Fix Xss in the segment name (#490)

aryaantony92 · web-flow · commit 72f45dd537a7 · 2023-07-26T11:55:42.000+02:00
* Fix Xss in the segment name

* Apply php-cs-fixer changes

* Fix PHP stan

---------

Co-authored-by: aryaantony92 &lt;aryaantony92@users.noreply.github.com&gt;
diff --git a/composer.json b/composer.json
@@ -24,7 +24,7 @@
     "pear/archive_tar": "^1.4.3",
     "pimcore/number-sequence-generator": "^1.0.5",
     "pimcore/object-merger": "^3.0",
-    "pimcore/pimcore": "^10.5",
+    "pimcore/pimcore": "^10.5.21",
     "pimcore/search-query-parser": "^1.3",
     "symfony/asset": "^5.3",
     "symfony/config": "^5.3",
diff --git a/src/View/Formatter/DefaultViewFormatter.php b/src/View/Formatter/DefaultViewFormatter.php
@@ -19,6 +19,7 @@
 use CustomerManagementFrameworkBundle\Model\CustomerSegmentInterface;
 use Pimcore\Model\DataObject\ClassDefinition;
 use Pimcore\Model\DataObject\ClassDefinition\Data;
+use Pimcore\Security\SecurityHelper;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
 class DefaultViewFormatter implements ViewFormatterInterface
@@ -176,7 +177,7 @@ public function getLocale()
      */
     protected function formatSegmentValue(CustomerSegmentInterface $segment)
     {
-        return sprintf('<span class="label label-default">%s</span>', $segment->getName());
+        return sprintf('<span class="label label-default">%s</span>', SecurityHelper::convertHtmlSpecialChars($segment->getName()));
     }
 
     protected function getLanguageFromLocale($locale)

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,7 @@`
`19`	`19`	`use CustomerManagementFrameworkBundle\Model\CustomerSegmentInterface;`
`20`	`20`	`use Pimcore\Model\DataObject\ClassDefinition;`
`21`	`21`	`use Pimcore\Model\DataObject\ClassDefinition\Data;`
	`22`	`+use Pimcore\Security\SecurityHelper;`
`22`	`23`	`use Symfony\Contracts\Translation\TranslatorInterface;`
`23`	`24`
`24`	`25`	`class DefaultViewFormatter implements ViewFormatterInterface`
`@@ -176,7 +177,7 @@ public function getLocale()`
`176`	`177`	`*/`
`177`	`178`	`protected function formatSegmentValue(CustomerSegmentInterface $segment)`
`178`	`179`	`{`
`179`		`- return sprintf('<span class="label label-default">%s</span>', $segment->getName());`
	`180`	`+ return sprintf('<span class="label label-default">%s</span>', SecurityHelper::convertHtmlSpecialChars($segment->getName()));`
`180`	`181`	`}`
`181`	`182`
`182`	`183`	`protected function getLanguageFromLocale($locale)`