fix: improve error handling by escaping output in exceptions

Author: dermatz

src/Console/Command/Hyva/TokensCommand.php

@@ -76,8 +76,11 @@ protected function executeCommand(InputInterface $input, OutputInterface $output
                 return Command::SUCCESS;
             }
 
-            $options = array_map(fn($theme) => $theme->getCode(), $hyvaThemes);
-            
+            $options = [];
+            foreach ($hyvaThemes as $theme) {
+                $options[] = $theme->getCode();
+            }
+
             $themeCodePrompt = new SelectPrompt(
                 label: 'Select Hyvä theme to generate tokens for',
                 options: $options,

src/Service/DependencyChecker.php

@@ -7,7 +7,6 @@
 use Magento\Framework\Filesystem\Driver\File;
 use Symfony\Component\Console\Style\SymfonyStyle;
 use Magento\Framework\Shell;
-
 class DependencyChecker
 {
     private const PACKAGE_JSON = 'package.json';

src/Service/HyvaTokens/ConfigReader.php

@@ -30,7 +30,7 @@ public function __construct(
     public function getConfig(string $themePath): array
     {
         $configPath = $this->getConfigPath($themePath);
-        
+
         // Default configuration
         $config = [
             'src' => self::DEFAULT_SOURCE,
@@ -41,16 +41,16 @@ public function getConfig(string $themePath): array
 
         if ($this->fileDriver->isExists($configPath)) {
             $configContent = $this->fileDriver->fileGetContents($configPath);
-            
+
             try {
                 $jsonConfig = json_decode($configContent, true, 512, JSON_THROW_ON_ERROR);
             } catch (\JsonException $e) {
-                throw new \Exception("Invalid JSON in configuration file: " . $e->getMessage());
+                throw new \Exception("Invalid JSON in configuration file: " . htmlspecialchars($e->getMessage(), ENT_QUOTES, 'UTF-8'));
             }
 
             if (isset($jsonConfig['tokens'])) {
                 $tokensConfig = $jsonConfig['tokens'];
-                
+
                 // Override with config file values
                 if (isset($tokensConfig['src'])) {
                     $config['src'] = $tokensConfig['src'];

src/Service/HyvaTokens/CssGenerator.php

@@ -51,7 +51,7 @@ public function write(string $content, string $outputPath): bool
         $pathParts = explode('/', $outputPath);
         array_pop($pathParts); // Remove filename
         $directory = implode('/', $pathParts);
-        
+
         if (!$this->fileDriver->isDirectory($directory)) {
             $this->fileDriver->createDirectory($directory, 0750);
         }
@@ -60,7 +60,7 @@ public function write(string $content, string $outputPath): bool
             $this->fileDriver->filePutContents($outputPath, $content);
             return true;
         } catch (\Exception $e) {
-            throw new \Exception("Failed to write CSS file: " . $e->getMessage());
+            throw new \Exception("Failed to write CSS file: " . htmlspecialchars($e->getMessage(), ENT_QUOTES, 'UTF-8'));
         }
     }
 }

src/Service/HyvaTokens/TokenParser.php

@@ -34,15 +34,15 @@ public function parse(?string $filePath, ?array $inlineValues, string $format):
 
         // Otherwise, read from file
         if ($filePath === null || !$this->fileDriver->isFile($filePath)) {
-            throw new \Exception("Token source file not found: " . ($filePath ?? 'null'));
+            throw new \Exception("Token source file not found: " . htmlspecialchars($filePath ?? 'null', ENT_QUOTES, 'UTF-8'));
         }
 
         $content = $this->fileDriver->fileGetContents($filePath);
-        
+
         try {
             $tokens = json_decode($content, true, 512, JSON_THROW_ON_ERROR);
         } catch (\JsonException $e) {
-            throw new \Exception("Invalid JSON in token file: " . $e->getMessage());
+            throw new \Exception("Invalid JSON in token file: " . htmlspecialchars($e->getMessage(), ENT_QUOTES, 'UTF-8'));
         }
 
         return $this->normalizeTokens($tokens, $format);

src/Service/ThemeBuilder/BuilderFactory.php

@@ -16,7 +16,7 @@ public function addBuilder(BuilderInterface $builder): void
     public function create(string $type): BuilderInterface
     {
         if (!isset($this->builders[$type])) {
-            throw new \InvalidArgumentException("Builder $type not found");
+            throw new \InvalidArgumentException("Builder " . htmlspecialchars($type, ENT_QUOTES, 'UTF-8') . " not found");
         }
 
         return $this->builders[$type];