Skip to content

Commit c9ab1fe

Browse files
author
vrana
committed
Return safe HTML from all render()
Summary: This is pretty brutal and it adds some `phutil_safe_html()`. But it is a big step in the right direction. Test Plan: None. Reviewers: epriestley Reviewed By: epriestley CC: aran, Korvin Maniphest Tasks: T2432 Differential Revision: https://secure.phabricator.com/D4905
1 parent 37b9845 commit c9ab1fe

File tree

48 files changed

+390
-383
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+390
-383
lines changed

‎src/aphront/response/Aphront403Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public function buildResponseString() {
2626
}
2727
$failure = new AphrontRequestFailureView();
2828
$failure->setHeader('403 Forbidden');
29-
$failure->appendChild('<p>'.$forbidden_text.'</p>');
29+
$failure->appendChild(phutil_tag('p', array(), $forbidden_text));
3030

3131
$view = new PhabricatorStandardPageView();
3232
$view->setTitle('403 Forbidden');

‎src/aphront/response/Aphront404Response.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ public function getHTTPResponseCode() {
1212
public function buildResponseString() {
1313
$failure = new AphrontRequestFailureView();
1414
$failure->setHeader('404 Not Found');
15-
$failure->appendChild('<p>The page you requested was not found.</p>');
15+
$failure->appendChild(phutil_tag('p', array(), pht(
16+
'The page you requested was not found.')));
1617

1718
$view = new PhabricatorStandardPageView();
1819
$view->setTitle('404 Not Found');

‎src/applications/auth/controller/PhabricatorDisabledUserController.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ public function processRequest() {
1616

1717
$failure_view = new AphrontRequestFailureView();
1818
$failure_view->setHeader(pht('Account Disabled'));
19-
$failure_view->appendChild(
20-
'<p>'.pht('Your account has been disabled.').'</p>');
19+
$failure_view->appendChild(phutil_tag('p', array(), pht(
20+
'Your account has been disabled.')));
2121

2222
return $this->buildStandardPageResponse(
2323
$failure_view,

‎src/applications/auth/controller/PhabricatorEmailLoginController.php‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,10 +98,8 @@ public function processRequest() {
9898

9999
$view = new AphrontRequestFailureView();
100100
$view->setHeader(pht('Check Your Email'));
101-
$view->appendChild(
102-
'<p>'.pht(
103-
'An email has been sent with a link you can use to login.'
104-
).'</p>');
101+
$view->appendChild(phutil_tag('p', array(), pht(
102+
'An email has been sent with a link you can use to login.')));
105103
return $this->buildStandardPageResponse(
106104
$view,
107105
array(

‎src/applications/auth/controller/PhabricatorEmailTokenController.php‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,17 +50,16 @@ public function processRequest() {
5050

5151
$view = new AphrontRequestFailureView();
5252
$view->setHeader(pht('Unable to Login'));
53-
$view->appendChild(
54-
'<p>'.pht('The authentication information in the link you clicked is '.
53+
$view->appendChild(phutil_tag('p', array(), pht(
54+
'The authentication information in the link you clicked is '.
5555
'invalid or out of date. Make sure you are copy-and-pasting the '.
5656
'entire link into your browser. You can try again, or request '.
57-
'a new email.').'</p>');
58-
$view->appendChild(
57+
'a new email.')));
58+
$view->appendChild(hsprintf(
5959
'<div class="aphront-failure-continue">'.
60-
'<a class="button" href="/login/email/">'.
61-
pht('Send Another Email').
62-
'</a>'.
63-
'</div>');
60+
'<a class="button" href="/login/email/">%s</a>'.
61+
'</div>',
62+
pht('Send Another Email')));
6463

6564
return $this->buildStandardPageResponse(
6665
$view,

‎src/applications/auth/controller/PhabricatorLoginValidateController.php‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,16 @@ public function processRequest() {
4949

5050
$view = new AphrontRequestFailureView();
5151
$view->setHeader(pht('Login Failed'));
52-
$view->appendChild(
53-
'<p>'.pht('Login failed:').'</p>'.
54-
$list.
55-
'<p>'.pht('<strong>Clear your cookies</strong> and try again.').'</p>');
56-
$view->appendChild(
52+
$view->appendChild(hsprintf(
53+
'<p>%s</p>%s<p>%s</p>',
54+
pht('Login failed:'),
55+
$list,
56+
pht('<strong>Clear your cookies</strong> and try again.')));
57+
$view->appendChild(hsprintf(
5758
'<div class="aphront-failure-continue">'.
58-
'<a class="button" href="/login/">'.pht('Try Again').'</a>'.
59-
'</div>');
59+
'<a class="button" href="/login/">%s</a>'.
60+
'</div>',
61+
pht('Try Again')));
6062
return $this->buildStandardPageResponse(
6163
$view,
6264
array(

‎src/applications/auth/controller/PhabricatorMustVerifyEmailController.php‎

Lines changed: 17 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -41,31 +41,26 @@ public function processRequest() {
4141

4242
$error_view = new AphrontRequestFailureView();
4343
$error_view->setHeader(pht('Check Your Email'));
44-
$error_view->appendChild(
45-
'<p>'.
46-
pht('You must verify your email address to login. You should have a new '.
44+
$error_view->appendChild(phutil_tag('p', array(), pht(
45+
'You must verify your email address to login. You should have a new '.
4746
'email message from Phabricator with verification instructions in your '.
48-
'inbox (%s).', phutil_tag('strong', array(), $email_address)).
49-
'</p>');
50-
$error_view->appendChild(
51-
'<p>'.
52-
pht('If you did not receive an email, you can click the button below '.
53-
'to try sending another one.').
54-
'</p>');
55-
$error_view->appendChild(
56-
'<div class="aphront-failure-continue">'.
57-
phabricator_form(
58-
$user,
47+
'inbox (%s).', phutil_tag('strong', array(), $email_address))));
48+
$error_view->appendChild(phutil_tag('p', array(), pht(
49+
'If you did not receive an email, you can click the button below '.
50+
'to try sending another one.')));
51+
$error_view->appendChild(hsprintf(
52+
'<div class="aphront-failure-continue">%s</div>',
53+
phabricator_form(
54+
$user,
55+
array(
56+
'action' => '/login/mustverify/',
57+
'method' => 'POST',
58+
),
59+
phutil_tag(
60+
'button',
5961
array(
60-
'action' => '/login/mustverify/',
61-
'method' => 'POST',
6262
),
63-
phutil_tag(
64-
'button',
65-
array(
66-
),
67-
pht('Send Another Email'))).
68-
'</div>');
63+
pht('Send Another Email')))));
6964

7065

7166
return $this->buildApplicationPage(

‎src/applications/auth/view/PhabricatorOAuthFailureView.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,12 @@ public function render() {
7777
$provider_name);
7878
}
7979

80-
$view->appendChild(
80+
$view->appendChild(hsprintf(
8181
'<div class="aphront-failure-continue">'.
82-
$diagnose.
83-
'<a href="/login/" class="button">'.pht('Continue').'</a>'.
84-
'</div>');
82+
'%s<a href="/login/" class="button">%s</a>'.
83+
'</div>',
84+
$diagnose,
85+
pht('Continue')));
8586

8687
return $view->render();
8788
}

‎src/applications/calendar/view/AphrontCalendarMonthView.php‎

Lines changed: 33 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,10 @@ public function render() {
4848

4949
$markup = array();
5050

51-
$empty_box =
52-
'<div class="aphront-calendar-day aphront-calendar-empty">'.
53-
'</div>';
51+
$empty_box = phutil_tag(
52+
'div',
53+
array('class' => 'aphront-calendar-day aphront-calendar-empty'),
54+
'');
5455

5556
for ($ii = 0; $ii < $empty; $ii++) {
5657
$markup[] = $empty_box;
@@ -79,9 +80,10 @@ public function render() {
7980
} else {
8081
$show_events = array_fill_keys(
8182
array_keys($show_events),
82-
'<div class="aphront-calendar-event aphront-calendar-event-empty">'.
83-
'&nbsp;'.
84-
'</div>');
83+
hsprintf(
84+
'<div class="aphront-calendar-event aphront-calendar-event-empty">'.
85+
'&nbsp;'.
86+
'</div>'));
8587
}
8688

8789
foreach ($events as $event) {
@@ -110,31 +112,32 @@ public function render() {
110112
$name);
111113
}
112114

113-
$markup[] =
114-
'<div class="'.$class.'">'.
115-
'<div class="aphront-calendar-date-number">'.
116-
$day_number.
117-
'</div>'.
118-
$holiday_markup.
119-
implode("\n", $show_events).
120-
'</div>';
115+
$markup[] = hsprintf(
116+
'<div class="%s">'.
117+
'<div class="aphront-calendar-date-number">%s</div>'.
118+
'%s%s'.
119+
'</div>',
120+
$class,
121+
$day_number,
122+
$holiday_markup,
123+
phutil_implode_html("\n", $show_events));
121124
}
122125

123126
$table = array();
124127
$rows = array_chunk($markup, 7);
125128
foreach ($rows as $row) {
126-
$table[] = '<tr>';
129+
$table[] = hsprintf('<tr>');
127130
while (count($row) < 7) {
128131
$row[] = $empty_box;
129132
}
130133
foreach ($row as $cell) {
131-
$table[] = '<td>'.$cell.'</td>';
134+
$table[] = phutil_tag('p', array(), $cell);
132135
}
133-
$table[] = '</tr>';
136+
$table[] = hsprintf('</tr>');
134137
}
135-
$table =
138+
$table = hsprintf(
136139
'<table class="aphront-calendar-view">'.
137-
$this->renderCalendarHeader($first).
140+
'%s'.
138141
'<tr class="aphront-calendar-day-of-week-header">'.
139142
'<th>Sun</th>'.
140143
'<th>Mon</th>'.
@@ -144,8 +147,10 @@ public function render() {
144147
'<th>Fri</th>'.
145148
'<th>Sat</th>'.
146149
'</tr>'.
147-
implode("\n", $table).
148-
'</table>';
150+
'%s'.
151+
'</table>',
152+
$this->renderCalendarHeader($first),
153+
phutil_implode_html("\n", $table));
149154

150155
return $table;
151156
}
@@ -176,16 +181,15 @@ private function renderCalendarHeader(DateTime $date) {
176181
"\xE2\x86\x92"
177182
);
178183

179-
$left_th = '<th>'.$prev_link.'</th>';
180-
$right_th = '<th>'.$next_link.'</th>';
184+
$left_th = phutil_tag('th', array(), $prev_link);
185+
$right_th = phutil_tag('th', array(), $next_link);
181186
}
182187

183-
return
184-
'<tr class="aphront-calendar-month-year-header">'.
185-
$left_th.
186-
'<th colspan="'.$colspan.'">'.$date->format('F Y').'</th>'.
187-
$right_th.
188-
'</tr>';
188+
return hsprintf(
189+
'<tr class="aphront-calendar-month-year-header">%s%s%s</tr>',
190+
$left_th,
191+
phutil_tag('th', array('colspan' => $colspan), $date->format('F Y')),
192+
$right_th);
189193
}
190194

191195
private function getNextYearAndMonth() {

‎src/applications/differential/controller/DifferentialRevisionViewController.php‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -386,14 +386,15 @@ public function processRequest() {
386386

387387
$page_pane = id(new DifferentialPrimaryPaneView())
388388
->setID($pane_id)
389-
->appendChild(
390-
$comment_view->render().
391-
$diff_history->render().
392-
$warning.
393-
$local_view->render().
394-
$toc_view->render().
395-
$other_view.
396-
$changeset_view->render());
389+
->appendChild(array(
390+
$comment_view->render(),
391+
$diff_history->render(),
392+
$warning,
393+
$local_view->render(),
394+
$toc_view->render(),
395+
$other_view,
396+
$changeset_view->render(),
397+
));
397398
if ($comment_form) {
398399
$page_pane->appendChild($comment_form->render());
399400
}
@@ -857,13 +858,12 @@ private function renderOtherRevisions(array $revisions) {
857858
$handles = $this->loadViewerHandles($phids);
858859
$view->setHandles($handles);
859860

860-
return
861+
return hsprintf(
862+
'%s<div class="differential-panel">%s</div>',
861863
id(new PhabricatorHeaderView())
862864
->setHeader(pht('Open Revisions Affecting These Files'))
863-
->render().
864-
'<div class="differential-panel">'.
865-
$view->render().
866-
'</div>';
865+
->render(),
866+
$view->render());
867867
}
868868

869869
/**

0 commit comments

Comments
 (0)