Skip to content

Commit 163302f

Browse files
davemacaulaydavemacaulay
authored
Merge pull request #4330 from magento-obsessive-owls/MC-16599
[Owls] MC-16599 Use Escaper methods
2 parents 6801e95 + e5ab4b6 commit 163302f

File tree

55 files changed

+832
-259
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+832
-259
lines changed

‎app/code/Magento/AdminNotification/Model/Feed.php

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel
2525

2626
const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update';
2727

28+
/**
29+
* @var \Magento\Framework\Escaper
30+
*/
31+
private $escaper;
32+
2833
/**
2934
* Feed url
3035
*
@@ -77,6 +82,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel
7782
* @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
7883
* @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
7984
* @param array $data
85+
* @param \Magento\Framework\Escaper|null $escaper
8086
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
8187
*/
8288
public function __construct(
@@ -90,21 +96,26 @@ public function __construct(
9096
\Magento\Framework\UrlInterface $urlBuilder,
9197
\Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
9298
\Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
93-
array $data = []
99+
array $data = [],
100+
\Magento\Framework\Escaper $escaper = null
94101
) {
95102
parent::__construct($context, $registry, $resource, $resourceCollection, $data);
96-
$this->_backendConfig = $backendConfig;
97-
$this->_inboxFactory = $inboxFactory;
98-
$this->curlFactory = $curlFactory;
103+
$this->_backendConfig = $backendConfig;
104+
$this->_inboxFactory = $inboxFactory;
105+
$this->curlFactory = $curlFactory;
99106
$this->_deploymentConfig = $deploymentConfig;
100-
$this->productMetadata = $productMetadata;
101-
$this->urlBuilder = $urlBuilder;
107+
$this->productMetadata = $productMetadata;
108+
$this->urlBuilder = $urlBuilder;
109+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
110+
\Magento\Framework\Escaper::class
111+
);
102112
}
103113

104114
/**
105115
* Init model
106116
*
107117
* @return void
118+
* phpcs:disable Magento2.CodeAnalysis.EmptyBlock
108119
*/
109120
protected function _construct()
110121
{
@@ -252,6 +263,6 @@ public function getFeedXml()
252263
*/
253264
private function escapeString(\SimpleXMLElement $data)
254265
{
255-
return htmlspecialchars((string)$data);
266+
return $this->escaper->escapeHtml((string)$data);
256267
}
257268
}

‎app/code/Magento/Catalog/Block/Adminhtml/Product/Edit.php

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,16 @@
1212
*/
1313
namespace Magento\Catalog\Block\Adminhtml\Product;
1414

15+
/**
16+
* Class Edit
17+
*/
1518
class Edit extends \Magento\Backend\Block\Widget
1619
{
20+
/**
21+
* @var \Magento\Framework\Escaper
22+
*/
23+
private $escaper;
24+
1725
/**
1826
* @var string
1927
*/
@@ -47,6 +55,7 @@ class Edit extends \Magento\Backend\Block\Widget
4755
* @param \Magento\Eav\Model\Entity\Attribute\SetFactory $attributeSetFactory
4856
* @param \Magento\Framework\Registry $registry
4957
* @param \Magento\Catalog\Helper\Product $productHelper
58+
* @param \Magento\Framework\Escaper $escaper
5059
* @param array $data
5160
*/
5261
public function __construct(
@@ -55,16 +64,20 @@ public function __construct(
5564
\Magento\Eav\Model\Entity\Attribute\SetFactory $attributeSetFactory,
5665
\Magento\Framework\Registry $registry,
5766
\Magento\Catalog\Helper\Product $productHelper,
67+
\Magento\Framework\Escaper $escaper,
5868
array $data = []
5969
) {
6070
$this->_productHelper = $productHelper;
6171
$this->_attributeSetFactory = $attributeSetFactory;
6272
$this->_coreRegistry = $registry;
6373
$this->jsonEncoder = $jsonEncoder;
74+
$this->escaper = $escaper;
6475
parent::__construct($context, $data);
6576
}
6677

6778
/**
79+
* Edit Product constructor
80+
*
6881
* @return void
6982
*/
7083
protected function _construct()
@@ -144,6 +157,8 @@ protected function _prepareLayout()
144157
}
145158

146159
/**
160+
* Retrieve back button html
161+
*
147162
* @return string
148163
*/
149164
public function getBackButtonHtml()
@@ -152,6 +167,8 @@ public function getBackButtonHtml()
152167
}
153168

154169
/**
170+
* Retrieve cancel button html
171+
*
155172
* @return string
156173
*/
157174
public function getCancelButtonHtml()
@@ -160,6 +177,8 @@ public function getCancelButtonHtml()
160177
}
161178

162179
/**
180+
* Retrieve save button html
181+
*
163182
* @return string
164183
*/
165184
public function getSaveButtonHtml()
@@ -168,6 +187,8 @@ public function getSaveButtonHtml()
168187
}
169188

170189
/**
190+
* Retrieve save and edit button html
191+
*
171192
* @return string
172193
*/
173194
public function getSaveAndEditButtonHtml()
@@ -176,6 +197,8 @@ public function getSaveAndEditButtonHtml()
176197
}
177198

178199
/**
200+
* Retrieve delete button html
201+
*
179202
* @return string
180203
*/
181204
public function getDeleteButtonHtml()
@@ -194,6 +217,8 @@ public function getSaveSplitButtonHtml()
194217
}
195218

196219
/**
220+
* Retrieve validation url
221+
*
197222
* @return string
198223
*/
199224
public function getValidationUrl()
@@ -202,6 +227,8 @@ public function getValidationUrl()
202227
}
203228

204229
/**
230+
* Retrieve save url
231+
*
205232
* @return string
206233
*/
207234
public function getSaveUrl()
@@ -210,6 +237,8 @@ public function getSaveUrl()
210237
}
211238

212239
/**
240+
* Retrieve save and continue url
241+
*
213242
* @return string
214243
*/
215244
public function getSaveAndContinueUrl()
@@ -221,6 +250,8 @@ public function getSaveAndContinueUrl()
221250
}
222251

223252
/**
253+
* Retrieve product id
254+
*
224255
* @return mixed
225256
*/
226257
public function getProductId()
@@ -229,6 +260,8 @@ public function getProductId()
229260
}
230261

231262
/**
263+
* Retrieve product set id
264+
*
232265
* @return mixed
233266
*/
234267
public function getProductSetId()
@@ -241,6 +274,8 @@ public function getProductSetId()
241274
}
242275

243276
/**
277+
* Retrieve duplicate url
278+
*
244279
* @return string
245280
*/
246281
public function getDuplicateUrl()
@@ -249,6 +284,8 @@ public function getDuplicateUrl()
249284
}
250285

251286
/**
287+
* Retrieve product header
288+
*
252289
* @deprecated 101.1.0
253290
* @return string
254291
*/
@@ -263,6 +300,8 @@ public function getHeader()
263300
}
264301

265302
/**
303+
* Get product attribute set name
304+
*
266305
* @return string
267306
*/
268307
public function getAttributeSetName()
@@ -275,11 +314,14 @@ public function getAttributeSetName()
275314
}
276315

277316
/**
317+
* Retrieve id of selected tab
318+
*
278319
* @return string
279320
*/
280321
public function getSelectedTabId()
281322
{
282-
return addslashes(htmlspecialchars($this->getRequest()->getParam('tab')));
323+
// phpcs:ignore Magento2.Functions.DiscouragedFunction
324+
return addslashes($this->escaper->escapeHtml($this->getRequest()->getParam('tab')));
283325
}
284326

285327
/**

‎app/code/Magento/Checkout/view/frontend/templates/onepage/failure.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<p><?= $block->escapeHtml($error) ?></p>
1414
<?php endif ?>
1515
<p><?= $block->escapeHtml(
16-
_('Click <a href="%1">here</a> to continue shopping.', $block->escapeUrl($block->getContinueShoppingUrl())),
16+
__('Click <a href="%1">here</a> to continue shopping.', $block->escapeUrl($block->getContinueShoppingUrl())),
1717
['a']
1818
) ?>
1919
</p>

‎app/code/Magento/Customer/Block/Adminhtml/Edit/Tab/Newsletter/Grid/Renderer/Action.php

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@
1010
*/
1111
class Action extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\AbstractRenderer
1212
{
13+
/**
14+
* @var \Magento\Framework\Escaper
15+
*/
16+
private $escaper;
17+
1318
/**
1419
* Core registry
1520
*
@@ -21,17 +26,24 @@ class Action extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\Abstract
2126
* @param \Magento\Backend\Block\Context $context
2227
* @param \Magento\Framework\Registry $registry
2328
* @param array $data
29+
* @param \Magento\Framework\Escaper|null $escaper
2430
*/
2531
public function __construct(
2632
\Magento\Backend\Block\Context $context,
2733
\Magento\Framework\Registry $registry,
28-
array $data = []
34+
array $data = [],
35+
\Magento\Framework\Escaper $escaper = null
2936
) {
3037
$this->_coreRegistry = $registry;
38+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
39+
\Magento\Framework\Escaper::class
40+
);
3141
parent::__construct($context, $data);
3242
}
3343

3444
/**
45+
* Render actions
46+
*
3547
* @param \Magento\Framework\DataObject $row
3648
* @return string
3749
*/
@@ -57,15 +69,20 @@ public function render(\Magento\Framework\DataObject $row)
5769
}
5870

5971
/**
72+
* Retrieve escaped value
73+
*
6074
* @param string $value
6175
* @return string
6276
*/
6377
protected function _getEscapedValue($value)
6478
{
65-
return addcslashes(htmlspecialchars($value), '\\\'');
79+
// phpcs:ignore Magento2.Functions.DiscouragedFunction
80+
return addcslashes($this->escaper->escapeHtml($value), '\\\'');
6681
}
6782

6883
/**
84+
* Actions to html
85+
*
6986
* @param array $actions
7087
* @return string
7188
*/

‎app/code/Magento/Customer/Block/Adminhtml/Edit/Tab/Wishlist/Grid/Renderer/Description.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ class Description extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\Abs
1818
*/
1919
public function render(\Magento\Framework\DataObject $row)
2020
{
21-
return nl2br(htmlspecialchars($row->getData($this->getColumn()->getIndex())));
21+
return nl2br($this->escapeHtml($row->getData($this->getColumn()->getIndex())));
2222
}
2323
}

‎app/code/Magento/Customer/Model/Address/Validator/Country.php

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@
1616
*/
1717
class Country implements ValidatorInterface
1818
{
19+
/**
20+
* @var \Magento\Framework\Escaper
21+
*/
22+
private $escaper;
23+
1924
/**
2025
* @var Data
2126
*/
@@ -29,13 +34,18 @@ class Country implements ValidatorInterface
2934
/**
3035
* @param Data $directoryData
3136
* @param AllowedCountries $allowedCountriesReader
37+
* @param \Magento\Framework\Escaper|null $escaper
3238
*/
3339
public function __construct(
3440
Data $directoryData,
35-
AllowedCountries $allowedCountriesReader
41+
AllowedCountries $allowedCountriesReader,
42+
\Magento\Framework\Escaper $escaper = null
3643
) {
3744
$this->directoryData = $directoryData;
3845
$this->allowedCountriesReader = $allowedCountriesReader;
46+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
47+
\Magento\Framework\Escaper::class
48+
);
3949
}
4050

4151
/**
@@ -67,7 +77,7 @@ private function validateCountry(AbstractAddress $address)
6777
//Checking if such country exists.
6878
$errors[] = __(
6979
'Invalid value of "%value" provided for the %fieldName field.',
70-
['fieldName' => 'countryId', 'value' => htmlspecialchars($countryId)]
80+
['fieldName' => 'countryId', 'value' => $this->escaper->escapeHtml($countryId)]
7181
);
7282
}
7383

@@ -104,7 +114,7 @@ private function validateRegion(AbstractAddress $address)
104114
//If a region is selected then checking if it exists.
105115
$errors[] = __(
106116
'Invalid value of "%value" provided for the %fieldName field.',
107-
['fieldName' => 'regionId', 'value' => htmlspecialchars($regionId)]
117+
['fieldName' => 'regionId', 'value' => $this->escaper->escapeHtml($regionId)]
108118
);
109119
}
110120

‎app/code/Magento/Customer/Test/Unit/Model/Address/Validator/CountryTest.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,17 @@ protected function setUp()
3535
\Magento\Directory\Model\AllowedCountries::class,
3636
['getAllowedCountries']
3737
);
38+
39+
$escaper = $this->objectManager->getObject(
40+
\Magento\Framework\Escaper::class
41+
);
42+
3843
$this->model = $this->objectManager->getObject(
3944
\Magento\Customer\Model\Address\Validator\Country::class,
4045
[
4146
'directoryData' => $this->directoryDataMock,
4247
'allowedCountriesReader' => $this->allowedCountriesReaderMock,
48+
'escaper' => $escaper
4349
]
4450
);
4551
}

0 commit comments

Comments
 (0)