[Console] Allow OutputFormatter::escape() to be used for escaping URLs used in <href> #44912
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hey! To help keep things organized, we don't allow "Draft" pull requests. Could you please click the "ready for review" button or close this PR and open a new one when you are done? Note that a pull request does not have to be "perfect" or "ready for merge" when you first open it. We just want it to be ready for a first review. Cheers! Carsonbot |
|
I would say that this makes sense (but it indeed needs tests covering it) |
|
OK added tests to cover the new functionality and fixed existing ones 👍🏻 |
fabpot
reviewed
Jan 7, 2022
08dc2bd to
61f06fa
Compare
…<href> - escape() now escapes `>` as well as `<` - URLs containing escaped `<` and `>` are rendered correctly as is - user-provided URLs should now be safe to use (as in they cannot break the formatting) as long as they're piped through `escape()`
fabpot
approved these changes
Jan 7, 2022
|
Thank you @Seldaek. |
This was referenced Jan 28, 2022
Merged
Merged
Merged
Merged
This was referenced Jan 29, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I was trying to use escape() to make user-provided URLs safe in
<href=...>but I realized it was really only good for avoid starting tags, and not for escaping the content of a tag.>as well as<<,>are now rendered correctlyescape()'<'.OutputFormatter::escape($color).'>'where as in current released code it would not help you at all here. I haven't checked that yetI am happy to spend time adding tests but would like to first get feedback on the changes to know if it's reasonable or not to change
escape()in this way.The rest of the changes I think are absolutely safe to merge and make sense regardless.