[HtmlSanitizer] Add support for sanitizing unlimited length of HTML document

Author: lyrixx

CHANGELOG.md

@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+6.4
+---
+
+ * Add support for sanitizing unlimited length of HTML document
+
 6.1
 ---
 

HtmlSanitizer.php

@@ -60,7 +60,7 @@ private function sanitizeWithContext(string $context, string $input): string
         $this->domVisitors[$context] ??= $this->createDomVisitorForContext($context);
 
         // Prevent DOS attack induced by extremely long HTML strings
-        if (\strlen($input) > $this->config->getMaxInputLength()) {
+        if (-1 !== $this->config->getMaxInputLength() && \strlen($input) > $this->config->getMaxInputLength()) {
             $input = substr($input, 0, $this->config->getMaxInputLength());
         }
 

HtmlSanitizerConfig.php

@@ -405,8 +405,16 @@ public function withoutAttributeSanitizer(AttributeSanitizerInterface $sanitizer
         return $clone;
     }
 
+    /**
+     * @param int $maxInputLength The maximum length of the input string in bytes
+     *                            -1 means no limit
+     */
     public function withMaxInputLength(int $maxInputLength): static
     {
+        if ($maxInputLength < -1) {
+            throw new \InvalidArgumentException(sprintf('The maximum input length must be greater than -1, "%d" given.', $maxInputLength));
+        }
+
         $clone = clone $this;
         $clone->maxInputLength = $maxInputLength;
 

Tests/HtmlSanitizerAllTest.php

@@ -561,4 +561,15 @@ public static function provideSanitizeBody()
             yield $case[0] => $case;
         }
     }
+
+    public function testUnlimitedLength()
+    {
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));
+
+        $input = str_repeat('a', 10_000_000);
+
+        $sanitized = $sanitizer->sanitize($input);
+
+        $this->assertSame(\strlen($input), \strlen($sanitized));
+    }
 }