@@ -69,9 +69,9 @@ public function testEscapeJsEscapesOwaspRecommendedRanges()
69
69
// Exceptions to escaping ranges
70
70
$ immune = [', ' , '. ' , '_ ' ];
71
71
for ($ chr = 0 ; $ chr < 0xFF ; $ chr ++) {
72
- if ($ chr >= 0x30 && $ chr <= 0x39
73
- || $ chr >= 0x41 && $ chr <= 0x5A
74
- || $ chr >= 0x61 && $ chr <= 0x7A
72
+ if (( $ chr >= 0x30 && $ chr <= 0x39 )
73
+ || ( $ chr >= 0x41 && $ chr <= 0x5A )
74
+ || ( $ chr >= 0x61 && $ chr <= 0x7A )
75
75
) {
76
76
$ literal = $ this ->codepointToUtf8 ($ chr );
77
77
$ this ->assertEquals ($ literal , $ this ->escaper ->escapeJs ($ literal ));
@@ -171,6 +171,11 @@ public function escapeHtmlDataProvider()
171
171
'data ' => '&<>" \'&<>"'	 ' ,
172
172
'expected ' => '&<>"'&<>"'	 '
173
173
],
174
+ 'text with special characters and allowed tag ' => [
175
+ 'data ' => '&<br/>" \'&<>"'	 ' ,
176
+ 'expected ' => '&<br>"'&<>"'	 ' ,
177
+ 'allowedTags ' => ['br ' ],
178
+ ],
174
179
'text with multiple allowed tags, includes self closing tag ' => [
175
180
'data ' => '<span>some text in tags<br /></span> ' ,
176
181
'expected ' => '<span>some text in tags<br></span> ' ,
0 commit comments