Testing for

BaseAR.php

<?php
namespace common\components;

/**
 * Active Record extended functions
 * All base/models are extended from this class
 *
 */
class BaseAR extends \yii\db\ActiveRecord
{
    public static $enableLog = false;

    use XssArTestTrait;

//  ......

    /**
     * @throws \yii\base\InvalidConfigException
     */
    public function afterFind()
    {
        parent::afterFind(); // TODO: Change the autogenerated stub
        $this->fixXssAttributes();
    }
//  ......
}

XssArTestTrait.php

<?php
/**
 * Created by PhpStorm.
 * User: analitic
 * Date: 25.10.18
 * Time: 13:46
 */

namespace common\components;

/**
 * Trait XssArTestTrait
 *
 * @package common\components
 * @mixin BaseAR
 */
trait XssArTestTrait
{
    protected function getXssTestText()
    {
        return '<script>alert(document.cookie);</script>';
    }

    protected function fixXssSkiplist()
    {
        return ['user' => ['password', 'login'], 'system_setting' => ['json', 'value'], 'file' => ['path', 'stored_name']];
    }

    /**
     * @param $attributeName
     * @param $attributeValue
     * @return string
     * @throws \yii\base\InvalidConfigException
     */
    protected function fixXssAttribute($attributeName, $attributeValue)
    {
        $metaColumn = self::getTableSchema()->getColumn($attributeName);
        if ($metaColumn) {
            if ($metaColumn->phpType === 'string' && $metaColumn->size > 50) {
                // Get only text values, that can contain xss
                $attributeValue .= $this->getXssTestText();
            };
        }
        return $attributeValue;
    }

    /**
     * Fix xss attributes
     *
     * @throws \yii\base\InvalidConfigException
     */
    protected function fixXssAttributes(): void
    {
        $skipList = $this->fixXssSkiplist();
        $skipAttributes = $skipList[$this->tableName()] ?? [];

        foreach ($this->attributes as $attributeName => $attributeValue) {
            if (\in_array($attributeName, $skipAttributes, true)) {
                continue;
            }
            $newAttributeValue = $this->fixXssAttribute($attributeName, $attributeValue);
            if ($attributeValue !== $newAttributeValue) {
                $this->setAttribute($attributeName, $newAttributeValue);
            }
        }
    }
}