Escape doctrine entries (#657)

* Escape doctrine entries

* Add PDO browsertest

demo/bridge/doctrine/index.php

@@ -12,7 +12,8 @@
 $product = new Demo\Product();
 $product->setName("foobar");
 
+
 $entityManager->persist($product);
 $entityManager->flush();
-
+$entityManager->createQuery("select p from Demo\\Product p where p.name=:c")->setParameter("c", "<script>alert();</script>")->execute();
 render_demo_page();

demo/pdo.php

@@ -19,6 +19,10 @@
 $stmt->execute(array('foo'));
 $foo = $stmt->fetch();
 
+$stmt = $pdo->prepare('select * from users where name=?');
+$stmt->execute(array('<script>alert();</script>'));
+$foo = $stmt->fetch();
+
 $pdo->exec('delete from users');
 
 render_demo_page();

src/DebugBar/Bridge/DoctrineCollector.php

@@ -60,7 +60,7 @@ public function collect()
  foreach ($this->debugStack->queries as $q) {
  $queries[] = array(
  'sql' => $q['sql'],
- 'params' => (object) $q['params'],
+ 'params' => (object) $this->getParameters($q),
  'duration' => $q['executionMS'],
  'duration_str' => $this->formatDuration($q['executionMS'])
  );
@@ -75,6 +75,20 @@ public function collect()
  );
  }
 
+ /**
+ * Returns an array of parameters used with the query
+ *
+ * @return array
+ */
+ public function getParameters($query) : array
+ {
+ $params = [];
+ foreach ($query['params'] as $name => $param) {
+ $params[$name] = htmlentities($param?:"", ENT_QUOTES, 'UTF-8', false);
+ }
+ return $params;
+ }
+
  /**
  * @return string
  */

tests/DebugBar/Tests/Browser/Bridge/DoctrineTest.php

@@ -33,7 +33,7 @@ public function testMonologCollector(): void
  });
 
  $this->assertEquals('INSERT INTO products (name) VALUES (?)', $statements[1]);
- $this->assertCount(3, $statements);
+ $this->assertCount(4, $statements);
  }
 
 }

tests/DebugBar/Tests/Browser/PdoTest.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace DebugBar\Tests\Browser;
+
+use DebugBar\Browser\Bridge\WebDriverElement;
+
+class PdoTest extends AbstractBrowserTest
+{
+ public function testMonologCollector(): void
+ {
+ $client = static::createPantherClient();
+
+ $client->request('GET', '/demo/pdo.php');
+
+ // Wait for Debugbar to load
+ $crawler = $client->waitFor('.phpdebugbar-body');
+ usleep(1000);
+
+ if (!$this->isTabActive($crawler, 'database')) {
+ $client->click($this->getTabLink($crawler, 'database'));
+ }
+
+ $crawler = $client->waitForVisibility('.phpdebugbar-panel[data-collector=database]');
+
+ $statements = $crawler->filter('.phpdebugbar-panel[data-collector=database] .phpdebugbar-widgets-sql')
+ ->each(function($node){
+ return $node->getText();
+ });
+
+ $this->assertEquals('insert into users (name) values (?)', $statements[1]);
+ $this->assertCount(7, $statements);
+ }
+
+}