Skip to content

Commit d28e2c8

Browse files
alongoszalongosz
committed
Merged branch '4.6'
2 parents cd81290 + 3d6ab04 commit d28e2c8

File tree

3 files changed

+60
-26
lines changed

3 files changed

+60
-26
lines changed

‎phpstan-baseline.neon‎

Lines changed: 41 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ parameters:
175175
path: src/lib/Configuration/UI/Mapper/CustomTag.php
176176

177177
-
178-
message: '#^Call to an undefined method DOMNode\:\:setAttribute\(\)\.$#'
178+
message: '#^Call to an undefined method DOMNameSpaceNode\|DOMNode\:\:setAttribute\(\)\.$#'
179179
identifier: method.notFound
180180
count: 2
181181
path: src/lib/FieldType/RichText/RichTextStorage.php
@@ -283,7 +283,7 @@ parameters:
283283
path: src/lib/Persistence/Legacy/RichTextFieldValueConverter.php
284284

285285
-
286-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
286+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
287287
identifier: foreach.nonIterable
288288
count: 1
289289
path: src/lib/RichText/Converter/Link.php
@@ -295,7 +295,13 @@ parameters:
295295
path: src/lib/RichText/Converter/Link.php
296296

297297
-
298-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
298+
message: '#^Access to an undefined property DOMNameSpaceNode\|DOMNode\:\:\$textContent\.$#'
299+
identifier: property.notFound
300+
count: 2
301+
path: src/lib/RichText/Converter/ProgramListing.php
302+
303+
-
304+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
299305
identifier: foreach.nonIterable
300306
count: 1
301307
path: src/lib/RichText/Converter/ProgramListing.php
@@ -331,19 +337,19 @@ parameters:
331337
path: src/lib/RichText/Converter/Render.php
332338

333339
-
334-
message: '#^Cannot access property \$length on DOMNodeList\<DOMNode\>\|false\.$#'
340+
message: '#^Cannot access property \$length on DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false\.$#'
335341
identifier: property.nonObject
336342
count: 1
337343
path: src/lib/RichText/Converter/Render.php
338344

339345
-
340-
message: '#^Cannot call method item\(\) on DOMNodeList\<DOMNode\>\|false\.$#'
346+
message: '#^Cannot call method item\(\) on DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false\.$#'
341347
identifier: method.nonObject
342348
count: 1
343349
path: src/lib/RichText/Converter/Render.php
344350

345351
-
346-
message: '#^Parameter \#1 \$configHash of method Ibexa\\FieldTypeRichText\\RichText\\Converter\\Render\:\:extractHash\(\) expects DOMNode, DOMNode\|null given\.$#'
352+
message: '#^Parameter \#1 \$configHash of method Ibexa\\FieldTypeRichText\\RichText\\Converter\\Render\:\:extractHash\(\) expects DOMNode, DOMNameSpaceNode\|DOMNode\|null given\.$#'
347353
identifier: argument.type
348354
count: 1
349355
path: src/lib/RichText/Converter/Render.php
@@ -355,7 +361,7 @@ parameters:
355361
path: src/lib/RichText/Converter/Render.php
356362

357363
-
358-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
364+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
359365
identifier: foreach.nonIterable
360366
count: 1
361367
path: src/lib/RichText/Converter/Render/Embed.php
@@ -385,13 +391,13 @@ parameters:
385391
path: src/lib/RichText/Converter/Render/Embed.php
386392

387393
-
388-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
394+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
389395
identifier: foreach.nonIterable
390396
count: 2
391397
path: src/lib/RichText/Converter/Render/Template.php
392398

393399
-
394-
message: '#^Cannot access property \$length on DOMNodeList\<DOMNode\>\|false\.$#'
400+
message: '#^Cannot access property \$length on DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false\.$#'
395401
identifier: property.nonObject
396402
count: 1
397403
path: src/lib/RichText/Converter/Render/Template.php
@@ -414,14 +420,20 @@ parameters:
414420
count: 1
415421
path: src/lib/RichText/Converter/Render/Template.php
416422

423+
-
424+
message: '#^Parameter \#1 \$node of method Ibexa\\FieldTypeRichText\\RichText\\Converter\\Render\\Template\:\:getCustomTemplateContent\(\) expects DOMNode, DOMNameSpaceNode\|DOMNode given\.$#'
425+
identifier: argument.type
426+
count: 1
427+
path: src/lib/RichText/Converter/Render/Template.php
428+
417429
-
418430
message: '#^Parameter \#1 \$string of function trim expects string, string\|false given\.$#'
419431
identifier: argument.type
420432
count: 1
421433
path: src/lib/RichText/Converter/Render/Template.php
422434

423435
-
424-
message: '#^Parameter \#3 \$template of method Ibexa\\FieldTypeRichText\\RichText\\Converter\\Render\\Template\:\:processTemplate\(\) expects DOMElement, DOMNode given\.$#'
436+
message: '#^Parameter \#3 \$template of method Ibexa\\FieldTypeRichText\\RichText\\Converter\\Render\\Template\:\:processTemplate\(\) expects DOMElement, DOMNameSpaceNode\|DOMNode given\.$#'
425437
identifier: argument.type
426438
count: 1
427439
path: src/lib/RichText/Converter/Render/Template.php
@@ -463,7 +475,7 @@ parameters:
463475
path: src/lib/RichText/Exception/InvalidXmlException.php
464476

465477
-
466-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
478+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
467479
identifier: foreach.nonIterable
468480
count: 1
469481
path: src/lib/RichText/RelationProcessor.php
@@ -475,13 +487,13 @@ parameters:
475487
path: src/lib/RichText/TextExtractor/ShortTextExtractor.php
476488

477489
-
478-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
490+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
479491
identifier: foreach.nonIterable
480492
count: 1
481493
path: src/lib/RichText/Validator/InternalLinkValidator.php
482494

483495
-
484-
message: '#^Argument of an invalid type DOMNodeList\<DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
496+
message: '#^Argument of an invalid type DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false supplied for foreach, only iterables are supported\.$#'
485497
identifier: foreach.nonIterable
486498
count: 1
487499
path: src/lib/RichText/Validator/Validator.php
@@ -499,7 +511,7 @@ parameters:
499511
path: src/lib/RichText/Validator/Validator.php
500512

501513
-
502-
message: '#^Parameter \#1 \$failedAssert of method Ibexa\\FieldTypeRichText\\RichText\\Validator\\Validator\:\:formatSVRLFailure\(\) expects DOMElement, DOMNode given\.$#'
514+
message: '#^Parameter \#1 \$failedAssert of method Ibexa\\FieldTypeRichText\\RichText\\Validator\\Validator\:\:formatSVRLFailure\(\) expects DOMElement, DOMNameSpaceNode\|DOMNode given\.$#'
503515
identifier: argument.type
504516
count: 1
505517
path: src/lib/RichText/Validator/Validator.php
@@ -522,6 +534,18 @@ parameters:
522534
count: 2
523535
path: src/lib/RichText/Validator/ValidatorDispatcher.php
524536

537+
-
538+
message: '#^Access to an undefined property DOMNameSpaceNode\|DOMNode\:\:\$textContent\.$#'
539+
identifier: property.notFound
540+
count: 1
541+
path: src/lib/RichText/XMLSanitizer.php
542+
543+
-
544+
message: '#^Parameter \#2 \$child of method DOMNode\:\:replaceChild\(\) expects TNode of DOMNode, DOMNameSpaceNode\|DOMNode given\.$#'
545+
identifier: argument.type
546+
count: 1
547+
path: src/lib/RichText/XMLSanitizer.php
548+
525549
-
526550
message: '#^Parameter \#2 \$desc of method Ibexa\\FieldTypeRichText\\Translation\\Extractor\\OnlineEditorCustomAttributesExtractor\:\:createMessage\(\) expects string, int\|string given\.$#'
527551
identifier: argument.type
@@ -685,19 +709,19 @@ parameters:
685709
path: tests/lib/RichText/Converter/Xslt/BaseTest.php
686710

687711
-
688-
message: '#^Cannot access property \$length on DOMNodeList\<DOMNode\>\|false\.$#'
712+
message: '#^Cannot access property \$length on DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false\.$#'
689713
identifier: property.nonObject
690714
count: 1
691715
path: tests/lib/RichText/Converter/Xslt/BaseTest.php
692716

693717
-
694-
message: '#^Cannot access property \$parentNode on DOMNode\|null\.$#'
718+
message: '#^Cannot access property \$parentNode on DOMNameSpaceNode\|DOMNode\|null\.$#'
695719
identifier: property.nonObject
696720
count: 1
697721
path: tests/lib/RichText/Converter/Xslt/BaseTest.php
698722

699723
-
700-
message: '#^Cannot call method item\(\) on DOMNodeList\<DOMNode\>\|false\.$#'
724+
message: '#^Cannot call method item\(\) on DOMNodeList\<DOMNameSpaceNode\|DOMNode\>\|false\.$#'
701725
identifier: method.nonObject
702726
count: 2
703727
path: tests/lib/RichText/Converter/Xslt/BaseTest.php

‎src/bundle/Resources/public/js/CKEditor/custom-tags/block-custom-tag/custom-tag-editing.js‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ import { Plugin, Widget, toWidget, toWidgetEditable } from 'ckeditor5';
22

33
import IbexaCustomTagCommand from './custom-tag-command';
44

5+
const { escapeHTML, escapeHTMLAttribute } = window.ibexa.helpers.text;
6+
const { dangerouslySetInnerHTML } = window.ibexa.helpers.dom;
7+
58
class IbexaCustomTagEditing extends Plugin {
69
static get requires() {
710
return [Widget];
@@ -66,18 +69,18 @@ class IbexaCustomTagEditing extends Plugin {
6669
const config = downcastWriter.createUIElement('span', { 'data-ezelement': 'ezconfig' }, function (domDocument) {
6770
const domElement = this.toDomElement(domDocument);
6871

69-
domElement.innerHTML = Object.entries(values).reduce((total, [attribute, value]) => {
70-
// Escaping
71-
// <script>alert("Hello! I am a script!");</script> --> &lt;script&gt;alert("Hello! I am a script!");&lt;/script&gt;
72-
const stringTempNode = domDocument.createElement('div');
73-
stringTempNode.appendChild(domDocument.createTextNode(value !== null ? value : ''));
74-
const attributeValue = stringTempNode.innerHTML;
72+
const attributesHTMLCode = Object.entries(values).reduce((total, [attributeName, value]) => {
73+
const attributeValue = value ?? '';
74+
const attributeValueEscaped = escapeHTML(attributeValue);
75+
const attributeNameAttributeEscaped = escapeHTMLAttribute(attributeName);
7576

76-
const ezvalue = `<span data-ezelement="ezvalue" data-ezvalue-key="${attribute}">${attributeValue}</span>`;
77+
const ezvalue = `<span data-ezelement="ezvalue" data-ezvalue-key="${attributeNameAttributeEscaped}">${attributeValueEscaped}</span>`;
7778

7879
return `${total}${ezvalue}`;
7980
}, '');
8081

82+
dangerouslySetInnerHTML(domElement, attributesHTMLCode);
83+
8184
return domElement;
8285
});
8386

‎src/bundle/Resources/public/js/CKEditor/custom-tags/inline-custom-tag/inline-custom-tag-editing.js‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ import { Plugin, Widget, toWidget } from 'ckeditor5';
22

33
import IbexaInlineCustomTagCommand from './inline-custom-tag-command';
44

5+
const { escapeHTML, escapeHTMLAttribute } = window.ibexa.helpers.text;
6+
const { dangerouslySetInnerHTML } = window.ibexa.helpers.dom;
7+
58
class IbexaInlineCustomTagEditing extends Plugin {
69
static get requires() {
710
return [Widget];
@@ -51,13 +54,17 @@ class IbexaInlineCustomTagEditing extends Plugin {
5154
const config = downcastWriter.createUIElement('span', { 'data-ezelement': 'ezconfig' }, function (domDocument) {
5255
const domElement = this.toDomElement(domDocument);
5356

54-
domElement.innerHTML = Object.entries(values).reduce((total, [attribute, value]) => {
57+
const attributesHTMLCode = Object.entries(values).reduce((total, [attributeName, value]) => {
5558
const attributeValue = value ?? '';
56-
const ezvalue = `<span data-ezelement="ezvalue" data-ezvalue-key="${attribute}">${attributeValue}</span>`;
59+
const attributeValueEscaped = escapeHTML(attributeValue);
60+
const attributeNameAttributeEscaped = escapeHTMLAttribute(attributeName);
61+
const ezvalue = `<span data-ezelement="ezvalue" data-ezvalue-key="${attributeNameAttributeEscaped}">${attributeValueEscaped}</span>`;
5762

5863
return `${total}${ezvalue}`;
5964
}, '');
6065

66+
dangerouslySetInnerHTML(domElement, attributesHTMLCode);
67+
6168
return domElement;
6269
});
6370

0 commit comments

Comments
 (0)