ApplicationConfig unescaped

[weierophinney]

Hi.
Broken page because the code is displayed unescaped.
It seems there is a problem in ConfigCollector::unserializeArray().

---

Originally posted by @mamont77 at zendframework/zend-developer-tools#116

[weierophinney]

@mamont77 are you running the latest version? Escaping should be applied there...

---

Originally posted by @Ocramius at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

@Ocramius, yes. I'am using latest master.

---

Originally posted by @mamont77 at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

Could you please paste the HTML generated by the toolbar? I didn't find the location where the output would not be correctly escaped..

---

Originally posted by @Ocramius at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

Sorry, I could not attach a file, unsupported format.
Temporarily added to my repository.
https://github.com/mamont77/fcontrol/blob/master/temp.html

---

Originally posted by @mamont77 at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

@mamont77 if I get this correctly, it's a problem in Zend\Debug itself.

The problems are at https://github.com/mamont77/fcontrol/blob/master/temp.html#L367, right?

If so, then this issue should be opened against Zend\Debug with a small test array (nothing fancy, just those weird keys).

---

Originally posted by @Ocramius at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

@Ocramius I'm not convinced by your analysis. Zend\Debug\Debug::dump() does the following:

• If xdebug is detected, it simply wraps the output in <pre> tags.
• If not, it uses the composed Zend\Escaper\Escaper instance, and calls escapeHtml() to escape the output, before wrapping in <pre> tags.

Based on the configuration dumped, I'd argue it's a problem with Escaper, to be honest -- there are clearly < and > characters not being escaped.

---

Originally posted by @weierophinney at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

@weierophinney no analysis: I just stopped after finding out that it's not ZDT ;)

---

Originally posted by @Ocramius at zendframework/zend-developer-tools#116 (comment)

[weierophinney]

Odd -- I took the relevant parts of the configuration:

• the console routes
• the super messenger configuration
• the factories that were defined as inline anonymous functions

and wrote a test to see if the values were being escaped. They were. In fact, all quotes, all angle brackets, and a number of other characters were being escaped for HTML.

This makes me wonder if it's either (a) browser-specific, or (b) an issue with how the JS library is handling the data.

---

Originally posted by @weierophinney at zendframework/zend-developer-tools#116 (comment)

[samsonasik]

Escaped contents should already handled in laminas-developer-tools ^1.3.1 || ^2.0.2. If you found the problem persist, please re-create issue.

Closing.