diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug #40209 [WebLink] Escape double quotes in attributes values (fancyweb)

Browse Source 
This PR was merged into the 4.4 branch.

Discussion
----------

[WebLink] Escape double quotes in attributes values

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

If the attribute value contains a double quote, the serialized value is invalid: `</foo>; rel="alternate"; title="foo " bar"`. Ideally we would use `addcslashes` but we can't because users that already pass escaped values would then be impacted.

Commits
-------

7946be2b95 [WebLink] Escape double quotes in attributes values
This commit is contained in:
Fabien Potencier 2021-02-16 13:01:27 +01:00
commit f8ce7d0803
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/Symfony/Component/WebLink/HttpHeaderSerializer.php
View File

@ -39,14 +39,14 @@ final class HttpHeaderSerializer
foreach ($link->getAttributes() as $key => $value) {
if (\is_array($value)) {
foreach ($value as $v) {
$attributesParts[] = sprintf('%s="%s"', $key, $v);
$attributesParts[] = sprintf('%s="%s"', $key, preg_replace('/(?<!\\\\)"/', '\"', $v));
}
continue;
}
if (!\is_bool($value)) {
$attributesParts[] = sprintf('%s="%s"', $key, $value);
$attributesParts[] = sprintf('%s="%s"', $key, preg_replace('/(?<!\\\\)"/', '\"', $value));
continue;
}

8
src/Symfony/Component/WebLink/Tests/HttpHeaderSerializerTest.php
View File

@ -44,4 +44,12 @@ class HttpHeaderSerializerTest extends TestCase
{
$this->assertNull($this->serializer->serialize([]));
}
public function testSerializeDoubleQuotesInAttributeValue()
{
$this->assertSame('</foo>; rel="alternate"; title="\"escape me\" \"already escaped\" \"\"\""', $this->serializer->serialize([
(new Link('alternate', '/foo'))
->withAttribute('title', '"escape me" \"already escaped\" ""\"'),
]));
}
}