SPIN-5582: Strip html from database values. Keep html in specific renderer output.

Util/Datatable.php

@@ -16,6 +16,7 @@
 use Ali\DatatableBundle\Util\Formatter\Renderer;
 use Ali\DatatableBundle\Util\Factory\Prototype\PrototypeBuilder;
 use Twig\Environment;
+use Twig\Markup;
 
 class Datatable
 {
@@ -174,16 +175,29 @@ public function execute()
         }
         if (!is_null($this->_renderer))
         {
+            $raw_data = $data;
             array_walk($data, $this->_renderer);
+            $this->_markRendererOutputAsSafe($data, $raw_data);
         }
         if (!is_null($this->_renderer_obj))
         {
+            // ->setRenderers() always renders every column through Twig (falling back to
+            // _default.html.twig's {{ dt_item }}), so auto-escaping is guaranteed here.
             $this->_renderer_obj->applyTo($data, $objects);
         }
+        else
+        {
+            // No Twig pass is guaranteed to run (no ->setRenderers()), so nothing will
+            // auto-escape leftover raw entity/DB values (or a whole untouched row when
+            // ->setRenderer() isn't used either). Escape them now instead of relying on
+            // a pass that may never happen.
+            $this->_escapeUnsafeValues($data);
+        }
         if (!empty($this->_multiple))
         {
             array_walk($data, function($val, $key) use(&$data, $ids) {
-                array_unshift($val, "<input type='checkbox' name='dataTables[actions][]' value='{$ids[$key]}' />");
+                $safe_id = htmlspecialchars((string) $ids[$key], ENT_QUOTES, 'UTF-8');
+                array_unshift($val, "<input type='checkbox' name='dataTables[actions][]' value='{$safe_id}' />");
                 $data[$key] = $val;
             });
         }
@@ -196,6 +210,61 @@ public function execute()
         return new JsonResponse($output);
     }
 
+    /**
+     * Column values untouched by the controller's ->setRenderer() closure are raw entity/DB
+     * data. They are left as plain strings here and escaped later, either by Twig
+     * (if ->setRenderers() is also configured, see execute()) or by _escapeUnsafeValues().
+     * Values the closure *did* rewrite are trusted, deliberately-built HTML (links, badges, ...),
+     * so we wrap them in Twig\Markup - the same "already safe" marker the |raw filter produces -
+     * so neither a later Twig pass nor _escapeUnsafeValues() mangles them.
+     *
+     * @param array $data     data after the renderer closure ran (modified in place)
+     * @param array $raw_data data as it was before the renderer closure ran
+     *
+     * @return void
+     */
+    private function _markRendererOutputAsSafe(array &$data, array $raw_data)
+    {
+        foreach ($data as $row_index => &$row)
+        {
+            foreach ($row as $column_index => &$value)
+            {
+                $original = $raw_data[$row_index][$column_index] ?? null;
+                if (is_string($value) && $value !== $original)
+                {
+                    $value = new Markup($value, 'UTF-8');
+                }
+            }
+        }
+    }
+
+    /**
+     * Escapes any plain string cell value so raw entity/DB data can never be interpreted as
+     * HTML/script by the client-side DataTables grid, which inserts aaData directly into the
+     * DOM. Used whenever no ->setRenderers() Twig pass is configured to guarantee escaping -
+     * i.e. when the table has no renderer at all, or only a ->setRenderer() closure that may
+     * leave some columns (or all rows, for columns it doesn't touch) unrendered.
+     * Values already wrapped in Twig\Markup by _markRendererOutputAsSafe() are deliberately
+     * built HTML and are left untouched.
+     *
+     * @param array $data data after any ->setRenderer() closure ran (modified in place)
+     *
+     * @return void
+     */
+    private function _escapeUnsafeValues(array &$data)
+    {
+        foreach ($data as &$row)
+        {
+            foreach ($row as &$value)
+            {
+                if (is_string($value))
+                {
+                    $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
+                }
+            }
+        }
+    }
+
     /**
      * get datatable instance by id
      *  return current instance if null

Util/Formatter/Renderer.php

@@ -34,9 +34,7 @@ public function __construct(Environment $twig, array $renderers, array $fields)
      */
     public function applyView($view_path, array $params)
     {
-        $out = $this->twig
-                ->render($view_path, $params);
-        return html_entity_decode($out);
+        return $this->twig->render($view_path, $params);
     }
 
     /**