From ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 Mon Sep 17 00:00:00 2001
From: Christophe Coevoet <stof@notk.org>
Date: Sat, 6 Apr 2019 11:38:26 +0200
Subject: [PATCH] Fix XSS issues in the form theme of the PHP templating engine

---
 .../Resources/views/Form/choice_widget_collapsed.html.php     | 2 +-
 .../FrameworkBundle/Resources/views/Form/form_errors.html.php | 2 +-
 .../FrameworkBundle/Resources/views/Form/form_start.html.php  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php
index c63d354e17..6a57d585c7 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php
@@ -11,7 +11,7 @@
     <?php if (count($preferred_choices) > 0): ?>
         <?php echo $view['form']->block($form, 'choice_widget_options', ['choices' => $preferred_choices]) ?>
         <?php if (count($choices) > 0 && null !== $separator): ?>
-            <option disabled="disabled"><?php echo $separator ?></option>
+            <option disabled="disabled"><?php echo $view->escape($separator) ?></option>
         <?php endif ?>
     <?php endif ?>
     <?php echo $view['form']->block($form, 'choice_widget_options', ['choices' => $choices]) ?>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php
index 77c60d7dfb..d97179e9a6 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php
@@ -1,7 +1,7 @@
 <?php if (count($errors) > 0): ?>
     <ul>
         <?php foreach ($errors as $error): ?>
-            <li><?php echo $error->getMessage() ?></li>
+            <li><?php echo $view->escape($error->getMessage()) ?></li>
         <?php endforeach; ?>
     </ul>
 <?php endif ?>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
index ba2f3a4791..7e24425805 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
@@ -1,6 +1,6 @@
 <?php $method = strtoupper($method) ?>
 <?php $form_method = $method === 'GET' || $method === 'POST' ? $method : 'POST' ?>
-<form name="<?php echo $name ?>" method="<?php echo strtolower($form_method) ?>"<?php if ($action !== ''): ?> action="<?php echo $action ?>"<?php endif ?><?php foreach ($attr as $k => $v) { printf(' %s="%s"', $view->escape($k), $view->escape($v)); } ?><?php if ($multipart): ?> enctype="multipart/form-data"<?php endif ?>>
+<form name="<?php echo $name ?>" method="<?php echo strtolower($form_method) ?>"<?php if ($action !== ''): ?> action="<?php echo $view->escape($action) ?>"<?php endif ?><?php foreach ($attr as $k => $v) { printf(' %s="%s"', $view->escape($k), $view->escape($v)); } ?><?php if ($multipart): ?> enctype="multipart/form-data"<?php endif ?>>
 <?php if ($form_method !== $method): ?>
-    <input type="hidden" name="_method" value="<?php echo $method ?>" />
+    <input type="hidden" name="_method" value="<?php echo $view->escape($method) ?>" />
 <?php endif ?>