[5.4] Escape inline sections

[sileence]

Subtle but important change (imho).

This is a possible XSS attack: @section('title', '</title><script>alert("hi")</script>')

Of course the problem there is evident, but it is less evident if you have something like:

@section('title', $user->username) or @section('title', $userPost->title)

Using:

@section('title')
    {!! $post->title !!}
@endsection

Makes it evident that the content is not escaped, but @section('title', $post->title) doesn't.

[tillkruss]

Nice one. @taylorotwell This should probably be mentioned in the 5.4 upgrade guide, right?

[maddhatter]

This broke a couple of sections for me - something in the upgrade guide would be awesome.

[sileence]

@maddhatter it's easier to notice HTML being escaped than the other way around.

[maddhatter]

@sileence Yeah, I totally get the motivation for the change and agree with it. It just took awhile of working my way through the all the Blade classes/methods to find what had changed so I could fix my code.

[ChristopheB]

I'm having an issue with this change. I was using the method inject to dynamically fill a section with another view, something like this:

$view = \View::make('layout');
$view->getFactory()->inject('section', $anotherView->render());

I can't do this anymore, as now the injected view gets encoded by e(). Here is the awkward workaround I'm currently using:

$view = \View::make('layout');
$view->getFactory()->startSection('section');
echo $anotherView->render();
$view->getFactory()->stopSection();

I don't know what was the exact purpose of the method inject, but I would say I try to use it the intended way (?). This would fix the issue I have:

public function inject($section, $content)
{
    return $this->extendSection($section, $content);
}

If that's ok, I can make a PR with this change.

[GrahamCampbell]

The correct work around is to just use the HtmlString class (at least, the best way I can think of).

[GrahamCampbell]

$view->getFactory()->inject('section', new HtmlString($anotherView->render()));

[ChristopheB]

Nice one Graham, I'll use that, thanks! 👍

[GrahamCampbell]

We probably need better docs for this tbh. :)