Merge branch 'security/escaper-usage'

Fixes a number of components that were not using Zend\Escaper to escape HTML,
HTML attributes, and/or URLs.

src/Formatter/Xml.php

@@ -14,6 +14,7 @@
 use DOMDocument;
 use DOMElement;
 use Traversable;
+use Zend\Escaper\Escaper;
 use Zend\Stdlib\ArrayUtils;
 
 /**
@@ -38,6 +39,11 @@ class Xml implements FormatterInterface
      */
     protected $encoding;
 
+    /**
+     * @var Escaper instance
+     */
+    protected $escaper;
+
     /**
      * Format specifier for DateTime objects in event data (default: ISO 8601)
      *
@@ -121,6 +127,33 @@ public function setEncoding($value)
         return $this;
     }
 
+    /**
+     * Set Escaper instance
+     *
+     * @param  Escaper $escaper
+     * @return Xml
+     */
+    public function setEscaper(Escaper $escaper)
+    {
+        $this->escaper = $escaper;
+        return $this;
+    }
+
+    /**
+     * Get Escaper instance
+     *
+     * Lazy-loads an instance with the current encoding if none registered.
+     *
+     * @return Escaper
+     */
+    public function getEscaper()
+    {
+        if (null === $this->escaper) {
+            $this->setEscaper(new Escaper($this->getEncoding()));
+        }
+        return $this->escaper;
+    }
+
     /**
      * Formats data into a single line to be written by the writer.
      *
@@ -142,17 +175,18 @@ public function format($event)
             }
         }
 
-        $enc = $this->getEncoding();
-        $dom = new DOMDocument('1.0', $enc);
-        $elt = $dom->appendChild(new DOMElement($this->rootElement));
+        $enc     = $this->getEncoding();
+        $escaper = $this->getEscaper();
+        $dom     = new DOMDocument('1.0', $enc);
+        $elt     = $dom->appendChild(new DOMElement($this->rootElement));
 
         foreach ($dataToInsert as $key => $value) {
             if (empty($value)
                 || is_scalar($value)
                 || (is_object($value) && method_exists($value,'__toString'))
             ) {
                 if ($key == "message") {
-                    $value = htmlspecialchars($value, ENT_COMPAT, $enc);
+                    $value = $escaper->escapeHtml($value);
                 } elseif ($key == "extra" && empty($value)) {
                     continue;
                 }