From: Alexander Ebert <ebert@woltlab.com>
Date: Fri, 25 Aug 2023 14:25:19 +0000 (+0200)
Subject: Apply encoding to the formatted exception description
X-Git-Tag: 6.0.0_Beta_4~52
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=cee449e1d147f8633edf2cbb0a3eba6112318e0f;p=GitHub%2FWoltLab%2FWCF.git

Apply encoding to the formatted exception description
---

diff --git a/wcfsetup/install/files/lib/core.functions.php b/wcfsetup/install/files/lib/core.functions.php
index 36839da203..a004a1a9fe 100644
--- a/wcfsetup/install/files/lib/core.functions.php
+++ b/wcfsetup/install/files/lib/core.functions.php
@@ -167,7 +167,7 @@ namespace wcf\functions\exception {
 
 	/**
 	 * Logs the given Throwable.
-	 * 
+	 *
 	 * @param	string			$logFile	The log file to use. If set to `null` the default log file will be used and the variable contents will be replaced by the actual path.
 	 * @return	string					The ID of the log entry.
 	 */
@@ -251,7 +251,7 @@ namespace wcf\functions\exception {
 	/**
 	 * Pretty prints the given Throwable. It is recommended to `exit;`
 	 * the request after calling this function.
-	 * 
+	 *
 	 * @throws	\Exception
 	 */
 	function printThrowable(\Throwable $e)
@@ -290,12 +290,12 @@ EXPLANATION;
 
 		/*
 		 * A notice on the HTML used below:
-		 * 
+		 *
 		 * It might appear a bit weird to use <p> all over the place where semantically
 		 * other elements would fit in way better. The reason behind this is that we avoid
 		 * inheriting unwanted styles (e.g. exception displayed in an overlay) and that
 		 * the output needs to be properly readable when copied & pasted somewhere.
-		 * 
+		 *
 		 * Besides the visual appearance, the output was built to provide a maximum of
 		 * compatibility and readability when pasted somewhere else, e.g. a WYSIWYG editor
 		 * without the potential of messing up the formatting and thus harming the readability.
@@ -621,7 +621,7 @@ EXPLANATION;
 																echo "Final ";
 															} ?>Error</p>
 							<?php if ($e instanceof SystemException && $e->getDescription()) { ?>
-								<p class="exceptionText"><?php echo $e->getDescription(); ?></p>
+								<p class="exceptionText"><?php echo StringUtil::encodeHTML($e->getDescription()); ?></p>
 							<?php } ?>
 							<ul class="exceptionErrorDetails">
 								<li>
@@ -765,7 +765,7 @@ EXPLANATION;
 	/**
 	 * Returns the stack trace of the given Throwable with sensitive
 	 * information removed.
-	 * 
+	 *
 	 * @param	bool			$ignorePaths	If set to `true`: Don't call `sanitizePath`.
 	 * @return	mixed[]
 	 */