Use consistent HTML escaping in error details fragment - #3466
Conversation
The exception message and trace in renderExceptionFragment() used bare htmlentities(), whose default flags differ across PHP versions and inherit the default_charset ini, while the title and description are escaped with explicit ENT_QUOTES | ENT_SUBSTITUTE flags and a pinned UTF-8 charset. Align the fragment escaping with the same explicit call so behavior is identical on every supported PHP version.
|
coverage: 99.457% (+0.002%) from 99.455% — iliaal:fix/html-error-renderer-escape-consistency into slimphp:4.x |
| htmlspecialchars($exception->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') | ||
| ); | ||
|
|
||
| $html .= sprintf('<div><strong>File:</strong> %s</div>', $exception->getFile()); |
There was a problem hiding this comment.
File is still emitted without HTML escaping
There was a problem hiding this comment.
Agreed. getFile() is string and a path can contain <>&"'. I'll escape it with the same htmlspecialchars(..., ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') call as message and trace.
|
|
||
| $html .= sprintf('<div><strong>File:</strong> %s</div>', $exception->getFile()); | ||
|
|
||
| $html .= sprintf('<div><strong>Line:</strong> %s</div>', $exception->getLine()); |
There was a problem hiding this comment.
Is still emitted without HTML escaping
There was a problem hiding this comment.
getLine() is int, so escaping is a no-op. I'll still add it for uniformity.
The real sibling is Type: anonymous class names embed the file path. I'll escape Type (and Code, which has no return type on Throwable) in the same pass.
File, Type, Code, and Line were interpolated into the details fragment without escaping. File paths and anonymous class names can contain HTML metacharacters, and Throwable::getCode() is untyped. Route every fragment field through the same htmlspecialchars() flags as title and description.
3 participants
HtmlErrorRenderer::renderExceptionFragment()escapes the exception message and stack trace with barehtmlentities(), while the title and description are escaped with explicithtmlspecialchars(..., ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'). The two escape sites therefore behave differently across the supported PHP range:htmlentities()default flags gainedENT_QUOTESonly in PHP 8.1, so on 7.4/8.0 single quotes in the message pass through unescaped, and the charset is inherited from thedefault_charsetini rather than pinned to UTF-8.This aligns the fragment escaping with the same explicit call used everywhere else in the renderer, making behavior identical on every supported PHP version.