Merge branch 'AC-12871' into cia-2.4.8-beta2-develop-bugfix-10212024

pawan-adobe-security · pawan-adobe-security · commit 626d917ea108 · 2024-10-24T18:40:50.000+05:30
diff --git a/app/code/Magento/Config/Block/System/Config/Form/Field/File.php b/app/code/Magento/Config/Block/System/Config/Form/Field/File.php
@@ -55,7 +55,7 @@ protected function _getDeleteCheckbox()
             $html .= '<input type="hidden" name="' .
                 parent::getName() .
                 '[value]" value="' .
-                $this->getValue() .
+                $this->_escaper->escapeHtml($this->getValue()) .
                 '" />';
             $html .= '</div>';
         }
diff --git a/app/code/Magento/Config/Test/Unit/Block/System/Config/Form/Field/FileTest.php b/app/code/Magento/Config/Test/Unit/Block/System/Config/Form/Field/FileTest.php
@@ -114,11 +114,13 @@ public function testGetElementHtml(): void
         $expectedHtmlId = $this->testData['html_id_prefix']
             . $this->testData['html_id']
             . $this->testData['html_id_suffix'];
+        $escapeValue = $this->testData['value'];
         $this->escaperMock->expects($this->any())->method('escapeHtml')->willReturnMap(
             [
                 [$expectedHtmlId, null, $expectedHtmlId],
                 [self::XSS_FILE_NAME_TEST, null, self::XSS_FILE_NAME_TEST],
                 [self::INPUT_NAME_TEST, null, self::INPUT_NAME_TEST],
+                [$escapeValue, null, $escapeValue],
             ]
         );
 

Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ protected function _getDeleteCheckbox()`
`55`	`55`	`$html .= '<input type="hidden" name="' .`
`56`	`56`	`parent::getName() .`
`57`	`57`	`'[value]" value="' .`
`58`		`- $this->getValue() .`
	`58`	`+ $this->_escaper->escapeHtml($this->getValue()) .`
`59`	`59`	`'" />';`
`60`	`60`	`$html .= '</div>';`
`61`	`61`	`}`
Original file line number	Diff line number	Diff line change
`@@ -114,11 +114,13 @@ public function testGetElementHtml(): void`
`114`	`114`	`$expectedHtmlId = $this->testData['html_id_prefix']`
`115`	`115`	`. $this->testData['html_id']`
`116`	`116`	`. $this->testData['html_id_suffix'];`
	`117`	`+ $escapeValue = $this->testData['value'];`
`117`	`118`	`$this->escaperMock->expects($this->any())->method('escapeHtml')->willReturnMap(`
`118`	`119`	`[`
`119`	`120`	`[$expectedHtmlId, null, $expectedHtmlId],`
`120`	`121`	`[self::XSS_FILE_NAME_TEST, null, self::XSS_FILE_NAME_TEST],`
`121`	`122`	`[self::INPUT_NAME_TEST, null, self::INPUT_NAME_TEST],`
	`123`	`+ [$escapeValue, null, $escapeValue],`
`122`	`124`	`]`
`123`	`125`	`);`
`124`	`126`