Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Screen name() with apostrophe gets escaped causing ' to appear instead. #2755

Closed
BrianWendt opened this issue Dec 4, 2023 · 2 comments
Assignees
Labels

Comments

@BrianWendt
Copy link

BrianWendt commented Dec 4, 2023

Describe the bug
Screen name() with apostrophe get's escaped causing & # 0 3 9 ; to appear instead. (spaces added because markdown decodes the & # 0 3 9 ; as and apostrophe)

To Reproduce
Steps to reproduce the behavior:

  1. Create a screen (blah blah blah)
  2. Have the name() method return "You're testing this"
  3. Render screen and see the entity code in the header and <title> tag

Expected behavior
I expect the title and header to read "You're testing this" but it returns "You& # 0 3 9 ;re testing this"

Screenshots

Desktop (please complete the following information):

  • OS: Windows 11
  • Browser: Chrome
  • Version

Smartphone (please complete the following information):

  • Device: [e.g. iPhone6]
  • OS: [e.g. iOS8.1]
  • Browser [e.g. stock browser, safari]
  • Version [e.g. 22]

Server (please complete the following information):

  • Platfrom Version: 14.14
  • Laravel Version: 10.10
  • PHP Version: [e.g. 8.1]
  • Database: MariaDB
  • Database Version: 10.4.28

Additional context

@BrianWendt
Copy link
Author

BrianWendt commented Dec 4, 2023

I think the e() helper function should be removed from where the 'title' section is defined. Only the Screen class uses that view and the $name is set via a method that is strict typed as a string. The @yeild directive already escapes strings which I think is causing the problem. With that in mind, I think removing the e() shouldn't cause any security vulnerability.

@BrianWendt BrianWendt changed the title Screen name() with apostrophe get's escaped causing &#039; to appear instead. Screen name() with apostrophe gets escaped causing &#039; to appear instead. Dec 5, 2023
@tabuna
Copy link
Member

tabuna commented Dec 11, 2023

Yes, I think that escaping was unnecessary. I suggest upgrading to the latest version to fix this issue.

@tabuna tabuna closed this as completed Dec 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants