Comments on: A View Stream with Zend_View

By: Pieter Vogelaar

Pieter Vogelaar — Fri, 16 Sep 2011 09:15:14 +0000

Over at the PiKe project we build a custom stream wrapper that automatically escapes all view variables, with a MINIMAL performance hit! You can still get the RAW value with:

Notice the "~" character. Checkout http://code.google.com/p/php-pike/wiki/Pike_View_Stream

I know you said that you want to avoid "tricky ways like output buffering and PREG replacing *.phtml files.", but I still think it's a very neat way to fix auto escaping in Zend Framework 1.

By: Joe Devon

Joe Devon — Sun, 28 Mar 2010 00:24:07 +0000

I grant you that's a bad example, heh heh, what I meant is,

If you're trying to improve security then a robust solution would be preferred, which would require a parser instead of regex...

But I suppose this'll do the trick if you make sure you keep it to a one liner.

For your readers, I'll link to a cool thread (that you participated in) about how escaping is being planned for #ZF 2.0:
http://framework.zend.com/wiki/display/ZFDEV2/Zend_View+2.0

By: Rob...

Rob... — Sat, 27 Mar 2010 17:33:36 +0000

Joe,

I expect it would break :) But then I wouldn't be impressed if I saw that code in a view template anyway!

Rob...

By: Joe Devon

Joe Devon — Sat, 27 Mar 2010 17:28:18 +0000

Nice thought but personally not a huge fan of this approach, feels like it's using regex where a parser is more appropriate... particularly as you're trying to solve a security issue, where arcane, missed details are often where holes are exploited...

P.S. I didn't look much at the regex but I'm curious, how would you want to handle something like this?:

< ?= @var; @var2 ?>

By: Rob...

Rob... — Fri, 28 Mar 2008 08:06:08 +0000

Dinoboff,

Very interesting, Thanks!

Regards,

Rob...

By: Dinoboff

Dinoboff — Fri, 28 Mar 2008 04:42:57 +0000

Here a version with caching:
http://code.google.com/p/simple-php-template/source/browse/trunk/src/library/Spt/Stream/View.php

It doesn't add the escape method. A subclass of Zend_View escape the variables by default instead.

By: Dinoboff

Dinoboff — Thu, 27 Mar 2008 16:55:36 +0000

Finally, about the ternary operator:

become:

escape($this->var ? $this->var : '-unknown-'); ?>
escape($var ? $var : '-unknown-'); ?>

Even if it is not really what you write, isn't it valid php?

By: Dinoboff

Dinoboff — Thu, 27 Mar 2008 16:40:46 +0000

We also need to escape result of functions:

$find = '/<\?=\s*([^;]*);?\s*\?>/';
$replace = "escape($1); ?>";
$this->data = preg_replace($find, $replace, $this->data);

By: Dinoboff

Dinoboff — Thu, 27 Mar 2008 16:33:56 +0000

Try again...
$find = '/<\?=\s*(\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*)\s*;?\s*\?>/';
$replace = "escape($1); ?>";
$this->data = preg_replace($find, $replace, $this->data);

By: Dinoboff

Dinoboff — Thu, 27 Mar 2008 16:31:05 +0000

Nevermind, I had to test the solution to understand the details. ps: make it to work I had to use the following regex:



$find = '//';

            $replace = "escape($1); ?>";

            $this->data = preg_replace($find, $replace, $this->data);

The regex for a viriable name is from http://www.php.net/language.variables