Compare commits

...

5 Commits

Author SHA1 Message Date
Nicolas Grekas
7c13ae8ce1 Merge branch '3.2' into 3.3
* 3.2:
  [DI] Remove unused props from the PhpDumper
  [ProxyManager] Cleanup fixtures
  [Debug] HTML-escape array key
  Add some phpdocs for IDE autocompletion and better SCA
  Fixed typo in docblock
2017-07-28 17:27:31 +02:00
Nicolas Grekas
ba7276868c Merge branch '2.8' into 3.2
* 2.8:
  [DI] Remove unused props from the PhpDumper
  [ProxyManager] Cleanup fixtures
  [Debug] HTML-escape array key
  Add some phpdocs for IDE autocompletion and better SCA
  Fixed typo in docblock
2017-07-28 17:22:55 +02:00
Nicolas Grekas
236ca98a42 Merge branch '2.7' into 2.8
* 2.7:
  [DI] Remove unused props from the PhpDumper
  [ProxyManager] Cleanup fixtures
  [Debug] HTML-escape array key
  Add some phpdocs for IDE autocompletion and better SCA
2017-07-28 17:21:22 +02:00
Nicolas Grekas
0946243775 bug #23684 [Debug] Missing escape in debug output (c960657)
This PR was merged into the 2.7 branch.

Discussion
----------

[Debug] Missing escape in debug output

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

When pretty-printing an exception, the debug handler does not properly escape array keys.

The problem only occurs when debug output is enabled, so this is not considered a [security issue](http://symfony.com/doc/current/contributing/code/security.html) (according to @fabpot), because the debug tools [should not be used in production](https://symfony.com/doc/current/components/debug.html#usage).

A test for this is included in my patch for #18722.

Commits
-------

636777d [Debug] HTML-escape array key
2017-07-26 22:00:18 +02:00
Christian Schmidt
e1ce6a4ded [Debug] HTML-escape array key 2017-07-26 17:00:11 +02:00

View File

@@ -393,7 +393,7 @@ EOF;
$formattedValue = str_replace("\n", '', $this->escapeHtml(var_export($item[1], true)));
}
$result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $key, $formattedValue);
$result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $this->escapeHtml($key), $formattedValue);
}
return implode(', ', $result);