bug #23684 [Debug] Missing escape in debug output (c960657)

nicolas-grekas · nicolas-grekas · commit 50b5696779fc · 2017-07-26T22:00:18.000+02:00
This PR was merged into the 2.7 branch. Discussion ---------- [Debug] Missing escape in debug output | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | When pretty-printing an exception, the debug handler does not properly escape array keys. The problem only occurs when debug output is enabled, so this is not considered a [security issue](http://symfony.com/doc/current/contributing/code/security.html) (according to @fabpot), because the debug tools [should not be used in production](https://symfony.com/doc/current/components/debug.html#usage). A test for this is included in my patch for #18722. Commits ------- 636777d [Debug] HTML-escape array key
diff --git a/src/Symfony/Component/Debug/ExceptionHandler.php b/src/Symfony/Component/Debug/ExceptionHandler.php
@@ -419,7 +419,7 @@ private function formatArgs(array $args)
                 $formattedValue = str_replace("\n", '', var_export($this->escapeHtml((string) $item[1]), true));
             }
 
-            $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $key, $formattedValue);
+            $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $this->escapeHtml($key), $formattedValue);
         }
 
         return implode(', ', $result);

Original file line number	Diff line number	Diff line change
`@@ -419,7 +419,7 @@ private function formatArgs(array $args)`
`419`	`419`	`$formattedValue = str_replace("\n", '', var_export($this->escapeHtml((string) $item[1]), true));`
`420`	`420`	`}`
`421`	`421`
`422`		`- $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $key, $formattedValue);`
	`422`	`+ $result[] = is_int($key) ? $formattedValue : sprintf("'%s' => %s", $this->escapeHtml($key), $formattedValue);`
`423`	`423`	`}`
`424`	`424`
`425`	`425`	`return implode(', ', $result);`