Code Monkey home page Code Monkey logo

ionizer's Introduction

Ionizer

Build Status Latest Stable Version Latest Unstable Version License Downloads

Ionizer provides strict typing and input validation for dynamic inputs (i.e. HTTP request parameters). Requires PHP 7 or higher.

What is Ionizer?

Ionizer is a structured input filtering system ideal for HTTP form data.

Why is Ionizer important?

Aside from the benefits of being able to strictly type your applications that accept user input, Ionizer makes it easy to mitigate some NoSQL injection techniques.

Installing

Get Composer, then run the following:

composer require paragonie/ionizer

Usage

<?php

use ParagonIE\Ionizer\GeneralFilterContainer;
use ParagonIE\Ionizer\Filter\{
    StringFilter,
    AllowList
};

// Define properties to filter:
$ic = new GeneralFilterContainer();
$ic->addFilter(
        'username',
        (new StringFilter())->setPattern('^[A-Za-z0-9_\-]{3,24}$')
    )
    ->addFilter('passphrase', new StringFilter())
    ->addFilter(
        'domain',
        new AllowList('US-1', 'US-2', 'EU-1', 'EU-2')
    );

// Invoke the filter container on the array to get the filtered result:
try {
    // $post passed all of our filters.
    $post = $ic($_POST);
} catch (\TypeError $ex) {
    // Invalid data provided.
}

Ionizer can even specify structured input with some caveats.

<?php

use ParagonIE\Ionizer\GeneralFilterContainer;
use ParagonIE\Ionizer\Filter\{
    IntFilter,
    IntArrayFilter,
    StringArrayFilter,
    StringFilter
};

$ic = new GeneralFilterContainer();
    // You can type entire arrays at once:
$ic->addFilter('numbers', new IntArrayFilter())
    ->addFilter('strings', new StringArrayFilter())
    
    // You can also specify subkeys, separated by a period:
    ->addFilter('user.name', new StringFilter())
    ->addFilter('user.unixtime', new IntFilter());

$input = [
    'numbers' => [1, 2, 3],
    'strings' => ['a', 'b'],
    'user' => [
        'name' => 'test',
        'unixtime' => time()
    ]    
];

try {
    $valid = $ic($input);
} catch (\TypeError $ex) {
}

Support Contracts

If your company uses this library in their products or services, you may be interested in purchasing a support contract from Paragon Initiative Enterprises.

ionizer's People

Contributors

paragonie-security avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar

ionizer's Issues

Optimization: Overkill composer command in Travis build

In the install part of the Travis configuration:

ionizer/.travis.yml

Lines 16 to 17 in e3abcb2

install:
- composer update

I believe a composer install would be enough since the dependencies should already have been computed and committed in the composer.lock file beforehand.

It would significantly speed up Travis builds, although the effect is directly dependent on the number of dependencies.

Philosophy: Does the type check code belong to overloading classes?

Shouldn't this code:

if ($this->type === 'int') {
if (\is_array($data)) {
throw new \TypeError(
\sprintf('Unexpected array for integer filter (%s).', $this->index)
);
}
if (\is_int($data) || \is_float($data)) {
$data = (int) $data;
} elseif (\is_null($data) || $data === '') {
$data = null;
} elseif (\is_string($data) && \preg_match('#^\-?[0-9]+$#', $data)) {
$data = (int) $data;
} else {
throw new \TypeError(
\sprintf('Expected an integer (%s).', $this->index)
);
}
}

Be moved to the respective Filter\IntFilter::process() function?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.