<commit_before><?php

/**
 * This file is part of Laravel Security by <NAME>.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at http://bit.ly/UWsjkb.
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace GrahamCampbell\Security;

/**
 * This is the security class.
 *
 * Some code in this class it taken from EllisLab's CodeIgniter.
 * That code is licensed under the Open Software License version 3.0.
 * See the original here: http://bit.ly/1oQnpjn.
 *
 * @author    <NAME> <<EMAIL>>
 * @copyright 2013-2014 <NAME>
 * @license   <https://github.com/GrahamCampbell/Laravel-Security/blob/master/LICENSE.md> Apache 2.0
 */
class Security
{
    /**
     * A random hash for protecting urls.
     *
     * @var string
     */
    protected $xssHash;

    /**
     * The evil attributes.
     *
     * @var string[]
     */
    protected $evil;

    /**
     * Create a new security instance.
     *
     * @param string[] $evil
     *
     * @return void
     */
    public function __construct(array $evil = array('on\w*', 'style', 'xmlns', 'formaction', 'form', 'xlink:href'))
    {
        $this->evil = $evil;
    }

    /**
     * XSS clean.
     *
     * @param string|string[] $str
     *
     * @return string
     */
    public function clean($str)
    {
        if (is_array($str)) {
            while (list($key) = each($str)) {
                $str[$key] = $this->clean($str[$key]);
            }

            return $str;
        }

        $i = 0;
        do {
            $i++;
            $processed = $this->process($str);
        } while ($i < 3 && $processed !== $str);

        return $processed;
    }

    /**
     * Process a string for cleaning.
     *
     * @param string $str
     *
     * @return string
     */
    protected function process($str)
    {
        $str = $this->removeInvisibleCharacters($str);

        do {
            $str = rawurldecode($str);
        } while (preg_match('/%[0-9a-f]{2,}/i', $str));

        $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, 'convertAttribute'), $str);
        $str = preg_replace_callback('/<\w+.*?(?=>|<|$)/si', array($this, 'decodeEntity'), $str);

        $str = $this->removeInvisibleCharacters($str);

        $str = str_replace("\t", ' ', $str);

        $str = $this->doNeverAllowed($str);

        $str = str_replace(array('<?', '?'.'>'), array('&lt;?', '?&gt;'), $str);

        $words = array(
            'javascript', 'expression', 'vbscript', 'jscript', 'wscript',
            'vbs', 'script', 'base64', 'applet', 'alert', 'document',
            'write', 'cookie', 'window', 'confirm', 'prompt',
        );

        foreach ($words as $word) {
            $word = implode('\s*', str_split($word)).'\s*';
            $str = preg_replace_callback(
                '#('.substr($word, 0, -3).')(\W)#is',
                array($this, 'compactExplodedWords'),
                $str
            );
        }

        do {
            $original = $str;

            if (preg_match('/<a/i', $str)) {
                $str = preg_replace_callback(
                    '#<a[^a-z0-9>]+([^>]*?)(?:>|$)#si',
                    array($this, 'jsLinkRemoval'),
                    $str
                );
            }

            if (preg_match('/<img/i', $str)) {
                $str = preg_replace_callback(
                    '#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#si',
                    array($this, 'jsImgRemoval'),
                    $str
                );
            }

            if (preg_match('/script|xss/i', $str)) {
                $str = preg_replace('#</*(?:script|xss).*?>#si', '[removed]', $str);
            }
        } while ($original !== $str);

        unset($original);

        $str = $this->removeEvilAttributes($str);

        $naughty = 'alert|prompt|confirm|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|button|select|isindex|layer|link|meta|keygen|object|plaintext|style|script|textarea|title|math|video|svg|xml|xss';
        $str = preg_replace_callback(
            '#<(/*\s*)('.$naughty.')([^><]*)([><]*)#is',
            array($this, 'sanitizeNaughtyHtml'),
            $str
        );

        $str = preg_replace(
            '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
            '\\1\\2&#40;\\3&#41;',
            $str
        );

        return $this->doNeverAllowed($str);
    }

    /**
     * Generates the XSS hash if needed and returns it.
     *
     * @return string
     */
    protected function xssHash()
    {
        if (!$this->xssHash) {
            $this->xssHash = md5(uniqid(mt_rand(), true));
        }

        return $this->xssHash;
    }<commit_msg>Made the xss hash more robust<commit_after><?php

/**
 * This file is part of Laravel Security by <NAME>.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at http://bit.ly/UWsjkb.
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace GrahamCampbell\Security;

/**
 * This is the security class.
 *
 * Some code in this class it taken from EllisLab's CodeIgniter.
 * That code is licensed under the Open Software License version 3.0.
 * See the original here: http://bit.ly/1oQnpjn.
 *
 * @author    <NAME> <<EMAIL>>
 * @copyright 2013-2014 <NAME>
 * @license   <https://github.com/GrahamCampbell/Laravel-Security/blob/master/LICENSE.md> Apache 2.0
 */
class Security
{
    /**
     * A random hash for protecting urls.
     *
     * @var string
     */
    protected $xssHash;

    /**
     * The evil attributes.
     *
     * @var string[]
     */
    protected $evil;

    /**
     * Create a new security instance.
     *
     * @param string[] $evil
     *
     * @return void
     */
    public function __construct(array $evil = array('on\w*', 'style', 'xmlns', 'formaction', 'form', 'xlink:href'))
    {
        $this->evil = $evil;
    }

    /**
     * XSS clean.
     *
     * @param string|string[] $str
     *
     * @return string
     */
    public function clean($str)
    {
        if (is_array($str)) {
            while (list($key) = each($str)) {
                $str[$key] = $this->clean($str[$key]);
            }

            return $str;
        }

        $i = 0;
        do {
            $i++;
            $processed = $this->process($str);
        } while ($i < 3 && $processed !== $str);

        return $processed;
    }

    /**
     * Process a string for cleaning.
     *
     * @param string $str
     *
     * @return string
     */
    protected function process($str)
    {
        $str = $this->removeInvisibleCharacters($str);

        do {
            $str = rawurldecode($str);
        } while (preg_match('/%[0-9a-f]{2,}/i', $str));

        $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, 'convertAttribute'), $str);
        $str = preg_replace_callback('/<\w+.*?(?=>|<|$)/si', array($this, 'decodeEntity'), $str);

        $str = $this->removeInvisibleCharacters($str);

        $str = str_replace("\t", ' ', $str);

        $str = $this->doNeverAllowed($str);

        $str = str_replace(array('<?', '?'.'>'), array('&lt;?', '?&gt;'), $str);

        $words = array(
            'javascript', 'expression', 'vbscript', 'jscript', 'wscript',
            'vbs', 'script', 'base64', 'applet', 'alert', 'document',
            'write', 'cookie', 'window', 'confirm', 'prompt',
        );

        foreach ($words as $word) {
            $word = implode('\s*', str_split($word)).'\s*';
            $str = preg_replace_callback(
                '#('.substr($word, 0, -3).')(\W)#is',
                array($this, 'compactExplodedWords'),
                $str
            );
        }

        do {
            $original = $str;

            if (preg_match('/<a/i', $str)) {
                $str = preg_replace_callback(
                    '#<a[^a-z0-9>]+([^>]*?)(?:>|$)#si',
                    array($this, 'jsLinkRemoval'),
                    $str
                );
            }

            if (preg_match('/<img/i', $str)) {
                $str = preg_replace_callback(
                    '#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#si',
                    array($this, 'jsImgRemoval'),
                    $str
                );
            }

            if (preg_match('/script|xss/i', $str)) {
                $str = preg_replace('#</*(?:script|xss).*?>#si', '[removed]', $str);
            }
        } while ($original !== $str);

        unset($original);

        $str = $this->removeEvilAttributes($str);

        $naughty = 'alert|prompt|confirm|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|button|select|isindex|layer|link|meta|keygen|object|plaintext|style|script|textarea|title|math|video|svg|xml|xss';
        $str = preg_replace_callback(
            '#<(/*\s*)('.$naughty.')([^><]*)([><]*)#is',
            array($this, 'sanitizeNaughtyHtml'),
            $str
        );

        $str = preg_replace(
            '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
            '\\1\\2&#40;\\3&#41;',
            $str
        );

        return $this->doNeverAllowed($str);
    }

    /**
     * Generates the XSS hash if needed and returns it.
     *
     * @return string
     */
    protected function xssHash()
    {
        if (!$this->xssHash) {
            $this->xssHash = str_random(40);
        }

        return $this->xssHash;
    }
{'fraction_non_alphanumeric': 0.18011886503067484, 'fraction_numerical': 0.007956288343558281, 'mean_word_length': 2.0196816208393633, 'pattern_counts': {'":': 0, '<': 41, '<?xml version=': 0, '>': 59, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 4}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3344794', 'n_tokens_mistral': 3426, 'n_tokens_neox': 3270, 'n_words': 704}