Skip to content

Commit 8add899

Browse files
sdwrightsdwright
authored
Merge pull request #160 from magento-jackalopes/MAGETWO-53353-refactor-escaper
[Jackalopes] Magetwo-53353: refactor escaper
2 parents 6474bc8 + 5baaba8 commit 8add899

File tree

47 files changed

+372
-138
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+372
-138
lines changed

‎app/code/Magento/Backend/Block/Widget/Button.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ protected function _attributesToHtml($attributes)
113113
if ($attributeValue === null || $attributeValue == '') {
114114
continue;
115115
}
116-
$html .= $attributeKey . '="' . $this->escapeHtml($attributeValue) . '" ';
116+
$html .= $attributeKey . '="' . $this->escapeHtmlAttr($attributeValue, false) . '" ';
117117
}
118118

119119
return $html;

‎app/code/Magento/Backend/Block/Widget/Button/SplitButton.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ protected function _getAttributesString($attributes)
229229
if ($attributeValue === null || $attributeValue == '') {
230230
continue;
231231
}
232-
$html[] = $attributeKey . '="' . $this->escapeHtml($attributeValue) . '"';
232+
$html[] = $attributeKey . '="' . $this->escapeHtmlAttr($attributeValue, false) . '"';
233233
}
234234
return join(' ', $html);
235235
}

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Renderer/Action.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,9 @@ protected function _toOptionHtml($action, \Magento\Framework\DataObject $row)
8282
$actionCaption = '';
8383
$this->_transformActionData($action, $actionCaption, $row);
8484

85-
$htmlAttributes = ['value' => $this->escapeHtml($this->_jsonEncoder->encode($action))];
85+
$htmlAttributes = [
86+
'value' => $this->escapeHtmlAttr($this->_jsonEncoder->encode($action), false)
87+
];
8688
$actionAttributes->setData($htmlAttributes);
8789
return '<option ' . $actionAttributes->serialize() . '>' . $actionCaption . '</option>';
8890
}

‎app/code/Magento/Backend/Block/Widget/Grid/Massaction/AbstractMassaction.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ protected function _construct()
5454
{
5555
parent::_construct();
5656

57-
$this->setErrorText($this->escapeJsQuote(__('Please select items.')));
57+
$this->setErrorText($this->escapeHtml(__('Please select items.')));
5858

5959
if (null !== $this->getOptions()) {
6060
foreach ($this->getOptions() as $optionId => $option) {

‎app/code/Magento/Backend/Block/Widget/Grid/Massaction/Extended.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public function __construct(
6666
public function _construct()
6767
{
6868
parent::_construct();
69-
$this->setErrorText($this->escapeJsQuote(__('Please select items.')));
69+
$this->setErrorText($this->escapeHtml(__('Please select items.')));
7070
}
7171

7272
/**

‎app/code/Magento/Backend/view/adminhtml/templates/system/search.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
class="search-global-input"
1818
id="search-global"
1919
name="query"
20-
data-mage-init='<?php echo $block->escapeHtml($this->helper('Magento\Framework\Json\Helper\Data')->jsonEncode($block->getWidgetInitOptions()))?>'>
20+
data-mage-init='<?php /* @noEscape */ echo $this->helper('Magento\Framework\Json\Helper\Data')->jsonEncode($block->getWidgetInitOptions()) ?>'>
2121
<button
2222
type="submit"
2323
class="search-global-action"

‎app/code/Magento/Backup/view/adminhtml/templates/backup/dialogs.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,8 @@ require([
147147

148148
//<![CDATA[
149149
backup = new AdminBackup();
150-
backup.rollbackUrl = '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote($rollbackUrl);?>';
151-
backup.backupUrl = '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote($backupUrl);?>';
150+
backup.rollbackUrl = '<?php echo $block->escapeUrl($rollbackUrl); ?>';
151+
backup.backupUrl = '<?php echo $block->escapeUrl($backupUrl); ?>';
152152
//]]>
153153

154154
});

‎app/code/Magento/Catalog/Block/Adminhtml/Product/Attribute/Set/Main.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ protected function _prepareLayout()
127127
'Magento\Backend\Block\Widget\Button',
128128
[
129129
'label' => __('Delete'),
130-
'onclick' => 'deleteConfirm(\'' . $this->escapeJsQuote(
130+
'onclick' => 'deleteConfirm(\'' . $this->escapeJs(
131131
__(
132132
'You are about to delete all products in this attribute set. '
133133
. 'Are you sure you want to do that?'

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/attribute/set/main.phtml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@
214214

215215
if( editSet.SystemNodesExists(editSet.currentNode) ) {
216216
alert({
217-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('This group contains system attributes. Please move system attributes to another group and try again.')) ?>'
217+
content: '<?php echo $block->escapeJs(__('This group contains system attributes. Please move system attributes to another group and try again.')) ?>'
218218
});
219219
return;
220220
}
@@ -343,7 +343,7 @@
343343

344344
failure : function(o) {
345345
alert({
346-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('Sorry, we\'re unable to complete this request.')) ?>'
346+
content: '<?php echo $block->escapeJs(__('Sorry, we\'re unable to complete this request.')) ?>'
347347
});
348348
},
349349

@@ -360,7 +360,7 @@
360360
rightBeforeAppend : function(tree, nodeThis, node, newParent) {
361361
if (node.attributes.is_user_defined == 0) {
362362
alert({
363-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('You can\'t remove attributes from this attribute set.')) ?>'
363+
content: '<?php echo $block->escapeJs(__('You can\'t remove attributes from this attribute set.')) ?>'
364364
});
365365
return false;
366366
} else {
@@ -376,7 +376,7 @@
376376

377377
if (node.attributes.is_unassignable == 0) {
378378
alert({
379-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('You can\'t remove attributes from this attribute set.')) ?>'
379+
content: '<?php echo $block->escapeJs(__('You can\'t remove attributes from this attribute set.')) ?>'
380380
});
381381
return false;
382382
} else {

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/date.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ require([
5858
if (dateTimeParts[i].value == "") return false;
5959
}
6060
return true;
61-
}, '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote( __('This is a required option.') )?>');
61+
}, '<?php echo $block->escapeJs(__('This is a required option.')) ?>');
6262
<?php else: ?>
6363
jQuery.validator.addMethod('validate-datetime-<?php /* @escapeNotVerified */ echo $_optionId ?>', function(v) {
6464
var dateTimeParts = jQuery('.datetime-picker[id^="options_<?php /* @escapeNotVerified */ echo $_optionId ?>"]');
@@ -74,7 +74,7 @@ require([
7474
}
7575
}
7676
return hasWithValue ^ hasWithNoValue;
77-
}, '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote( __('The field isn\'t complete.') )?>');
77+
}, '<?php echo $block->escapeJs(__('The field isn\'t complete.')) ?>');
7878
<?php endif; ?>
7979
//]]>
8080

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/edit/price/tier.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,12 @@ var tierPriceRowTemplate = '<tr>'
5858
+ '<td class="col-websites"<?php if (!$_showWebsite): ?> style="display:none"<?php endif; ?>>'
5959
+ '<select class="<?php /* @escapeNotVerified */ echo $_htmlClass ?> required-entry" name="<?php /* @escapeNotVerified */ echo $_htmlName ?>[<%- data.index %>][website_id]" id="tier_price_row_<%- data.index %>_website">'
6060
<?php foreach ($block->getWebsites() as $_websiteId => $_info): ?>
61-
+ '<option value="<?php /* @escapeNotVerified */ echo $_websiteId ?>"><?php /* @escapeNotVerified */ echo $block->escapeJsQuote($block->escapeHtml($_info['name'])) ?><?php if (!empty($_info['currency'])): ?> [<?php echo $block->escapeHtml($_info['currency']) ?>]<?php endif; ?></option>'
61+
+ '<option value="<?php /* @escapeNotVerified */ echo $_websiteId ?>"><?php echo $block->escapeJs($_info['name']) ?><?php if (!empty($_info['currency'])): ?> [<?php echo $block->escapeHtml($_info['currency']) ?>]<?php endif; ?></option>'
6262
<?php endforeach ?>
6363
+ '</select></td>'
6464
+ '<td class="col-customer-group"><select class="<?php /* @escapeNotVerified */ echo $_htmlClass ?> custgroup required-entry" name="<?php /* @escapeNotVerified */ echo $_htmlName ?>[<%- data.index %>][cust_group]" id="tier_price_row_<%- data.index %>_cust_group">'
6565
<?php foreach ($block->getCustomerGroups() as $_groupId => $_groupName): ?>
66-
+ '<option value="<?php /* @escapeNotVerified */ echo $_groupId ?>"><?php /* @escapeNotVerified */ echo $block->escapeJsQuote($block->escapeHtml($_groupName)) ?></option>'
66+
+ '<option value="<?php /* @escapeNotVerified */ echo $_groupId ?>"><?php echo $block->escapeJs($_groupName) ?></option>'
6767
<?php endforeach ?>
6868
+ '</select></td>'
6969
+ '<td class="col-qty">'

‎app/code/Magento/ConfigurableProduct/view/adminhtml/templates/catalog/product/attribute/set/js.phtml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ editSet.submit = editSet.submit.wrap(function(original) {
2929
if (editSet.currentNode){
3030
if (ConfigurableNodeExists(editSet.currentNode)) {
3131
alert({
32-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('This group contains attributes used in configurable products. Please move these attributes to another group and try again.')) ?>'
32+
content: '<?php echo $block->escapeJs(__('This group contains attributes used in configurable products. Please move these attributes to another group and try again.')) ?>'
3333
});
3434
return;
3535
}
@@ -40,7 +40,7 @@ editSet.submit = editSet.submit.wrap(function(original) {
4040
editSet.rightBeforeAppend = editSet.rightBeforeAppend.wrap(function(original, tree, nodeThis, node, newParent) {
4141
if (node.attributes.is_configurable == 1) {
4242
alert({
43-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('This attribute is used in configurable products. You cannot remove it from the attribute set.')) ?>'
43+
content: '<?php echo $block->escapeJs(__('This attribute is used in configurable products. You cannot remove it from the attribute set.')) ?>'
4444
});
4545
return false;
4646
}
@@ -50,7 +50,7 @@ editSet.rightBeforeAppend = editSet.rightBeforeAppend.wrap(function(original, tr
5050
editSet.rightBeforeInsert = editSet.rightBeforeInsert.wrap(function(original, tree, nodeThis, node, newParent) {
5151
if (node.attributes.is_configurable == 1) {
5252
alert({
53-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('This attribute is used in configurable products. You cannot remove it from the attribute set.')) ?>'
53+
content: '<?php echo $block->escapeJs(__('This attribute is used in configurable products. You cannot remove it from the attribute set.')) ?>'
5454
});
5555
return false;
5656
}

‎app/code/Magento/CurrencySymbol/view/adminhtml/templates/grid.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@
2727
<input id="custom_currency_symbol<?php /* @escapeNotVerified */ echo $code; ?>"
2828
class="required-entry admin__control-text"
2929
type="text"
30-
value="<?php echo $block->escapeQuote($data['displaySymbol']); ?>"
30+
value="<?php echo $block->escapeHtmlAttr($data['displaySymbol']); ?>"
3131
<?php echo $data['inherited'] ? ' disabled="disabled"' : '';?>
3232
name="custom_currency_symbol[<?php /* @escapeNotVerified */ echo $code; ?>]">
3333
<div class="admin__field admin__field-option">
3434
<input id="custom_currency_symbol_inherit<?php /* @escapeNotVerified */ echo $code; ?>"
3535
class="admin__control-checkbox" type="checkbox"
36-
onclick="toggleUseDefault(<?php /* @escapeNotVerified */ echo '\'' . $code . '\',\'' . $block->escapeQuote($data['parentSymbol'], true) . '\''; ?>)"
36+
onclick="toggleUseDefault(<?php /* @escapeNotVerified */ echo '\'' . $code . '\',\'' . $block->escapeJs($data['parentSymbol']) . '\''; ?>)"
3737
<?php echo $data['inherited'] ? ' checked="checked"' : ''; ?>
3838
value="1"
3939
name="inherit_custom_currency_symbol[<?php /* @escapeNotVerified */ echo $code; ?>]">

‎app/code/Magento/Customer/view/adminhtml/templates/tab/cart.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,14 +57,14 @@ require([
5757

5858
if (!itemId) {
5959
alert({
60-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('No item specified.')) ?>'
60+
content: '<?php echo $block->escapeJs(__('No item specified.')) ?>'
6161
});
6262

6363
return false;
6464
}
6565

6666
confirm({
67-
content: '<?php /* @escapeNotVerified */ echo $block->escapeJsQuote(__('Are you sure you want to remove this item?')) ?>',
67+
content: '<?php echo $block->escapeJs(__('Are you sure you want to remove this item?')) ?>',
6868
actions: {
6969
confirm: function(){
7070
self.reload({'delete':itemId});

‎app/code/Magento/GoogleAnalytics/Block/Ga.php

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -77,12 +77,11 @@ public function getPageTrackingCode($accountId)
7777
$pageName = trim($this->getPageName());
7878
$optPageURL = '';
7979
if ($pageName && substr($pageName, 0, 1) == '/' && strlen($pageName) > 1) {
80-
$optPageURL = ", '{$this->escapeJsQuote($pageName)}'";
80+
$optPageURL = ", '" . $this->escapeHtmlAttr($pageName, false) . "'";
8181
}
8282

83-
return "\nga('create', '{$this->escapeJsQuote(
84-
$accountId
85-
)}', 'auto');\nga('send', 'pageview'{$optPageURL});\n";
83+
return "\nga('create', '" . $this->escapeHtmlAttr($accountId, false)
84+
. ", 'auto');\nga('send', 'pageview'{$optPageURL});\n";
8685
}
8786

8887
/**
@@ -121,8 +120,8 @@ public function getOrdersTrackingCode()
121120
'price': '%s',
122121
'quantity': %s
123122
});",
124-
$this->escapeJsQuote($item->getSku()),
125-
$this->escapeJsQuote($item->getName()),
123+
$this->escapeJs($item->getSku()),
124+
$this->escapeJs($item->getName()),
126125
$item->getBasePrice(),
127126
$item->getQtyOrdered()
128127
);
@@ -137,7 +136,7 @@ public function getOrdersTrackingCode()
137136
'shipping': '%s'
138137
});",
139138
$order->getIncrementId(),
140-
$this->escapeJsQuote($this->_storeManager->getStore()->getFrontendName()),
139+
$this->escapeJs($this->_storeManager->getStore()->getFrontendName()),
141140
$order->getBaseGrandTotal(),
142141
$order->getBaseTaxAmount(),
143142
$order->getBaseShippingAmount()

‎app/code/Magento/Integration/Block/Adminhtml/Widget/Grid/Column/Renderer/Button.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,11 @@ protected function _prepareAttributes(DataObject $row)
8585
) : $this->getColumn()->{$rowMethodName}();
8686

8787
if ($attributeValue) {
88-
$attributes[] = sprintf('%s="%s"', $attributeName, $this->escapeHtml($attributeValue));
88+
$attributes[] = sprintf(
89+
'%s="%s"',
90+
$attributeName,
91+
$this->escapeHtmlAttr($attributeValue, false)
92+
);
8993
}
9094
}
9195
return $attributes;

‎app/code/Magento/Integration/Block/Adminhtml/Widget/Grid/Column/Renderer/Link.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ protected function _getAttributesHtml()
118118
if ($value === null || $value == '') {
119119
continue;
120120
}
121-
$html[] = sprintf('%s="%s"', $key, $this->escapeHtml($value));
121+
$html[] = sprintf('%s="%s"', $key, $this->escapeHtmlAttr($value, false));
122122
}
123123

124124
return join(' ', $html);

‎app/code/Magento/Integration/Test/Unit/Block/Adminhtml/Widget/Grid/Column/Renderer/ButtonTest.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ public function testRender()
5858
$column->expects($this->any())
5959
->method('getId')
6060
->willReturn('1');
61+
$this->escaperMock->expects($this->at(0))->method('escapeHtmlAttr')->willReturn('1');
62+
$this->escaperMock->expects($this->at(1))->method('escapeHtmlAttr')->willReturn('bigButton');
6163
$column->expects($this->any())
6264
->method('getIndex')
6365
->willReturn('name');

‎app/code/Magento/Integration/Test/Unit/Block/Adminhtml/Widget/Grid/Column/Renderer/LinkTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ public function testRender()
7474
$column->expects($this->any())
7575
->method('getId')
7676
->willReturn('1');
77+
$this->escaperMock->expects($this->at(0))->method('escapeHtmlAttr')->willReturn('Link Caption');
7778
$this->linkRenderer->setColumn($column);
7879
$object = new \Magento\Framework\DataObject(['id' => '1']);
7980
$actualResult = $this->linkRenderer->render($object);

‎app/code/Magento/Integration/view/adminhtml/templates/integration/popup_container.phtml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@
1919
], function ($, Confirm) {
2020

2121
window.integration = new Integration(
22-
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/permissionsDialog', ['id' => ':id', 'reauthorize' => ':isReauthorize']); ?>',
23-
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/tokensDialog', ['id' => ':id', 'reauthorize' => ':isReauthorize']); ?>',
24-
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/tokensExchange', ['id' => ':id', 'reauthorize' => ':isReauthorize']); ?>',
22+
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/permissionsDialog', ['id' => ':id', 'reauthorize' => ':isReauthorize', '_escape_params' => false]); ?>',
23+
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/tokensDialog', ['id' => ':id', 'reauthorize' => ':isReauthorize', '_escape_params' => false]); ?>',
24+
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/tokensExchange', ['id' => ':id', 'reauthorize' => ':isReauthorize', '_escape_params' => false]); ?>',
2525
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*'); ?>',
2626
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/loginSuccessCallback'); ?>'
2727
);

‎app/code/Magento/Payment/Test/Unit/Block/InfoTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ public function getValueAsArrayDataProvider()
155155
[[], false, []],
156156
['string', true, [0 => 'string']],
157157
['string', false, ['string']],
158-
[['key' => 'v"a!@#%$%^^&&*(*/\'\]l'], true, ['key' => 'v&quot;a!@#%$%^^&amp;&amp;*(*/\'\]l']],
158+
[['key' => 'v"a!@#%$%^^&&*(*/\'\]l'], true, ['key' => 'v&quot;a!@#%$%^^&amp;&amp;*(*/&#039;\]l']],
159159
[['key' => 'val'], false, ['key' => 'val']]
160160
];
161161
}

‎app/code/Magento/Payment/view/frontend/templates/transparent/iframe.phtml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ $params = $block->getParams();
1414
<head>
1515
<script>
1616
<?php if (isset($params['redirect'])): ?>
17-
window.location="<?php echo $block->escapeXssInUrl($params['redirect']); ?>";
17+
window.location="<?php echo $block->escapeUrl($params['redirect']); ?>";
1818
<?php elseif (isset($params['redirect_parent'])): ?>
1919
var require = window.top.require;
2020
require(
@@ -24,7 +24,7 @@ $params = $block->getParams();
2424
function($) {
2525
var parent = window.top;
2626
$(parent).trigger('clearTimeout');
27-
parent.location="<?php echo $block->escapeXssInUrl($params['redirect_parent']); ?>";
27+
parent.location="<?php echo $block->escapeUrl($params['redirect_parent']); ?>";
2828
}
2929
);
3030
<?php elseif (isset($params['error_msg'])): ?>
@@ -44,7 +44,7 @@ $params = $block->getParams();
4444
}
4545
);
4646
<?php elseif (isset($params['order_success'])): ?>
47-
window.top.location = "<?php echo $block->escapeXssInUrl($params['order_success']); ?>";
47+
window.top.location = "<?php echo $block->escapeUrl($params['order_success']); ?>";
4848
<?php else: ?>
4949
var require = window.top.require;
5050
require(

0 commit comments

Comments
 (0)