修复调试模式下 $key 未编码导致的异常页面XSS问题

2026-07-01 12:42:48 +08:00 · 2024-04-11 10:40:58 +08:00
parent 3883e15817
commit c79fdd579e
1 changed files with 1 additions and 1 deletions
--- a/tpl/think_exception.tpl
+++ b/tpl/think_exception.tpl
@@ -68,7 +68,7 @@
                        break;
                }

-                $result[] = is_int($key) ? $value : "'{$key}' => {$value}";
+                $result[] = is_int($key) ? $value : sprintf('\'%s\' => %s', htmlentities($key), $value);
            }

            return implode(', ', $result);