diff options
| author | Simon Wisselink <s.wisselink@iwink.nl> | 2021-08-19 15:26:27 +0200 |
|---|---|---|
| committer | Simon Wisselink <s.wisselink@iwink.nl> | 2021-08-19 15:26:27 +0200 |
| commit | 3b0fd82849141ee5a33db2cddd7b0828d8e35361 (patch) | |
| tree | bb86ce23c406edefec2a4101cb9262bb31c88703 | |
| parent | e3eabe0b965fefba8ff6f295f14e8d1e208c39b7 (diff) | |
| parent | 9cde36e3bc263b261b4f123876c5bf9c54817925 (diff) | |
| download | smarty-3b0fd82849141ee5a33db2cddd7b0828d8e35361.tar.gz smarty-3b0fd82849141ee5a33db2cddd7b0828d8e35361.tar.bz2 smarty-3b0fd82849141ee5a33db2cddd7b0828d8e35361.zip | |
Merge branch 'escape' of https://github.com/m-haritonov/smarty into m-haritonov-escape
| -rw-r--r-- | libs/plugins/modifier.escape.php | 6 | ||||
| -rw-r--r-- | libs/plugins/modifiercompiler.escape.php | 3 |
2 files changed, 7 insertions, 2 deletions
diff --git a/libs/plugins/modifier.escape.php b/libs/plugins/modifier.escape.php index 05d129a6..43353cfc 100644 --- a/libs/plugins/modifier.escape.php +++ b/libs/plugins/modifier.escape.php @@ -184,7 +184,11 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $ '"' => '\\"', "\r" => '\\r', "\n" => '\\n', - '</' => '<\/' + '</' => '<\/', + // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements + '<!--' => '<\!--', + '<s' => '<\s', + '<S' => '<\S' ) ); case 'mail': diff --git a/libs/plugins/modifiercompiler.escape.php b/libs/plugins/modifiercompiler.escape.php index e0763adc..a3048a03 100644 --- a/libs/plugins/modifiercompiler.escape.php +++ b/libs/plugins/modifiercompiler.escape.php @@ -89,9 +89,10 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile return 'preg_replace("%(?<!\\\\\\\\)\'%", "\\\'",' . $params[ 0 ] . ')'; case 'javascript': // escape quotes and backslashes, newlines, etc. + // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements return 'strtr(' . $params[ 0 ] . - ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/" ))'; + ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))'; } } catch (SmartyException $e) { // pass through to regular plugin fallback |