Preventing XSS in a Symfony form to add a timetable entry

Question

I have started to implement cross site scripting prevention (xss) within my code.

However as I am using symfony for this particular project I have read up that nothing needs to be done for xss in symfony as it is already protected from it, is this case?

If this is not the case I want to make sure that the code I have written below if sufficient enough to protect from xss. Or if there is anything I can do to enhance it to prevent xss attacks.

Here is what my controller looks like

$app->post('/addTimetable', function(Request $request) use($app) {

$tutoremail = $app['request']->get('tutoremail');
$starttime = $app['request']->get('starttime');
$endtime = $app['request']->get('endtime');
$location = $app['request']->get('location');
$class = $app['request']->get('class');
$level = $app['request']->get('level');
$topic = $app['request']->get('topic');
$capacity = $app['request']->get('capacity');
$postcode = $app['request']->get('postcode');
$post = array($tutoremail,$starttime,$endtime,$location,$class,$level,$topic,$capacity,$postcode);

$tutoremail = trim(filter_var($tutoremail,FILTER_SANITIZE_EMAIL));
//not sure how to filter datetime
$location = trim(filter_var($location,FILTER_SANITIZE_STRING));
$class = trim(filter_var($class,FILTER_SANITIZE_STRING));
$level = trim(filter_var($level,FILTER_SANITIZE_STRING));
$topic = trim(filter_var($topic,FILTER_SANITIZE_STRING));
$capacity = trim(filter_var($capacity,FILTER_SANITIZE_NUMBER_INT));

if(!(isset($tutoremail)) || !(isset($starttime)) || !(isset($endtime)) || !(isset($location)) || !(isset($class)) || !(isset($level)) || !(isset($topic)) || !(isset($capacity))){
    $app['session']->getFlashBag()->add('error','Please fill in all fields');
    return $app->redirect('/admin');
}else if($app['auth']->spamBotCheck($post)){
    $app['session']->getFlashBag()->add('error', 'There was a problem with the information you entered');
    return $app->redirect('/admin');
}else if($app['auth']->honeyPotCheck($postcode)){
    $app['session']->getFlashBag()->add('error','Your form submission has an error');
    return $app->redirect('/admin');
}else if(is_numeric($capacity) && $app['admin']->add_timetable($tutoremail,$starttime,$endtime,$location,$class,$level,$topic,$capacity)){
    $app['session']->getFlashBag()->add('success','Success! New lesson added to timetable');
    return $app->redirect('/admin');
} else {
    $app['session']->getFlashBag()->add('error','Error! New lesson not added to timetable');
    return $app->redirect('/admin');
}
});

Here is the model code for the methods spamBotCheck and honeyPotCheck

public function spamBotCheck($post){
    foreach($post as $value){
        if(stripos($value,'Content-Type:') !== FALSE){
            return true;
        }else{
            return false;
        }
    }

}

public function honeyPotCheck($postcode){
 if($postcode != ""){
    return true;
 }else{
    return false;
 }
}

and lastly here is my form from my twig file

<form class="form-signin collapse" id="demo" method="post" action="/addTimetable">

    <label for="ad_tutoremail" class="sr-only">Tutor Email:</label>
    <input class="form-control" name="tutoremail" type="email" id="ad_tutoremail" placeholder="Tutoremail" required>

    <label for="ad_starttime" class="sr-only">Starttime:</label>
    <input class="form-control" name="starttime" type="text" id="ad_starttime" placeholder="Starttime" required>

    <label for="ad_endtime" class="sr-only">Endtime:</label>
    <input class="form-control" name="endtime" type="text" id="ad_endtime" placeholder="Endtime" required>

    <label for="ad_location" class="sr-only">Location:</label>
    <input class="form-control" name="location" type="text" id="ad_location" placeholder="Location" required>

    <label for="ad_class" class="sr-only">Class:</label>
    <input class="form-control" name="class" type="text" id="ad_class" placeholder="Class" required>

    <label for="ad_level" class="sr-only">Level:</label>
    <input class="form-control" name="level" type="text" id="ad_level" placeholder="Level" required>

    <label for="ad_topic" class="sr-only">Topic:</label>
    <input class="form-control" name="topic" type="text"id="ad_topic" placeholder="Topic" required>

    <label for="ad_capacity" class="sr-only">Capacity:</label>
    <input class="form-control" name="capacity" type="text" id="ad_capacity" placeholder="Capacity" required>

    <div class="spamCheck">
        <label for="inputPostcode" class=sr-only">Postcode</label>
        <input type="text" id="inputPostcode" class="form-control" name="postcode" placeholder="Leave this field blank" />
    </div>

    <input class="createButton" type="submit" value="Create">

</form>

Answer 1

I have read up that nothing needs to be done for xss in symfony as it is already protected from it, is this case?

The Twig templating engine automatically encodes output variables, which will prevent XSS in most situations, but not all. A simple example is <script>[user_input]</script> or <a href="" onclick="[user_input]">click me</a>.

PHP templates do not encode output, and of course any echoes you perform outside of templates are also not encoded.

If this is not the case I want to make sure that the code I have written below if sufficient enough to protect from xss. Or if there is anything I can do to enhance it to prevent xss attacks.

You don't actually print any variables, so there is no danger of XSS in the code you provided.

Your additional input filter is generally a very good idea (as defense-in-depth; never as only defense; XSS is prevented by encoding output), although I would suggest that you write your own instead of using the filter functions PHP provides. The problem with FILTER_SANITIZE_STRING:

• It is poorly named. What does sanitize string even mean? This also means that the behavior may be changed in later versions, as it would still fit the name.
• It is poorly documented. It says this: Strip tags, optionally strip or encode special characters. It does apply strip_tags, but it also encodes ' and " by default, not optionally. < and > on the other hand are not encoded.
• It changes your input. strip_tags doesn't actually just strip tags. If there is a stray < in the string, it will remove anything afterwards which may cause bugs (I <3 you becomes I, super<secure_password becomes super).
• Encoding should happen at the output, not at the input.

I would suggest that you write your own input filter class, which may look something like the linked one.