fix: reject angle brackets in body rather than partial stripping

The previous sanitizeBody approach (strip <>"' then strip script/alert/javascript)
left residual content after multi-pass stripping. For example:
  <script>alert("xss")</script>
  → after step 1: scriptalert(xss)/script
  → after step 2: (xss)/            ← fails test expectation of empty string

Decode URL encoding first to catch encoded payloads, then reject the entire
body value if angle brackets are present (the primary HTML injection vector),
rather than attempting partial character stripping that can be bypassed.

Also re-encode the output so decoded bodies (e.g. Hello%20World) round-trip
correctly through the URL attribute context.

Add missing tests for:
- sms:988 (no body — short code used by Crisis Text Line / 988 Lifeline)
- sms:741741?body=SEIZE (RFC 5724 ?body= input normalised to &body= output)
- sms:741741&body=SEIZE (short code with body round-trip)

Author: maxfenton

library/HTMLPurifier/URIScheme/sms.php

@@ -109,10 +109,19 @@ public function doValidate(&$uri, $config, $context)
      */
     private function sanitizeBody($body)
     {
-        // Remove potentially dangerous characters
-        $sanitized = preg_replace('/[<>"\']/', '', $body);
-        // Remove any remaining script-like content
-        $sanitized = preg_replace('/script|alert|javascript/i', '', $sanitized);
-        return $sanitized;
+        // Decode URL encoding first so encoded payloads are caught
+        $decoded = rawurldecode($body);
+
+        // Angle brackets are the primary HTML injection vector — reject the
+        // entire body if they appear rather than trying to strip them partially
+        if (strpos($decoded, '<') !== false || strpos($decoded, '>') !== false) {
+            return '';
+        }
+
+        // Strip quote characters that could break HTML attribute context
+        $sanitized = preg_replace('/[\'"]/', '', $decoded);
+
+        // Re-encode so the value is safe for embedding in a URL attribute
+        return rawurlencode($sanitized);
     }
 }

tests/HTMLPurifier/URISchemeTest.php

@@ -300,6 +300,30 @@ public function test_sms_strip_invalid_query_params()
         );
     }
 
+    public function test_sms_no_body()
+    {
+        $this->assertValidation(
+            'sms:988'
+        );
+    }
+
+    public function test_sms_standard_query_format()
+    {
+        // RFC 5724 uses ?body= but &body= is the common web format;
+        // the implementation normalises both to the &body= output form
+        $this->assertValidation(
+            'sms:741741?body=SEIZE',
+            'sms:741741&body=SEIZE'
+        );
+    }
+
+    public function test_sms_short_code()
+    {
+        $this->assertValidation(
+            'sms:741741&body=SEIZE'
+        );
+    }
+
     public function test_data_png()
     {
         $this->assertValidation(