diff options
| author | Simon Wisselink <s.wisselink@iwink.nl> | 2021-08-19 16:15:57 +0200 |
|---|---|---|
| committer | Simon Wisselink <s.wisselink@iwink.nl> | 2021-08-19 16:15:57 +0200 |
| commit | 770bc4aae225226dd756a71a5c2116049554a54b (patch) | |
| tree | 67701132e30d6750398adc49e9fff17435221d09 /libs | |
| parent | 1a68b79b6c1155a457218373fe898da75c389655 (diff) | |
| parent | 0ff7ba5ab6295f9b42653a07d1cdefee49e9cbd8 (diff) | |
| download | smarty-770bc4aae225226dd756a71a5c2116049554a54b.tar.gz smarty-770bc4aae225226dd756a71a5c2116049554a54b.tar.bz2 smarty-770bc4aae225226dd756a71a5c2116049554a54b.zip | |
Merge branch 'm-haritonov-escape'
Diffstat (limited to 'libs')
| -rw-r--r-- | libs/plugins/modifier.escape.php | 6 | ||||
| -rw-r--r-- | libs/plugins/modifiercompiler.escape.php | 3 |
2 files changed, 7 insertions, 2 deletions
diff --git a/libs/plugins/modifier.escape.php b/libs/plugins/modifier.escape.php index 05d129a6..43353cfc 100644 --- a/libs/plugins/modifier.escape.php +++ b/libs/plugins/modifier.escape.php @@ -184,7 +184,11 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $ '"' => '\\"', "\r" => '\\r', "\n" => '\\n', - '</' => '<\/' + '</' => '<\/', + // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements + '<!--' => '<\!--', + '<s' => '<\s', + '<S' => '<\S' ) ); case 'mail': diff --git a/libs/plugins/modifiercompiler.escape.php b/libs/plugins/modifiercompiler.escape.php index e0763adc..a3048a03 100644 --- a/libs/plugins/modifiercompiler.escape.php +++ b/libs/plugins/modifiercompiler.escape.php @@ -89,9 +89,10 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile return 'preg_replace("%(?<!\\\\\\\\)\'%", "\\\'",' . $params[ 0 ] . ')'; case 'javascript': // escape quotes and backslashes, newlines, etc. + // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements return 'strtr(' . $params[ 0 ] . - ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/" ))'; + ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))'; } } catch (SmartyException $e) { // pass through to regular plugin fallback |