Compare commits

...

11 Commits

Author SHA1 Message Date
Javier Eguiluz
8beb24eec7 Improved how links are displayed in exception messages 2017-09-01 15:23:39 +02:00
Fabien Potencier
084d804fe3 Merge branch '2.8' into 3.3
* 2.8:
  [VarDumper] Enhance docblock to tell about AbstractDumper::dumpLine(-1)
  [Debug] Remove false-positive check in DebugClassLoader
  [Validator] Fix use of GroupSequenceProvider in child classes
  Change number PHPDoc type to int|float
  [VarDumper] Strengthen dumped JS
  [travis] Add timing info
  [Validator] Fix Greek translation
  [Console] Initialize lazily to render exceptions properly
  [Validator] Add a property tag for File::$maxSize
2017-08-27 07:52:21 -07:00
Fabien Potencier
efc9656dcb Merge branch '2.7' into 2.8
* 2.7:
  [VarDumper] Enhance docblock to tell about AbstractDumper::dumpLine(-1)
  [Debug] Remove false-positive check in DebugClassLoader
  [Validator] Fix use of GroupSequenceProvider in child classes
  Change number PHPDoc type to int|float
  [VarDumper] Strengthen dumped JS
  [travis] Add timing info
  [Validator] Fix Greek translation
  [Console] Initialize lazily to render exceptions properly
  [Validator] Add a property tag for File::$maxSize
2017-08-27 07:29:03 -07:00
Nicolas Grekas
f45a908634 [Debug] Remove false-positive check in DebugClassLoader 2017-08-27 10:27:28 +02:00
Javier Eguiluz
0920d5f066 Fixed the exception page design in responsive mode 2017-08-08 15:39:42 +02:00
Nicolas Grekas
e06181ae56 Bump minimal PHP version to ^5.5.9|>=7.0.8 2017-07-29 23:54:42 +02:00
Nicolas Grekas
7c13ae8ce1 Merge branch '3.2' into 3.3
* 3.2:
  [DI] Remove unused props from the PhpDumper
  [ProxyManager] Cleanup fixtures
  [Debug] HTML-escape array key
  Add some phpdocs for IDE autocompletion and better SCA
  Fixed typo in docblock
2017-07-28 17:27:31 +02:00
Nicolas Grekas
ba7276868c Merge branch '2.8' into 3.2
* 2.8:
  [DI] Remove unused props from the PhpDumper
  [ProxyManager] Cleanup fixtures
  [Debug] HTML-escape array key
  Add some phpdocs for IDE autocompletion and better SCA
  Fixed typo in docblock
2017-07-28 17:22:55 +02:00
Nicolas Grekas
236ca98a42 Merge branch '2.7' into 2.8
* 2.7:
  [DI] Remove unused props from the PhpDumper
  [ProxyManager] Cleanup fixtures
  [Debug] HTML-escape array key
  Add some phpdocs for IDE autocompletion and better SCA
2017-07-28 17:21:22 +02:00
Nicolas Grekas
0946243775 bug #23684 [Debug] Missing escape in debug output (c960657)
This PR was merged into the 2.7 branch.

Discussion
----------

[Debug] Missing escape in debug output

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

When pretty-printing an exception, the debug handler does not properly escape array keys.

The problem only occurs when debug output is enabled, so this is not considered a [security issue](http://symfony.com/doc/current/contributing/code/security.html) (according to @fabpot), because the debug tools [should not be used in production](https://symfony.com/doc/current/components/debug.html#usage).

A test for this is included in my patch for #18722.

Commits
-------

636777d [Debug] HTML-escape array key
2017-07-26 22:00:18 +02:00
Christian Schmidt
e1ce6a4ded [Debug] HTML-escape array key 2017-07-26 17:00:11 +02:00
5 changed files with 33 additions and 9 deletions

View File

@@ -26,6 +26,7 @@ class DebugClassLoader
{
private $classLoader;
private $isFinder;
private $loaded = array();
private static $caseCheck;
private static $final = array();
private static $finalMethods = array();
@@ -139,9 +140,10 @@ class DebugClassLoader
ErrorHandler::stackErrors();
try {
if ($this->isFinder) {
if ($this->isFinder && !isset($this->loaded[$class])) {
$this->loaded[$class] = true;
if ($file = $this->classLoader[0]->findFile($class)) {
require_once $file;
require $file;
}
} else {
call_user_func($this->classLoader, $class);

View File

@@ -310,8 +310,8 @@ EOF;
.exception-message { flex-grow: 1; padding: 30px 0; }
.exception-message, .exception-message a { color: #FFF; font-size: 21px; font-weight: 400; margin: 0; }
.exception-message.long { font-size: 18px; }
.exception-message a { text-decoration: none; }
.exception-message a:hover { text-decoration: underline; }
.exception-message a { border-bottom: 1px solid rgba(255, 255, 255, 0.5); font-size: inherit; text-decoration: none; }
.exception-message a:hover { border-bottom-color: #ffffff; }
.exception-illustration { flex-basis: 111px; flex-shrink: 0; height: 66px; margin-left: 15px; opacity: .7; }
@@ -320,11 +320,11 @@ EOF;
.trace-message { font-size: 14px; font-weight: normal; margin: .5em 0 0; }
.trace-file-path, .trace-file-path a { margin-top: 3px; color: #999; color: #795da3; color: #B0413E; color: #222; font-size: 13px; }
.trace-file-path, .trace-file-path a { color: #222; margin-top: 3px; font-size: 13px; }
.trace-class { color: #B0413E; }
.trace-type { padding: 0 2px; }
.trace-method { color: #B0413E; color: #222; font-weight: bold; color: #B0413E; }
.trace-arguments { color: #222; color: #999; font-weight: normal; color: #795da3; color: #777; padding-left: 2px; }
.trace-method { color: #B0413E; font-weight: bold; }
.trace-arguments { color: #777; font-weight: normal; padding-left: 2px; }
@media (min-width: 575px) {
.hidden-xs-down { display: initial; }
@@ -393,7 +393,7 @@ EOF;
$formattedValue = str_replace("\n", '', $this->escapeHtml(var_export($item[1], true)));
}
$result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $key, $formattedValue);
$result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $this->escapeHtml($key), $formattedValue);
}
return implode(', ', $result);

View File

@@ -59,6 +59,23 @@ class DebugClassLoaderTest extends TestCase
$this->fail('DebugClassLoader did not register');
}
/**
* @expectedException \Exception
* @expectedExceptionMessage boo
*/
public function testThrowingClass()
{
try {
class_exists(__NAMESPACE__.'\Fixtures\Throwing');
$this->fail('Exception expected');
} catch (\Exception $e) {
$this->assertSame('boo', $e->getMessage());
}
// the second call also should throw
class_exists(__NAMESPACE__.'\Fixtures\Throwing');
}
public function testUnsilencing()
{
if (\PHP_VERSION_ID >= 70000) {
@@ -124,6 +141,7 @@ class DebugClassLoaderTest extends TestCase
/**
* @expectedException \RuntimeException
* @expectedExceptionMessage Case mismatch between loaded and declared class names
*/
public function testNameCaseMismatch()
{
@@ -145,6 +163,7 @@ class DebugClassLoaderTest extends TestCase
/**
* @expectedException \RuntimeException
* @expectedExceptionMessage Case mismatch between loaded and declared class names
*/
public function testPsr4CaseMismatch()
{

View File

@@ -0,0 +1,3 @@
<?php
throw new \Exception('boo');

View File

@@ -16,7 +16,7 @@
}
],
"require": {
"php": ">=5.5.9",
"php": "^5.5.9|>=7.0.8",
"psr/log": "~1.0"
},
"conflict": {