Skip to content

Commit 8b4429f

Browse files
authored
Merge pull request #81 from jessedobbelaere/fix-double-encoding
Fix double encoding issue on text fields
2 parents 8a81581 + 2ed6933 commit 8b4429f

6 files changed

Lines changed: 93 additions & 1 deletion

File tree

spoon/form/text.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -788,7 +788,8 @@ public function parse($template = null)
788788
if($this->attributes['name'] == '') throw new SpoonFormException('A name is required for a textfield. Please provide a name.');
789789

790790
// start html generation
791-
$output = '<input value="' . SpoonFilter::htmlspecialchars($this->getValue()) . '"';
791+
// note: no need to encode the value here, it gets encoding in the getter as long as $allowHTML=true
792+
$output = '<input value="' . $this->getValue() . '"';
792793

793794
// add attributes
794795
$output .= $this->getAttributesHTML(array('[id]' => $this->attributes['id'], '[name]' => $this->attributes['name'], '[value]' => $this->getValue())) . ' />';

spoon/tests/form/SpoonFormDateTest.php

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,4 +168,20 @@ public function testDateFormatsShort()
168168
);
169169
$this->loopOverFormats($formats);
170170
}
171+
172+
public function testParse()
173+
{
174+
$_POST['date'] = '12/10/2026';
175+
$this->assertEquals(
176+
'<input type="text" value="12/10/2026" id="date" name="date" maxlength="10" data-mask="dd/mm/yy" class="inputDatefield" />',
177+
$this->txtDate->parse()
178+
);
179+
180+
// Make sure we encode XSS payloads
181+
$_POST['date'] = '12/10/2026\'"()%26%25<yes><ScRiPt%20>alert(1)</ScRiPt>';
182+
$this->assertEquals(
183+
'<input type="text" value="12/10/2026&#039;&quot;()%26%25&lt;yes&gt;&lt;ScRiPt%20&gt;alert(1)&lt;/ScRiPt&gt;" id="date" name="date" maxlength="10" data-mask="dd/mm/yy" class="inputDatefield" />',
184+
$this->txtDate->parse()
185+
);
186+
}
171187
}

spoon/tests/form/SpoonFormHiddenTest.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,4 +51,21 @@ public function testGetValue()
5151
$_POST['hidden'] = array('foo', 'bar');
5252
$this->assertEquals('Array', $this->hidHidden->getValue());
5353
}
54+
55+
public function testParse()
56+
{
57+
$_POST['form'] = 'hiddenfield';
58+
$_POST['hidden'] = 'But I am le tired';
59+
$this->assertEquals(
60+
'<input type="hidden" value="But I am le tired" id="hidden" name="hidden" />',
61+
$this->hidHidden->parse()
62+
);
63+
64+
// Make sure we encode XSS payloads
65+
$_POST['hidden'] = 'But I am le tired\'"()%26%25<yes><ScRiPt%20>alert(1)</ScRiPt>';
66+
$this->assertEquals(
67+
'<input type="hidden" value="But I am le tired&amp;#039;&amp;quot;()%26%25&amp;lt;yes&amp;gt;&amp;lt;ScRiPt%20&amp;gt;alert(1)&amp;lt;/ScRiPt&amp;gt;" id="hidden" name="hidden" />',
68+
$this->hidHidden->parse()
69+
);
70+
}
5471
}

spoon/tests/form/SpoonFormPasswordTest.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,4 +114,21 @@ public function testGetValue()
114114
$_POST['name'] = array('foo', 'bar');
115115
$this->assertEquals('Array', $this->txtPassword->getValue());
116116
}
117+
118+
public function testParse()
119+
{
120+
$_POST['form'] = 'passwordfield';
121+
$_POST['name'] = 'But I am le tired';
122+
$this->assertEquals(
123+
'<input type="password" value="But I am le tired" id="name" name="name" class="inputPassword" />',
124+
$this->txtPassword->parse()
125+
);
126+
127+
// Make sure we encode XSS payloads
128+
$_POST['name'] = 'But I am le tired\'"()%26%25<yes><ScRiPt%20>alert(1)</ScRiPt>';
129+
$this->assertEquals(
130+
'<input type="password" value="But I am le tired&#039;&quot;()%26%25&lt;yes&gt;&lt;ScRiPt%20&gt;alert(1)&lt;/ScRiPt&gt;" id="name" name="name" class="inputPassword" />',
131+
$this->txtPassword->parse()
132+
);
133+
}
117134
}

spoon/tests/form/SpoonFormTextTest.php

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,4 +336,28 @@ public function testChainingMethods()
336336
$this->txtName->getErrors()
337337
);
338338
}
339+
340+
public function testParse()
341+
{
342+
$_POST['form'] = 'textfield';
343+
$_POST['name'] = 'But I am le tired';
344+
$this->assertEquals(
345+
'<input value="But I am le tired" id="name" name="name" type="text" class="inputText" />',
346+
$this->txtName->parse()
347+
);
348+
349+
// Make sure we encode XSS payloads
350+
$_POST['name'] = 'But I am le tired\'"()%26%25<yes><ScRiPt%20>alert(1)</ScRiPt>';
351+
$this->assertEquals(
352+
'<input value="But I am le tired&#039;&quot;()%26%25&lt;yes&gt;&lt;ScRiPt%20&gt;alert(1)&lt;/ScRiPt&gt;" id="name" name="name" type="text" class="inputText" />',
353+
$this->txtName->parse()
354+
);
355+
356+
// Make sure we do not do double encoding on the ampersand
357+
$_POST['name'] = 'Something & something else';
358+
$this->assertEquals(
359+
'<input value="Something &amp; something else" id="name" name="name" type="text" class="inputText" />',
360+
$this->txtName->parse()
361+
);
362+
}
339363
}

spoon/tests/form/SpoonFormTimeTest.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,4 +92,21 @@ public function testGetValue()
9292
$_POST['time'] = array('foo', 'bar');
9393
$this->assertEquals('Array', $this->txtTime->getValue());
9494
}
95+
96+
public function testParse()
97+
{
98+
$_POST['form'] = 'timefield';
99+
$_POST['time'] = '15:30';
100+
$this->assertEquals(
101+
'<input type="text" value="15:30" id="time" name="time" maxlength="5" class="inputTimefield" />',
102+
$this->txtTime->parse()
103+
);
104+
105+
// Make sure we encode XSS payloads
106+
$_POST['time'] = '15:30\'"()%26%25<yes><ScRiPt%20>alert(1)</ScRiPt>';
107+
$this->assertEquals(
108+
'<input type="text" value="15:30&#039;&quot;()%26%25&lt;yes&gt;&lt;ScRiPt%20&gt;alert(1)&lt;/ScRiPt&gt;" id="time" name="time" maxlength="5" class="inputTimefield" />',
109+
$this->txtTime->parse()
110+
);
111+
}
95112
}

0 commit comments

Comments
 (0)