Loading includes/bootstrap.inc +1 −1 Original line number Diff line number Diff line Loading @@ -1905,7 +1905,7 @@ function format_string($string, array $args = array()) { * @ingroup sanitization */ function check_plain($text) { return htmlspecialchars($text, ENT_QUOTES, 'UTF-8'); return htmlspecialchars((string) $text, ENT_QUOTES, 'UTF-8'); } /** Loading modules/simpletest/tests/common.test +5 −0 Original line number Diff line number Diff line Loading @@ -480,6 +480,11 @@ class CommonXssUnitTest extends DrupalUnitTestCase { * Check that invalid multi-byte sequences are rejected. */ function testInvalidMultiByte() { // Ignore PHP 8.0+ null deprecatations. $text = check_plain(NULL); $this->assertEqual($text, '', 'check_plain() casts null to string'); $text = check_plain(FALSE); $this->assertEqual($text, '', 'check_plain() casts boolean to string'); // Ignore PHP 5.3+ invalid multibyte sequence warning. $text = @check_plain("Foo\xC0barbaz"); $this->assertEqual($text, '', 'check_plain() rejects invalid sequence "Foo\xC0barbaz"'); Loading Loading
includes/bootstrap.inc +1 −1 Original line number Diff line number Diff line Loading @@ -1905,7 +1905,7 @@ function format_string($string, array $args = array()) { * @ingroup sanitization */ function check_plain($text) { return htmlspecialchars($text, ENT_QUOTES, 'UTF-8'); return htmlspecialchars((string) $text, ENT_QUOTES, 'UTF-8'); } /** Loading
modules/simpletest/tests/common.test +5 −0 Original line number Diff line number Diff line Loading @@ -480,6 +480,11 @@ class CommonXssUnitTest extends DrupalUnitTestCase { * Check that invalid multi-byte sequences are rejected. */ function testInvalidMultiByte() { // Ignore PHP 8.0+ null deprecatations. $text = check_plain(NULL); $this->assertEqual($text, '', 'check_plain() casts null to string'); $text = check_plain(FALSE); $this->assertEqual($text, '', 'check_plain() casts boolean to string'); // Ignore PHP 5.3+ invalid multibyte sequence warning. $text = @check_plain("Foo\xC0barbaz"); $this->assertEqual($text, '', 'check_plain() rejects invalid sequence "Foo\xC0barbaz"'); Loading