make voku/anti-xss an optional package

[jasverix]

This package installs voku/portable-utf8 which "sanitizes" REQUEST_URI in globals, which in turn crashed our entire system.

Library packages should never 'do' anything, just be libraries.

This is:

- [ x ] a bugfix
- [ ] a new feature

Checklist:

• Changes are covered by unit tests
• Code style is respected
• Commit message explains why the change is made (see https://github.com/erlang/otp/wiki/Writing-good-commit-messages)
• CHANGELOG.md contains a short summary of the change
• Documentation is updated as necessary

Why this change is needed?

Our system did break down some time ago after installing voku/portable-utf8 because it sanitizes global variable REQUEST_URI. After that, the package is completely banned from our code base. I don't know if you will accept making it optional (only used one place..), but I will give it a try.

[MarkBaker]

Simply making this optional exposes the security vulnerability that it was intended to fix, which is not a good thing. Users don't install optional extras unless they need them; and security issues should never be an optional add-in

There is at least one practical alternative to voku/antixss, although it isn't quite as lightweight or easy to use, and that is ezyang/htmlpurifier, which is still active and also PHP8 ready... would you have any problems switching to that instead

[jasverix]

Yes, I understand, and I just wanted to open discussion, because I did not think you would just remove it. But voku/portable-utf8 has a bootstrap.php file which does a little more than we can accept - libraries should in my world just add classes and not do things on each request.

I would not have any problems using htmlpurifier, that library is not adding any bootstrap file at least (and has much less dependencies). I can fix the PR to do that instead, and then you can consider. I am not using the HTML Writer myself.

[jasverix]

Tried to implement this now, but you have unit-tests requiring that this string is not allowed:
<div class="comment">javascript:alert(1)</div>

That's not dangerous HTML, it's just strange plain text. As an attribute, though, it is more dangerous. But should we still not allow this text? Looks like anti-xss removed it completely, but HTMLPurifier leaves it (but the first test <script>alert('test')</script> is passing)

[MarkBaker]

I've updated the tests, and modified the code to use HTMLPurifier instead of anti-xss in a separate PR

[jasverix]

Great! Thank you!