zend-developer-tools icon indicating copy to clipboard operation
zend-developer-tools copied to clipboard

Published 20 hours ago • verified publisher icon zendframework

ApplicationConfig unescaped

Open mamont77 opened this issue 12 years ago • 9 comments

Hi. Broken page because the code is displayed unescaped. It seems there is a problem in ConfigCollector::unserializeArray().

SceenSnap

mamont77 avatar Jul 14 '13 10:07 mamont77

@mamont77 are you running the latest version? Escaping should be applied there...

Ocramius avatar Jul 14 '13 13:07 Ocramius

@Ocramius, yes. I'am using latest master.

mamont77 avatar Jul 15 '13 13:07 mamont77

Could you please paste the HTML generated by the toolbar? I didn't find the location where the output would not be correctly escaped..

Ocramius avatar Jul 16 '13 02:07 Ocramius

Sorry, I could not attach a file, unsupported format. Temporarily added to my repository. https://github.com/mamont77/fcontrol/blob/master/temp.html

mamont77 avatar Jul 16 '13 06:07 mamont77

@mamont77 if I get this correctly, it's a problem in Zend\Debug itself.

The problems are at https://github.com/mamont77/fcontrol/blob/master/temp.html#L367, right?

If so, then this issue should be opened against Zend\Debug with a small test array (nothing fancy, just those weird keys).

Ocramius avatar Jul 16 '13 07:07 Ocramius

@Ocramius I'm not convinced by your analysis. Zend\Debug\Debug::dump() does the following:

  • If xdebug is detected, it simply wraps the output in <pre> tags.
  • If not, it uses the composed Zend\Escaper\Escaper instance, and calls escapeHtml() to escape the output, before wrapping in <pre> tags.

Based on the configuration dumped, I'd argue it's a problem with Escaper, to be honest -- there are clearly < and > characters not being escaped.

weierophinney avatar Jul 18 '13 17:07 weierophinney

@weierophinney no analysis: I just stopped after finding out that it's not ZDT ;)

Ocramius avatar Jul 18 '13 17:07 Ocramius

Odd -- I took the relevant parts of the configuration:

  • the console routes
  • the super messenger configuration
  • the factories that were defined as inline anonymous functions

and wrote a test to see if the values were being escaped. They were. In fact, all quotes, all angle brackets, and a number of other characters were being escaped for HTML.

This makes me wonder if it's either (a) browser-specific, or (b) an issue with how the JS library is handling the data.

weierophinney avatar Jul 18 '13 20:07 weierophinney

This repository has been closed and moved to laminas/laminas-developer-tools; a new issue has been opened at https://github.com/laminas/laminas-developer-tools/issues/20.

weierophinney avatar Dec 31 '19 22:12 weierophinney