[WebProfilerBundle] Normalize whitespace in exceptions passed in headers

If an exception was thrown with line separators in its message the
WebProfiler would cause an exception by passing it through unsanitized
into the X-Debug-Error HTTP header. This commit fixes that by replacing
all whitespace sequences with a single space in the header.
This commit is contained in:
Niels Keurentjes 2017-03-25 00:33:11 +01:00
parent 22383987e0
commit d64679014b
2 changed files with 22 additions and 1 deletions

View File

@ -68,7 +68,7 @@ class WebDebugToolbarListener implements EventSubscriberInterface
$this->urlGenerator->generate('_profiler', array('token' => $response->headers->get('X-Debug-Token')))
);
} catch (\Exception $e) {
$response->headers->set('X-Debug-Error', get_class($e).': '.$e->getMessage());
$response->headers->set('X-Debug-Error', get_class($e).': '.preg_replace('/\s+/', ' ', $e->getMessage()));
}
}

View File

@ -228,6 +228,27 @@ class WebDebugToolbarListenerTest extends \PHPUnit_Framework_TestCase
$this->assertEquals('Exception: foo', $response->headers->get('X-Debug-Error'));
}
public function testThrowingErrorCleanup()
{
$response = new Response();
$response->headers->set('X-Debug-Token', 'xxxxxxxx');
$urlGenerator = $this->getUrlGeneratorMock();
$urlGenerator
->expects($this->once())
->method('generate')
->with('_profiler', array('token' => 'xxxxxxxx'))
->will($this->throwException(new \Exception("This\nmultiline\r\ntabbed text should\tcome out\r on\n \ta single plain\r\nline")))
;
$event = new FilterResponseEvent($this->getKernelMock(), $this->getRequestMock(), HttpKernelInterface::MASTER_REQUEST, $response);
$listener = new WebDebugToolbarListener($this->getTwigMock(), false, WebDebugToolbarListener::ENABLED, 'bottom', $urlGenerator);
$listener->onKernelResponse($event);
$this->assertEquals('Exception: This multiline tabbed text should come out on a single plain line', $response->headers->get('X-Debug-Error'));
}
protected function getRequestMock($isXmlHttpRequest = false, $requestFormat = 'html', $hasSession = true)
{
$request = $this->getMock(