Skip to content

Commit 916a030

Browse files
cammonrocammonro
committed
MAGE-1381 Apply JS escaping where necessary
1 parent 396d46a commit 916a030

File tree

11 files changed

+28
-56
lines changed

11 files changed

+28
-56
lines changed

‎view/adminhtml/templates/catalog/category/edit/merchandising.phtml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
/** @var \Algolia\AlgoliaSearch\Block\Adminhtml\Category\Merchandising $block */
44
/** @var \Magento\Framework\Escaper $escaper */
5-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
65

76
$configHelper = $block->getConfigHelper();
87

@@ -197,7 +196,7 @@ $isConfig = [
197196
<script>
198197
requirejs(['algoliaAdminBundle'], function (algoliaAdminBundle) {
199198
algoliaAdminBundle.$(function ($) {
200-
var config = <?= /** phpcs:ignore Magento2.Security.XssTemplate.FoundUnescaped */json_encode($isConfig); ?>;
199+
var config = JSON.parse('<?= $escaper->escapeJs(json_encode($isConfig)) ?>');
201200

202201
var search = algoliaAdminBundle.instantsearch(config);
203202

‎view/adminhtml/templates/common.phtml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
/** @var \Magento\Backend\Block\Template $block */
33
/** @var \Magento\Framework\Escaper $escaper */
44
/** @var \Algolia\AlgoliaSearch\ViewModel\Adminhtml\Common $viewModel */
5-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
65

76
$viewModel = $block->getViewModel();
87

@@ -12,9 +11,9 @@ $ajaxCheckQuery = $block->getUrl('algolia_algoliasearch/query/checkQuery');
1211
$applicationId = $viewModel->getApplicationId();
1312
?>
1413
<script>
15-
var applicationId = <?=/** phpcs:ignore Magento2.Security.XssTemplate.FoundUnescaped */ json_encode($applicationId); ?>;
16-
var ajaxCheckUrl = <?=/** phpcs:ignore Magento2.Security.XssTemplate.FoundUnescaped */ json_encode($ajaxCheckUrl); ?>;
17-
var ajaxCheckQuery = <?= /** phpcs:ignore Magento2.Security.XssTemplate.FoundUnescaped */json_encode($ajaxCheckQuery); ?>;
14+
var applicationId = "<?= $escaper->escapeJs($applicationId) ?>";
15+
var ajaxCheckUrl = "<?= $escaper->escapeJs($ajaxCheckUrl) ?>";
16+
var ajaxCheckQuery = "<?= $escaper->escapeJs($ajaxCheckQuery) ?>";
1817
document.addEventListener("DOMContentLoaded", function(event) {
1918
requirejs([
2019
'jquery',

‎view/adminhtml/templates/configuration.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
/** @var \Magento\Backend\Block\Template $block */
44
/** @var \Magento\Framework\Escaper $escaper */
55
/** @var \Algolia\AlgoliaSearch\ViewModel\Adminhtml\Configuration $viewModel */
6-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
76

87
$viewModel = $block->getViewModel();
98

@@ -24,6 +23,7 @@ if (preg_match('/algoliasearch_/', $section)) {
2423
?>
2524

2625
<script>
26+
<?php // The following is internally generated trusted content and can be ignored by PHPCS ?>
2727
var isClickAnalyticsEnabled = <?= /** phpcs:ignore Magento2.Security.EscapeOutput.OutputNotEscaped */json_encode($isClickAnalyticsEnabled); ?>;
2828
var linksAndVideoTemplate = <?= /** phpcs:ignore Magento2.Security.EscapeOutput.OutputNotEscaped */json_encode($linksAndVideoTemplate); ?>;
2929
var personalizationStatus = <?= /** phpcs:ignore Magento2.Security.EscapeOutput.OutputNotEscaped */json_encode($personalizationStatus); ?>;

‎view/adminhtml/templates/landingpage/search-configuration.phtml

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/** @var \Magento\Framework\Escaper $escaper */
33
/** @var \Algolia\AlgoliaSearch\Block\Adminhtml\LandingPage\SearchConfiguration $block */
4-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
4+
55
$configHelper = $block->getConfigHelper();
66
$merchIllustration = $block->getViewFileUrl('Algolia_AlgoliaSearch::images/illu-merchtool.svg');
77
$starsIllustration = $block->getViewFileUrl('Algolia_AlgoliaSearch::images/icon-stars.svg');
@@ -117,9 +117,7 @@ $isConfig = [
117117
{{/_highlightResult.sku.0}}
118118
</td>
119119
<td>{{{ _highlightResult.name.value }}}</td>
120-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
121-
<td>{{ price.<?= $configHelper->getCurrencyCode() ?>.default_formated }}</td>
122-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
120+
<td>{{ price.<?= $escaper->escapeHtml($configHelper->getCurrencyCode()) ?>.default_formated }}</td>
123121
<td class="actions">
124122
<div class="pin_block">
125123
<a class="arrow up" href="#">
@@ -184,9 +182,7 @@ $isConfig = [
184182
{{/_highlightResult.sku.0}}
185183
</td>
186184
<td>{{{ _highlightResult.name.value }}}</td>
187-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
188-
<td>{{ price.<?= $configHelper->getCurrencyCode() ?>.default_formated }}</td>
189-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
185+
<td>{{ price.<?= $escaper->escapeHtml($configHelper->getCurrencyCode()) ?>.default_formated }}</td>
190186
<td class="actions">
191187
<div class="pin_block">
192188
<a class="arrow up" href="#">
@@ -227,9 +223,7 @@ $isConfig = [
227223
{{/sku.0}}
228224
</td>
229225
<td>{{{ name }}}</td>
230-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
231-
<td>{{ price.<?= $configHelper->getCurrencyCode() ?>.default_formated }}</td>
232-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
226+
<td>{{ price.<?= $escaper->escapeHtml($configHelper->getCurrencyCode()) ?>.default_formated }}</td>
233227
<td class="actions">
234228
<div class="pin_block">
235229
<a class="arrow up" href="#">
@@ -256,9 +250,7 @@ $isConfig = [
256250
<div class="info">
257251
{{{ _highlightResult.name.value }}}
258252
<div class="price">
259-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
260-
{{ price.<?= $configHelper->getCurrencyCode() ?>.default_formated }}
261-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
253+
{{ price.<?= $escaper->escapeHtml($configHelper->getCurrencyCode()) ?>.default_formated }}
262254
</div>
263255
</div>
264256

@@ -316,7 +308,7 @@ $isConfig = [
316308

317309
algoliaAdminBundle.$(function ($) {
318310
var storeId = $('select[name="store_id"]').val();
319-
var config = <?=/** phpcs:ignore Magento2.Security.EscapeOutput.OutputNotEscaped */ json_encode($isConfig); ?>;
311+
var config = JSON.parse('<?= $escaper->escapeJs(json_encode($isConfig)) ?>');
320312

321313
config.appId = config.indexDataByStoreIds[storeId].appId;
322314
config.apiKey = config.indexDataByStoreIds[storeId].apiKey;

‎view/adminhtml/templates/query/edit/merchandising.phtml

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
/** @var \Algolia\AlgoliaSearch\Block\Adminhtml\Query\Merchandising $block */
44
/** @var \Magento\Framework\Escaper $escaper */
5-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
65

76
$configHelper = $block->getConfigHelper();
87
$indexName = $block->getCoreHelper()->getBaseIndexName();
@@ -83,9 +82,7 @@ $isConfig = [
8382
{{/_highlightResult.sku.0}}
8483
</td>
8584
<td>{{{ _highlightResult.name.value }}}</td>
86-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
87-
<td>{{ price.<?= $currencyCode ?>.default_formated }}</td>
88-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
85+
<td>{{ price.<?= $escaper->escapeHtml($currencyCode) ?>.default_formated }}</td>
8986
<td class="actions">
9087
<div class="pin_block">
9188
<a class="arrow up" href="#">
@@ -135,9 +132,7 @@ $isConfig = [
135132
{{/sku.0}}
136133
</td>
137134
<td>{{{ name }}}</td>
138-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
139-
<td>{{ price.<?= $currencyCode ?>.default_formated }}</td>
140-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
135+
<td>{{ price.<?= $escaper->escapeHtml($currencyCode) ?>.default_formated }}</td>
141136
<td class="actions">
142137
<div class="pin_block">
143138
<a class="arrow up" href="#">
@@ -164,9 +159,7 @@ $isConfig = [
164159
<div class="info">
165160
{{{ _highlightResult.name.value }}}
166161
<div class="price">
167-
<!-- phpcs:disable Magento2.Security.XssTemplate.FoundUnescaped -->
168-
{{ price.<?= $currencyCode ?>.default_formated }}
169-
<!-- phpcs:enable Magento2.Security.XssTemplate.FoundUnescaped -->
162+
{{ price.<?= $escaper->escapeHtml($currencyCode) ?>.default_formated }}
170163
</div>
171164
</div>
172165

@@ -197,7 +190,7 @@ $isConfig = [
197190
var initInstantSearch = function() {
198191
algoliaAdminBundle.$(function ($) {
199192
var storeId = $('select[name="store_id"]').val();
200-
var config = <?= /** phpcs:ignore Magento2.Security.XssTemplate.FoundUnescaped */json_encode($isConfig); ?>;
193+
var config = JSON.parse('<?= $escaper->escapeJs(json_encode($isConfig)) ?>');
201194

202195
config.appId = config.indexDataByStoreIds[storeId].appId;
203196
config.apiKey = config.indexDataByStoreIds[storeId].apiKey;

‎view/adminhtml/templates/support/overview.phtml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
/** @var \Magento\Backend\Block\Template $block */
44
/** @var \Magento\Framework\Escaper $escaper */
5-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
65
/** @var \Algolia\AlgoliaSearch\ViewModel\Adminhtml\Support\Overview $view */
76
$view = $block->getViewModel();
87

@@ -32,11 +31,9 @@ $videoFeatures = $block->getViewFileUrl('Algolia_AlgoliaSearch::images/video-fea
3231
<div id="algolia_support_tab_content">
3332

3433
<div class="algolia_support_panel" id="algolia-documentation-panel">
35-
<!-- phpcs:disable Magento2.Security.EscapeOutput.OutputNotEscaped -->
3634
<script>
37-
const noResultsIllustration = "<?= $noResultsIllustration; ?>"
35+
const noResultsIllustration = "<?= $escaper->escapeUrl($noResultsIllustration) ?>"
3836
</script>
39-
<!-- phpcs:enable Magento2.Security.EscapeOutput.OutputNotEscaped -->
4037

4138
<div class="search-box-wrapper">
4239
<input type="text" name="q" id="search_box" />

‎view/frontend/templates/checkout/conversion.phtml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,8 @@
11
<?php
22
/** @var \Magento\Framework\Escaper $escaper */
3-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
43
/** @var \Algolia\AlgoliaSearch\Block\Checkout\Conversion $block */
54
$orderItemsJson = $block->getOrderItemsConversionJson();
65
?>
7-
<!-- phpcs:disable Magento2.Security.EscapeOutput.OutputNotEscaped -->
86
<script type="text/javascript">
9-
var algoliaOrderConversionJson = <?= $orderItemsJson ?>;
7+
var algoliaOrderConversionJson = JSON.parse('<?= $escaper->escapeJs($orderItemsJson) ?>');
108
</script>
11-
<!-- phpcs:enable Magento2.Security.EscapeOutput.OutputNotEscaped -->

‎view/frontend/templates/instant/hit.phtml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,14 @@ $origFormatedVar = $escaper->escapeHtml('price' . $priceKey . '_original_formate
5252

5353
{{^<?= $escaper->escapeHtml($maxVar) ?>}}
5454
<div itemprop="offers" itemscope itemtype="http://schema.org/Offer" class="price">
55-
<meta itemprop="price" content="{{<?= $escaper->escapeHtml($baseVar); ?>}}" />
55+
<meta itemprop="price" content="{{<?= $escaper->escapeHtmlAttr($baseVar); ?>}}" />
5656
{{/<?= $escaper->escapeHtml($maxVar); ?>}}
5757
{{#<?= $escaper->escapeHtml($maxVar); ?>}}
5858
<div itemprop="offers" itemscope itemtype="http://schema.org/AggregateOffer" class="price">
59-
<meta itemprop="lowPrice" content="{{<?= $escaper->escapeHtml($baseVar); ?>}}" />
60-
<meta itemprop="highPrice" content="{{<?= $escaper->escapeHtml($maxVar); ?>}}" />
59+
<meta itemprop="lowPrice" content="{{<?= $escaper->escapeHtmlAttr($baseVar); ?>}}" />
60+
<meta itemprop="highPrice" content="{{<?= $escaper->escapeHtmlAttr($maxVar); ?>}}" />
6161
{{/<?= $escaper->escapeHtml($maxVar); ?>}}
62-
<meta itemprop="priceCurrency" content="<?= $escaper->escapeHtml($currencyCode); ?>" />
62+
<meta itemprop="priceCurrency" content="<?= $escaper->escapeHtmlAttr($currencyCode); ?>" />
6363
<div class="price-wrapper">
6464
<div>
6565

‎view/frontend/templates/layer/filter/js-default.phtml

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
11
<?php
2+
/** @var \Magento\Backend\Block\Template $block */
23
/** @var \Magento\Framework\Escaper $escaper */
3-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
4+
45
$datascope = $block->getFilter()->getRequestVar() . 'Filter';
56
?>
67
<?php if (!empty($filterItems)): ?>
7-
<div data-bind="scope: '<?= /** phpcs:ignore Magento2.Security.XssTemplate.FoundUnescaped */$datascope; ?>'">
8+
<div data-bind="scope: '<?= $escaper->escapeHtmlAttr($datascope) ?>'">
89
<!-- ko template: getTemplate() --> <!-- /ko -->
910
</div>
10-
<!-- phpcs:disable Magento2.Security.EscapeOutput.OutputNotEscaped -->
1111
<script type="text/x-magento-init">
12-
{"*" : {"Magento_Ui/js/core/app": {"components": {"<?= $datascope; ?>": <?= $block->getJsLayout(); ?>}}}}
12+
{"*" : {"Magento_Ui/js/core/app": {"components": {"<?= $escaper->escapeJs($datascope) ?>": JSON.parse('<?= $escaper->escapeJs($block->getJsLayout()) ?>')}}}}
1313
</script>
14-
<!-- phpcs:enable Magento2.Security.EscapeOutput.OutputNotEscaped -->
15-
16-
<?php endif; ?>
14+
<?php endif; ?>

‎view/frontend/templates/recommend/cart/recommend_items.phtml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
<?php
22
/** @var \Algolia\AlgoliaSearch\ViewModel\Recommend\Cart $block */
33
/** @var \Magento\Framework\Escaper $escaper */
4-
/** TODO:Reevaluate PHPCS ignores and enables/disables */
54
$viewModel = $block->getViewModel();
65
$recommendConfig = $viewModel->getAlgoliaRecommendConfiguration();
76
if (!empty($recommendConfig['enabledRelatedInCart']) || !empty($recommendConfig['enabledFBTInCart']) || !empty($recommendConfig['isTrendItemsEnabledInCartPage'])):
@@ -13,17 +12,15 @@ if (!empty($recommendConfig['enabledRelatedInCart']) || !empty($recommendConfig[
1312
<div id="trendItems" class="trendsItem recommend-component"></div>
1413
<div id="lookingSimilar" class="lookingSimilar recommend-component"></div>
1514
</div>
16-
<!-- phpcs:disable Magento2.Security.EscapeOutput.OutputNotEscaped -->
1715
<script type="text/x-magento-init">
1816
{
1917
"*": {
2018
"Algolia_AlgoliaSearch/js/recommend" : {
21-
"objectIDs" : <?= json_encode($cartItems) ?>
19+
"objectIDs" : JSON.parse('<?= $escaper->escapeJs(json_encode($cartItems)) ?>')
2220
}
2321
}
2422
}
2523
</script>
26-
<!-- phpcs:enable Magento2.Security.EscapeOutput.OutputNotEscaped -->
2724
<script type="text/x-magento-init">
2825
{
2926
"[data-role=tocart-form]": {

0 commit comments

Comments
 (0)