NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.8k

[VarExporter] escape unicode chars involved in directionality#43909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

fabpot merged 1 commit intosymfony:4.4fromnicolas-grekas:ve-lre

Nov 3, 2021

Merged

[VarExporter] escape unicode chars involved in directionality#43909

fabpot merged 1 commit intosymfony:4.4fromnicolas-grekas:ve-lre

Nov 3, 2021

Conversation

Copy link

Member

nicolas-grekas commentedNov 3, 2021

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	-
License	MIT
Doc PR	-

According tohttps://www.trojansource.codes/, source code should never contain directional characters.
Let's escape them.

carsonbot added Status: Needs Review Bug VarExporter labels

Nov 3, 2021

carsonbot added this to the4.4 milestone

Nov 3, 2021

Copy link

Member

jderusse commentedNov 3, 2021

What's about Php dumpers likeSymfony\Component\Intl\Data\Bundle\Writer\PhpBundleWriter?

lyrixx changed the title~~[VarExporter] espace unicode chars involved in directionality~~[VarExporter] escape unicode chars involved in directionality

Nov 3, 2021

Copy link

MemberAuthor

nicolas-grekas commentedNov 3, 2021

They could be updated to use VarExporter. But from another pov, what's the point since all this is going to be autogenerated, and the "vulnerability" targets human reviews?