Fix the escaping of the source code when displaying it

stof · stof · commit 2d0965ed2a41 · 2015-04-07T15:34:27.000+02:00
The source code of the controller cannot be considered as being safe
HTML. It needs to be escaped.
This also moves the escaping of the template source code from the
extension to the template rendering it.
diff --git a/app/Resources/views/default/_source_code.html.twig b/app/Resources/views/default/_source_code.html.twig
@@ -20,10 +20,10 @@
 
                 <div class="modal-body">
                     <h3>Controller code <small class="pull-right">{{ controller_file_path }}</small></h3>
-                    <pre><code class="php">{{ controller_source_code|raw }}</code></pre>
+                    <pre><code class="php">{{ controller_source_code }}</code></pre>
 
                     <h3>Twig template code <small class="pull-right">{{ template_file_path }}</small></h3>
-                    <pre><code class="twig">{{ template_source_code|raw }}</code></pre>
+                    <pre><code class="twig">{{ template_source_code }}</code></pre>
                 </div>
             </div>
         </div>
diff --git a/src/AppBundle/Twig/SourceCodeExtension.php b/src/AppBundle/Twig/SourceCodeExtension.php
@@ -50,7 +50,7 @@ public function showSourceCode(\Twig_Environment $twig, $template)
         return $twig->render('default/_source_code.html.twig', array(
             'controller_source_code' => $this->getControllerCode(),
             'controller_file_path'   => $this->getControllerRelativePath(),
-            'template_source_code'   => htmlspecialchars($this->getTemplateCode(), ENT_QUOTES, 'UTF-8'),
+            'template_source_code'   => $this->getTemplateCode(),
             'template_file_path'     => $this->getTemplateRelativePath(),
         ));
     }

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,7 @@ public function showSourceCode(\Twig_Environment $twig, $template)`
`50`	`50`	`return $twig->render('default/_source_code.html.twig', array(`
`51`	`51`	`'controller_source_code' => $this->getControllerCode(),`
`52`	`52`	`'controller_file_path' => $this->getControllerRelativePath(),`
`53`		`- 'template_source_code' => htmlspecialchars($this->getTemplateCode(), ENT_QUOTES, 'UTF-8'),`
	`53`	`+ 'template_source_code' => $this->getTemplateCode(),`
`54`	`54`	`'template_file_path' => $this->getTemplateRelativePath(),`
`55`	`55`	`));`
`56`	`56`	`}`