implemented mandatory escaping (cannot be disabled using |noescape)

nette · Oct 11, 2023 · 5b3bc33 · 5b3bc33
1 parent 22bd941
commit 5b3bc33
Show file tree

Hide file tree

Showing 9 changed files with 63 additions and 8 deletions.
diff --git a/src/Latte/Compiler/Escaper.php b/src/Latte/Compiler/Escaper.php
@@ -220,6 +220,26 @@ public function escape(string $str): string
 	}
 
 
+	public function escapeMandatory(string $str): string
+	{
+		return match ($this->contentType) {
+			ContentType::Html => match ($this->state) {
+				self::HtmlAttribute => "LR\\Filters::escapeHtmlQuotes($str)",
+				self::HtmlRawText => match ($this->subType) {
+					self::HtmlText => 'LR\Filters::convertHtmlToHtmlRawText(' . $str . ')',
+					default => "LR\\Filters::convertJSToHtmlRawText($str)",
+				},
+				default => $str,
+			},
+			ContentType::Xml => match ($this->state) {
+				self::HtmlAttribute => "LR\\Filters::escapeHtmlQuotes($str)",
+				default => $str,
+			},
+			default => $str,
+		};
+	}
+
+
 	public function check(string $str): string
 	{
 		if ($this->state === self::HtmlAttribute && $this->subType === self::Url) {

diff --git a/src/Latte/Compiler/Nodes/Php/ModifierNode.php b/src/Latte/Compiler/Nodes/Php/ModifierNode.php
@@ -68,9 +68,9 @@ public function printSimple(PrintContext $context, string $expr): string
 			$expr = $escaper->check($expr);
 		}
 
-		if ($escape) {
-			$expr = $escaper->escape($expr);
-		}
+		$expr = $escape
+			? $escaper->escape($expr)
+			: $escaper->escapeMandatory($expr);
 
 		return $expr;
 	}

diff --git a/src/Latte/Runtime/Filters.php b/src/Latte/Runtime/Filters.php
@@ -116,6 +116,15 @@ public static function escapeHtmlRawTextHtml($s): string
 	}
 
 
+	/**
+	 * Escapes only quotes.
+	 */
+	public static function escapeHtmlQuotes($s): string
+	{
+		return strtr((string) $s, ['"' => '&quot;', "'" => '&apos;']);
+	}
+
+
 	/**
 	 * Escapes string for use everywhere inside XML (except for comments and tags).
 	 */

diff --git a/tests/common/contentType.html.css.phpt b/tests/common/contentType.html.css.phpt
@@ -57,6 +57,6 @@ Assert::match(
 
 // no escape
 Assert::match(
-	'<style></style></style>',
+	'<style><\/style></style>',
 	$latte->renderToString('<style>{="</style>"|noescape}</style>'),
 );
diff --git a/tests/common/contentType.html.javascript.phpt b/tests/common/contentType.html.javascript.phpt
@@ -131,6 +131,6 @@ Assert::match(
 
 // no escape
 Assert::match(
-	'<script></script></script>',
+	'<script><\/script></script>',
 	$latte->renderToString('<script>{="</script>"|noescape}</script>'),
 );
diff --git a/tests/common/contentType.html.phpt b/tests/common/contentType.html.phpt
@@ -35,12 +35,12 @@ Assert::match(
 
 // no escape in attribute
 Assert::match(
-	'<p title="foo a=\'a\' b="b">"></p>',
+	'<p title="foo a=&apos;a&apos; b=&quot;b&quot;>"></p>',
 	$latte->renderToString('<p title={="foo a=\'a\' b=\"b\">"|noescape}></p>'),
 );
 
 // no escape in JS attribute
 Assert::match(
-	'<p onclick="foo a=\'a\' b="b">"></p>',
+	'<p onclick="foo a=&apos;a&apos; b=&quot;b&quot;>"></p>',
 	$latte->renderToString('<p onclick="{="foo a=\'a\' b=\"b\">"|noescape}"></p>'),
 );
diff --git a/tests/common/contentType.html.script-html.phpt b/tests/common/contentType.html.script-html.phpt
@@ -32,7 +32,7 @@ Assert::match(
 
 // no escape
 Assert::match(
-	'<script type="text/html"></script></script>',
+	'<script type="text/html"></x-script></script>',
 	$latte->renderToString('<script type="text/html">{="</script>"|noescape}</script>'),
 );
 

diff --git a/tests/common/contentType.html.script-unknown.phpt b/tests/common/contentType.html.script-unknown.phpt
@@ -37,6 +37,12 @@ Assert::exception(
 	'Including block a with content type HTML into incompatible type HTML/RAW/TEXT.',
 );
 
+// no escape
+Assert::match(
+	'<script type="foo"><\/script></script>',
+	$latte->renderToString('<script type="foo">{="</script>"|noescape}</script>'),
+);
+
 // content of <script> is RAWTEXT
 Assert::match(
 	<<<'XX'

diff --git a/tests/filters/escapeHtmlQuotes.phpt b/tests/filters/escapeHtmlQuotes.phpt
@@ -0,0 +1,20 @@
+<?php
+
+/**
+ * Test: Latte\Runtime\Filters::escapeHtmlQuotes
+ */
+
+declare(strict_types=1);
+
+use Latte\Runtime\Filters;
+use Tester\Assert;
+
+require __DIR__ . '/../bootstrap.php';
+
+
+Assert::same('', Filters::escapeHtmlQuotes(null));
+Assert::same('', Filters::escapeHtmlQuotes(''));
+Assert::same('1', Filters::escapeHtmlQuotes(1));
+Assert::same('string', Filters::escapeHtmlQuotes('string'));
+Assert::same('< & &apos; &quot; >', Filters::escapeHtmlQuotes('< & \' " >'));
+Assert::same('&quot;', Filters::escapeHtmlQuotes('&quot;'));