newInstanceWithoutConstructor(); return $template->escape($value); } public function test_non_ascii_is_left_alone(): void { $this->assertSame('Müller', $this->escape('Müller')); $this->assertSame('Ä Ö Ü ä ö ü ß', $this->escape('Ä Ö Ü ä ö ü ß')); $this->assertStringNotContainsString( 'ü', $this->escape('Müller'), 'Umlauts must not be turned into named entities (#3636)' ); } public function test_xss_relevant_characters_are_still_escaped(): void { $this->assertSame('<script>alert(1)</script>', $this->escape('')); $this->assertSame('" onerror="alert(1)', $this->escape('" onerror="alert(1)')); $this->assertSame('' onmouseover='x', $this->escape("' onmouseover='x")); $this->assertSame('a < b & c > d', $this->escape('a < b & c > d')); } public function test_ampersand_is_escaped_exactly_once(): void { // The double-escape the user actually saw came from & being encoded here and again // by Blade. One pass here must produce exactly one &. $this->assertSame('Müller & Söhne', $this->escape('Müller & Söhne')); } public function test_null_is_an_empty_string(): void { $this->assertSame('', $this->escape(null)); } }