Visitar URL original
Merge pull request #728 from flightphp/fix-ghsa-r8g9-view-e · flightphp/core@241541b · GitHub
Skip to content

Commit 241541b

Browse files
authored
Merge pull request #728 from flightphp/fix-ghsa-r8g9-view-e
fix: escape single quotes in View::e()
2 parents a406f91 + 6b8d2f9 commit 241541b

2 files changed

Lines changed: 12 additions & 1 deletion

File tree

‎flight/template/View.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ public function getTemplate(string $file): string
191191
*/
192192
public function e(string $str): string
193193
{
194-
$value = \htmlentities($str);
194+
$value = \htmlentities($str, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
195195
echo $value;
196196
return $value;
197197
}

‎tests/ViewTest.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,17 @@ public function testeNoNeedToEscape(): void
133133
$this->assertEquals('script', $result);
134134
}
135135

136+
public function testEEscapesSingleQuote(): void
137+
{
138+
$expected = htmlentities("'", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
139+
140+
$this->expectOutputString($expected);
141+
$result = $this->view->e("'");
142+
143+
$this->assertEquals($expected, $result);
144+
$this->assertEquals(''', $result);
145+
}
146+
136147
public function testNormalizePath(): void
137148
{
138149
$viewMock = new class extends View

0 commit comments

Comments
 (0)