Use HTML-escaped messages in CheckstyleOutput

fixes #72
php-parallel-lint · Dec 6, 2021 · 490078e · 490078e
1 parent dd43959
commit 490078e
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 1 deletion.
diff --git a/src/Output.php b/src/Output.php
@@ -441,7 +441,7 @@ public function writeResult(Result $result, ErrorFormatter $errorFormatter, $ign
                     sprintf(
                         '        <error line="%d" severity="ERROR" message="%s" source="%s" />',
                         $fileError['line'],
-                        $fileError['message'],
+                        htmlspecialchars($fileError['message'], ENT_COMPAT, 'UTF-8'),
                         $fileError['source']
                     ) .
                     PHP_EOL

diff --git a/tests/Output.phpt b/tests/Output.phpt
@@ -8,6 +8,7 @@ require __DIR__ . '/../vendor/autoload.php';
 
 use JakubOnderka\PhpParallelLint\ErrorFormatter;
 use JakubOnderka\PhpParallelLint\GitLabOutput;
+use JakubOnderka\PhpParallelLint\CheckstyleOutput;
 use JakubOnderka\PhpParallelLint\IWriter;
 use JakubOnderka\PhpParallelLint\Result;
 use JakubOnderka\PhpParallelLint\SyntaxError;
@@ -46,6 +47,27 @@ class OutputTest extends Tester\TestCase
         }
     }
 
+    public function testCheckstyleOutput()
+    {
+        $errors = array(
+            new JakubOnderka\PhpParallelLint\SyntaxError(
+                'sample.php',
+                'Parse error: syntax error, unexpected \'"\' in ./sample.php on line 3'
+            ),
+        );
+
+        $result = new Result($errors, array(), array(), 0);
+        $writer = new TestWriter();
+        $output = new CheckstyleOutput($writer);
+
+        $output->writeResult($result, new ErrorFormatter(), true);
+        $xml = $writer->getLogs();
+        $parsed = @simplexml_load_string($xml);
+
+        Assert::contains("unexpected '&quot;'", $xml);
+        Assert::type('SimpleXMLElement', $parsed);
+    }
+
     public function getGitLabOutputData()
     {
         return array(