Merge pull request from GHSA-jq4p-mq33-w375

Html escape validation error messages
laminas · Jan 28, 2022 · 43005a3 · 43005a3
2 parents beee25d + d9131a2
commit 43005a3
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 1 deletion.
diff --git a/composer.json b/composer.json
@@ -54,7 +54,11 @@
         "laminas/laminas-view": "^2.14, required for using the laminas-form view helpers"
     },
     "config": {
-        "sort-packages": true
+        "sort-packages": true,
+        "allow-plugins": {
+            "composer/package-versions-deprecated": true,
+            "dealerdirect/phpcodesniffer-composer-installer": true
+        }
     },
     "extra": {
         "laminas": {

diff --git a/src/View/Helper/FormElementErrors.php b/src/View/Helper/FormElementErrors.php
@@ -9,6 +9,7 @@
 
 use function array_merge;
 use function array_walk_recursive;
+use function count;
 use function implode;
 use function sprintf;
 
@@ -77,6 +78,12 @@ public function render(ElementInterface $element, array $attributes = []): strin
             $attributes = ' ' . $attributes;
         }
 
+        $count   = count($messages);
+        $escaper = $this->getEscapeHtmlHelper();
+        for ($i = 0; $i < $count; $i += 1) {
+            $messages[$i] = $escaper($messages[$i]);
+        }
+
         // Generate markup
         $markup  = sprintf($this->getMessageOpenFormat(), $attributes);
         $markup .= implode($this->getMessageSeparatorString(), $messages);

diff --git a/test/View/Helper/FormElementErrorsTest.php b/test/View/Helper/FormElementErrorsTest.php
@@ -222,4 +222,22 @@ public function testCallingTheHelperToRenderInvokeCanReturnObject(): void
         $helper = $this->helper;
         $this->assertEquals($helper(), $helper);
     }
+
+    public function testHtmlEscapingOfMessages(): void
+    {
+        $messages = [
+            [
+                '<span>First validator message</span>',
+                '<span>Second validator first message</span>',
+                '<span>Second validator second message</span>',
+            ],
+        ];
+        $element  = new Element('foo');
+        $element->setMessages($messages);
+
+        $markup = $this->helper->render($element);
+
+        $this->assertStringNotContainsString('<span>', $markup);
+        $this->assertStringNotContainsString('</span>', $markup);
+    }
 }