• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

TYPO3 / Fluid / 1435
99%
master: 97%

Build:
Build:
LAST BUILD BRANCH: main
DEFAULT BRANCH: master
Ran 17 Nov 2020 03:52AM UTC
Jobs 2
Files 96
Run time 20min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

pending completion
1435

push

travis-ci

NamelessCoder
[SECURITY] Introduce selective argument escaping

Addresses three XSS vulnerabilities:

* The "then" and "else" arguments of condition ViewHelpers
  were not escaped. They are now escaped based on the
  escapeChildren toggle of the ViewHelper, which is ON by
  default in subclasses of AbstractConditionViewHelper.
* Content arguments in ViewHelpers which disable
  escapeOutput were not escaped, but values passed as
  child node were escaped. Both cases are now treated
  the same and escaping is based on escapeChildren state.
* TagBased ViewHelpers allowed attribute names containing
  HTML if passed in "additionalAttributes" which made XSS
  possible by crafting array keys with HTML. Attribute names
  are now subjected to the same escaping as attribute values.

Also fixes a couple of undesirable behaviors as well, e.g. avoids
double escaping of output in some combinations of escapeOutput=true
and quoted arguments.

# Conflicts:
#	src/Core/ViewHelper/AbstractConditionViewHelper.php

# Conflicts:
#	src/Core/ViewHelper/TagBuilder.php
#	tests/Unit/Core/Parser/TemplateParserTest.php

2558 of 2590 relevant lines covered (98.76%)

103.41 hits per line

Jobs
ID Job ID Ran Files Coverage
2 1435.2 17 Nov 2020 03:52AM UTC 0
98.76
Travis Job 1435.2
3 1435.3 17 Nov 2020 04:13AM UTC 0
98.73
Travis Job 1435.3
Source Files on build 1435
  • Tree
  • List 96
  • Changed 0
  • Source Changed 0
  • Coverage Changed 0
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Travis Build #1435
  • 7a03cd3f on github
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc