+1 for not escaping this.
Bill Karwin wrote:
Matthew Weier O'Phinney-3 wrote:
However, you're right -- the value should be escaped. I'll escalate the
issue.
Really? Message strings in Exceptions should be HTML-escaped?
If this constitutes an XSS vulnerability, then one could equally argue that
PHP should automatically escape any error or exception output if it is being
directed to the page. Though it's hard for PHP to know when to do this,
because of other conditions, e.g. output buffering may be in effect, and PHP
doesn't know whether you plan to escape the contents of the ob.
My point is that escaping output is the responsibility of the application,
not the framework (or the language). Only the application developer knows
when it's the right thing to do.
Regards,
Bill Karwin
