minor symfony#26 Fix the escaping of the source code when displaying it (stof)

javiereguiluz · javiereguiluz · commit 427fe5acf5f1 · 2015-04-07T15:45:49.000+02:00
This PR was merged into the master branch. Discussion ---------- Fix the escaping of the source code when displaying it The source code of the controller cannot be considered as being safe HTML. It needs to be escaped. This also moves the escaping of the template source code from the extension to the template rendering it, where it belongs (which also avoid using ``|raw``, which is flagged by Insight as being dangerous because it expects the escaping to happen elsewhere, see the first point about the controller source code) Commits ------- 2d0965e Fix the escaping of the source code when displaying it
diff --git a/app/Resources/views/default/_source_code.html.twig b/app/Resources/views/default/_source_code.html.twig
@@ -20,10 +20,10 @@
 
                 <div class="modal-body">
                     <h3>Controller code <small class="pull-right">{{ controller_file_path }}</small></h3>
-                    <pre><code class="php">{{ controller_source_code|raw }}</code></pre>
+                    <pre><code class="php">{{ controller_source_code }}</code></pre>
 
                     <h3>Twig template code <small class="pull-right">{{ template_file_path }}</small></h3>
-                    <pre><code class="twig">{{ template_source_code|raw }}</code></pre>
+                    <pre><code class="twig">{{ template_source_code }}</code></pre>
                 </div>
             </div>
         </div>
diff --git a/src/AppBundle/Twig/SourceCodeExtension.php b/src/AppBundle/Twig/SourceCodeExtension.php
@@ -50,7 +50,7 @@ public function showSourceCode(\Twig_Environment $twig, $template)
         return $twig->render('default/_source_code.html.twig', array(
             'controller_source_code' => $this->getControllerCode(),
             'controller_file_path'   => $this->getControllerRelativePath(),
-            'template_source_code'   => htmlspecialchars($this->getTemplateCode(), ENT_QUOTES, 'UTF-8'),
+            'template_source_code'   => $this->getTemplateCode(),
             'template_file_path'     => $this->getTemplateRelativePath(),
         ));
     }

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,7 @@ public function showSourceCode(\Twig_Environment $twig, $template)`
`50`	`50`	`return $twig->render('default/_source_code.html.twig', array(`
`51`	`51`	`'controller_source_code' => $this->getControllerCode(),`
`52`	`52`	`'controller_file_path' => $this->getControllerRelativePath(),`
`53`		`- 'template_source_code' => htmlspecialchars($this->getTemplateCode(), ENT_QUOTES, 'UTF-8'),`
	`53`	`+ 'template_source_code' => $this->getTemplateCode(),`
`54`	`54`	`'template_file_path' => $this->getTemplateRelativePath(),`
`55`	`55`	`));`
`56`	`56`	`}`