Escape doctrine entries (#657)

* Escape doctrine entries

* Add PDO browsertest

demo/bridge/doctrine/index.php

@@ -12,7 +12,8 @@ $debugbar->addCollector(new DebugBar\Bridge\DoctrineCollector($debugStack));
 $product = new Demo\Product();
 $product->setName("foobar");
 
+
 $entityManager->persist($product);
 $entityManager->flush();
-
+$entityManager->createQuery("select p from  Demo\\Product p where p.name=:c")->setParameter("c", "<script>alert();</script>")->execute();
 render_demo_page();

demo/pdo.php

@@ -19,6 +19,10 @@ $stmt = $pdo->prepare('select * from users where name=?');
 $stmt->execute(array('foo'));
 $foo = $stmt->fetch();
 
+$stmt = $pdo->prepare('select * from users where name=?');
+$stmt->execute(array('<script>alert();</script>'));
+$foo = $stmt->fetch();
+
 $pdo->exec('delete from users');
 
 render_demo_page();

src/DebugBar/Bridge/DoctrineCollector.php

@@ -60,7 +60,7 @@ class DoctrineCollector extends DataCollector implements Renderable, AssetProvid
         foreach ($this->debugStack->queries as $q) {
             $queries[] = array(
                 'sql' => $q['sql'],
-                'params' => (object) $q['params'],
+                'params' => (object) $this->getParameters($q),
                 'duration' => $q['executionMS'],
                 'duration_str' => $this->formatDuration($q['executionMS'])
             );
@@ -75,6 +75,20 @@ class DoctrineCollector extends DataCollector implements Renderable, AssetProvid
         );
     }
 
+    /**
+     * Returns an array of parameters used with the query
+     *
+     * @return array
+     */
+    public function getParameters($query) : array
+    {
+        $params = [];
+        foreach ($query['params'] as $name => $param) {
+            $params[$name] = htmlentities($param?:"", ENT_QUOTES, 'UTF-8', false);
+        }
+        return $params;
+    }
+
     /**
      * @return string
      */

tests/DebugBar/Tests/Browser/Bridge/DoctrineTest.php

@@ -33,7 +33,7 @@ class DoctrineTest extends AbstractBrowserTest
             });
 
         $this->assertEquals('INSERT INTO products (name) VALUES (?)', $statements[1]);
-        $this->assertCount(3, $statements);
+        $this->assertCount(4, $statements);
     }
 
 }

tests/DebugBar/Tests/Browser/PdoTest.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace DebugBar\Tests\Browser;
+
+use DebugBar\Browser\Bridge\WebDriverElement;
+
+class PdoTest extends AbstractBrowserTest
+{
+    public function testMonologCollector(): void
+    {
+        $client = static::createPantherClient();
+
+        $client->request('GET', '/demo/pdo.php');
+
+        // Wait for Debugbar to load
+        $crawler = $client->waitFor('.phpdebugbar-body');
+        usleep(1000);
+
+        if (!$this->isTabActive($crawler, 'database')) {
+            $client->click($this->getTabLink($crawler, 'database'));
+        }
+
+        $crawler = $client->waitForVisibility('.phpdebugbar-panel[data-collector=database]');
+
+        $statements = $crawler->filter('.phpdebugbar-panel[data-collector=database] .phpdebugbar-widgets-sql')
+            ->each(function($node){
+                return $node->getText();
+            });
+
+        $this->assertEquals('insert into users (name) values (?)', $statements[1]);
+        $this->assertCount(7, $statements);
+    }
+
+}