Applied patch attached to ZF-11597 to fix ZF-9926 by escaping single quotes in HTML attibutes where attribute delineated by single quotes in the HTML source.

git-svn-id: http://framework.zend.com/svn/framework/standard/trunk@24398 44c647ce-9c0f-0410-b52a-842ac1e357ba

library/Zend/View/Helper/HtmlElement.php

@@ -109,7 +109,11 @@ abstract class Zend_View_Helper_HtmlElement extends Zend_View_Helper_Abstract
                     require_once 'Zend/Json.php';
                     $val = Zend_Json::encode($val);
                 }
-                $val = preg_replace('/"([^"]*)":/', '$1:', $val);
+                // Escape single quotes inside event attribute values.
+                // This will create html, where the attribute value has
+                // single quotes around it, and escaped single quotes or
+                // non-escaped double quotes inside of it
+                $val = str_replace('\'', ''', $val);
             } else {
                 if (is_array($val)) {
                     $val = implode(' ', $val);

tests/Zend/View/Helper/AttributeJsEscapingTest.php

@@ -0,0 +1,102 @@
+<?php
+/**
+ * Zend Framework
+ *
+ * LICENSE
+ *
+ * This source file is subject to the new BSD license that is bundled
+ * with this package in the file LICENSE.txt.
+ * It is also available through the world-wide-web at this URL:
+ * http://framework.zend.com/license/new-bsd
+ * If you did not receive a copy of the license and are unable to
+ * obtain it through the world-wide-web, please send an email
+ * to license@zend.com so we can send you a copy immediately.
+ *
+ * @category   Zend
+ * @package    Zend_View
+ * @subpackage UnitTests
+ * @copyright  Copyright (c) 2005-2011 Zend Technologies USA Inc. (http://www.zend.com)
+ * @license    http://framework.zend.com/license/new-bsd     New BSD License
+ * @version    $Id: FormSubmitTest.php 23772 2011-02-28 21:35:29Z ralph $
+ */
+
+// Call Zend_View_Helper_FormSubmitTest::main() if this source file is executed directly.
+if (!defined("PHPUnit_MAIN_METHOD")) {
+    define("PHPUnit_MAIN_METHOD", "Zend_View_Helper_FormSubmitTest::main");
+}
+
+require_once 'Zend/View/Helper/FormSubmit.php';
+require_once 'Zend/View.php';
+require_once 'Zend/Registry.php';
+
+/**
+ * Test class for Zend_View_Helper_HtmlElement JS Escaping.
+ *
+ * @category   Zend
+ * @package    Zend_View
+ * @subpackage UnitTests
+ * @copyright  Copyright (c) 2005-2011 Zend Technologies USA Inc. (http://www.zend.com)
+ * @license    http://framework.zend.com/license/new-bsd     New BSD License
+ * @group      Zend_View
+ * @group      Zend_View_Helper
+ */
+class Zend_View_Helper_AttributeJsEscapingTest extends PHPUnit_Framework_TestCase
+{
+    /**
+     * Runs the test methods of this class.
+     *
+     * @return void
+     */
+    public static function main()
+    {
+        $suite  = new PHPUnit_Framework_TestSuite("Zend_View_Helper_FormSubmitTest");
+        $result = PHPUnit_TextUI_TestRunner::run($suite);
+    }
+
+    /**
+     * Sets up the fixture, for example, open a network connection.
+     * This method is called before a test is executed.
+     *
+     * @return void
+     */
+    public function setUp()
+    {
+        if (Zend_Registry::isRegistered('Zend_View_Helper_Doctype')) {
+            $registry = Zend_Registry::getInstance();
+            unset($registry['Zend_View_Helper_Doctype']);
+        }
+        $this->view   = new Zend_View();
+        $this->helper = new Zend_View_Helper_FormSubmit();
+        $this->helper->setView($this->view);
+    }
+
+    /**
+     * Tears down the fixture, for example, close a network connection.
+     * This method is called after a test is executed.
+     *
+     * @return void
+     */
+    public function tearDown()
+    {
+        unset($this->helper, $this->view);
+    }
+
+
+    /**
+     * @group ZF-9926
+     */
+    public function testRendersSubmitInput()
+    {
+        $html = $this->helper->formSubmit(array(
+            'name'    => 'foo',
+            'value'   => 'Submit!',
+            'attribs' => array('onsubmit' => array('foo', '\'bar\'', 10))
+        ));
+        $this->assertEquals('<input type="submit" name="foo" id="foo" value="Submit!" onsubmit=\'["foo","&#39;bar&#39;",10]\'>', $html);
+    }
+}
+
+// Call Zend_View_Helper_FormSubmitTest::main() if this source file is executed directly.
+if (PHPUnit_MAIN_METHOD == "Zend_View_Helper_FormSubmitTest::main") {
+    Zend_View_Helper_FormSubmitTest::main();
+}