Merge branch 'hotfix/3'

Close #3
Fixes #2

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to this project will be documented in this file, in reverse chronological order by release.
 
-## 2.5.2 - TBD
+## 2.5.2 - 2016-06-30
 
 ### Added
 
@@ -21,4 +21,6 @@ All notable changes to this project will be documented in this file, in reverse
 
 ### Fixed
 
-- Nothing.
+- [#3](https://github.com/zendframework/zend-escaper/pull/3) updates the
+  the escaping mechanism to add support for escaping characters outside the Basic
+  Multilingual Plane when escaping for JS, CSS, or HTML attributes.

src/Escaper.php

@@ -244,7 +244,7 @@ protected function htmlAttrMatcher($matches)
          * replace it with while grabbing the integer value of the character.
          */
         if (strlen($chr) > 1) {
-            $chr = $this->convertEncoding($chr, 'UTF-16BE', 'UTF-8');
+            $chr = $this->convertEncoding($chr, 'UTF-32BE', 'UTF-8');
         }
 
         $hex = bin2hex($chr);
@@ -277,7 +277,13 @@ protected function jsMatcher($matches)
             return sprintf('\\x%02X', ord($chr));
         }
         $chr = $this->convertEncoding($chr, 'UTF-16BE', 'UTF-8');
-        return sprintf('\\u%04s', strtoupper(bin2hex($chr)));
+        $hex = strtoupper(bin2hex($chr));
+        if (strlen($hex) <= 4) {
+            return sprintf('\\u%04s', $hex);
+        }
+        $highSurrogate = substr($hex, 0, 4);
+        $lowSurrogate = substr($hex, 4, 4);
+        return sprintf('\\u%04s\\u%04s', $highSurrogate, $lowSurrogate);
     }
 
     /**
@@ -293,7 +299,7 @@ protected function cssMatcher($matches)
         if (strlen($chr) == 1) {
             $ord = ord($chr);
         } else {
-            $chr = $this->convertEncoding($chr, 'UTF-16BE', 'UTF-8');
+            $chr = $this->convertEncoding($chr, 'UTF-32BE', 'UTF-8');
             $ord = hexdec(bin2hex($chr));
         }
         return sprintf('\\%X ', $ord);

test/EscaperTest.php

@@ -44,6 +44,8 @@ class EscaperTest extends \PHPUnit_Framework_TestCase
         '&'     => '&',
         /* Characters beyond ASCII value 255 to unicode escape */
         'Ā'     => 'Ā',
+        /* Characters beyond Unicode BMP to unicode escape */
+        "\xF0\x90\x80\x80" => '𐀀',
         /* Immune chars excluded */
         ','     => ',',
         '.'     => '.',
@@ -79,6 +81,8 @@ class EscaperTest extends \PHPUnit_Framework_TestCase
         '&'     => '\\x26',
         /* Characters beyond ASCII value 255 to unicode escape */
         'Ā'     => '\\u0100',
+        /* Characters beyond Unicode BMP to unicode escape */
+        "\xF0\x90\x80\x80" => '\\uD800\\uDC00',
         /* Immune chars excluded */
         ','     => ',',
         '.'     => '.',
@@ -143,6 +147,8 @@ class EscaperTest extends \PHPUnit_Framework_TestCase
         '&'     => '\\26 ',
         /* Characters beyond ASCII value 255 to unicode escape */
         'Ā'     => '\\100 ',
+        /* Characters beyond Unicode BMP to unicode escape */
+        "\xF0\x90\x80\x80" => '\\10000 ',
         /* Immune chars excluded */
         ','     => '\\2C ',
         '.'     => '\\2E ',