Безопасность заметок и прокси изображений

Web/Models/Entities/Note.php

@@ -2,6 +2,33 @@
 namespace openvk\Web\Models\Entities;
 use HTMLPurifier_Config;
 use HTMLPurifier;
+use HTMLPurifier_Filter;
+
+class SecurityFilter extends HTMLPurifier_Filter
+{
+    public function preFilter($html, $config, $context)
+    {
+        $html = preg_replace_callback(
+            '/<img[^>]*src\s*=\s*["\']([^"\']*)["\'][^>]*>/i',
+            function ($matches) {
+                $originalSrc = $matches[1];
+                $encodedSrc = '/image.php?url=' . base64_encode($originalSrc);
+                return str_replace($originalSrc, $encodedSrc, $matches[0]);
+            },
+            $html
+        );
+
+        return preg_replace_callback(
+            '/<a[^>]*href\s*=\s*["\']([^"\']*)["\'][^>]*>/i',
+            function ($matches) {
+                $originalHref = $matches[1];
+                $encodedHref = '/away.php?to=' . urlencode($originalHref);
+                return str_replace($originalHref, $encodedHref, $matches[0]);
+            },
+            $html
+        );
+    }
+}
 
 class Note extends Postable
 {
@@ -74,7 +101,8 @@ class Note extends Postable
         $config->set("Attr.AllowedClasses", [
             "underline",
         ]);
-    
+        $config->set('Filter.Custom', [new SecurityFilter()]);
+
         $source = NULL;
         if(is_null($this->getRecord())) {
             if(isset($this->changes["source"]))

Web/Presenters/ImagesProxyPresenter.php

@@ -0,0 +1,56 @@
+<?php declare(strict_types=1);
+
+namespace openvk\Web\Presenters;
+
+use openvk\Web\Models\Repositories\{Gifts, Users};
+use openvk\Web\Models\Entities\Notifications\GiftNotification;
+
+final class ImagesProxyPresenter extends OpenVKPresenter
+{
+    const CACHE_EXPIRATION = 1210000;
+
+    private function image(string $contentType, $contentSize, string $raw): void
+    {
+        header("Content-Type: $contentType");
+        header("Content-Size: $contentSize");
+        header("Cache-Control: public, max-age=" . self::CACHE_EXPIRATION);
+        header("X-Accel-Expires: " . self::CACHE_EXPIRATION);
+        exit($raw);
+    }
+
+    private function placeholder(): void
+    {
+        $placeholder = file_get_contents(__DIR__ . "/../static/img/oof.apng");
+        $this->image("image/png", strlen($placeholder), $placeholder);
+    }
+
+    public function renderIndex(): void
+    {
+        $url = base64_decode($this->requestParam("url"));
+        if (!$url || !filter_var($url, FILTER_VALIDATE_URL)) {
+            $this->placeholder();
+        }
+
+        $ch = curl_init($url);
+        curl_setopt_array($ch, [
+            CURLOPT_HEADER => 0,
+            CURLOPT_URL => $url,
+            CURLOPT_USERAGENT => OPENVK_ROOT_CONF["openvk"]["appearance"]["name"] . ' Images Proxy/1.0',
+            CURLOPT_REFERER => "https://$_SERVER[SERVER_NAME]/",
+            CURLOPT_RETURNTRANSFER => 1,
+            CURLOPT_BINARYTRANSFER => 1,
+        ]);
+
+        $raw = curl_exec($ch);
+        $contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
+        $contentSize = curl_getinfo($ch, CURLINFO_CONTENT_LENGTH_DOWNLOAD);
+
+        curl_close($ch);
+
+        if ($raw && str_contains($contentType, "image")) {
+            $this->image($contentType, $contentSize, $raw);
+        } else {
+            $this->placeholder();
+        }
+    }
+}

Web/di.yml

@@ -49,3 +49,4 @@ services:
     - openvk\Web\Models\Repositories\BannedLinks
     - openvk\Web\Models\Repositories\ChandlerGroups
     - openvk\Web\Presenters\MaintenancePresenter
+    - openvk\Web\Presenters\ImagesProxyPresenter

Web/routes.yml

@@ -349,6 +349,8 @@ routes:
       handler: "About->dev"
     - url: "/tour"
       handler: "About->tour"
+    - url: "/image.php"
+      handler: "ImagesProxy->index"
     - url: "/{?shortCode}"
       handler: "UnknownTextRouteStrategy->delegate"
       placeholders: