Feature/security

Logger.php

@@ -11,6 +11,11 @@ class Logger
      */
     private $logger;
 
+    /**
+     * @var SanitizerInterface
+     */
+    private $sanitizer;
+
     /**
      * @var array
      */
@@ -43,14 +48,21 @@ class Logger
     /**
      * Constructor
      *
-     * @param LoggerInterface $logger
-     * @param array           $allowedLevels
-     * @param array           $ignoredMessages
-     * @param array           $ignoredURLs
+     * @param LoggerInterface    $logger
+     * @param SanitizerInterface $sanitizer
+     * @param array              $allowedLevels
+     * @param array              $ignoredMessages
+     * @param array              $ignoredURLs
      */
-    public function __construct(LoggerInterface $logger, array $allowedLevels, array $ignoredMessages = array(), array $ignoredURLs = array())
-    {
+    public function __construct(
+        LoggerInterface $logger,
+        SanitizerInterface $sanitizer,
+        array $allowedLevels,
+        array $ignoredMessages = array(),
+        array $ignoredURLs = array()
+    ) {
         $this->logger = $logger;
+        $this->sanitizer = $sanitizer;
         $this->allowedLevels = $allowedLevels;
         $this->ignoredMessages = $ignoredMessages;
         $this->ignoredURLs = $ignoredURLs;
@@ -81,7 +93,11 @@ public function write($level, $message, array $context = array())
             }
         }
 
-        $this->logger->{$this->levelToMethod[$level]}($message, $context);
+        foreach ($context as $key => $value) {
+            $context[$key] = $this->sanitizer->sanitize($value);
+        }
+
+        $this->logger->{$this->levelToMethod[$level]}($this->sanitizer->sanitize($message), $context);
 
         return true;
     }

Resources/config/services.xml

@@ -6,18 +6,22 @@
 
     <parameters>
         <parameter key="nelmio_js_logger.logger.class">Nelmio\JsLoggerBundle\Logger</parameter>
+        <parameter key="nelmio_js_logger.sanitizer.class">Nelmio\JsLoggerBundle\StringSanitizer</parameter>
         <parameter key="nelmio_js_logger.twig_extension.class">Nelmio\JsLoggerBundle\TwigExtension</parameter>
     </parameters>
 
     <services>
         <service id="nelmio_js_logger.logger" class="%nelmio_js_logger.logger.class%">
             <argument type="service" id="logger" />
+            <argument type="service" id="nelmio_js_logger.sanitizer" />
             <argument>%nelmio_js_logger.allowed_levels%</argument>
             <argument>%nelmio_js_logger.ignore_messages%</argument>
             <argument>%nelmio_js_logger.ignore_url_prefixes%</argument>
             <tag name="monolog.logger" channel="frontend" />
         </service>
 
+        <service id="nelmio_js_logger.sanitizer" class="%nelmio_js_logger.sanitizer.class%" />
+
         <service id="nelmio_js_logger.twig_extension" class="%nelmio_js_logger.twig_extension.class%">
             <argument type="service" id="router" />
             <argument>%nelmio_js_logger.stacktrace_js_path%</argument>

SanitizerInterface.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace Nelmio\JsLoggerBundle;
+
+interface SanitizerInterface
+{
+    /**
+     * @param string $value
+     * @return string
+     */
+    public function sanitize($value);
+}

StringSanitizer.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace Nelmio\JsLoggerBundle;
+
+class StringSanitizer implements SanitizerInterface
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function sanitize($value)
+    {
+        return filter_var($value, FILTER_SANITIZE_STRING);
+    }
+}

TwigExtension.php

@@ -41,11 +41,10 @@ public function initErrorLogger($level = 'error', $includeScriptTag = true)
             function(stackframes) {
                 var req = new XMLHttpRequest();
                     req.onerror = function(err) {
-                                        if (typeof console !== 'undefined' && typeof console.log === 'function') {
-                                            console.log('An error occurred while trying to log an error using stacktrace.js!');
-                                        }
-                                        throw new Error('POST to $url failed.');
-                                   };
+                        if (typeof console !== 'undefined' && typeof console.log === 'function') {
+                            console.log('An error occurred while trying to log an error using stacktrace.js!');
+                        }
+                    };
                     req.onreadystatechange = function onreadystatechange() {
                         if (req.readyState === 4) {
                             if (req.status >= 200 && req.status < 400) {
@@ -56,7 +55,6 @@ function(stackframes) {
                                 if (typeof console !== 'undefined' && typeof console.log === 'function') {
                                     console.log('POST to $url failed with status: ' + req.status);
                                 }
-                                throw new Error('POST to $url failed with status: ' + req.status);
                             }
                         }
                     };