Skip to content

Fix for allowing property which begins with an underscore #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: 3.x-dev
Choose a base branch
from
Open

Fix for allowing property which begins with an underscore #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2d4a55d
Fix for allowing property which begins with an underscore
1Jesper1 Jul 31, 2024
d4ed6f9
Update OutputFilterTest.php
1Jesper1 Aug 8, 2024
cda572c
Merge branch 'joomla-framework:3.x-dev' into objectHtmlSafe-fix
1Jesper1 Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions Tests/OutputFilterTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,9 @@
class FilterTestObject
{
public $string1;

public $string2;

public $string3;

public $_string4;
public $array1;

/**
Expand All @@ -33,6 +31,7 @@ public function __construct()
$this->string1 = "<script>alert();</script>";
$this->string2 = "This is a test.";
$this->string3 = "<script>alert(3);</script>";
$this->_string4 = "<script>alert();</script>";
$this->array1 = [1, 2, 3];
}
}
Expand Down Expand Up @@ -79,6 +78,7 @@ public function testObjectHtmlSafe()
$this->assertEquals('&lt;script&gt;alert();&lt;/script&gt;', $this->safeObject->string1, "Script tag should be defused");
$this->assertEquals('This is a test.', $this->safeObject->string2, "Plain text should pass");
$this->assertEquals('<script>alert(3);</script>', $this->safeObject->string3, "This Script tag should be passed");
$this->assertEquals('<script>alert();</script>', $this->safeObject->_string4, "Property which begins with underscore should pass.");
}

/**
Expand All @@ -90,6 +90,7 @@ public function testObjectHtmlSafeWithArray()
$this->assertEquals('<script>alert();</script>', $this->safeObject->string1, "Script tag should pass array test");
$this->assertEquals('This is a test.', $this->safeObject->string2, "Plain text should pass array test");
$this->assertEquals('<script>alert(3);</script>', $this->safeObject->string3, "This Script tag should pass array test");
$this->assertEquals('<script>alert();</script>', $this->safeObject->_string4, "Property which begins with underscore should pass array test.");
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/OutputFilter.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ public static function objectHtmlSafe(&$mixed, $quoteStyle = \ENT_QUOTES, $exclu

if (\is_object($mixed)) {
foreach (get_object_vars($mixed) as $k => $v) {
if (\is_array($v) || \is_object($v) || $v == null || substr($k, 1, 1) == '_') {
if (\is_array($v) || \is_object($v) || $v == null || substr($k, 0, 1) == '_') {
continue;
}

Expand Down