Merge pull request #163 from Slamdunk/backport_GHSA-jq4p-mq33-w375

Backport GHSA-jq4p-mq33-w375 to v2
laminas · Feb 1, 2022 · af231c2 · af231c2
2 parents 2a18e67 + 8496215
commit af231c2
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 1 deletion.
diff --git a/composer.json b/composer.json
@@ -51,7 +51,11 @@
         "laminas/laminas-view": "^2.11.4, required for using the laminas-form view helpers"
     },
     "config": {
-        "sort-packages": true
+        "sort-packages": true,
+        "allow-plugins": {
+            "composer/package-versions-deprecated": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true
+        }
     },
     "extra": {
         "laminas": {

diff --git a/src/View/Helper/FormElementErrors.php b/src/View/Helper/FormElementErrors.php
@@ -8,6 +8,7 @@
 
 use function array_merge;
 use function array_walk_recursive;
+use function count;
 use function get_class;
 use function gettype;
 use function implode;
@@ -96,6 +97,13 @@ public function render(ElementInterface $element, array $attributes = [])
             $attributes = ' ' . $attributes;
         }
 
+        $count   = count($messages);
+        $escaper = $this->getEscapeHtmlHelper();
+        for ($i = 0; $i < $count; $i += 1) {
+            $messages[$i] = $escaper($messages[$i]);
+        }
+
+
         // Generate markup
         $markup  = sprintf($this->getMessageOpenFormat(), $attributes);
         $markup .= implode($this->getMessageSeparatorString(), $messages);

diff --git a/test/View/Helper/FormElementErrorsTest.php b/test/View/Helper/FormElementErrorsTest.php
@@ -219,4 +219,22 @@ public function testCallingTheHelperToRenderInvokeCanReturnObject()
         $helper = $this->helper;
         $this->assertEquals($helper(), $helper);
     }
+
+    public function testHtmlEscapingOfMessages(): void
+    {
+        $messages = [
+            [
+                '<span>First validator message</span>',
+                '<span>Second validator first message</span>',
+                '<span>Second validator second message</span>',
+            ],
+        ];
+        $element  = new Element('foo');
+        $element->setMessages($messages);
+
+        $markup = $this->helper->render($element);
+
+        $this->assertStringNotContainsString('<span>', $markup);
+        $this->assertStringNotContainsString('</span>', $markup);
+    }
 }