smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2025-07-31 16:37:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Implement fix and tests

Browse Source
This commit is contained in:
Simon Wisselink
2023-03-24 12:19:34 +01:00
parent e58c3dde4d
commit 7677db7bc9
4 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libs/plugins/modifier.escape.php
View File

@@ -188,7 +188,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
'<!--' => '<\!--',
'<s' => '<\s',
'<S' => '<\S'
'<S' => '<\S',
"`" => "\\\\`",
"\${" => "\\\\\\$\\{"
)
);
case 'mail':

4
libs/plugins/modifiercompiler.escape.php
View File

@@ -92,7 +92,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
// see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
return 'strtr(' .
$params[ 0 ] .
', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r",
"\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
"`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
}
} catch (SmartyException $e) {
// pass through to regular plugin fallback

21
tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php
View File

@@ -207,4 +207,25 @@ class PluginModifierEscapeTest extends PHPUnit_Smarty
$this->assertEquals("sma'rty@&#187;example&#171;.com", $this->smarty->fetch($tpl));
Smarty::$_MBSTRING = true;
}
public function testTemplateLiteralBackticks()
{
$tpl = $this->smarty->createTemplate('string:{"`Hello, World!`"|escape:"javascript"}');
$this->assertEquals("\\`Hello, World!\\`", $this->smarty->fetch($tpl));
}
public function testTemplateLiteralInterpolation()
{
$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
$this->smarty->assign('vector', "`Hello, \${name}!`");
$this->assertEquals("\\`Hello, \\\$\\{name}!\\`", $this->smarty->fetch($tpl));
}
public function testTemplateLiteralBackticksAndInterpolation()
{
$this->smarty->assign('vector', '`${alert(`Hello, ${name}!`)}${`\n`}`');
$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
$this->assertEquals("\\`\\\$\\{alert(\\`Hello, \\\$\\{name}!\\`)}\\\$\\{\\`\\\\n\\`}\\`", $this->smarty->fetch($tpl));
}
}

2
tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore vendored Normal file
View File

@@ -0,0 +1,2 @@
# Ignore anything in here, but keep this directory
*