fixed XSS in the exception handler
This commit is contained in:
parent
43f74ef41f
commit
1af6a9ec5a
@ -131,6 +131,7 @@ class ExceptionHandler
|
|||||||
}
|
}
|
||||||
|
|
||||||
$content = '';
|
$content = '';
|
||||||
|
$flags = PHP_VERSION_ID >= 50400 ? ENT_QUOTES | ENT_SUBSTITUTE : ENT_QUOTES;
|
||||||
if ($this->debug) {
|
if ($this->debug) {
|
||||||
try {
|
try {
|
||||||
$count = count($exception->getAllPrevious());
|
$count = count($exception->getAllPrevious());
|
||||||
@ -138,7 +139,7 @@ class ExceptionHandler
|
|||||||
foreach ($exception->toArray() as $position => $e) {
|
foreach ($exception->toArray() as $position => $e) {
|
||||||
$ind = $count - $position + 1;
|
$ind = $count - $position + 1;
|
||||||
$class = $this->abbrClass($e['class']);
|
$class = $this->abbrClass($e['class']);
|
||||||
$message = nl2br($e['message']);
|
$message = nl2br(htmlspecialchars($e['message'], $flags, $this->charset));
|
||||||
$content .= sprintf(<<<EOF
|
$content .= sprintf(<<<EOF
|
||||||
<div class="block_exception clear_fix">
|
<div class="block_exception clear_fix">
|
||||||
<h2><span>%d/%d</span> %s: %s</h2>
|
<h2><span>%d/%d</span> %s: %s</h2>
|
||||||
@ -169,7 +170,7 @@ EOF
|
|||||||
} catch (\Exception $e) {
|
} catch (\Exception $e) {
|
||||||
// something nasty happened and we cannot throw an exception anymore
|
// something nasty happened and we cannot throw an exception anymore
|
||||||
if ($this->debug) {
|
if ($this->debug) {
|
||||||
$title = sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), $e->getMessage());
|
$title = sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), htmlspecialchars($e->getMessage(), $flags, $this->charset));
|
||||||
} else {
|
} else {
|
||||||
$title = 'Whoops, looks like something went wrong.';
|
$title = 'Whoops, looks like something went wrong.';
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user