Merge branch '6.4' into 7.0

* 6.4:
  [Messenger] Fix requiring symfony/deprecation-contracts
  [AssetMapper] Warn of missing or incompat dependencies
  Added missing Uzbek translations.
  [Messenger] [Sqs] Add `AddFifoStamp` middleware
  DX: nullable_type_declaration
  [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document
  [Validator] Add missing Finnish translations
  [FrameworkBundle][Routing][Translation][Workflow] Move some compiler passes from FrameworkBundle to components

Author: nicolas-grekas

CHANGELOG.md

@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+6.4
+---
+
+ * Add support for sanitizing unlimited length of HTML document
+
 6.1
 ---
 

HtmlSanitizer.php

@@ -60,7 +60,7 @@ private function sanitizeWithContext(string $context, string $input): string
         $this->domVisitors[$context] ??= $this->createDomVisitorForContext($context);
 
         // Prevent DOS attack induced by extremely long HTML strings
-        if (\strlen($input) > $this->config->getMaxInputLength()) {
+        if (-1 !== $this->config->getMaxInputLength() && \strlen($input) > $this->config->getMaxInputLength()) {
             $input = substr($input, 0, $this->config->getMaxInputLength());
         }
 

HtmlSanitizerConfig.php

@@ -405,8 +405,16 @@ public function withoutAttributeSanitizer(AttributeSanitizerInterface $sanitizer
         return $clone;
     }
 
+    /**
+     * @param int $maxInputLength The maximum length of the input string in bytes
+     *                            -1 means no limit
+     */
     public function withMaxInputLength(int $maxInputLength): static
     {
+        if ($maxInputLength < -1) {
+            throw new \InvalidArgumentException(sprintf('The maximum input length must be greater than -1, "%d" given.', $maxInputLength));
+        }
+
         $clone = clone $this;
         $clone->maxInputLength = $maxInputLength;
 

Tests/HtmlSanitizerAllTest.php

@@ -561,4 +561,15 @@ public static function provideSanitizeBody()
             yield $case[0] => $case;
         }
     }
+
+    public function testUnlimitedLength()
+    {
+        $sanitizer = new HtmlSanitizer((new HtmlSanitizerConfig())->withMaxInputLength(-1));
+
+        $input = str_repeat('a', 10_000_000);
+
+        $sanitized = $sanitizer->sanitize($input);
+
+        $this->assertSame(\strlen($input), \strlen($sanitized));
+    }
 }