A simple invalid 2 octet sequence can cause an exception (which then …

[Saeven]

A change is necessary to prevent routine penetration tests, or user-land attacks from causing critical exceptions. Users shouldn't be able to craft malicious input that causes 500s when using components such as Zend Form.

Did my best to eyeball formatting conventions, phpcs is in a panic with the given config.

Debug added as second arg to ctor; but could separately be moved into (or complemented by) a setDebug method.

[Ocramius]

Closing as inapplicable

[Ocramius]

This is not dangerous behavior: it is documented and expected behavior.

Passing around an empty string when an invalid value to escape is passed in can cause much more serious issues.

[Ocramius]

No, please remove this. If you want to run an escaper in debug mode, subclass the Escaper and implement something like:

class DebugEscaper extends \Zend\Escaper\Escaper
{
    public function escapeHtml($toEscape) { return 'ESCAPED-HTML-START' . $toEscape . 'ESCAPED-HTML-END'; }
}

[weierophinney]

@Ocramius For context, please see the related issue in zend-form:

• Prevent AbstractHelper from attempting to output malformed user input zend-form#193

I asked @Saeven to open the issue here, because it is applicable, and there's a generalized issue in escapeHtmlAttr() when malformed UTF-8 is present for the value.

The fix is needed; the question is whether the approach here is correct, or needs revisions.

[Ocramius]

@weierophinney we will bring the issue offline first and discuss it. The original issue is clear, the fix is not valid though, and the default behavior is correct, while this particular patch would only provide a new attack surface.

Invalid values do need to crash systems by default, as otherwise:

• bugs go unnoticed
• logic execution continues even with invalid output (think legal documents/PDFs with unexpected blank fields, for example, and the chaos that causes later on)

[weierophinney]

@Ocramius Just now catching up on the Slack discussion and zend-form discussion; I reacted hastily.