-- Bill Karwin <[EMAIL PROTECTED]> wrote (on Wednesday, 30 July 2008, 10:14 AM -0700): > Matthew Weier O'Phinney-3 wrote: > > > > However, you're right -- the value should be escaped. I'll escalate the > > issue. > > > > Really? Message strings in Exceptions should be HTML-escaped? > > If this constitutes an XSS vulnerability, then one could equally argue that > PHP should automatically escape any error or exception output if it is being > directed to the page. Though it's hard for PHP to know when to do this, > because of other conditions, e.g. output buffering may be in effect, and PHP > doesn't know whether you plan to escape the contents of the ob. > > My point is that escaping output is the responsibility of the application, > not the framework (or the language). Only the application developer knows > when it's the right thing to do.
When I discovered that the original string is generated by PDO, I came to the same conclusion. This is not a failure on ZF's part, but a failure on the developer to (a) prevent exceptions showing in their output, and (b) not escaping the output when they did allow exceptions to be shown. The potential failure here is that Zend_View probably should be escaping variables by default, and this is an improvement slated for 2.0.0. -- Matthew Weier O'Phinney Software Architect | [EMAIL PROTECTED] Zend Framework | http://framework.zend.com/
