Skip to content

Commit a22ef4e

Browse files
author
vrana
committed
Kill most of phutil_escape_html()
Summary: This resolves lots of double escaping. We changed most of `phutil_render_tag(, , $s)` to `phutil_tag(, , $s)` which means that `$s` is now auto-escaped. Also `pht()` auto escapes if it gets `PhutilSafeHTML`. Test Plan: None. Reviewers: epriestley Reviewed By: epriestley CC: aran, Korvin Maniphest Tasks: T2432 Differential Revision: https://secure.phabricator.com/D4889
1 parent 9b8da73 commit a22ef4e

24 files changed

+127
-101
lines changed

‎src/aphront/console/plugin/DarkConsoleErrorLogPlugin.php

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,11 @@ public function renderPanel() {
5050
$row['str'].' at ['.basename($file).':'.$line.']');
5151
$rows[] = array($tag);
5252

53-
$details .=
54-
'<div class="dark-console-panel-error-details" id="row-details-'.
55-
$index.'">'.
56-
phutil_escape_html($row['details'])."\n".
57-
'Stack trace:'."\n";
53+
$details .= hsprintf(
54+
'<div class="dark-console-panel-error-details" id="row-details-%s">'.
55+
"%s\nStack trace:\n",
56+
$index,
57+
$row['details']);
5858

5959
foreach ($row['trace'] as $key => $entry) {
6060
$line = '';

‎src/applications/auth/controller/PhabricatorLoginController.php

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,8 +247,7 @@ public function processRequest() {
247247
$title = pht("Login or Register with %s", $provider_name);
248248
$body = pht('Login or register for Phabricator using your %s account.',
249249
$provider_name);
250-
$button = pht("Login or Register with %s",
251-
phutil_escape_html($provider_name));
250+
$button = pht("Login or Register with %s", $provider_name);
252251
} else {
253252
$title = pht("Login with %s", $provider_name);
254253
$body = hsprintf(
@@ -259,7 +258,7 @@ public function processRequest() {
259258
pht(
260259
'You can not use %s to register a new account.',
261260
$provider_name));
262-
$button = pht("Log in with %s", phutil_escape_html($provider_name));
261+
$button = pht("Log in with %s", $provider_name);
263262
}
264263

265264
$auth_form = new AphrontFormView();

‎src/applications/calendar/controller/PhabricatorCalendarViewStatusController.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ private function getNoDataString() {
9494
} else {
9595
$no_data =
9696
pht('%s does not have any upcoming status events.',
97-
phutil_escape_html($this->getHandle($this->phid)->getName()));
97+
$this->getHandle($this->phid)->getName());
9898
}
9999
return $no_data;
100100
}
@@ -115,7 +115,7 @@ private function getPageTitle() {
115115
} else {
116116
$page_title = pht(
117117
'Upcoming Statuses for %s',
118-
phutil_escape_html($this->getHandle($this->phid)->getName())
118+
$this->getHandle($this->phid)->getName()
119119
);
120120
}
121121
return $page_title;

‎src/applications/calendar/view/AphrontCalendarMonthView.php

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -100,11 +100,14 @@ public function render() {
100100

101101
$holiday_markup = null;
102102
if ($holiday) {
103-
$name = phutil_escape_html($holiday->getName());
104-
$holiday_markup =
105-
'<div class="aphront-calendar-holiday" title="'.$name.'">'.
106-
$name.
107-
'</div>';
103+
$name = $holiday->getName();
104+
$holiday_markup = phutil_tag(
105+
'div',
106+
array(
107+
'class' => 'aphront-calendar-holiday',
108+
'title' => $name,
109+
),
110+
$name);
108111
}
109112

110113
$markup[] =

‎src/applications/conpherence/storage/ConpherenceTransaction.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,18 +50,18 @@ public function getTitle() {
5050
$title = pht(
5151
'%s renamed this conpherence from "%s" to "%s".',
5252
$this->renderHandleLink($author_phid),
53-
phutil_escape_html($old),
54-
phutil_escape_html($new));
53+
$old,
54+
$new);
5555
} else if ($old) {
5656
$title = pht(
5757
'%s deleted the conpherence name "%s".',
5858
$this->renderHandleLink($author_phid),
59-
phutil_escape_html($old));
59+
$old);
6060
} else {
6161
$title = pht(
6262
'%s named this conpherence "%s".',
6363
$this->renderHandleLink($author_phid),
64-
phutil_escape_html($new));
64+
$new);
6565
}
6666
return $title;
6767
case ConpherenceTransactionType::TYPE_FILES:

‎src/applications/differential/field/specification/DifferentialReviewersFieldSpecification.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,8 +143,7 @@ public function renderValueForRevisionList(DifferentialRevision $revision) {
143143
if ($other_reviewers) {
144144
$names = array();
145145
foreach ($other_reviewers as $reviewer => $_) {
146-
$names[] = phutil_escape_html(
147-
$this->getHandle($reviewer)->getLinkName());
146+
$names[] = $this->getHandle($reviewer)->getLinkName();
148147
}
149148
$suffix = javelin_tag(
150149
'abbr',

‎src/applications/differential/view/DifferentialDiffTableOfContentsView.php

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -94,22 +94,20 @@ public function render() {
9494
$meta[] = pht('Copied to multiple locations:');
9595
}
9696
foreach ($away as $path) {
97-
$meta[] = phutil_escape_html($path);
97+
$meta[] = $path;
9898
}
99-
$meta = implode('<br />', $meta);
99+
$meta = phutil_implode_html(phutil_tag('br'), $meta);
100100
} else {
101101
if ($type == DifferentialChangeType::TYPE_MOVE_AWAY) {
102-
$meta = pht('Moved to %s', phutil_escape_html(reset($away)));
102+
$meta = pht('Moved to %s', reset($away));
103103
} else {
104-
$meta = pht('Copied to %s', phutil_escape_html(reset($away)));
104+
$meta = pht('Copied to %s', reset($away));
105105
}
106106
}
107107
} else if ($type == DifferentialChangeType::TYPE_MOVE_HERE) {
108-
$meta = pht('Moved from %s',
109-
phutil_escape_html($changeset->getOldFile()));
108+
$meta = pht('Moved from %s', $changeset->getOldFile());
110109
} else if ($type == DifferentialChangeType::TYPE_COPY_HERE) {
111-
$meta = pht('Copied from %s',
112-
phutil_escape_html($changeset->getOldFile()));
110+
$meta = pht('Copied from %s', $changeset->getOldFile());
113111
} else {
114112
$meta = null;
115113
}
@@ -162,11 +160,12 @@ public function render() {
162160
'<td class="differential-toc-mcov">'.$mcov.'</td>'.
163161
'</tr>';
164162
if ($meta) {
165-
$rows[] =
163+
$rows[] = hsprintf(
166164
'<tr>'.
167165
'<td colspan="3"></td>'.
168-
'<td class="differential-toc-meta">'.$meta.'</td>'.
169-
'</tr>';
166+
'<td class="differential-toc-meta">%s</td>'.
167+
'</tr>',
168+
$meta);
170169
}
171170
if ($this->diff && $this->repository) {
172171
$paths[] =

‎src/applications/differential/view/DifferentialRevisionCommentView.php

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -116,19 +116,22 @@ public function render() {
116116
array());
117117

118118
$verb = DifferentialAction::getActionPastTenseVerb($comment->getAction());
119-
$verb = phutil_escape_html($verb);
120119

121120
$actions = array();
122121
// TODO: i18n
123122
switch ($comment->getAction()) {
124123
case DifferentialAction::ACTION_ADDCCS:
125-
$actions[] = "{$author_link} added CCs: ".
126-
$this->renderHandleList($added_ccs).".";
124+
$actions[] = hsprintf(
125+
"%s added CCs: %s.",
126+
$author_link,
127+
$this->renderHandleList($added_ccs));
127128
$added_ccs = null;
128129
break;
129130
case DifferentialAction::ACTION_ADDREVIEWERS:
130-
$actions[] = "{$author_link} added reviewers: ".
131-
$this->renderHandleList($added_reviewers).".";
131+
$actions[] = hsprintf(
132+
"%s added reviewers: %s.",
133+
$author_link,
134+
$this->renderHandleList($added_reviewers));
132135
$added_reviewers = null;
133136
break;
134137
case DifferentialAction::ACTION_UPDATE:
@@ -140,33 +143,48 @@ public function render() {
140143
'href' => '/D'.$comment->getRevisionID().'?id='.$diff_id,
141144
),
142145
'Diff #'.$diff_id);
143-
$actions[] = "{$author_link} updated this revision to {$diff_link}.";
146+
$actions[] = hsprintf(
147+
"%s updated this revision to %s.",
148+
$author_link,
149+
$diff_link);
144150
} else {
145-
$actions[] = "{$author_link} {$verb} this revision.";
151+
$actions[] = hsprintf(
152+
"%s %s this revision.",
153+
$author_link,
154+
$verb);
146155
}
147156
break;
148157
default:
149-
$actions[] = "{$author_link} {$verb} this revision.";
158+
$actions[] = hsprintf(
159+
"%s %s this revision.",
160+
$author_link,
161+
$verb);
150162
break;
151163
}
152164

153165
if ($added_reviewers) {
154-
$actions[] = "{$author_link} added reviewers: ".
155-
$this->renderHandleList($added_reviewers).".";
166+
$actions[] = hsprintf(
167+
"%s added reviewers: %s.",
168+
$author_link,
169+
$this->renderHandleList($added_reviewers));
156170
}
157171

158172
if ($removed_reviewers) {
159-
$actions[] = "{$author_link} removed reviewers: ".
160-
$this->renderHandleList($removed_reviewers).".";
173+
$actions[] = hsprintf(
174+
"%s removed reviewers: %s.",
175+
$author_link,
176+
$this->renderHandleList($removed_reviewers));
161177
}
162178

163179
if ($added_ccs) {
164-
$actions[] = "{$author_link} added CCs: ".
165-
$this->renderHandleList($added_ccs).".";
180+
$actions[] = hsprintf(
181+
"%s added CCs: %s.",
182+
$author_link,
183+
$this->renderHandleList($added_ccs));
166184
}
167185

168186
foreach ($actions as $key => $action) {
169-
$actions[$key] = '<div>'.$action.'</div>';
187+
$actions[$key] = phutil_tag('div', array(), $action);
170188
}
171189

172190
$xaction_view = id(new PhabricatorTransactionView())
@@ -205,7 +223,7 @@ private function renderHandleList(array $phids) {
205223
foreach ($phids as $phid) {
206224
$result[] = $this->handles[$phid]->renderLink();
207225
}
208-
return implode(', ', $result);
226+
return phutil_implode_html(', ', $result);
209227
}
210228

211229
private function renderInlineComments() {

‎src/applications/diffusion/view/DiffusionCommentView.php

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -114,17 +114,19 @@ private function renderActions() {
114114
$actions = array();
115115
if ($action == PhabricatorAuditActionConstants::ADD_CCS) {
116116
$rendered_ccs = $this->renderHandleList($added_ccs);
117-
$actions[] = "{$author_link} added CCs: {$rendered_ccs}.";
117+
$actions[] = hsprintf("%s added CCs: %s.", $author_link, $rendered_ccs);
118118
} else if ($action == PhabricatorAuditActionConstants::ADD_AUDITORS) {
119119
$rendered_auditors = $this->renderHandleList($added_auditors);
120-
$actions[] = "{$author_link} added auditors: ".
121-
"{$rendered_auditors}.";
120+
$actions[] = hsprintf(
121+
"%s added auditors: %s.",
122+
$author_link,
123+
$rendered_auditors);
122124
} else {
123-
$actions[] = "{$author_link} ".phutil_escape_html($verb)." this commit.";
125+
$actions[] = hsprintf("%s %s this commit.", $author_link, $verb);
124126
}
125127

126128
foreach ($actions as $key => $action) {
127-
$actions[$key] = '<div>'.$action.'</div>';
129+
$actions[$key] = phutil_tag('div', array(), $action);
128130
}
129131

130132
return $actions;
@@ -186,7 +188,7 @@ private function renderHandleList(array $phids) {
186188
foreach ($phids as $phid) {
187189
$result[] = $this->handles[$phid]->renderLink();
188190
}
189-
return implode(', ', $result);
191+
return phutil_implode_html(', ', $result);
190192
}
191193

192194
private function renderClasses() {

‎src/applications/feed/story/PhabricatorFeedStoryCommit.php

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@ public function renderView() {
1919
if ($data->getValue('authorPHID')) {
2020
$author = $this->linkTo($data->getValue('authorPHID'));
2121
} else {
22-
$author = phutil_escape_html($data->getValue('authorName'));
22+
$author = $data->getValue('authorName');
2323
}
2424

2525
$committer = null;
2626
if ($data->getValue('committerPHID')) {
2727
$committer = $this->linkTo($data->getValue('committerPHID'));
2828
} else if ($data->getValue('committerName')) {
29-
$committer = phutil_escape_html($data->getValue('committerName'));
29+
$committer = $data->getValue('committerName');
3030
}
3131

3232
$commit = $this->linkTo($data->getValue('commitPHID'));
@@ -37,9 +37,16 @@ public function renderView() {
3737
}
3838

3939
if ($author) {
40-
$title = "{$committer} committed {$commit} (authored by {$author})";
40+
$title = hsprintf(
41+
"%s committed %s (authored by %s)",
42+
$committer,
43+
$commit,
44+
$author);
4145
} else {
42-
$title = "{$committer} committed {$commit}";
46+
$title = hsprintf(
47+
"%s committed %s",
48+
$committer,
49+
$commit);
4350
}
4451

4552
$view = new PhabricatorFeedStoryView();

‎src/applications/flag/events/PhabricatorFlagsUIEventListener.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ private function handleActionEvent($event) {
3131
$flag_action = id(new PhabricatorActionView())
3232
->setWorkflow(true)
3333
->setHref('/flag/delete/'.$flag->getID().'/')
34-
->setName(phutil_escape_html('Remove '.$color.' Flag'))
34+
->setName('Remove '.$color.' Flag')
3535
->setIcon('flag-'.$flag->getColor());
3636
} else {
3737
$flag_action = id(new PhabricatorActionView())

‎src/applications/macro/storage/PhabricatorMacroTransaction.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,8 @@ public function getTitle() {
6464
return pht(
6565
'%s renamed this macro from "%s" to "%s".',
6666
$this->renderHandleLink($author_phid),
67-
phutil_escape_html($old),
68-
phutil_escape_html($new));
67+
$old,
68+
$new);
6969
break;
7070
case PhabricatorMacroTransactionType::TYPE_DISABLED:
7171
if ($new) {
@@ -109,8 +109,8 @@ public function getTitleForFeed() {
109109
'%s renamed %s from "%s" to "%s".',
110110
$this->renderHandleLink($author_phid),
111111
$this->renderHandleLink($object_phid),
112-
phutil_escape_html($old),
113-
phutil_escape_html($new));
112+
$old,
113+
$new);
114114
case PhabricatorMacroTransactionType::TYPE_DISABLED:
115115
if ($new) {
116116
return pht(

‎src/applications/maniphest/auxiliaryfield/ManiphestAuxiliaryFieldDefaultSpecification.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,13 +152,13 @@ public function renderForDetailView() {
152152
switch ($this->getFieldType()) {
153153
case self::TYPE_BOOL:
154154
if ($this->getValue()) {
155-
return phutil_escape_html($this->getCheckboxValue());
155+
return $this->getCheckboxValue();
156156
} else {
157157
return null;
158158
}
159159
case self::TYPE_SELECT:
160160
$display = idx($this->getSelectOptions(), $this->getValue());
161-
return phutil_escape_html($display);
161+
return $display;
162162
}
163163
return parent::renderForDetailView();
164164
}

‎src/applications/maniphest/auxiliaryfield/ManiphestAuxiliaryFieldSpecification.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public function renderControl() {
7171
}
7272

7373
public function renderForDetailView() {
74-
return phutil_escape_html($this->getValue());
74+
return $this->getValue();
7575
}
7676

7777

‎src/applications/paste/controller/PhabricatorPasteListController.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ private function buildPasteList(array $pastes) {
109109
$lang_name = $paste->getLanguage();
110110
if ($lang_name) {
111111
$lang_name = idx($lang_map, $lang_name, $lang_name);
112-
$item->addIcon('none', phutil_escape_html($lang_name));
112+
$item->addIcon('none', $lang_name);
113113
}
114114

115115
$list->addItem($item);

0 commit comments

Comments
 (0)