geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-09-15 11:56:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

bug #2750 Fix multi-byte UFT-8 in escape('html_attr') (svalgaard)

Browse Source 
This PR was merged into the 2.x branch.

Discussion
----------

Fix multi-byte UFT-8 in escape('html_attr')

Alternative to #2734

Commits
-------

dc3acfb7 Fix multi-byte UFT-8 in escape('html_attr')
This commit is contained in:
Fabien Potencier
2018-09-20 16:27:31 +02:00
parent 3da51873fa dc3acfb7cd
commit e90c786102
2 changed files with 21 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
composer.json
+1 -1
View File
@@ -28,7 +28,7 @@
},
"require": {
"php": "^7.0",
"symfony/polyfill-mbstring": "~1.0",
"symfony/polyfill-mbstring": "^1.3",
"symfony/polyfill-ctype": "^1.8"
},
"require-dev": {
lib/Twig/Extension/Core.php
+20 -36
View File
@@ -1013,20 +1013,7 @@ function twig_escape_filter(Twig_Environment $env, $string, $strategy = 'html',
$string = preg_replace_callback('#[^a-zA-Z0-9]#Su', function ($matches) {
$char = $matches[0];
// \xHH
if (!isset($char[1])) {
$hex = ltrim(strtoupper(bin2hex($char)), '0');
if (0 === strlen($hex)) {
$hex = '0';
}
return '\\'.$hex.' ';
}
// \uHHHH
$char = twig_convert_encoding($char, 'UTF-16BE', 'UTF-8');
return '\\'.ltrim(strtoupper(bin2hex($char)), '0').' ';
return sprintf('\\%X ', 1 === strlen($char) ? ord($char) : mb_ord($char, 'UTF-8'));
}, $string);
if ('UTF-8' !== $charset) {
@@ -1051,18 +1038,6 @@ function twig_escape_filter(Twig_Environment $env, $string, $strategy = 'html',
* @copyright Copyright (c) 2005-2012 Zend Technologies USA Inc. (https://www.zend.com)
* @license https://framework.zend.com/license/new-bsd New BSD License
*/
/*
* While HTML supports far more named entities, the lowest common denominator
* has become HTML5's XML Serialisation which is restricted to the those named
* entities that XML supports. Using HTML entities would result in this error:
* XML Parsing Error: undefined entity
*/
static $entityMap = array(
34 => 'quot', /* quotation mark */
38 => 'amp', /* ampersand */
60 => 'lt', /* less-than sign */
62 => 'gt', /* greater-than sign */
);
$chr = $matches[0];
$ord = ord($chr);
@@ -1079,23 +1054,32 @@ function twig_escape_filter(Twig_Environment $env, $string, $strategy = 'html',
* Check if the current character to escape has a name entity we should
* replace it with while grabbing the hex value of the character.
*/
if (1 == strlen($chr)) {
$hex = strtoupper(substr('00'.bin2hex($chr), -2));
} else {
$chr = twig_convert_encoding($chr, 'UTF-16BE', 'UTF-8');
$hex = strtoupper(substr('0000'.bin2hex($chr), -4));
}
if (1 === strlen($chr)) {
/*
* While HTML supports far more named entities, the lowest common denominator
* has become HTML5's XML Serialisation which is restricted to the those named
* entities that XML supports. Using HTML entities would result in this error:
* XML Parsing Error: undefined entity
*/
static $entityMap = array(
34 => '"', /* quotation mark */
38 => '&', /* ampersand */
60 => '<', /* less-than sign */
62 => '>', /* greater-than sign */
);
$int = hexdec($hex);
if (array_key_exists($int, $entityMap)) {
return sprintf('&%s;', $entityMap[$int]);
if (isset($entityMap[$ord])) {
return $entityMap[$ord];
}
return sprintf('&#x%02X;', $ord);
}
/*
* Per OWASP recommendations, we'll use hex entities for any other
* characters where a named entity does not exist.
*/
return sprintf('&#x%s;', $hex);
return sprintf('&#x%04X;', mb_ord($chr, 'UTF-8'));
}, $string);
if ('UTF-8' !== $charset) {