Revert "fix(textfield): Unescaped HTML when displaying a form answer"

This reverts commit d476385.

inc/field/textfield.class.php

@@ -63,7 +63,7 @@ public function showForm(array $options): void {
 
    public function getRenderedHtml($domain, $canEdit = true): string {
       if (!$canEdit) {
-         return Sanitizer::sanitize($this->value, false);
+         return $this->value;
       }
 
       $html         = '';
@@ -108,11 +108,7 @@ public function getValueForDesign(): string {
    }
 
    public function getValueForTargetText($domain, $richText): ?string {
-      if ($richText) {
-         return Sanitizer::sanitize($this->value, false);
-      }
-
-      return $this->value;
+      return Sanitizer::unsanitize($this->value);
    }
 
    public function moveUploads() {

inc/formanswer.class.php

@@ -1353,6 +1353,7 @@ public function parseTags(string $content, PluginFormcreatorTargetInterface $tar
                }
             }
          }
+         // $content = str_replace('##answer_' . $questionId . '##', Sanitizer::sanitize($value ?? ''), $content);
          $content = str_replace('##answer_' . $questionId . '##', $value ?? '', $content);
 
          if ($this->questionFields[$questionId] instanceof DropdownField) {

tests/3-unit/GlpiPlugin/Formcreator/Field/TextField.php

@@ -397,12 +397,6 @@ public function providerGetValueForTargetText() {
             'expected' => true,
             'expectedValue' => 'foo\\bar',
          ],
-         [
-            'question' => $this->getQuestion(),
-            'value' => '"><img src=x onerror="alert(1337)" x=x>',
-            'expected' => true,
-            'expectedValue' => '"><img src=x onerror="alert(1337)" x=x>',
-         ],
       ];
    }
 
@@ -426,13 +420,5 @@ public function testGetValueForTargetText($question, $value, $expected, $expecte
       }
    }
 
-   public function testGetRenderedHtml() {
-      // XSS check
-      $instance = $this->newTestedInstance($this->getQuestion());
-      $instance->deserializeValue('"><img src=x onerror="alert(1337)" x=x>');
-      $output = $instance->getRenderedHtml('no_domain', false);
-      $this->string($output)->isEqualTo('"&#62;&#60;img src=x onerror="alert(1337)" x=x&#62;');
-      $output = $instance->getRenderedHtml('no_domain', true);
-      $this->string($output)->contains('&quot;><img src=x onerror=&quot;alert(1337)&quot; x=x>');
-   }
+
 }

tests/3-unit/GlpiPlugin/Formcreator/Field/TextareaField.php

@@ -313,16 +313,4 @@ public function testGetValueForApi($input, $expected) {
       $output = $instance->getValueForApi();
       $this->string($output)->isEqualTo($expected);
    }
-
-   public function testGetRenderedHtml() {
-      // XSS check
-      $formAnswer = new PluginFormcreatorFormAnswer();
-      $instance = $this->newTestedInstance($this->getQuestion());
-      $instance->setFormAnswer($formAnswer);
-      $instance->deserializeValue('"><img src=x onerror="alert(1337)" x=x>');
-      $output = $instance->getRenderedHtml('no_domain', false);
-      $this->string($output)->isEqualTo('"&gt;<img src="x" alt="image"  loading="lazy">');
-      $output = $instance->getRenderedHtml('no_domain', true);
-      $this->string($output)->contains('"><img src=x onerror="alert(1337)" x=x>');
-   }
 }

tests/src/CommonTargetTestCase.php

@@ -2,20 +2,9 @@
 
 namespace GlpiPlugin\Formcreator\Tests;
 use PluginFormcreatorForm;
-use PluginFormcreatorFormAnswer;
-use PluginFormcreatorSection;
 
 abstract class CommonTargetTestCase extends CommonTestCase
 {
-   public function beforeTestMethod($method) {
-      parent::beforeTestMethod($method);
-      switch ($method) {
-         case 'testXSS':
-            $this->login('glpi', 'glpi');
-            break;
-      }
-   }
-
    /**
     * Test handling of uuid when adding an item
     */
@@ -67,35 +56,4 @@ public function testPrepareInputForUpdate_uuid() {
        $this->array($output)->HasKey('uuid');
        $this->string($output['uuid'])->isEqualTo('foo');
    }
-
-   public function testXSS() {
-      $question = $this->getQuestion([
-         'fieldtype' => 'text',
-      ]);
-      $section = new PluginFormcreatorSection();
-      $section->update([
-            'id' => $question->fields['plugin_formcreator_sections_id'],
-            'name' => 'section',
-      ]);
-      $form = PluginFormcreatorForm::getByItem($question);
-      $testedClassName = $this->getTestedClassName();
-      $target = new $testedClassName();
-      $target->add([
-         'name' => $this->getUniqueString(),
-         'plugin_formcreator_forms_id' => $form->getID(),
-         'target_name' => '##answer_' . $question->getID() . '##',
-         'content'     => '##FULLFORM##',
-      ]);
-      $formAnswer = new PluginFormcreatorFormAnswer();
-      $formAnswer->add([
-         'plugin_formcreator_forms_id' => $form->getID(),
-         'formcreator_field_' . $question->getID() => '"><img src=x onerror="alert(1337)" x=x>"',
-      ]);
-      $generated = $formAnswer->targetList[0] ?? null;
-      $this->object($generated);
-      $this->string($generated->fields['name'])
-         ->isEqualTo('"><img src=x onerror="alert(1337)" x=x>"');
-      $this->string($generated->fields['content'])
-         ->isEqualTo('<h1>Form data</h1><h2>section</h2><div><b>1) question : </b>"><img src=x onerror="alert(1337)" x=x>"</div>');
-   }
-}
+}