mirror of
https://github.com/e107inc/e107.git
synced 2025-08-12 01:25:01 +02:00
Deprecate e_parse::toJS()
`e_parse::toJS()`, documented with the description > Convert text blocks which are to be embedded within JS , does not protect strings from injections, which appears to be its primary use. Additionally, it performs multiple unrelated string modifications: * Replace Windows line breaks with a literal `\\n` (which would later be parsed as `\n` in JavaScript/JSON) * Does not modify Unix line breaks (`\n`), which is inconsistent with the Windows line break behavior * Removes HTML tags * Replaces HTML entities as `htmlentities()` does This method cannot be fixed because its usages are inconsistent. Most notably, some usages surround the method's output in single quotes while others surround it with double quotes. Strings cannot be JSON-encoded without confounding quotation mark styles. All core usages of `e_parse::toJS()` have been replaced with alternatives, which are also documented in the method's DocBlock. Fixes: #4546
This commit is contained in:
@@ -1871,9 +1871,16 @@ class e_parse
|
||||
*
|
||||
* @param string|array $stringarray
|
||||
* @return string
|
||||
* @deprecated v2.3.1 This method will not escape a string properly for use as a JavaScript or JSON string. Use
|
||||
* {@see e_parse::toJSON()} instead. When using {@see e_parse::toJSON()}, do not surround its output
|
||||
* with quotation marks, and do not attempt to escape sequences like "\n" as "\\n". If HTML tags need to
|
||||
* be removed, consider {@see e_parse::toText()} separately. If the text needs to be used in an HTML
|
||||
* tag attribute (e.g. <a onclick="ATTRIBUTE"></a>), surround the string with
|
||||
* {@see e_parse::toAttribute()} and either single-quote or double-quote the attribute value.
|
||||
*/
|
||||
public function toJS($stringarray)
|
||||
{
|
||||
trigger_error('<b>' . __METHOD__ . ' is deprecated. See method DocBlock for alternatives.</b>', E_USER_WARNING); // NO LAN
|
||||
|
||||
$search = array("\r\n", "\r", '<br />', "'");
|
||||
$replace = array("\\n", '', "\\n", "\'");
|
||||
|
Reference in New Issue
Block a user