Skip to content

mvc: deprecate htmlspecialchars() use #10041

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Greelan wants to merge 3 commits into
base: master
Choose a base branch
from
Open

mvc: deprecate htmlspecialchars() use #10041

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1f12f03
mvc: address htmlspecialchars
Greelan Mar 26, 2026
9074f0f
Merge remote-tracking branch 'upstream/master' into htmlspecialchars
Greelan Mar 26, 2026
229b865
Fix volt escaping
Greelan Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/controllers/OPNsense/Core/Api/BackupController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,7 @@ public function diffAction($host, $backup1, $backup2)
$diff = Shell::shell_safe('/usr/bin/diff -u %s %s', [$bckfilename2, $bckfilename1], true);
if (!empty($diff)) {
foreach ($diff as $line) {
$result['items'][] = htmlspecialchars($line, ENT_QUOTES | ENT_HTML401);
$result['items'][] = htmlspecialchars($line ?? '', ENT_QUOTES | ENT_HTML401);
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ class ItemController extends \OPNsense\Base\IndexController
*/
public function openAction($uuid = null)
{
$this->view->selected_uuid = htmlspecialchars($uuid, ENT_QUOTES | ENT_HTML401);
$this->view->selected_uuid = $uuid;
// include dialog form definitions
$this->view->formDialogEdit = $this->getForm("dialogEdit");
$this->view->formGridJobs = $this->getFormGrid('dialogEdit');
Expand Down
4 changes: 2 additions & 2 deletions src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@ class LogController extends IndexController
public function renderPage($module, $scope)
{
$this->view->pick('OPNsense/Diagnostics/log');
$this->view->module = htmlspecialchars($module, ENT_QUOTES | ENT_HTML401);
$this->view->scope = htmlspecialchars($scope, ENT_QUOTES | ENT_HTML401);
$this->view->module = $module;
$this->view->scope = $scope;
$this->view->service = '';
$this->view->default_log_severity = 'Warning';

Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/AliasController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@ public function delItemAction($uuid)
if (!empty($uses)) {
$message = "";
foreach ($uses as $key => $value) {
$message .= htmlspecialchars(sprintf("\n[%s] %s", $key, $value), ENT_NOQUOTES | ENT_HTML401);
$message .= sprintf("\n[%s] %s", $key, $value);
}
$message = sprintf(gettext("Cannot delete alias. Currently in use by %s"), $message);
throw new \OPNsense\Base\UserException($message, gettext("Alias in use"));
Expand Down
4 changes: 2 additions & 2 deletions src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ protected function getNetworks($names)
];

foreach (Config::getInstance()->object()->interfaces->children() as $ifname => $ifdetail) {
$descr = htmlspecialchars(!empty($ifdetail->descr) ? $ifdetail->descr : strtoupper($ifname));
$descr = !empty($ifdetail->descr) ? (string)$ifdetail->descr : strtoupper($ifname);
$nets[$ifname] = sprintf(gettext('%s network'), $descr);
if (!empty($ifdetail->if)) {
/* some automatic rules use device names */
Expand Down Expand Up @@ -215,7 +215,7 @@ public function listNetworkSelectOptionsAction()
];

foreach ((Config::getInstance()->object())->interfaces->children() as $ifname => $ifdetail) {
$descr = htmlspecialchars(!empty($ifdetail->descr) ? $ifdetail->descr : strtoupper($ifname));
$descr = !empty($ifdetail->descr) ? (string)$ifdetail->descr : strtoupper($ifname);
$networks[$ifname] = sprintf(gettext('%s network'), $descr);
if (!isset($ifdetail->virtual)) {
$networks["{$ifname}ip"] = sprintf(gettext('%s address'), $descr);
Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/GroupController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ public function delItemAction($uuid)
if (!empty($uses)) {
$message = "";
foreach ($uses as $key => $value) {
$message .= htmlspecialchars(sprintf("\n[%s] %s", $key, $value), ENT_NOQUOTES | ENT_HTML401);
$message .= sprintf("\n[%s] %s", $key, $value);
}
$message = sprintf(gettext("Cannot delete group. Currently in use by %s"), $message);
throw new \OPNsense\Base\UserException($message, gettext("Group in use"));
Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/LaggSettingsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ public function delItemAction($uuid)
if (!empty($uses)) {
$message = "";
foreach ($uses as $key => $value) {
$message .= htmlspecialchars(sprintf("\n[%s] %s", $key, $value), ENT_NOQUOTES | ENT_HTML401);
$message .= sprintf("\n[%s] %s", $key, $value);
}
$message = sprintf(gettext("Cannot delete lagg. Currently in use by %s"), $message);
throw new \OPNsense\Base\UserException($message, gettext("Lagg in use"));
Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/library/OPNsense/Core/SanitizeFilter.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ protected function filter_int($input)

protected function filter_string($input)
{
return htmlspecialchars($input, ENT_QUOTES | ENT_HTML401);
return htmlspecialchars($input ?? '', ENT_QUOTES | ENT_HTML401);
}

protected function filter_alnum($input)
Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/NetworkAliasField.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ protected function actionPostLoadingEvent()
];
// interface nets and addresses
foreach (Config::getInstance()->object()->interfaces->children() as $ifname => $ifdetail) {
$descr = htmlspecialchars(!empty($ifdetail->descr) ? $ifdetail->descr : strtoupper($ifname));
$descr = !empty($ifdetail->descr) ? (string)$ifdetail->descr : strtoupper($ifname);
$data[$ifname] = $descr . " " . gettext("net");
if (!isset($ifdetail->virtual)) {
$data[$ifname . "ip"] = $descr . " " . gettext("address");
Expand Down
2 changes: 1 addition & 1 deletion src/opnsense/mvc/app/views/OPNsense/Cron/index.volt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
);

{% if (selected_uuid|default("") != "") %}
openDialog('{{selected_uuid}}');
openDialog('{{selected_uuid|safe}}');
{% endif %}

/*************************************************************************************************************
Expand Down
24 changes: 12 additions & 12 deletions src/opnsense/mvc/app/views/OPNsense/Diagnostics/log.volt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,18 +37,18 @@
}).get();

if (window.localStorage) {
if (localStorage.getItem('log_filter_exact_{{module}}_{{scope}}')) {
s_filter_val = localStorage.getItem('log_severity_{{module}}_{{scope}}') ? localStorage.getItem('log_severity_{{module}}_{{scope}}').split(',') : [];
if (localStorage.getItem('log_filter_exact_{{module|safe}}_{{scope|safe}}')) {
s_filter_val = localStorage.getItem('log_severity_{{module|safe}}_{{scope|safe}}') ? localStorage.getItem('log_severity_{{module|safe}}_{{scope|safe}}').split(',') : [];
filter_exact = true;
} else {
s_filter_val = localStorage.getItem('log_severity_{{module}}_{{scope}}') ? localStorage.getItem('log_severity_{{module}}_{{scope}}').split(',') : s_filter_val;
s_filter_val = localStorage.getItem('log_severity_{{module|safe}}_{{scope|safe}}') ? localStorage.getItem('log_severity_{{module|safe}}_{{scope|safe}}').split(',') : s_filter_val;
}
$("#validFrom_filter").val(localStorage.getItem('log_validFrom_filter_{{module}}_{{scope}}') ? localStorage.getItem('log_validFrom_filter_{{module}}_{{scope}}') : 'day');
$("#validFrom_filter").val(localStorage.getItem('log_validFrom_filter_{{module|safe}}_{{scope|safe}}') ? localStorage.getItem('log_validFrom_filter_{{module|safe}}_{{scope|safe}}') : 'day');
}
switch_mode(s_filter_val);

let grid_log = $("#grid-log").UIBootgrid({
search:'/api/diagnostics/log/{{module}}/{{scope}}',
search:'/api/diagnostics/log/{{module|safe}}/{{scope|safe}}',
options: {
initialSearchPhrase: getUrlHash('search'),
sorting:false,
Expand Down Expand Up @@ -109,8 +109,8 @@
$(".filter_act").change(function(event){
event.stopPropagation();
if (window.localStorage) {
localStorage.setItem('log_severity_{{module}}_{{scope}}', $("#severity_filter").val());
localStorage.setItem('log_validFrom_filter_{{module}}_{{scope}}', $("#validFrom_filter").val());
localStorage.setItem('log_severity_{{module|safe}}_{{scope|safe}}', $("#severity_filter").val());
localStorage.setItem('log_validFrom_filter_{{module|safe}}_{{scope|safe}}', $("#validFrom_filter").val());
}
$('#grid-log').bootgrid('reload');
});
Expand All @@ -128,7 +128,7 @@
}}, {
label: "{{ lang._('Yes') }}",
action: function(dialogRef) {
ajaxCall("/api/diagnostics/log/{{module}}/{{scope}}/clear", {}, function(){
ajaxCall("/api/diagnostics/log/{{module|safe}}/{{scope|safe}}/clear", {}, function(){
dialogRef.close();
$('#grid-log').bootgrid('reload');
});
Expand All @@ -138,7 +138,7 @@
});
// download (filtered) items
$("#exportbtn").click(function(event){
let download_link = "/api/diagnostics/log/{{module}}/{{scope}}/export";
let download_link = "/api/diagnostics/log/{{module|safe}}/{{scope|safe}}/export";
let params = [];

if ($("input.search-field").val() !== "") {
Expand Down Expand Up @@ -186,12 +186,12 @@

if (window.localStorage) {
if (filter_exact) {
localStorage.setItem('log_filter_exact_{{module}}_{{scope}}', 1);
localStorage.setItem('log_filter_exact_{{module|safe}}_{{scope|safe}}', 1);
} else {
localStorage.removeItem('log_filter_exact_{{module}}_{{scope}}');
localStorage.removeItem('log_filter_exact_{{module|safe}}_{{scope|safe}}');
}
// store user choice
localStorage.setItem('log_severity_{{module}}_{{scope}}', new_val);
localStorage.setItem('log_severity_{{module|safe}}_{{scope|safe}}', new_val);
}
switch_mode(new_val);
});
Expand Down
7 changes: 4 additions & 3 deletions src/opnsense/mvc/app/views/OPNsense/Firewall/filter_rule.volt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -524,18 +524,19 @@
const aliasMetadataList = row["alias_meta_" + column.id] || [];

const renderedItems = aliasMetadataList.map(aliasInfo => {
const safeText = $('<span>').text(aliasInfo.value || '').html();
if (aliasInfo.isAlias) {
const tooltipHtml = aliasInfo.summary || aliasInfo.description || aliasInfo.value || "";
const tooltipHtml = $('<span>').text(aliasInfo.summary || aliasInfo.description || aliasInfo.value || '').html();
return `
<span data-toggle="tooltip" data-html="true" title="${tooltipHtml}">${aliasInfo.value}&nbsp;</span>
<span data-toggle="tooltip" data-html="true" title="${tooltipHtml}">${safeText}&nbsp;</span>
<a href="/ui/firewall/alias/index/${encodeURIComponent(aliasInfo.value)}"
data-toggle="tooltip" title="{{ lang._('Edit alias') }}">
<i class="fa fa-fw fa-list"></i>
</a>
`;
}
// Not an alias, return translated value
return aliasInfo["%value"];
return $('<span>').text(aliasInfo["%value"] || '').html();
}).join(", ");

// There can only be a single negated value
Expand Down
7 changes: 4 additions & 3 deletions src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,17 +311,18 @@
const aliasMetadataList = row["alias_meta_" + column.id] || [];

const renderedItems = aliasMetadataList.map(aliasInfo => {
const safeText = $('<span>').text(aliasInfo.value || '').html();
if (aliasInfo.isAlias) {
const tooltipHtml = aliasInfo.summary || aliasInfo.description || aliasInfo.value || "";
const tooltipHtml = $('<span>').text(aliasInfo.summary || aliasInfo.description || aliasInfo.value || '').html();
return `
<span data-toggle="tooltip" data-html="true" title="${tooltipHtml}">${aliasInfo.value}&nbsp;</span>
<span data-toggle="tooltip" data-html="true" title="${tooltipHtml}">${safeText}&nbsp;</span>
<a href="/ui/firewall/alias/index/${encodeURIComponent(aliasInfo.value)}"
data-toggle="tooltip" title="{{ lang._('Edit alias') }}">
<i class="fa fa-fw fa-list"></i>
</a>
`;
}
return aliasInfo["%value"];
return $('<span>').text(aliasInfo["%value"] || '').html();
}).join(", ");

return isNegated + renderedItems;
Expand Down
4 changes: 2 additions & 2 deletions src/opnsense/mvc/app/views/layouts/default.volt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,8 +54,8 @@
if (request.responseJSON != undefined && request.responseJSON.errorMessage != undefined) {
BootstrapDialog.show({
type: BootstrapDialog.TYPE_DANGER,
title: request.responseJSON.errorTitle,
message:request.responseJSON.errorMessage,
title: $('<span>').text(request.responseJSON.errorTitle || '').html(),
message: $('<div>').text(request.responseJSON.errorMessage),
buttons: [{
label: '{{ lang._('Close') }}',
action: function(dialogItself){
Expand Down