Add new escaping methods from Magento 2.2 to XSS sniff whitelist

magento / marketplace-eqp

Magento 1.x Coding Standard

MIT License

224 stars 68 forks source link

Closed schmengler closed 6 years ago

schmengler commented 6 years ago

escapeHtmlAttr is already allowed because it contains "Html"

schmengler commented 6 years ago

I also added getJsLayout() because it returns JSON which does not need additional escaping in JS context, where it is used.

For a future PR, it would be nice to allow all methods that contain "Js" or "Json", just like all methods containing "Html" are allowed.

lenaorobei commented 6 years ago

Thank you @schmengler!