Fix HTML escaping of to-source links

This PR was merged into the 2.3 branch.

Discussion
----------

CS: Pre incrementation/decrementation should be used if possible

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Fixes provided by new fixer: https://github.com/FriendsOfPHP/PHP-CS-Fixer/pull/1113

If this pr is merged I would change the level of the fixer to `symfony`.

Commits
-------

c5123d6 CS: Pre incrementation/decrementation should be used if possible

ExceptionHandler.php

@@ -92,6 +92,7 @@ class ExceptionHandler
             foreach ($exception->getHeaders() as $name => $value) {
                 header($name.': '.$value, false);
             }
+            header('Content-Type: text/html; charset='.$this->charset);
         }
 
         echo $this->decorate($this->getContent($exception), $this->getStylesheet($exception));
@@ -110,7 +111,7 @@ class ExceptionHandler
             $exception = FlattenException::create($exception);
         }
 
-        return new Response($this->decorate($this->getContent($exception), $this->getStylesheet($exception)), $exception->getStatusCode(), $exception->getHeaders());
+        return Response::create($this->decorate($this->getContent($exception), $this->getStylesheet($exception)), $exception->getStatusCode(), $exception->getHeaders())->setCharset($this->charset);
     }
 
     /**
@@ -131,6 +132,7 @@ class ExceptionHandler
         }
 
         $content = '';
+        $flags = PHP_VERSION_ID >= 50400 ? ENT_QUOTES | ENT_SUBSTITUTE : ENT_QUOTES;
         if ($this->debug) {
             try {
                 $count = count($exception->getAllPrevious());
@@ -138,7 +140,7 @@ class ExceptionHandler
                 foreach ($exception->toArray() as $position => $e) {
                     $ind = $count - $position + 1;
                     $class = $this->abbrClass($e['class']);
-                    $message = nl2br($e['message']);
+                    $message = nl2br(htmlspecialchars($e['message'], $flags, $this->charset));
                     $content .= sprintf(<<<EOF
                         <div class="block_exception clear_fix">
                             <h2><span>%d/%d</span> %s: %s</h2>
@@ -155,10 +157,11 @@ EOF
                         }
                         if (isset($trace['file']) && isset($trace['line'])) {
                             if ($linkFormat = ini_get('xdebug.file_link_format')) {
-                                $link = str_replace(array('%f', '%l'), array($trace['file'], $trace['line']), $linkFormat);
-                                $content .= sprintf(' in <a href="%s" title="Go to source">%s line %s</a>', $link, $trace['file'], $trace['line']);
+                                $link = strtr($linkFormat, array('%f' => $trace['file'], '%l' => $trace['line']));
+                                $link = htmlspecialchars($link, $flags, $this->charset);
+                                $content .= sprintf(' in <a href="%s" title="Go to source">%s line %d</a>', $link, htmlspecialchars($trace['file'], $flags, $this->charset), $trace['line']);
                             } else {
-                                $content .= sprintf(' in %s line %s', $trace['file'], $trace['line']);
+                                $content .= sprintf(' in %s line %d', htmlspecialchars($trace['file'], $flags, $this->charset), $trace['line']);
                             }
                         }
                         $content .= "</li>\n";
@@ -169,7 +172,7 @@ EOF
             } catch (\Exception $e) {
                 // something nasty happened and we cannot throw an exception anymore
                 if ($this->debug) {
-                    $title = sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), $e->getMessage());
+                    $title = sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), htmlspecialchars($e->getMessage(), $flags, $this->charset));
                 } else {
                     $title = 'Whoops, looks like something went wrong.';
                 }
@@ -276,7 +279,7 @@ EOF;
     {
         $parts = explode('\\', $class);
 
-        return sprintf("<abbr title=\"%s\">%s</abbr>", $class, array_pop($parts));
+        return sprintf('<abbr title="%s">%s</abbr>', $class, array_pop($parts));
     }
 
     /**
@@ -296,9 +299,9 @@ EOF;
         $result = array();
         foreach ($args as $key => $item) {
             if ('object' === $item[0]) {
-                $formattedValue = sprintf("<em>object</em>(%s)", $this->abbrClass($item[1]));
+                $formattedValue = sprintf('<em>object</em>(%s)', $this->abbrClass($item[1]));
             } elseif ('array' === $item[0]) {
-                $formattedValue = sprintf("<em>array</em>(%s)", is_array($item[1]) ? $this->formatArgs($item[1]) : $item[1]);
+                $formattedValue = sprintf('<em>array</em>(%s)', is_array($item[1]) ? $this->formatArgs($item[1]) : $item[1]);
             } elseif ('string' === $item[0]) {
                 $formattedValue = sprintf("'%s'", htmlspecialchars($item[1], $flags, $this->charset));
             } elseif ('null' === $item[0]) {

README.md

@@ -40,5 +40,5 @@ Resources
 You can run the unit tests with the following command:
 
     $ cd path/to/Symfony/Component/Debug/
-    $ composer.phar install --dev
+    $ composer install
     $ phpunit

Tests/ErrorHandlerTest.php

@@ -26,13 +26,13 @@ class ErrorHandlerTest extends \PHPUnit_Framework_TestCase
      */
     protected $errorReporting;
 
-    public function setUp()
+    protected function setUp()
     {
         $this->errorReporting = error_reporting(E_ALL | E_STRICT);
         $this->iniSet('display_errors', '1');
     }
 
-    public function tearDown()
+    protected function tearDown()
     {
         error_reporting($this->errorReporting);
     }
@@ -59,9 +59,14 @@ class ErrorHandlerTest extends \PHPUnit_Framework_TestCase
         $that = $this;
         $exceptionCheck = function ($exception) use ($that) {
             $that->assertInstanceOf('Symfony\Component\Debug\Exception\ContextErrorException', $exception);
-            $that->assertEquals(E_STRICT, $exception->getSeverity());
             $that->assertEquals(2, $exception->getLine());
-            $that->assertStringStartsWith('Runtime Notice: Declaration of _CompileTimeError::foo() should be compatible with', $exception->getMessage());
+            if (PHP_VERSION_ID < 70000) {
+                $that->assertEquals(E_STRICT, $exception->getSeverity());
+                $that->assertStringStartsWith('Runtime Notice: Declaration of _CompileTimeError::foo() should be compatible with', $exception->getMessage());
+            } else {
+                $that->assertEquals(E_WARNING, $exception->getSeverity());
+                $that->assertStringStartsWith('Warning: Declaration of _CompileTimeError::foo() should be compatible with', $exception->getMessage());
+            }
             $that->assertArrayHasKey('bar', $exception->getContext());
         };
 

Tests/Exception/FlattenExceptionTest.php

@@ -189,9 +189,9 @@ class FlattenExceptionTest extends \PHPUnit_Framework_TestCase
     public function testTooBigArray()
     {
         $a = array();
-        for ($i = 0; $i < 20; $i++) {
-            for ($j = 0; $j < 50; $j++) {
-                for ($k = 0; $k < 10; $k++) {
+        for ($i = 0; $i < 20; ++$i) {
+            for ($j = 0; $j < 50; ++$j) {
+                for ($k = 0; $k < 10; ++$k) {
                     $a[$i][$j][$k] = 'value';
                 }
             }

composer.json

@@ -3,7 +3,7 @@
     "type": "library",
     "description": "Symfony Debug Component",
     "keywords": [],
-    "homepage": "http://symfony.com",
+    "homepage": "https://symfony.com",
     "license": "MIT",
     "authors": [
         {
@@ -12,7 +12,7 @@
         },
         {
             "name": "Symfony Community",
-            "homepage": "http://symfony.com/contributors"
+            "homepage": "https://symfony.com/contributors"
         }
     ],
     "require": {
@@ -22,6 +22,7 @@
         "symfony/http-kernel": ">=2.3,<2.3.24|~2.4.0|>=2.5,<2.5.9|>=2.6,<2.6.2"
     },
     "require-dev": {
+        "symfony/phpunit-bridge": "~2.7",
         "symfony/http-kernel": "~2.3.24|~2.5.9|~2.6,>=2.6.2",
         "symfony/http-foundation": "~2.1"
     },

phpunit.xml.dist

@@ -7,8 +7,7 @@
          bootstrap="vendor/autoload.php"
 >
     <php>
-        <!-- Silence E_USER_DEPRECATED (-16385 == -1 & ~E_USER_DEPRECATED) -->
-        <ini name="error_reporting" value="-16385"/>
+        <ini name="error_reporting" value="-1" />
     </php>
     <testsuites>
         <testsuite name="Symfony Debug Component Test Suite">