[EasyApiPlatform] Add OutputSanitizerListener

packages/EasyApiPlatform/bundle/EasyApiPlatformBundle.php

@@ -35,6 +35,10 @@ public function loadExtension(array $config, ContainerConfigurator $container, C
             $container->import('config/pagination.php');
         }
 
+        if ($config['output_sanitizer']['enabled']) {
+            $container->import('config/output_sanitizer.php');
+        }
+
         if ($config['return_not_found_on_read_operations']['enabled']) {
             $container->import('config/state_provider.php');
         }

packages/EasyApiPlatform/bundle/config/definition.php

@@ -25,6 +25,9 @@
             ->arrayNode('custom_paginator')
                 ->canBeDisabled()
             ->end()
+            ->arrayNode('output_sanitizer')
+                ->canBeEnabled()
+            ->end()
             ->arrayNode('return_not_found_on_read_operations')
                 ->canBeDisabled()
             ->end()

packages/EasyApiPlatform/bundle/config/output_sanitizer.php

@@ -0,0 +1,16 @@
+<?php
+declare(strict_types=1);
+
+namespace Symfony\Component\DependencyInjection\Loader\Configurator;
+
+use EonX\EasyApiPlatform\Common\Listener\OutputSanitizerListener;
+
+return static function (ContainerConfigurator $container): void {
+    $services = $container->services();
+
+    $services->defaults()
+        ->autowire()
+        ->autoconfigure();
+
+    $services->set(OutputSanitizerListener::class);
+};

packages/EasyApiPlatform/src/Common/Listener/OutputSanitizerListener.php

@@ -0,0 +1,32 @@
+<?php
+declare(strict_types=1);
+
+namespace EonX\EasyApiPlatform\Common\Listener;
+
+use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\HttpKernel\Event\ResponseEvent;
+
+#[AsEventListener]
+final class OutputSanitizerListener
+{
+    public function __invoke(ResponseEvent $event): void
+    {
+        if ($event->isMainRequest() === false) {
+            return;
+        }
+
+        $response = $event->getResponse();
+
+        if (\str_contains((string)$response->headers->get('Content-Type'), 'application/json') === false) {
+            return;
+        }
+
+        $content = $response->getContent();
+
+        if ($content === false) {
+            return;
+        }
+
+        $response->setContent(\str_replace(['<', '>'], ['&lt;', '&gt;'], $content));
+    }
+}

packages/EasyApiPlatform/tests/Application/src/Common/Listener/OutputSanitizerListenerTest.php

@@ -0,0 +1,43 @@
+<?php
+declare(strict_types=1);
+
+namespace EonX\EasyApiPlatform\Tests\Application\src\Common\Listener;
+
+use Doctrine\ORM\EntityManagerInterface;
+use EonX\EasyApiPlatform\Tests\Application\AbstractApplicationTestCase;
+use EonX\EasyApiPlatform\Tests\Fixture\App\CustomPaginator\ApiResource\Category;
+
+final class OutputSanitizerListenerTest extends AbstractApplicationTestCase
+{
+    public function testItSucceeds(): void
+    {
+        self::setUpClient(['environment' => 'enable_output_sanitizer']);
+        $this->initDatabase();
+        $entityManager = self::getService(EntityManagerInterface::class);
+        $category = (new Category())->setTitle('<Some category>');
+        $entityManager->persist($category);
+        $entityManager->flush();
+
+        $response = self::$client->request('GET', '/categories/' . $category->getId());
+
+        $responseData = $response->toArray(false);
+
+        self::assertSame('&lt;Some category&gt;', $responseData['title']);
+    }
+
+    public function testItSucceedsAndDoesNothingWhenDisabled(): void
+    {
+        $this->initDatabase();
+        $entityManager = self::getService(EntityManagerInterface::class);
+        $title = '<Some category>';
+        $category = (new Category())->setTitle($title);
+        $entityManager->persist($category);
+        $entityManager->flush();
+
+        $response = self::$client->request('GET', '/categories/' . $category->getId());
+
+        $responseData = $response->toArray(false);
+
+        self::assertSame($title, $responseData['title']);
+    }
+}

packages/EasyApiPlatform/tests/Fixture/app/config/packages/enable_output_sanitizer/easy_api_platform.php

@@ -0,0 +1,11 @@
+<?php
+declare(strict_types=1);
+
+namespace Symfony\Component\DependencyInjection\Loader\Configurator;
+
+use Symfony\Config\EasyApiPlatformConfig;
+
+return static function (EasyApiPlatformConfig $easyApiPlatformConfig): void {
+    $easyApiPlatformConfig->outputSanitizer()
+        ->enabled(true);
+};