Escape variable in Exception Template

jderusse · jderusse · commit 85b43e2337f3 · 2020-02-04T10:49:52.000+01:00
diff --git a/src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php b/src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php
@@ -20,18 +20,18 @@
                 <?php if ($exception['trace']) { ?>
                 <pre class="stacktrace">
 <?php
-                    echo $exception['class'].":\n";
+                    echo $this->escape($exception['class']).":\n";
                     if ($exception['message']) {
-                        echo $exception['message']."\n";
+                        echo $this->escape($exception['message'])."\n";
                     }
 
                     foreach ($exception['trace'] as $trace) {
                         echo "\n  ";
                         if ($trace['function']) {
-                            echo 'at '.$trace['class'].$trace['type'].$trace['function'].'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
+                            echo $this->escape('at '.$trace['class'].$trace['type'].$trace['function']).'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
                         }
                         if ($trace['file'] && $trace['line']) {
-                            echo($trace['function'] ? "\n     (" : 'at ').strtr(strip_tags($this->formatFile($trace['file'], $trace['line'])), [' at line '.$trace['line'] => '']).':'.$trace['line'].($trace['function'] ? ')' : '');
+                            echo ($trace['function'] ? "\n     (" : 'at ').strtr(strip_tags($this->formatFile($trace['file'], $trace['line'])), [' at line '.$trace['line'] => '']).':'.$trace['line'].($trace['function'] ? ')' : '');
                         }
                     }
 ?>

Original file line number	Diff line number	Diff line change
`@@ -20,18 +20,18 @@`
`20`	`20`	`<?php if ($exception['trace']) { ?>`
`21`	`21`	`<pre class="stacktrace">`
`22`	`22`	`<?php`
`23`		`- echo $exception['class'].":\n";`
	`23`	`+ echo $this->escape($exception['class']).":\n";`
`24`	`24`	`if ($exception['message']) {`
`25`		`- echo $exception['message']."\n";`
	`25`	`+ echo $this->escape($exception['message'])."\n";`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`foreach ($exception['trace'] as $trace) {`
`29`	`29`	`echo "\n ";`
`30`	`30`	`if ($trace['function']) {`
`31`		`- echo 'at '.$trace['class'].$trace['type'].$trace['function'].'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';`
	`31`	`+ echo $this->escape('at '.$trace['class'].$trace['type'].$trace['function']).'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';`
`32`	`32`	`}`
`33`	`33`	`if ($trace['file'] && $trace['line']) {`
`34`		`- echo($trace['function'] ? "\n (" : 'at ').strtr(strip_tags($this->formatFile($trace['file'], $trace['line'])), [' at line '.$trace['line'] => '']).':'.$trace['line'].($trace['function'] ? ')' : '');`
	`34`	`+ echo ($trace['function'] ? "\n (" : 'at ').strtr(strip_tags($this->formatFile($trace['file'], $trace['line'])), [' at line '.$trace['line'] => '']).':'.$trace['line'].($trace['function'] ? ')' : '');`
`35`	`35`	`}`
`36`	`36`	`}`
`37`	`37`	`?>`