Sanitize URIs in <meta http-equiv="refresh" ...> and image candidate string attributes

[giuscris]

This pull request enhances the security and flexibility of HTML and SVG sanitization by improving how URI attributes are validated and by adding special handling for certain attributes such as srcset, imagesrcset, and meta refresh tags. The main changes include refactoring URI safety checks, extending attribute whitelists, and adding more granular logic for complex attributes.

Improvements to URI attribute validation:

• Refactored URI attribute validation in DomSanitizer: introduced a dedicated isSafeUriAttribute method for checking URI safety, and moved URI decoding logic to a new decodeUri method. The validation now consistently checks allowed schemes and external URI policy. (formwork/src/Sanitizer/DomSanitizer.php) [1] [2]

HTML-specific attribute handling:

• In HtmlSanitizer, added custom logic to handle <meta http-equiv="refresh" content="..."> by removing the content attribute if the refresh URI is unsafe, and improved validation for srcset and imagesrcset attributes by checking each URI in the list. (formwork/src/Sanitizer/HtmlSanitizer.php)

Extension of URI attribute whitelist:

• Added srcset and imagesrcset to the list of recognized URI attributes in HtmlReference, ensuring these are properly sanitized. (formwork/src/Sanitizer/Reference/HtmlReference.php)

SVG attribute sanitization fix:

• Fixed the SVG sanitizer to immediately return after removing unsafe SMIL attributes, preventing further processing of removed attributes. (formwork/src/Sanitizer/SvgSanitizer.php)

Dependency and import updates:

• Added necessary imports for DOMAttr and DOMElement in HtmlSanitizer to support the new logic. (formwork/src/Sanitizer/HtmlSanitizer.php)