{"action":"closed","issue":{"url":"https://api.github.com/repos/zendframework/zend-escaper/issues/2","repository_url":"https://api.github.com/repos/zendframework/zend-escaper","labels_url":"https://api.github.com/repos/zendframework/zend-escaper/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/zendframework/zend-escaper/issues/2/comments","events_url":"https://api.github.com/repos/zendframework/zend-escaper/issues/2/events","html_url":"https://github.com/zendframework/zend-escaper/issues/2","id":94816882,"number":2,"title":"HtmlAttr, Js, and Css escapers fail for characters outside the BMP","user":{"login":"zerocrates","id":298975,"avatar_url":"https://avatars.githubusercontent.com/u/298975?v=3","gravatar_id":"","url":"https://api.github.com/users/zerocrates","html_url":"https://github.com/zerocrates","followers_url":"https://api.github.com/users/zerocrates/followers","following_url":"https://api.github.com/users/zerocrates/following{/other_user}","gists_url":"https://api.github.com/users/zerocrates/gists{/gist_id}","starred_url":"https://api.github.com/users/zerocrates/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zerocrates/subscriptions","organizations_url":"https://api.github.com/users/zerocrates/orgs","repos_url":"https://api.github.com/users/zerocrates/repos","events_url":"https://api.github.com/users/zerocrates/events{/privacy}","received_events_url":"https://api.github.com/users/zerocrates/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/zendframework/zend-escaper/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2015-07-13T21:33:48Z","updated_at":"2016-06-30T19:48:22Z","closed_at":"2016-06-30T19:48:22Z","body":"For an example, take the character \"🍥\" (FISH CAKE WITH SWIRL DESIGN, U+1F365)\r\n\r\nescapeHtml, since it uses htmlspecialchars, just passes this through unchanged.\r\n\r\nOn the other hand, escapeHtmlAttr internally tries to convert it to UTF-16 big-endian, resulting in the sequence `D83CDF65` and a final output of `&#xD83CDF65;`. That's not a valid HTML character reference for anything. The correct character reference in this case would be `&#x1F365;`.\r\n\r\nWhat it looks like is happening is that the escaper code always assumes that converting to UTF-16 will be always be sufficient to return a direct codepoint value as required for an HTML entity, but that's not correct. Characters from beyond the Basic Multilingual Plane will be encoded in UTF-16 as a surrogate pair. The incorrect attempt to print this result is how you get the crazy 8-hex-digit value instead of the appropriate 5 digits for the \"fish cake\" example.\r\n\r\nIt's possible to instead convert the input into UTF-32BE, which doesn't use surrogate pairs for any Unicode codepoint. The rest of the logic used by escapeHtmlAttr should then work fine."}}
{"actor":{"display_login":"weierophinney"}}