yf_security class

    public function entity_decode($str, $charset = null)
    {
        if (strpos($str, '&') === false) {
            return $str;
        }
        if (empty($charset)) {
            $charset = conf('charset');
        }
        do {
            $matches = $matches1 = 0;
            $str = html_entity_decode($str, ENT_COMPAT, $charset);
            $str = preg_replace_callback('~&#x(0*[0-9a-f]{2,5})~i', function ($m) {
                return chr(hexdec($m[1]));
            }, $str, -1, $matches);
            $str = preg_replace_callback('~&#([0-9]{2,4})~', function ($m) {
                return chr($m[1]);
            }, $str, -1, $matches1);
        } while ($matches or $matches1);
        return $str;
    }

    public function remove_invisible_characters($str, $url_encoded = true)
    {
        $non_displayables = [];
        // every control character except newline (dec 10),
        // carriage return (dec 13) and horizontal tab (dec 09)
        if ($url_encoded) {
            $non_displayables[] = '/%0[0-8bcef]/';	// url encoded 00-08, 11, 12, 14, 15
            $non_displayables[] = '/%1[0-9a-f]/';	// url encoded 16-31
        }
        $non_displayables[] = '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S';	// 00-08, 11, 12, 14-31, 127
        do {
            $str = preg_replace($non_displayables, '', $str, -1, $count);
        } while ($count);
        return $str;
    }

    public function sanitize_filename($str, $relative_path = false)
    {
        $bad = $this->filename_bad_chars;
        if ( ! $relative_path) {
            $bad[] = './';
            $bad[] = '/';
        }
        $str = $this->remove_invisible_characters($str, false);
        do {
            $old = $str;
            $str = str_replace($bad, '', $str);
        } while ($old !== $str);
        return stripslashes($str);
    }

    public function strip_image_tags($str)
    {
        return preg_replace(['#<img\s+.*?src\s*=\s*["\'](.+?)["\'].*?\>#', '#<img\s+.*?src\s*=\s*(.+?).*?\>#'], '\\1', $str);
    }

    public function xss_clean($str, $is_image = false)
    {
        // Is the string an array?
        if (is_array($str)) {
            while ($key = key($str)) {
                $str[$key] = $this->xss_clean($str[$key]);
                next($str);
            }
            return $str;
        }
        // Remove Invisible Characters and validate entities in URLs
        $str = $this->_validate_entities($this->remove_invisible_characters($str));

        // URL Decode, Just in case stuff like this is submitted: <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
        // Note: Use rawurldecode() so it does not remove plus signs
        $str = rawurldecode($str);

        // Convert character entities to ASCII
        // This permits our tests below to work reliably. We only convert entities that are within tags since  these are the ones that will pose security problems.
        $str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", [$this, '_convert_attribute'], $str);
        $str = preg_replace_callback('/<\w+.*/si', [$this, '_decode_entity'], $str);

        // Remove Invisible Characters Again!
        $str = $this->remove_invisible_characters($str);

        // Convert all tabs to spaces
        // This prevents strings like this: ja	vascript
        // NOTE: we deal with spaces between characters later.
        // NOTE: preg_replace was found to be amazingly slow here on large blocks of data, so we use str_replace.
        $str = str_replace("\t", ' ', $str);

        // Capture converted string for later comparison
        $converted_string = $str;

        // Remove strings that are never allowed
        $str = $this->_do_never_allowed($str);

        // Makes PHP tags safe
        // Note: XML tags are inadvertently replaced too: <?xml  But it doesn't seem to pose a problem.
        if ($is_image === true) {
            // Images have a tendency to have the PHP short opening and
            // closing tags every so often so we skip those and only
            // do the long opening tags.
            $str = preg_replace('/<\?(php)/i', '<?\\1', $str);
        } else {
            $str = str_replace(['<?', '?' . '>'], ['<?', '?>'], $str);
        }

        // Compact any exploded words
        // This corrects words like:  j a v a s c r i p t,  These words are compacted back to their correct state.
        $words = [
            'javascript', 'expression', 'vbscript', 'script', 'base64',
            'applet', 'alert', 'document', 'write', 'cookie', 'window',
        ];
        foreach ($words as $word) {
            $word = implode('\s*', str_split($word)) . '\s*';
            // We only want to do this when it is followed by a non-word character
            // That way valid stuff like "dealer to" does not become "dealerto"
            $str = preg_replace_callback('#(' . substr($word, 0, -3) . ')(\W)#is', [$this, '_compact_exploded_words'], $str);
        }

        // Remove disallowed Javascript in links or img tags
        // We used to do some version comparisons and use of stripos for PHP5, but it is dog slow compared to these simplified non-capturing preg_match(), especially if the pattern exists in the string
        do {
            $original = $str;
            if (preg_match('/<a/i', $str)) {
                $str = preg_replace_callback('#<a\s+([^>]*?)(?:>|$)#si', [$this, '_js_link_removal'], $str);
            }
            if (preg_match('/<img/i', $str)) {
                $str = preg_replace_callback('#<img\s+([^>]*?)(?:\s?/?>|$)#si', [$this, '_js_img_removal'], $str);
            }
            if (preg_match('/script|xss/i', $str)) {
                $str = preg_replace('#</*(?:script|xss).*?>#si', '[removed]', $str);
            }
        } while ($original !== $str);
        unset($original);

        // Remove evil attributes such as style, onclick and xmlns
        $str = $this->_remove_evil_attributes($str, $is_image);

        // Sanitize naughty HTML elements
        // If a tag containing any of the words in the list below is found, the tag gets converted to entities.
        // So this: <blink> Becomes: <blink>
        $naughty = 'alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|isindex|layer|link|meta|object|plaintext|style|script|textarea|title|video|xml|xss';
        $str = preg_replace_callback('#<(/*\s*)(' . $naughty . ')([^><]*)([><]*)#is', [$this, '_sanitize_naughty_html'], $str);

        // Sanitize naughty scripting elements
        // Similar to above, only instead of looking for  tags it looks for PHP and JavaScript commands that are disallowed. Rather than removing the
        // code, it simply converts the parenthesis to entities rendering the code un-executable.
        // For example:	eval('some code')  Becomes:	eval('some code')
        $str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', '\\1\\2(\\3)', $str);

        // Final clean up. This adds a bit of extra precaution in case something got through the above filters
        $str = $this->_do_never_allowed($str);

        // Images are handled in a special way
        // Essentially, we want to know that after all of the character conversion is done whether any unwanted, likely XSS, code was found. If not, we return TRUE, as the image is clean.
        // However, if the string post-conversion does not matched the string post-removal of XSS, then it fails, as there was unwanted XSS code found and removed/changed during processing.
        if ($is_image === true) {
            return $str === $converted_string;
        }
        return $str;
    }

    public function xss_hash()
    {
        if ($this->_xss_hash === '') {
            $this->_xss_hash = md5(uniqid(mt_rand()));
        }
        return $this->_xss_hash;
    }

    public function __call($name, $args)
    {
        return main()->extend_call($this, $name, $args);
    }