Repository navigation
Conversation
…a tags The `video()`, `audio()`, `_media()`, `source()`, `track()`, `object()`, `param()` and `embed()` helpers concatenated their arguments straight into double-quoted HTML attributes. A value containing a double quote - a `src`, `type`, `kind`, `label` or `name` that comes from a database column or a request parameter, for instance - could therefore close the attribute and inject arbitrary ones, such as `onerror`, into the generated markup. Attribute values now go through a new `_esc_attr()` helper that applies `htmlspecialchars()` with `ENT_QUOTES | ENT_SUBSTITUTE`, so both quote styles, `<`, `>` and `&` are encoded while ordinary URLs stay readable. `ENT_SUBSTITUTE` keeps invalid UTF-8 from turning the whole value into an empty string. The `$unsupportedMessage` fallback text of `video()`, `audio()` and `_media()` was emitted verbatim as well, so markup passed as the fallback message was rendered as HTML. It is now escaped with `esc($message, 'html')` and displayed as plain text. Regression tests cover each affected helper, including the alternative `ENT_SUBSTITUTE` behaviour.
carson-codeigniter4
Bot
added
the
bug
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
video(),audio(),_media(),source(),track(),object(),param()andembed()helpers concatenated their arguments directly into double-quoted HTML attributes, and emitted$unsupportedMessageas raw markup. Any value containing a double quote closes the attribute it was placed in, so caller-controlled data - asrc,type,kind,label,srclang,nameorvaluecoming from a database column or a request parameter - can inject arbitrary attributes such asonerrorinto the generated tag. In the same way, markup passed as the fallback message is rendered as HTML instead of text.Both are escaped now:
_esc_attr()helper that applieshtmlspecialchars()withENT_QUOTES | ENT_SUBSTITUTE, so both quote styles,<,>and&are encoded while ordinary URLs stay readable, and invalid UTF-8 is substituted instead of emptying the value;video(),audio()and_media()go throughesc($message, 'html').Values are escaped exactly once - the array branch of
video()/audio()reachessource(), which escapes its own arguments before_media()concatenates them. The$attributesparameters are intentionally left as-is: they are documented as raw HTML snippets supplied by the caller. Output for input without special characters is unchanged, which the existing tests assert.Checklist: