fix(formatter): prevent stored XSS by disabling default HTML safety

src/DataLoader/DoctrineDataLoader.php

@@ -29,7 +29,7 @@ public function getResults(): iterable
     {
         /** @var QueryBuilder $qb */
         $qb = (clone $this->options[self::OPT_QUERY_BUILDER]);
-        $qb->select('COUNT(' . $qb->getRootAliases()[0] . ')');
+        $qb->select('COUNT('.$qb->getRootAliases()[0].')');
         $qb->resetDQLPart('groupBy');
         $qb->resetDQLPart('orderBy');
         $this->paginationExtension->setTotalResults((int) $qb->getQuery()->getSingleScalarResult());

src/DependencyInjection/whatwedoTableExtension.php

@@ -17,7 +17,7 @@ public function load(array $configs, ContainerBuilder $container): void
         $configuration = new Configuration();
         $this->processConfiguration($configuration, $configs);
 
-        $loader = new YamlFileLoader($container, new FileLocator(__DIR__ . '/../Resources/config'));
+        $loader = new YamlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
         $loader->load('services.yml');
     }
 

src/EventListener/AjaxFilterSearchListener.php

@@ -63,7 +63,7 @@ public function searchResultSet(ResultRequestEvent $requestEvent)
             $ids = $this->indexRepository->search($term, $class);
             $queryBuilder = $requestEvent->getQueryBuilder() ?: $this->entityManager->getRepository($class)
                 ->createQueryBuilder('e');
-            $entities = $queryBuilder->andWhere($queryBuilder->getRootAliases()[0] . '.id IN (:ids)')
+            $entities = $queryBuilder->andWhere($queryBuilder->getRootAliases()[0].'.id IN (:ids)')
                 ->setParameter('ids', $ids)
                 ->getQuery()
                 ->getResult();

src/Extension/FilterExtension.php

@@ -312,7 +312,7 @@ private static function labelCallable(Table $table, $property)
 
     private static function jsonSearchCallable(string $entityClass)
     {
-        throw new \Exception('you need to define a json search callable for class "' . $entityClass . '".');
+        throw new \Exception('you need to define a json search callable for class "'.$entityClass.'".');
     }
 
     /**
@@ -323,7 +323,7 @@ private static function jsonSearchCallable(string $entityClass)
     private function addFilterAutomatically(Table $table, QueryBuilder $queryBuilder, callable $labelCallable, callable $jsonSearchCallable, \ReflectionProperty $property, string $namespace)
     {
         $acronymNoSuffix = $property->getName();
-        $acronym = '_' . $property->getName();
+        $acronym = '_'.$property->getName();
         $label = \call_user_func($labelCallable, $table, $property->getName());
         $allAliases = $queryBuilder->getAllAliases();
         $isPropertySelected = \in_array($acronym, $allAliases, true);
@@ -339,7 +339,7 @@ private function addFilterAutomatically(Table $table, QueryBuilder $queryBuilder
                 return $this->getFilter($acronymNoSuffix);
             }
         } catch (\InvalidArgumentException $exception) {
-            $this->logger->warning('could not automatically add filter for "' . $label . '"', [
+            $this->logger->warning('could not automatically add filter for "'.$label.'"', [
                 'message' => $exception->getMessage(),
                 'trace' => $exception->getTraceAsString(),
             ]);

src/Filter/FilterGuesser.php

@@ -127,7 +127,7 @@ private function newRelationFilter(string $class, string $acronym, string $targe
         }
 
         if (mb_strpos($targetEntity, '\\') === false) {
-            $targetEntity = $namespace . '\\' . $targetEntity;
+            $targetEntity = $namespace.'\\'.$targetEntity;
         }
 
         return new (self::RELATION_TYPE[$class])(

src/Filter/Type/AjaxManyToManyFilterType.php

@@ -35,15 +35,15 @@ class AjaxManyToManyFilterType extends AjaxOneToManyFilterType
 {
     public function toDql(string $operator, string $value, string $parameterName, QueryBuilder $queryBuilder)
     {
-        $targetParameter = 'target_' . hash('crc32', random_bytes(10));
+        $targetParameter = 'target_'.hash('crc32', random_bytes(10));
         $queryBuilder->setParameter(
             $targetParameter,
             $this->entityManager->getRepository($this->targetClass)->find($value)
         );
 
         switch ($operator) {
             case static::CRITERIA_EQUAL:
-                return $queryBuilder->expr()->isMemberOf(':' . $targetParameter, $this->column);
+                return $queryBuilder->expr()->isMemberOf(':'.$targetParameter, $this->column);
             case static::CRITERIA_NOT_EQUAL:
                 return $queryBuilder->expr()->not($queryBuilder->expr()->isMemberOf($targetParameter, $this->column));
         }

src/Filter/Type/AjaxOneToManyFilterType.php

@@ -75,17 +75,17 @@ public function getValueField(?string $value = '0'): string
 
     public function toDql(string $operator, string $value, string $parameterName, QueryBuilder $queryBuilder)
     {
-        $targetParameter = 'target_' . hash('crc32', random_bytes(10));
+        $targetParameter = 'target_'.hash('crc32', random_bytes(10));
         $queryBuilder->setParameter(
             $targetParameter,
             $this->entityManager->getRepository($this->targetClass)->find($value)
         );
 
         switch ($operator) {
             case static::CRITERIA_EQUAL:
-                return $queryBuilder->expr()->in($this->column, ':' . $targetParameter);
+                return $queryBuilder->expr()->in($this->column, ':'.$targetParameter);
             case static::CRITERIA_NOT_EQUAL:
-                return $queryBuilder->expr()->notIn($this->column, ':' . $targetParameter);
+                return $queryBuilder->expr()->notIn($this->column, ':'.$targetParameter);
         }
 
         return null;

src/Filter/Type/AjaxRelationFilterType.php

@@ -56,17 +56,17 @@ public function toDql(string $operator, string $value, string $parameterName, Qu
         switch ($operator) {
             case static::CRITERIA_EQUAL:
                 if ((int) $value) {
-                    return $queryBuilder->expr()->eq($this->getColumn() . '.id', (int) $value);
+                    return $queryBuilder->expr()->eq($this->getColumn().'.id', (int) $value);
                 }
 
-                return $queryBuilder->expr()->isNull($this->getColumn() . '.id');
+                return $queryBuilder->expr()->isNull($this->getColumn().'.id');
 
             case static::CRITERIA_NOT_EQUAL:
                 if ((int) $value) {
-                    return $queryBuilder->expr()->neq($this->getColumn() . '.id', (int) $value);
+                    return $queryBuilder->expr()->neq($this->getColumn().'.id', (int) $value);
                 }
 
-                return $queryBuilder->expr()->isNotNull($this->getColumn() . '.id');
+                return $queryBuilder->expr()->isNotNull($this->getColumn().'.id');
         }
 
         return null;

src/Filter/Type/ChoiceFilterType.php

@@ -52,9 +52,9 @@ public function toDql(string $operator, string $value, string $parameterName, Qu
 
         switch ($operator) {
             case static::CRITERIA_EQUAL:
-                return $queryBuilder->expr()->eq($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->eq($this->getColumn(), ':'.$parameterName);
             case static::CRITERIA_NOT_EQUAL:
-                return $queryBuilder->expr()->neq($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->neq($this->getColumn(), ':'.$parameterName);
         }
 
         return false;

src/Filter/Type/DatetimeFilterType.php

@@ -70,14 +70,14 @@ public function toDql(string $operator, string $value, string $parameterName, Qu
             case static::CRITERIA_IN_YEAR:
                 $startYear = clone $date;
                 $endYear = clone $date;
-                $startYear->modify('first day of January ' . date('Y'))->setTime(0, 0, 0);
-                $endYear->modify('last day of December ' . date('Y'))->setTime(23, 59, 59);
-                $queryBuilder->setParameter($parameterName . '_start', $startYear->format(static::getQueryDataFormat()));
-                $queryBuilder->setParameter($parameterName . '_end', $endYear->format(static::getQueryDataFormat()));
+                $startYear->modify('first day of January '.date('Y'))->setTime(0, 0, 0);
+                $endYear->modify('last day of December '.date('Y'))->setTime(23, 59, 59);
+                $queryBuilder->setParameter($parameterName.'_start', $startYear->format(static::getQueryDataFormat()));
+                $queryBuilder->setParameter($parameterName.'_end', $endYear->format(static::getQueryDataFormat()));
 
                 return $queryBuilder->expr()->andX(
-                    $queryBuilder->expr()->gte($this->getColumn(), sprintf(':%s', $parameterName . '_start')),
-                    $queryBuilder->expr()->lte($this->getColumn(), sprintf(':%s', $parameterName . '_end'))
+                    $queryBuilder->expr()->gte($this->getColumn(), sprintf(':%s', $parameterName.'_start')),
+                    $queryBuilder->expr()->lte($this->getColumn(), sprintf(':%s', $parameterName.'_end'))
                 );
         }
 

src/Filter/Type/NumberFilterType.php

@@ -41,13 +41,13 @@ public function toDql(string $operator, string $value, string $parameterName, Qu
 
         switch ($operator) {
             case static::CRITERIA_EQUAL:
-                return $queryBuilder->expr()->eq($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->eq($this->getColumn(), ':'.$parameterName);
             case static::CRITERIA_NOT_EQUAL:
-                return $queryBuilder->expr()->neq($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->neq($this->getColumn(), ':'.$parameterName);
             case static::CRITERIA_BIGGER_THAN:
-                return $queryBuilder->expr()->gt($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->gt($this->getColumn(), ':'.$parameterName);
             case static::CRITERIA_SMALLER_THAN:
-                return $queryBuilder->expr()->lt($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->lt($this->getColumn(), ':'.$parameterName);
         }
 
         return false;

src/Filter/Type/TextFilterType.php

@@ -53,40 +53,40 @@ public function toDql(string $operator, string $value, string $parameterName, Qu
             case static::CRITERIA_EQUAL:
                 $queryBuilder->setParameter($parameterName, $value);
 
-                return $queryBuilder->expr()->eq($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->eq($this->getColumn(), ':'.$parameterName);
 
             case static::CRITERIA_NOT_EQUAL:
                 $queryBuilder->setParameter($parameterName, $value);
 
-                return $queryBuilder->expr()->neq($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->neq($this->getColumn(), ':'.$parameterName);
 
             case static::CRITERIA_STARTS_WITH:
-                $queryBuilder->setParameter($parameterName, $value . '%');
+                $queryBuilder->setParameter($parameterName, $value.'%');
 
-                return $queryBuilder->expr()->like($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->like($this->getColumn(), ':'.$parameterName);
 
             case static::CRITERIA_ENDS_WITH:
-                $queryBuilder->setParameter($parameterName, '%' . $value);
+                $queryBuilder->setParameter($parameterName, '%'.$value);
 
-                return $queryBuilder->expr()->like($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->like($this->getColumn(), ':'.$parameterName);
 
             case static::CRITERIA_CONTAINS:
-                $queryBuilder->setParameter($parameterName, '%' . $value . '%');
+                $queryBuilder->setParameter($parameterName, '%'.$value.'%');
 
-                return $queryBuilder->expr()->like($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->like($this->getColumn(), ':'.$parameterName);
 
             case static::CRITERIA_IS_EMPTY:
                 $queryBuilder->setParameter($parameterName, '');
 
                 return $queryBuilder->expr()->orX()->addMultiple([
                     $queryBuilder->expr()->isNull($this->getColumn()),
-                    $queryBuilder->expr()->eq($this->getColumn(), ':' . $parameterName),
+                    $queryBuilder->expr()->eq($this->getColumn(), ':'.$parameterName),
                 ]);
 
             case static::CRITERIA_IS_NOT_EMPTY:
                 $queryBuilder->setParameter($parameterName, '');
 
-                return $queryBuilder->expr()->gt($this->getColumn(), ':' . $parameterName);
+                return $queryBuilder->expr()->gt($this->getColumn(), ':'.$parameterName);
         }
 
         return false;

src/Helper/RouterHelper.php

@@ -52,6 +52,6 @@ class RouterHelper
     public static function getParameterName(string $identifier, string $parameter, $addition = null): string
     {
         return sprintf('%s_%s', str_replace('.', '_', $identifier), $parameter)
-            . ($addition ? '_' . str_replace('.', '_', $addition) : '');
+            .($addition ? '_'.str_replace('.', '_', $addition) : '');
     }
 }

src/Manager/ExportManager.php

@@ -59,7 +59,7 @@ protected function createHeader(Worksheet $sheet, array $tableColumns): void
             }
 
             $columnIndex = $sheet->getColumnDimensionByColumn($colIndex + 1)->getColumnIndex();
-            $cell = $sheet->getCell($columnIndex . '1');
+            $cell = $sheet->getCell($columnIndex.'1');
             $cell->setValueExplicit($value, DataType::TYPE_STRING2);
             $cell->getStyle()->getFont()->setBold(true);
         }
@@ -89,7 +89,7 @@ protected function createTable(Worksheet $sheet, Table $table, array $tableColum
                     }
                 }
                 $columnIndex = $sheet->getColumnDimensionByColumn($colIndex)->getColumnIndex();
-                $cell = $sheet->getCell($columnIndex . ($rowIndex + 2));
+                $cell = $sheet->getCell($columnIndex.($rowIndex + 2));
 
                 $cell->setValueExplicit($data, DataType::TYPE_STRING2);
                 ++$colIndex;

src/Resources/views/tailwind_2/_table.html.twig

@@ -197,7 +197,8 @@
                                 {% endif %}
                             {% endif %}
                         {% endapply %}
-                        {{ whatwedo_table_column_render(column, row) }}
+                        {% set columnValue = whatwedo_table_column_render(column, row) %}
+                        {{ wwd_is_html_safe(column) ? columnValue|raw : columnValue }}
                         {% if column.option('link_the_column_content') and columnLink|default(false) %}</a>{% endif %}
                     </td>
                 {% endfor %}

src/Twig/TableExtension.php

@@ -92,7 +92,7 @@ protected function post2Name(array $array): array
             $new_key = '';
             foreach ($parts as $part) {
                 if ($i !== 0) {
-                    $part = '[' . $part . ']';
+                    $part = '['.$part.']';
                 }
                 $new_key .= $part;
                 $i++;
@@ -110,9 +110,9 @@ protected function flattenArray($array, $prefix = '')
         $result = [];
         foreach ($array as $key => $value) {
             if (is_array($value)) {
-                $result = $result + $this->flattenArray($value, $prefix . $key . '.');
+                $result = $result + $this->flattenArray($value, $prefix.$key.'.');
             } else {
-                $result[$prefix . $key] = $value;
+                $result[$prefix.$key] = $value;
             }
         }
         return $result;

src/Twig/TableRenderExtension.php

@@ -27,18 +27,20 @@ public function __construct(
 
     public function getFunctions(): array
     {
-        $options = [
+        $options = $noSafeOptions = [
             'needs_context' => true,
             'is_safe' => ['html'],
             'is_safe_callback' => true,
             'blockName' => 'blockName',
         ];
+        $noSafeOptions['is_safe'] = [];
 
         return [
             new TwigFunction('whatwedo_table_render', fn ($context, Table $table) => $this->renderTable($context, $table), $options),
             new TwigFunction('whatwedo_table_only_render', fn ($context, Table $table) => $this->renderTable($context, $table, 'table_table'), $options),
             new TwigFunction('whatwedo_table_action_render', fn ($context, Action $action, $entity) => $this->renderTableAction($context, $action, $entity), $options),
             new TwigFunction('whatwedo_table_column_render', fn ($context, Column $column, $entity) => $this->renderTableColumn($context, $column, $entity), $options),
+            new TwigFunction('araise_table_column_render', fn ($context, Column $column, $entity) => $this->renderTableColumn($context, $column, $entity), $noSafeOptions),
         ];
     }
 

tests/App/Factory/CompanyFactory.php

@@ -34,7 +34,7 @@ protected function getDefaults(): array
             'name' => self::faker()->company(),
             'city' => self::faker()->city(),
             'country' => self::faker()->country(),
-            'taxIdentificationNumber' => self::faker()->numerify(self::faker()->countryCode() . '###.####.###.#.###.##'),
+            'taxIdentificationNumber' => self::faker()->numerify(self::faker()->countryCode().'###.####.###.#.###.##'),
         ];
     }
 

tests/App/Kernel.php

@@ -18,11 +18,11 @@ public function __construct()
 
     public function getCacheDir(): string
     {
-        return $this->getProjectDir() . '/../../var/cache/' . $this->environment;
+        return $this->getProjectDir().'/../../var/cache/'.$this->environment;
     }
 
     public function getProjectDir(): string
     {
-        return \dirname(__DIR__) . '/App';
+        return \dirname(__DIR__).'/App';
     }
 }

tests/App/config/bootstrap.php

@@ -4,7 +4,7 @@
 
 use Symfony\Component\Dotenv\Dotenv;
 
-require dirname(__DIR__) . '/../../vendor/autoload.php';
+require dirname(__DIR__).'/../../vendor/autoload.php';
 
 //// Load cached env vars if the .env.local.php file exists
 //// Run "composer dump-env prod" to create it (requires symfony/flex >=1.2)

tests/App/public/index.php

@@ -6,7 +6,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use whatwedo\TableBundle\Tests\App\Kernel;
 
-require dirname(__DIR__) . '/config/bootstrap.php';
+require dirname(__DIR__).'/config/bootstrap.php';
 
 if ($_SERVER['APP_DEBUG']) {
     umask(0000);

tests/TableTest.php

@@ -170,7 +170,7 @@ public function testDoctrineDataLoderPaginatePage2Table()
         $tableFactory = self::getContainer()->get(TableFactory::class);
 
         $fakeRequest = Request::create('/', 'GET', [
-            'test_' . RouterHelper::PARAMETER_PAGINATION_PAGE => 2,
+            'test_'.RouterHelper::PARAMETER_PAGINATION_PAGE => 2,
         ]);
 
         $fakeRequest->setSession(new Session(new MockArraySessionStorage()));

tests/bootstrap.php

@@ -4,6 +4,6 @@
 
 use Symfony\Component\Filesystem\Filesystem;
 
-require \dirname(__DIR__) . '/vendor/autoload.php';
+require \dirname(__DIR__).'/vendor/autoload.php';
 
-(new Filesystem())->remove(__DIR__ . '/../var');
+(new Filesystem())->remove(__DIR__.'/../var');