From 18624270bb14f79edb73a1d52277db4d018b588b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Deruss=C3=A9?=
 <jeremy.derusse@sensiolabs.com>
Date: Thu, 4 Sep 2014 20:59:01 +0200
Subject: [PATCH] Escape SSI virtual in generated response

---
 src/Symfony/Component/HttpKernel/HttpCache/Ssi.php          | 6 ++----
 .../Component/HttpKernel/Tests/HttpCache/SsiTest.php        | 5 +++++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/Symfony/Component/HttpKernel/HttpCache/Ssi.php b/src/Symfony/Component/HttpKernel/HttpCache/Ssi.php
index 6f9d102b95..c955900159 100644
--- a/src/Symfony/Component/HttpKernel/HttpCache/Ssi.php
+++ b/src/Symfony/Component/HttpKernel/HttpCache/Ssi.php
@@ -188,10 +188,8 @@ class Ssi implements SurrogateInterface
             throw new \RuntimeException('Unable to process an SSI tag without a "virtual" attribute.');
         }
 
-        return sprintf('<?php echo $this->surrogate->handle($this, \'%s\', \'%s\', %s) ?>' . "\n",
-            $options['virtual'],
-            '',
-            'false'
+        return sprintf('<?php echo $this->surrogate->handle($this, %s, \'\', false) ?>' . "\n",
+            var_export($options['virtual'], true)
         );
     }
 }
diff --git a/src/Symfony/Component/HttpKernel/Tests/HttpCache/SsiTest.php b/src/Symfony/Component/HttpKernel/Tests/HttpCache/SsiTest.php
index 3a1cc6d648..bb208cd86c 100644
--- a/src/Symfony/Component/HttpKernel/Tests/HttpCache/SsiTest.php
+++ b/src/Symfony/Component/HttpKernel/Tests/HttpCache/SsiTest.php
@@ -101,6 +101,11 @@ class SsiTest extends \PHPUnit_Framework_TestCase
 
         $this->assertEquals('foo <?php echo $this->surrogate->handle($this, \'...\', \'\', false) ?>'."\n", $response->getContent());
         $this->assertEquals('SSI', $response->headers->get('x-body-eval'));
+
+        $response = new Response('foo <!--#include virtual="foo\'" -->');
+        $ssi->process($request, $response);
+
+        $this->assertEquals("foo <?php echo \$this->surrogate->handle(\$this, 'foo\\'', '', false) ?>"."\n", $response->getContent());
     }
 
     public function testProcessEscapesPhpTags()