) {
+        if (empty($this->currentMailContent->description)) {
             return false;
         }
-
         return true;
     }