Changeset 8260

Timestamp:

04/04/08 11:10:11 (1 year ago)

Author:

fabien

Message:

removed both escaping strategy

• we now have 2 escaping strategy: on and off
  
• bc is now equivalent to off
  
• both is now equivalent to on
  
• if you still use bc or both, you will have an error in your log but you application will still work as expected
  
• sf_data is now available when strategy is off (but sf_data contains unescaped data)
  
• "normal" variables are now available when strategy is on (but the vars are escaped)
  
• everything is BC
  

Files:

• branches/1.1/lib/autoload/sfCoreAutoload.class.php (modified) (1 diff)
• branches/1.1/lib/config/config/core_compile.yml (modified) (1 diff)
• branches/1.1/lib/config/config/settings.yml (modified) (1 diff)
• branches/1.1/lib/plugins/sfPropelPlugin/test/functional/m2mTest.php (modified) (1 diff)
• branches/1.1/lib/task/generator/sfGenerateAppTask.class.php (modified) (1 diff)
• branches/1.1/lib/task/generator/skeleton/app/app/config/settings.yml (modified) (1 diff)
• branches/1.1/lib/view/escaper/sfOutputEscaper.class.php (modified) (2 diffs)
• branches/1.1/lib/view/sfEscapedViewParameterHolder.class.php (deleted)
• branches/1.1/lib/view/sfView.class.php (modified) (1 diff)
• branches/1.1/lib/view/sfViewParameterHolder.class.php (modified) (10 diffs)
• branches/1.1/test/functional/escapingTest.php (modified) (2 diffs)
• branches/1.1/test/functional/fixtures/project/apps/frontend/modules/escaping/actions/actions.class.php (modified) (1 diff)
• branches/1.1/test/functional/fixtures/project/apps/frontend/modules/escaping/templates/indexSuccess.php (modified) (1 diff)
• branches/1.1/test/unit/view/sfEscapedViewParameterHolderTest.php (deleted)
• branches/1.1/test/unit/view/sfViewParameterHolderTest.php (modified) (6 diffs)

branches/1.1/lib/autoload/sfCoreAutoload.class.php

@@ -396 +396 @@
-  'sfOutputEscaperObjectDecorator' => 'view/escaper',
-  'sfOutputEscaperSafe' => 'view/escaper',
-  'sfEscapedViewParameterHolder' => 'view',
-  'sfPHPView' => 'view',
-  'sfPartialView' => 'view',

branches/1.1/lib/config/config/core_compile.yml

@@ -24 +24 @@
-- %SF_SYMFONY_LIB_DIR%/view/sfView.class.php
-- %SF_SYMFONY_LIB_DIR%/view/sfViewParameterHolder.class.php
-- %SF_SYMFONY_LIB_DIR%/view/sfEscapedViewParameterHolder.class.php
-
-# these classes are optionals but very likely to be used (in web context)

branches/1.1/lib/config/config/settings.yml

@@ -25 +25 @@
-
-    # Output escaping settings
-both, on, off. The value off deactivates escaping completely and gives a slight boost
+on, off
-    escaping_method:        ESC_SPECIALCHARS # Function or helper used for escaping. Accepted values: ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, and ESC_SPECIALCHARS.
-

branches/1.1/lib/plugins/sfPropelPlugin/test/functional/m2mTest.php

@@ -20 +20 @@
-$b = new backendTestBrowser();
-
+sfConfig::set('sf_escaping_strategy', 'off');
-launch_tests($b);
-
-both
+on
-launch_tests($b);
-

branches/1.1/lib/task/generator/sfGenerateAppTask.class.php

@@ -73 +73 @@
-You can enable output escaping (to prevent XSS) by using the [escaping-strategy|COMMENT] option:
-
-both
+on
-
-You can enable session token in forms (to prevent CSRF) by defining

branches/1.1/lib/task/generator/skeleton/app/app/config/settings.yml

@@ -26 +26 @@
-
-    # Output escaping settings
-both, on, off. The value off deactivates escaping completely and gives a slight boost
+on, off
-    escaping_method:        ESC_SPECIALCHARS # Function or helper used for escaping. Accepted values: ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, and ESC_SPECIALCHARS.
-

branches/1.1/lib/view/escaper/sfOutputEscaper.class.php

@@ -75 +75 @@
-   * @param string $escapingMethod the escaping method (a PHP callable) to apply to the value
-   * @param mixed $value the value to escape
-   * @param mixed the escaped value
-   *
-   * @return mixed Escaping value
@@ -83 +82 @@
-  public static function escape($escapingMethod, $value)
-  {
- || 'esc_raw' == $escapingMethod
+
-    {
-      return $value;

branches/1.1/lib/view/sfView.class.php

@@ -150 +150 @@
-  protected function initializeAttributeHolder($attributes = array())
-  {
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-      'escaping_method'   => sfConfig::get('sf_escaping_method'),
-      'escaping_strategy' => sfConfig::get('sf_escaping_strategy'),

branches/1.1/lib/view/sfViewParameterHolder.class.php

@@ -3 +3 @@
-/*
- * This file is part of the symfony package.
-2004-2006 
+
- * 
- * For the full copyright and license information, please view the LICENSE
@@ -10 +10 @@
-
-/**
-
+
+
+
- *
- * @package    symfony
@@ -20 +22 @@
-{
-  protected
-
+
+
+
+
+
+
+
+
+
+
+
-
-  /**
@@ -29 +41 @@
-   * @param  array             An associative array of options.
-   *
-
+
+
+
+
+
+
-   *
-   * @throws <b>sfInitializationException</b> If an error occurs while initializing this view parameter holder.
@@ -41 +58 @@
-
-    $this->add($parameters);
+
+    $this->setEscaping(isset($options['escaping_strategy']) ? $options['escaping_strategy'] : false);
+    $this->setEscapingMethod(isset($options['escaping_method']) ? $options['escaping_method'] : 'ESC_SPECIALCHARS');
-  }
-
@@ -50 +70 @@
-  public function isEscaped()
-  {
-false
+in_array($this->getEscaping(), array('on', true), true)
-  }
-
@@ -57 +77 @@
-   *
-   * @return array An array of view parameters
+   *
+   * @throws InvalidArgumentException
-   */
-  public function toArray()
-  {
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-  }
-
@@ -70 +171 @@
-  public function serialize()
-  {
+    $this->set('_sf_escaping_method', $this->escapingMethod);
+    $this->set('_sf_escaping', $this->escaping);
+
-    $tmp = clone $this;
-    foreach ($tmp->getNames() as $key)
@@ -80 +184 @@
-    $tmp->dispatcher = null;
-
-
+
+
+
+
+
+
-  }
-
@@ -91 +200 @@
-
-    $this->initialize(sfContext::hasInstance() ? sfContext::getInstance()->getEventDispatcher() : new sfEventDispatcher());
+
+    $this->setEscapingMethod($this->remove('_sf_escaping_method'));
+    $this->setEscaping($this->remove('_sf_escaping'));
-  }
-}

branches/1.1/test/functional/escapingTest.php

@@ -18 +18 @@
-
-$b->
-  get('/escaping/both')->
-  isStatusCode(200)->
-  isRequestParameter('module', 'escaping')->
-  isRequestParameter('action', 'both')->
-  responseContains('<h1>Lorem &lt;strong&gt;ipsum&lt;/strong&gt; dolor sit amet.</h1>')->
-  responseContains('<h2>Lorem &lt;strong&gt;ipsum&lt;/strong&gt; dolor sit amet.</h2>');
-;
-
-$b->
-  get('/escaping/on')->
-  isStatusCode(200)->
-  isRequestParameter('module', 'escaping')->
-  isRequestParameter('action', 'on')->
--
+Lorem &lt;strong&gt;ipsum&lt;/strong&gt; dolor sit amet.
-  responseContains('<h2>Lorem &lt;strong&gt;ipsum&lt;/strong&gt; dolor sit amet.</h2>');
-;
@@ -41 +32 @@
-  isRequestParameter('action', 'off')->
-  responseContains('<h1>Lorem <strong>ipsum</strong> dolor sit amet.</h1>')->
--
+Lorem <strong>ipsum</strong> dolor sit amet.
-;

branches/1.1/test/functional/fixtures/project/apps/frontend/modules/escaping/actions/actions.class.php

@@ -18 +18 @@
-  }
-
-  public function executeBoth()
-  {
-    sfConfig::set('sf_escaping_strategy', 'both');
-  }
-
-  public function executeOn()
-  {

branches/1.1/test/functional/fixtures/project/apps/frontend/modules/escaping/templates/indexSuccess.php

@@ -1 @@
-isset($var) ? $var : '-'
-isset($sf_data) ? $sf_data->get('var') : '-'
+$var
+$sf_data->get('var')

branches/1.1/test/unit/view/sfViewParameterHolderTest.php

@@ -3 +3 @@
-/*
- * This file is part of the symfony package.
-2004-2006 
+
- * 
- * For the full copyright and license information, please view the LICENSE
@@ -12 +12 @@
-require_once($_test_dir.'/unit/sfContextMock.class.php');
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-class myRequest
@@ -34 +46 @@
-}
-
-
+
+
+
-$dispatcher = $context->dispatcher;
-
@@ -42 +56 @@
-// ->initialize()
-$t->diag('->initialize()');
-
+
+
+
+
+
-$p->initialize($dispatcher, array('foo' => 'bar'));
-$t->is($p->get('foo'), 'bar', '->initialize() takes an array of default parameters as its second argument');
-
+$p->initialize($dispatcher, array(), array('escaping_strategy' => 'on', 'escaping_method' => 'ESC_RAW'));
+$t->is($p->getEscaping(), 'on', '->initialize() takes an array of options as its third argument');
+$t->is($p->getEscapingMethod(), ESC_RAW, '->initialize() takes an array of options as its third argument');
+
-// ->isEscaped()
-$t->diag('->isEscaped()');
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-// ->toArray()
@@ -55 +105 @@
-$a = $p->toArray();
-$t->is($a['foo'], 'bar', '->toArray() returns an array representation of the parameter holder');
+
+// escaping strategies
+$p = new sfViewParameterHolder(new sfEventDispatcher(), array('foo' => 'bar'));
+
+try
+{
+  $p->setEscaping('null');
+  $p->toArray();
+  $t->fail('->toArray() throws an InvalidArgumentException if the escaping strategy does not exist');
+}
+catch (InvalidArgumentException $e)
+{
+  $t->pass('->toArray() throws an InvalidArgumentException if the escaping strategy does not exist');
+}
+
+$t->diag('Escaping strategy to on');
+$p->setEscaping('on');
+$values = $p->toArray();
+$t->is(count($values), 2, '->toArray() knows about the "on" strategy');
+$t->is(count($values['sf_data']), 1, '->toArray() knows about the "on" strategy');
+$t->is($values['foo'], '-ESCAPED-bar-ESCAPED-', '->toArray() knows about the "on" strategy');
+$t->is($values['sf_data']['foo'], '-ESCAPED-bar-ESCAPED-', '->toArray() knows about the "on" strategy');
+
+$t->diag('Escaping strategy to off');
+$p->setEscaping('off');
+$values = $p->toArray();
+$t->is(count($values), 2, '->toArray() knows about the "off" strategy');
+$t->is(count($values['sf_data']), 1, '->toArray() knows about the "on" strategy');
+$t->is($values['foo'], 'bar', '->toArray() knows about the "off" strategy');
+$t->is($values['sf_data']['foo'], 'bar', '->toArray() knows about the "off" strategy');
-
-// ->serialize() / ->unserialize()
@@ -63 +143 @@
-
-// template.filter_parameters
-
-
+
-$t->is($p->get('sf_request'), $context->request, '->initialize() add some symfony shortcuts as parameters');