From d610f1aece1736a9488ba86de96ddaf6f06aecd2 Mon Sep 17 00:00:00 2001
From: Kamil Tekiela <tekiela246@gmail.com>
Date: Fri, 1 Dec 2023 18:05:25 +0100
Subject: [PATCH] Quotes should also be escaped

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
---
 src/Sanitize.php               | 14 ++------------
 tests/classes/SanitizeTest.php |  8 ++++----
 2 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/src/Sanitize.php b/src/Sanitize.php
index 40f8f8ed2e..6773dfe874 100644
--- a/src/Sanitize.php
+++ b/src/Sanitize.php
@@ -13,7 +13,6 @@ use function __;
 use function array_keys;
 use function array_merge;
 use function count;
-use function htmlspecialchars;
 use function in_array;
 use function is_string;
 use function json_encode;
@@ -153,16 +152,7 @@ class Sanitize
     }
 
     /**
-     * Sanitizes $message, taking into account our special codes
-     * for formatting.
-     *
-     * If you want to include result in element attribute, you should escape it.
-     *
-     * Examples:
-     *
-     * <p><?php echo Sanitize::sanitizeMessage($foo); ?></p>
-     *
-     * <a title="<?php echo Sanitize::sanitizeMessage($foo, true); ?>">bar</a>
+     * Sanitizes $message, taking into account our special codes for formatting.
      *
      * @param string $message the message
      * @param bool   $safe    whether string is safe (can keep < and > chars)
@@ -170,7 +160,7 @@ class Sanitize
     public static function sanitizeMessage(string $message, bool $safe = false): string
     {
         if (! $safe) {
-            $message = strtr($message, ['<' => '&lt;', '>' => '&gt;']);
+            $message = strtr($message, ['<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#039;']);
         }
 
         /**
diff --git a/tests/classes/SanitizeTest.php b/tests/classes/SanitizeTest.php
index 59f17a3926..d385a02b2a 100644
--- a/tests/classes/SanitizeTest.php
+++ b/tests/classes/SanitizeTest.php
@@ -28,7 +28,7 @@ class SanitizeTest extends AbstractTestCase
     public function testXssInHref(): void
     {
         $this->assertEquals(
-            '[a@javascript:alert(\'XSS\');@target]link</a>',
+            '[a@javascript:alert(&#039;XSS&#039;);@target]link</a>',
             Sanitize::sanitizeMessage('[a@javascript:alert(\'XSS\');@target]link[/a]'),
         );
     }
@@ -98,7 +98,7 @@ class SanitizeTest extends AbstractTestCase
     public function testLinkDocXss(): void
     {
         $this->assertEquals(
-            '[a@./Documentation.html" onmouseover="alert(foo)"]doc</a>',
+            '[a@./Documentation.html&quot; onmouseover=&quot;alert(foo)&quot;]doc</a>',
             Sanitize::sanitizeMessage('[a@./Documentation.html" onmouseover="alert(foo)"]doc[/a]'),
         );
     }
@@ -110,7 +110,7 @@ class SanitizeTest extends AbstractTestCase
     {
         $this->assertEquals(
             '<a href="index.php?route=/url&url=https%3A%2F%2Fdocs.phpmyadmin.net%2F">doc</a>'
-                . '[a@javascript:alert(\'XSS\');@target]link</a>',
+                . '[a@javascript:alert(&#039;XSS&#039;);@target]link</a>',
             Sanitize::sanitizeMessage(
                 '[a@https://docs.phpmyadmin.net/]doc[/a][a@javascript:alert(\'XSS\');@target]link[/a]',
             ),
@@ -123,7 +123,7 @@ class SanitizeTest extends AbstractTestCase
     public function testHtmlTags(): void
     {
         $this->assertEquals(
-            '&lt;div onclick=""&gt;',
+            '&lt;div onclick=&quot;&quot;&gt;',
             Sanitize::sanitizeMessage('<div onclick="">'),
         );
     }