MDL-75516 core: Perform proper JSON encoding in mustache quote helper

lib/amd/src/templates.js

@@ -592,7 +592,7 @@ function(
     };
 
     /**
-     * Quote helper used to wrap content in quotes, and escape all quotes present in the content.
+     * Quote helper used to wrap content in quotes, and escape all special JSON characters present in the content.
      *
      * @method quoteHelper
      * @private
@@ -604,15 +604,11 @@ function(
     Renderer.prototype.quoteHelper = function(context, sectionText, helper) {
         var content = helper(sectionText.trim(), context);
 
-        // Escape the {{ and the ".
+        // Escape the {{ and JSON encode.
         // This involves wrapping {{, and }} in change delimeter tags.
-        content = content
-            .replace(/"/g, '\\"')
-            .replace(/\t/g, '	')
-            .replace(/([{}]{2,3})/g, '{{=<% %>=}}$1<%={{ }}=%>')
-            .replace(/(\r\n|\r|\n)/g, '&#x0a;')
-            ;
-        return '"' + content + '"';
+        content = JSON.stringify(content);
+        content = content.replace(/([{}]{2,3})/g, '{{=<% %>=}}$1<%={{ }}=%>');
+        return content;
     };
 
     /**

lib/classes/output/mustache_quote_helper.php

@@ -15,7 +15,7 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 /**
- * Wrap content in quotes, and escape all quotes used.
+ * Wrap content in quotes, and escape all special JSON characters used.
  *
  * @package    core
  * @category   output
@@ -26,7 +26,7 @@
 namespace core\output;
 
 /**
- * Wrap content in quotes, and escape all quotes used.
+ * Wrap content in quotes, and escape all special JSON characters used.
  *
  * @copyright  2016 Andrew Nicols <[email protected]>
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
@@ -34,22 +34,21 @@ namespace core\output;
 class mustache_quote_helper {
 
     /**
-     * Wrap content in quotes, and escape all quotes used.
+     * Wrap content in quotes, and escape all special JSON characters used.
      *
      * Note: This helper is only compatible with the standard {{ }} delimeters.
      *
      * @param string $text The text to parse for arguments.
-     * @param Mustache_LambdaHelper $helper Used to render nested mustache variables.
+     * @param \Mustache_LambdaHelper $helper Used to render nested mustache variables.
      * @return string
      */
     public function quote($text, \Mustache_LambdaHelper $helper) {
-        // Split the text into an array of variables.
         $content = trim($text);
         $content = $helper->render($content);
 
-        // Escape the {{ and the ".
-        $content = str_replace('"', '\\"', $content);
+        // Escape the {{ and JSON encode.
+        $content = json_encode($content);
         $content = preg_replace('([{}]{2,3})', '{{=<% %>=}}${0}<%={{ }}=%>', $content);
-        return '"' . $content . '"';
+        return $content;
     }
 }

lib/tests/output/mustache_quote_helper_test.php

@@ -0,0 +1,86 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+declare(strict_types=1);
+
+namespace core\output;
+
+/**
+ * Unit tests for the mustache_quote_helper class.
+ *
+ * @package   core
+ * @category  test
+ * @copyright 2022 TU Berlin
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @coversDefaultClass \core\output\mustache_quote_helper
+ */
+class mustache_quote_helper_test extends \basic_testcase {
+
+    /**
+     * Tests the quote helper
+     *
+     * @covers ::quote
+     */
+    public function test_quote() {
+        $engine = new \Mustache_Engine();
+        $context = new \Mustache_Context([
+            'world' => '{{planet}}',
+            'planet' => '<earth>'
+        ]);
+        $lambdahelper = new \Mustache_LambdaHelper($engine, $context);
+
+        $quotehelper = new mustache_quote_helper();
+
+        // Simple string.
+        $this->assertEquals('"Hello world!"', $quotehelper->quote('Hello world!', $lambdahelper));
+
+        // Special JSON characters in string.
+        $this->assertEquals(
+            '"Hello \\"world\\"! (\\b,\\f,\\n,\\r,\\t,\\\\)"',
+            $quotehelper->quote('Hello "world"! (' . chr(8) . ",\f,\n,\r,\t,\\)", $lambdahelper)
+        );
+
+        // Double curly braces in string.
+        $this->assertEquals(
+            '"Hello {{=<% %>=}}{{<%={{ }}=%>world{{=<% %>=}}}}<%={{ }}=%>!"',
+            $quotehelper->quote('{{=<% %>=}}Hello {{world}}!<%={{ }}=%>', $lambdahelper)
+        );
+
+        // Triple curly braces in string.
+        $this->assertEquals(
+            '"Hello {{=<% %>=}}{{{<%={{ }}=%>world{{=<% %>=}}}}}<%={{ }}=%>!"',
+            $quotehelper->quote('{{=<% %>=}}Hello {{{world}}}!<%={{ }}=%>', $lambdahelper)
+        );
+
+        // Variable interpolation with double braces.
+        $this->assertEquals(
+            '"Hello &lt;earth&gt;!"',
+            $quotehelper->quote('Hello {{planet}}!', $lambdahelper)
+        );
+
+        // Variable interpolation with triple braces.
+        $this->assertEquals(
+            '"Hello <earth>!"',
+            $quotehelper->quote('Hello {{{planet}}}!', $lambdahelper)
+        );
+
+        // Variables interpolated only once.
+        $this->assertEquals(
+            '"Hello {{=<% %>=}}{{<%={{ }}=%>planet{{=<% %>=}}}}<%={{ }}=%>!"',
+            $quotehelper->quote('Hello {{world}}!', $lambdahelper)
+        );
+    }
+}