[7.x] Escape attributes automatically in some situations

src/Illuminate/View/Compilers/ComponentTagCompiler.php

@@ -23,6 +23,13 @@ class ComponentTagCompiler
      */
     protected $aliases = [];
 
+    /**
+     * The "bind:" attributes that have been compiled for the current component.
+     *
+     * @var array
+     */
+    protected $boundAttributes = [];
+
     /**
      * Create new component tag compiler.
      *
@@ -96,6 +103,8 @@ protected function compileOpeningTags(string $value)
         /x";
 
         return preg_replace_callback($pattern, function (array $matches) {
+            $this->boundAttributes = [];
+
             $attributes = $this->getAttributesFromAttributeString($matches['attributes']);
 
             return $this->componentString($matches[1], $attributes);
@@ -136,6 +145,8 @@ protected function compileSelfClosingTags(string $value)
         /x";
 
         return preg_replace_callback($pattern, function (array $matches) {
+            $this->boundAttributes = [];
+
             $attributes = $this->getAttributesFromAttributeString($matches['attributes']);
 
             return $this->componentString($matches[1], $attributes)."\n@endcomponentClass";
@@ -165,15 +176,15 @@ protected function componentString(string $component, array $attributes)
         if (! class_exists($class)) {
             $parameters = [
                 'view' => "'$class'",
-                'data' => '['.$this->attributesToString($data->all()).']',
+                'data' => '['.$this->attributesToString($data->all(), $escapeBound = false).']',
             ];
 
             $class = AnonymousComponent::class;
         } else {
             $parameters = $data->all();
         }
 
-        return " @component('{$class}', [".$this->attributesToString($parameters).'])
+        return " @component('{$class}', [".$this->attributesToString($parameters, $escapeBound = false).'])
 <?php $component->withAttributes(['.$this->attributesToString($attributes->all()).']); ?>';
     }
 
@@ -319,6 +330,8 @@ protected function getAttributesFromAttributeString(string $attributeString)
 
             if (Str::startsWith($attribute, 'bind:')) {
                 $attribute = Str::after($attribute, 'bind:');
+
+                $this->boundAttributes[$attribute] = true;
             } else {
                 $value = "'".str_replace("'", "\\'", $value)."'";
             }
@@ -349,13 +362,16 @@ protected function parseBindAttributes(string $attributeString)
      * Convert an array of attributes to a string.
      *
      * @param  array  $attributes
+     * @param  bool  $escapeBound
      * @return string
      */
-    protected function attributesToString(array $attributes)
+    protected function attributesToString(array $attributes, $escapeBound = true)
     {
         return collect($attributes)
-                ->map(function (string $value, string $attribute) {
-                    return "'{$attribute}' => {$value}";
+                ->map(function (string $value, string $attribute) use ($escapeBound) {
+                    return $escapeBound && isset($this->boundAttributes[$attribute]) && $value !== 'true' && ! is_numeric($value)
+                                ? "'{$attribute}' => \Illuminate\View\Compilers\BladeCompiler::sanitizeComponentAttribute({$value})"
+                                : "'{$attribute}' => {$value}";
                 })
                 ->implode(',');
     }

src/Illuminate/View/Compilers/Concerns/CompilesComponents.php

@@ -154,4 +154,18 @@ protected function compileProps($expression)
 } ?>
 <?php unset(\$__defined_vars); ?>";
     }
+
+    /**
+     * Sanitize the given component attribute value.
+     *
+     * @param  mixed  $value
+     * @return mixed
+     */
+    public static function sanitizeComponentAttribute($value)
+    {
+        return is_string($value) ||
+               (is_object($value) && method_exists($value, '__toString'))
+                        ? e($value)
+                        : $value;
+    }
 }

tests/View/Blade/BladeComponentTagCompilerTest.php

@@ -5,6 +5,7 @@
 use Illuminate\Container\Container;
 use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Contracts\View\Factory;
+use Illuminate\View\Compilers\BladeCompiler;
 use Illuminate\View\Compilers\ComponentTagCompiler;
 use Illuminate\View\Component;
 use Mockery;
@@ -52,6 +53,22 @@ public function testDataCamelCasing()
 <?php \$component->withAttributes([]); ?> @endcomponentClass", trim($result));
     }
 
+    public function testColonData()
+    {
+        $result = (new ComponentTagCompiler(['profile' => TestProfileComponent::class]))->compileTags('<x-profile :user-id="1"></x-profile>');
+
+        $this->assertSame("@component('Illuminate\Tests\View\Blade\TestProfileComponent', ['userId' => 1])
+<?php \$component->withAttributes([]); ?> @endcomponentClass", trim($result));
+    }
+
+    public function testColonAttributesIsEscapedIfStrings()
+    {
+        $result = (new ComponentTagCompiler(['profile' => TestProfileComponent::class]))->compileTags('<x-profile :src="\'foo\'"></x-profile>');
+
+        $this->assertSame("@component('Illuminate\Tests\View\Blade\TestProfileComponent', [])
+<?php \$component->withAttributes(['src' => \Illuminate\View\Compilers\BladeCompiler::sanitizeComponentAttribute('foo')]); ?> @endcomponentClass", trim($result));
+    }
+
     public function testColonNestedComponentParsing()
     {
         $result = (new ComponentTagCompiler(['foo:alert' => TestAlertComponent::class]))->compileTags('<x-foo:alert></x-foo:alert>');
@@ -157,6 +174,21 @@ public function testClasslessComponents()
 <?php \$component->withAttributes(['name' => 'Taylor','age' => 31,'wire:model' => 'foo']); ?>
 @endcomponentClass", trim($result));
     }
+
+    public function testAttributeSanitization()
+    {
+        $class = new class {
+            public function __toString()
+            {
+                return '<hi>';
+            }
+        };
+
+        $this->assertEquals(e('<hi>'), BladeCompiler::sanitizeComponentAttribute('<hi>'));
+        $this->assertEquals(e('1'), BladeCompiler::sanitizeComponentAttribute('1'));
+        $this->assertEquals(1, BladeCompiler::sanitizeComponentAttribute(1));
+        $this->assertEquals(e('<hi>'), BladeCompiler::sanitizeComponentAttribute($class));
+    }
 }
 
 class TestAlertComponent extends Component