Merge pull request #44 from araise-dev/fix/186-vuln-stored-xss2

tuxes3 · web-flow · commit ea74425535b8 · 2025-09-25T10:40:45.000-05:00
fix(formatter): escape HTML output in default formatter
diff --git a/src/Formatter/AbstractFormatter.php b/src/Formatter/AbstractFormatter.php
@@ -22,7 +22,7 @@ public function __construct()
 
     public function getHtml(mixed $value): string
     {
-        return $this->getString($value);
+        return $this->escapeHTML($this->getString($value));
     }
 
     /**

Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ public function __construct()`
`22`	`22`
`23`	`23`	`public function getHtml(mixed $value): string`
`24`	`24`	`{`
`25`		`- return $this->getString($value);`
	`25`	`+ return $this->escapeHTML($this->getString($value));`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`/**`