Fix get() helper

Author: RobiNN1

src/Dashboards/APCu/APCuKeyView.php

@@ -24,7 +24,7 @@ private function getKeySize(string $key): int {
     }
 
     private function viewKey(): string {
-        $key = Http::get('key', '');
+        $key = Http::get('key', '', true);
 
         if (apcu_exists($key) === false) {
             Http::redirect();
@@ -89,7 +89,7 @@ public function saveKey(): void {
      * Add/edit form.
      */
     private function form(): string {
-        $key = Http::get('key', '');
+        $key = Http::get('key', '', true);
         $expire = 0;
 
         $encoder = Http::get('encoder', 'none');

src/Dashboards/Memcached/MemcachedKeyView.php

@@ -20,7 +20,7 @@ trait MemcachedKeyView {
      * @throws MemcachedException
      */
     private function viewKey(): string {
-        $key = Http::get('key', '');
+        $key = Http::get('key', '', true);
 
         if (!$this->memcached->exists($key)) {
             Http::redirect();
@@ -92,7 +92,7 @@ public function saveKey(): void {
      * @throws MemcachedException
      */
     private function form(): string {
-        $key = Http::get('key', '');
+        $key = Http::get('key', '', true);
         $expire = Http::get('ttl', 0);
         $expire = $expire === -1 ? 0 : $expire;
 

src/Dashboards/Redis/RedisKeyView.php

@@ -24,7 +24,7 @@ trait RedisKeyView {
      * @throws Exception
      */
     private function viewKey(): string {
-        $key = Http::get('key', '');
+        $key = Http::get('key', '', true);
 
         if (!$this->redis->exists($key)) {
             Http::redirect();
@@ -223,7 +223,7 @@ public function saveKey(): void {
      * @throws Exception
      */
     private function form(): string {
-        $key = (string) Http::get('key', Http::post('key', ''));
+        $key = (string) Http::get('key', Http::post('key', ''), true);
         $type = Http::post('rtype', 'string');
         $index = $_POST['index'] ?? '';
         $score = Http::post('score', 0);

src/Helpers.php

@@ -179,7 +179,8 @@ public static function export(array $keys, string $filename, callable $value, bo
             return $output;
         }
 
-        header('Content-disposition: attachment; filename='.$filename.'.json');
+        $safe_filename = preg_replace('/[\x00-\x1f"\\\\]+/', '', $filename);
+        header('Content-disposition: attachment; filename="'.$safe_filename.'.json"');
         header('Content-Type: application/json');
         echo $output;
         exit;

src/Http.php

@@ -49,22 +49,24 @@ public static function queryString(array $preserve = [], array $additional = [])
 
     /**
      * Get query parameter.
+     * Set $raw to true for values that are data rather than markup (e.g. cache keys, which may legitimately contain <, >..)
      *
      * @template Type
      *
      * @param Type $default
      *
      * @return Type
      */
-    public static function get(string $key, $default = null) {
+    public static function get(string $key, $default = null, bool $raw = false) {
         if (!isset($_GET[$key])) {
             return $default;
         }
 
-        $filter = is_int($default) ? FILTER_SANITIZE_NUMBER_INT : FILTER_SANITIZE_FULL_SPECIAL_CHARS;
-        $value = filter_var($_GET[$key], $filter);
+        if (is_int($default)) {
+            return (int) filter_var($_GET[$key], FILTER_SANITIZE_NUMBER_INT);
+        }
 
-        return is_int($default) ? (int) $value : $value;
+        return filter_var($_GET[$key], $raw ? FILTER_UNSAFE_RAW : FILTER_SANITIZE_FULL_SPECIAL_CHARS);
     }
 
     /**

templates/partials/table_view.twig

@@ -38,7 +38,7 @@
                     {% set td_class = is_title ? ' max-w-xs md:max-w-md truncate hover:text-clip hover:break-all hover:whitespace-normal' : '' %}
                     <td class="px-3 py-2 border-b border-gray-200 text-sm{{ td_class }}{{ classes[loop.index]|space }} dark:border-gray-700 dark:text-gray-300">
                         {% if item_key == 'link_title' and view_key %}
-                            {% set link = view_key|replace({__key__: key.key}) %}
+                            {% set link = view_key|replace({__key__: key.key|url_encode}) %}
                             <a class="font-semibold text-primary-500 dark:text-primary-400 dark:hover:text-primary-300 hover:text-primary-700" href="{{ link }}"{{ config('keymodal', false) ? ' data-view-key' : '' }}>
                                 {{ item }}
                                 {% if key.items %}

templates/partials/tree_view.twig

@@ -28,7 +28,7 @@
                         {% endif %}
 
                         <span class="font-semibold text-primary-500 dark:text-primary-400 dark:hover:text-primary-300 hover:text-primary-700">
-                            {% set link = view_key|replace({__key__: item.key}) %}
+                            {% set link = view_key|replace({__key__: item.key|url_encode}) %}
                             <a class="font-semibold text-primary-500 dark:text-primary-400 dark:hover:text-primary-300 hover:text-primary-700" href="{{ link }}"{{ config('keymodal', false) ? ' data-view-key' : '' }}>
                                 {{ item.name }}
                                 {% if item.items %}

tests/HttpTest.php

@@ -41,6 +41,16 @@ public function testGetString(): void {
         $this->assertSame('', Http::get('test-string-empty', ''));
     }
 
+    public function testGetSanitizesSpecialChars(): void {
+        $_GET['test-special'] = 'a<b>&"c';
+        $this->assertSame('a&lt;b&gt;&amp;&quot;c', Http::get('test-special', ''));
+    }
+
+    public function testGetRawKeepsSpecialChars(): void {
+        $_GET['test-raw'] = 'a<b>&"c';
+        $this->assertSame('a<b>&"c', Http::get('test-raw', '', true));
+    }
+
     public function testGetInt(): void {
         $_GET['test-int'] = 4646;
         $this->assertSame(4646, Http::get('test-int', 0));