MC-33404: Incorrect display of file name in import history

Author: StasKozar

app/code/Magento/ImportExport/Block/Adminhtml/Grid/Column/Renderer/Download.php

@@ -20,9 +20,9 @@ class Download extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\Text
      */
     public function _getValue(\Magento\Framework\DataObject $row)
     {
-        return '<p> ' . $row->getData('imported_file') .  '</p><a href="'
-        . $this->getUrl('*/*/download', ['filename' => $row->getData('imported_file')]) . '">'
-        . __('Download')
+        return '<p> ' . $this->escapeHtml($row->getData('imported_file')) .  '</p><a href="'
+        . $this->escapeUrl($this->getUrl('*/*/download', ['filename' => $row->getData('imported_file')])) . '">'
+        . $this->escapeHtml(__('Download'))
         . '</a>';
     }
 }

app/code/Magento/ImportExport/Block/Adminhtml/Grid/Column/Renderer/Error.php

@@ -22,9 +22,9 @@ public function _getValue(\Magento\Framework\DataObject $row)
     {
         $result = '';
         if ($row->getData('error_file') != '') {
-            $result = '<p> ' . $row->getData('error_file') .  '</p><a href="'
-                . $this->getUrl('*/*/download', ['filename' => $row->getData('error_file')]) . '">'
-                . __('Download')
+            $result = '<p> ' . $this->escapeHtml($row->getData('error_file')) .  '</p><a href="'
+                . $this->escapeUrl($this->getUrl('*/*/download', ['filename' => $row->getData('error_file')])) . '">'
+                . $this->escapeHtml(__('Download'))
                 . '</a>';
         }
         return $result;

app/code/Magento/ImportExport/Test/Unit/Block/Adminhtml/Grid/Column/Renderer/DownloadTest.php

@@ -5,12 +5,20 @@
  */
 namespace Magento\ImportExport\Test\Unit\Block\Adminhtml\Grid\Column\Renderer;
 
+use Magento\Backend\Block\Context;
+use Magento\Backend\Model\Url;
+use Magento\Framework\DataObject;
+use Magento\Framework\Escaper;
 use Magento\Framework\TestFramework\Unit\Helper\ObjectManager as ObjectManagerHelper;
+use Magento\ImportExport\Block\Adminhtml\Grid\Column\Renderer\Download;
 
+/**
+ * Test for \Magento\ImportExport\Block\Adminhtml\Grid\Column\Renderer\Download class.
+ */
 class DownloadTest extends \PHPUnit\Framework\TestCase
 {
     /**
-     * @var \Magento\Backend\Block\Context
+     * @var Context
      */
     protected $context;
 
@@ -20,24 +28,31 @@ class DownloadTest extends \PHPUnit\Framework\TestCase
     protected $objectManagerHelper;
 
     /**
-     * @var \Magento\ImportExport\Block\Adminhtml\Grid\Column\Renderer\Download
+     * @var Download
      */
     protected $download;
 
+    /**
+     * @var Escaper|\PHPUnit_Framework_MockObject_MockObjecti
+     */
+    private $escaperMock;
+
     /**
      * Set up
      */
     protected function setUp()
     {
-        $urlModel = $this->createPartialMock(\Magento\Backend\Model\Url::class, ['getUrl']);
+        $this->escaperMock = $this->createMock(Escaper::class);
+        $urlModel = $this->createPartialMock(Url::class, ['getUrl']);
         $urlModel->expects($this->any())->method('getUrl')->willReturn('url');
-        $this->context = $this->createPartialMock(\Magento\Backend\Block\Context::class, ['getUrlBuilder']);
+        $this->context = $this->createPartialMock(Context::class, ['getUrlBuilder', 'getEscaper']);
         $this->context->expects($this->any())->method('getUrlBuilder')->willReturn($urlModel);
+        $this->context->expects($this->any())->method('getEscaper')->willReturn($this->escaperMock);
         $data = [];
 
         $this->objectManagerHelper = new ObjectManagerHelper($this);
         $this->download = $this->objectManagerHelper->getObject(
-            \Magento\ImportExport\Block\Adminhtml\Grid\Column\Renderer\Download::class,
+            Download::class,
             [
                 'context' => $this->context,
                 'data' => $data
@@ -51,7 +66,16 @@ protected function setUp()
     public function testGetValue()
     {
         $data = ['imported_file' => 'file.csv'];
-        $row = new \Magento\Framework\DataObject($data);
+        $row = new DataObject($data);
+        $this->escaperMock->expects($this->at(0))
+            ->method('escapeHtml')
+            ->with('file.csv')
+            ->willReturn('file.csv');
+        $this->escaperMock->expects($this->once())->method('escapeUrl')->willReturn('url');
+        $this->escaperMock->expects($this->at(2))
+            ->method('escapeHtml')
+            ->with('Download')
+            ->willReturn('Download');
         $this->assertEquals('<p> file.csv</p><a href="url">Download</a>', $this->download->_getValue($row));
     }
 }