MAGETWO-45688: Reflected XSS in Cookie HTTP header

- Extended Zend escaper.
- Updated formKey to use zend's escape method.

Author: Hayder Sharhan

lib/internal/Magento/Framework/Data/Form/FormKey.php

@@ -52,7 +52,7 @@ public function getFormKey()
         if (!$this->isPresent()) {
             $this->set($this->mathRandom->getRandomString(16));
         }
-        return $this->escaper->escapeHtml($this->session->getData(self::FORM_KEY));
+        return $this->escaper->escapeHtmlAttr($this->session->getData(self::FORM_KEY));
     }
 
     /**

lib/internal/Magento/Framework/Data/Test/Unit/Form/FormKeyTest.php

@@ -38,7 +38,7 @@ protected function setUp()
         $methods = ['setData', 'getData'];
         $this->sessionMock = $this->getMock('Magento\Framework\Session\SessionManager', $methods, [], '', false);
         $this->escaperMock = $this->getMock('Magento\Framework\Escaper', [], [], '', false);
-        $this->escaperMock->expects($this->any())->method('escapeHtml')->willReturnArgument(0);
+        $this->escaperMock->expects($this->any())->method('escapeHtmlAttr')->willReturnArgument(0);
         $this->formKey = new FormKey(
             $this->mathRandomMock,
             $this->sessionMock,

lib/internal/Magento/Framework/Escaper.php

@@ -8,7 +8,7 @@
 /**
  * Magento escape methods
  */
-class Escaper
+class Escaper extends \Zend\Escaper\Escaper
 {
     /**
      * Escape html entities
@@ -103,4 +103,6 @@ public function escapeQuote($data, $addSlashes = false)
         }
         return htmlspecialchars($data, ENT_QUOTES, null, false);
     }
+
+
 }