mvc: htmlspecialchars() use

[fichtner]

Important notices

Our forum is located at https://forum.opnsense.org , please consider joining discussions there in stead of using GitHub for these matters.

Before you ask a new question, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Cleaning up a stray copy+paste html_safe() reimplementation I noticed that htmlspecialchars() is called in a few places either to be encoded in the volt template or through the new view_html_safe(). We tend to avoid the PHP function because of special encoding issues in JS and also PHP deprecation warnings causing issues...

# git grep htmlspecialchars src/opnsense/mvc 
src/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php:                $this->response->setContent(htmlspecialchars(json_encode($data), ENT_NOQUOTES));
src/opnsense/mvc/app/controllers/OPNsense/Core/Api/BackupController.php:                        $result['items'][] = htmlspecialchars($line, ENT_QUOTES | ENT_HTML401);
src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php:        $this->view->selected_uuid = htmlspecialchars($uuid, ENT_QUOTES | ENT_HTML401);
src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php:        $this->view->module = htmlspecialchars($module, ENT_QUOTES | ENT_HTML401);
src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php:        $this->view->scope = htmlspecialchars($scope, ENT_QUOTES | ENT_HTML401);
src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/AliasController.php:                    $message .= htmlspecialchars(sprintf("\n[%s] %s", $key, $value), ENT_NOQUOTES | ENT_HTML401);
src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php:            $descr = htmlspecialchars(!empty($ifdetail->descr) ? $ifdetail->descr : strtoupper($ifname));
src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/GroupController.php:                $message .= htmlspecialchars(sprintf("\n[%s] %s", $key, $value), ENT_NOQUOTES | ENT_HTML401);
src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/LaggSettingsController.php:                $message .= htmlspecialchars(sprintf("\n[%s] %s", $key, $value), ENT_NOQUOTES | ENT_HTML401);
src/opnsense/mvc/app/library/OPNsense/Core/SanitizeFilter.php:        return htmlspecialchars($input, ENT_QUOTES | ENT_HTML401);
src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/NetworkAliasField.php:                $descr = htmlspecialchars(!empty($ifdetail->descr) ? $ifdetail->descr : strtoupper($ifname));

[Greelan]

Hopefully this at least assists: #10041

Feel free to close if it is off-base