Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Added escapeCss function #5299

Merged
merged 7 commits into from
Sep 6, 2019
Merged

Added escapeCss function #5299

merged 7 commits into from
Sep 6, 2019

Conversation

jeff-matthews
Copy link
Contributor

Purpose of this pull request

This pull request (PR) adds an example of the escapeCss function.

Fixes #5273

Affected DevDocs pages

whatsnew
Added an example of the escapeCss function to the Templates XSS security topic.

@jeff-matthews jeff-matthews self-assigned this Aug 30, 2019
@jeff-matthews jeff-matthews added 2.3.x Magento 2.3 related changes Major Update Significant original updates to existing content Internal Dev Differentiates work between community and Magento staff and removed Progress: review labels Aug 30, 2019
@jeff-matthews jeff-matthews requested a review from a team August 30, 2019 14:07
@dobooth dobooth changed the base branch from master to small-changes September 4, 2019 19:03
@dobooth dobooth changed the base branch from small-changes to master September 4, 2019 19:04
meker12
meker12 approved these changes Sep 4, 2019
View reviewed changes
@atwixfirster
Copy link
Contributor

Hi, @meker12!

I want to say that this:

<div style="<?= $block->escapeCss("background: #000\"><script>alert(1)</script>") ?>"></div>

will return

<div style="background\3A \20 \23 000\22 \3E \3C script\3E alert\28 1\29 \3C \2F script\3E "></div>

dobooth
dobooth reviewed Sep 4, 2019
View reviewed changes
Copy link
Contributor

@dobooth dobooth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few trailing double backslashes on the Case lines.

meker12
meker12 reviewed Sep 5, 2019
View reviewed changes
@dobooth
Copy link
Contributor

dobooth commented Sep 6, 2019

running tests

@dobooth dobooth merged commit b9c1f00 into master Sep 6, 2019
@dobooth dobooth deleted the 5273-add-escapeCss-example branch September 6, 2019 16:28
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@lenaorobei lenaorobei Awaiting requested review from lenaorobei

3 more reviewers

@meker12 meker12 meker12 approved these changes

@atwixfirster atwixfirster atwixfirster left review comments

@dobooth dobooth dobooth approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees

@meker12 meker12

@jeff-matthews jeff-matthews

@dobooth dobooth

Labels
2.3.x Magento 2.3 related changes Internal Dev Differentiates work between community and Magento staff Major Update Significant original updates to existing content
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Missing function escapeCss
4 participants
@jeff-matthews @atwixfirster @dobooth @meker12