fix xss (#2060)

assets/js/plugins/KimaiFormSelect.js

@@ -130,29 +130,29 @@ export default class KimaiFormSelect extends KimaiPlugin {
         select.find('option').remove().end().find('optgroup').remove().end();
 
         if (emptyOption.length !== 0) {
-            select.append('<option value="">' + emptyOption.text() + '</option>');
+            select.append(this._createOption(emptyOption.text(), ''));
         }
 
-        let htmlOptions = '';
+        let emptyOpts = [];
-        let emptyOptions = '';
+        let options = [];
 
         for (const [key, value] of Object.entries(data)) {
             if (key === '__empty__') {
                 for (const entity of value) {
-                    emptyOptions +=  '<option value="' + entity.id + '">' + entity.name + '</option>';
+                    emptyOpts.push(this._createOption(entity.name, entity.id));
                 }
                 continue;
             }
 
-            htmlOptions += '<optgroup label="' + key + '">';
+            let optGroup = this._createOptgroup(key);
             for (const entity of value) {
-                htmlOptions +=  '<option value="' + entity.id + '">' + entity.name + '</option>';
+                optGroup.appendChild(this._createOption(entity.name, entity.id));
             }
-            htmlOptions += '</optgroup>';
+            options.push(optGroup);
         }
 
-        select.append(htmlOptions);
+        select.append(options);
-        select.append(emptyOptions);
+        select.append(emptyOpts);
 
         // if available, re-select the previous selected option (mostly usable for global activities)
         select.val(selectedValue);
@@ -165,4 +165,28 @@ export default class KimaiFormSelect extends KimaiPlugin {
             select.trigger('change.select2');
         }
     }
+
+    /**
+     * @param {string} label
+     * @param {string} value
+     * @returns {HTMLElement}
+     * @private
+     */
+    _createOption(label, value) {
+        let option = document.createElement('option');
+        option.innerText = label;
+        option.value = value;
+        return option;
+    }
+
+    /**
+     * @param {string} label
+     * @returns {HTMLElement}
+     * @private
+     */
+    _createOptgroup(label) {
+        let optGroup = document.createElement('optgroup');
+        optGroup.label = label;
+        return optGroup;
+    }
 }

public/build/entrypoints.json

@@ -5,7 +5,7 @@
         "build/runtime.098eaae1.js",
         "build/0.79dbdbb9.js",
         "build/1.32489d92.js",
-        "build/app.e7537426.js"
+        "build/app.dc6c3f34.js"
       ],
       "css": [
         "build/app.0325b7e0.css"
@@ -53,7 +53,7 @@
     "build/runtime.098eaae1.js": "sha384-xNNrNinl64G3nCUrIskgSjU0mUXXCB9lj6XCSInBTwxSKXk8uTMafnLHtdWdIGtd",
     "build/0.79dbdbb9.js": "sha384-U2Ao0ORAZ8PCeDmyRsqQFET3hc7pfUBimq0PrqFdG4/s0Bdi+qBj4TJK3o70bCd5",
     "build/1.32489d92.js": "sha384-wVkjh5FzjFhMV4S4uNP23E/OLBOf+Zi7t3lpm9eWzoMr/tm2pydT+q0Op1XHuoUP",
-    "build/app.e7537426.js": "sha384-VAGMhwYJVTYXW8aMLhwzJqKmiG/fTXhdNBQj+823jsWFKecz7J6RXmWDbS9uwcHy",
+    "build/app.dc6c3f34.js": "sha384-x36nGKgEWmvmvxXUeFIQFZohiVkBb6hh47nVsbu6sacnkMyhSaJrkjcCMB/GH2hi",
     "build/app.0325b7e0.css": "sha384-+e2X/+hgWNDL4q30jFlPjC+jD61G/j9nsyn+KO57Pakrq5XH5sjMuamVPtwgnDlG",
     "build/invoice.74279541.js": "sha384-2BXic5Sgorf2tXai6zSAN4wLY2dbg06L03/xMKW6itMcszvtnRArKzfBh6DNcF3f",
     "build/invoice.13d8ef4e.css": "sha384-B6RN/wZJToSBCZk2JeLokIqWEhbh+Eb9arYbt9dM+YoC2Z6PnCeTwTqSGyexWWJh",

public/build/manifest.json

@@ -3,7 +3,7 @@
   "build/1.32489d92.js": "build/1.32489d92.js",
   "build/2.7ab75d0a.js": "build/2.7ab75d0a.js",
   "build/app.css": "build/app.0325b7e0.css",
-  "build/app.js": "build/app.e7537426.js",
+  "build/app.js": "build/app.dc6c3f34.js",
   "build/calendar.css": "build/calendar.1408f57e.css",
   "build/calendar.js": "build/calendar.541a15eb.js",
   "build/chart.js": "build/chart.34d60a88.js",

src/Twig/Extensions.php

@@ -31,6 +31,7 @@ class Extensions extends AbstractExtension
             new TwigFilter('multiline_indent', [$this, 'multilineIndent']),
             new TwigFilter('color', [$this, 'color']),
             new TwigFilter('font_contrast', [$this, 'calculateFontContrastColor']),
+            new TwigFilter('nl2str', [$this, 'replaceNewline'], ['pre_escape' => 'html', 'is_safe' => ['html']]),
         ];
     }
 
@@ -113,4 +114,13 @@ class Extensions extends AbstractExtension
     {
         return Constants::HOMEPAGE . '/documentation/' . $url;
     }
+
+    public function replaceNewline($input, string $newline)
+    {
+        if (!\is_string($input)) {
+            return $input;
+        }
+
+        return str_replace(["\r\n", "\n", "\r"], $newline, $input);
+    }
 }

src/Twig/MarkdownExtension.php

@@ -43,9 +43,9 @@ final class MarkdownExtension extends AbstractExtension
     public function getFilters()
     {
         return [
-            new TwigFilter('md2html', [$this, 'markdownToHtml'], ['is_safe' => ['html']]),
+            new TwigFilter('md2html', [$this, 'markdownToHtml'], ['pre_escape' => 'html', 'is_safe' => ['html']]),
-            new TwigFilter('desc2html', [$this, 'timesheetContent'], ['is_safe' => ['html']]),
+            new TwigFilter('desc2html', [$this, 'timesheetContent'], ['pre_escape' => 'html', 'is_safe' => ['html']]),
-            new TwigFilter('comment2html', [$this, 'commentContent'], ['is_safe' => ['html']]),
+            new TwigFilter('comment2html', [$this, 'commentContent'], ['pre_escape' => 'html', 'is_safe' => ['html']]),
         ];
     }
 

templates/activity/delete.html.twig

@@ -9,24 +9,22 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%activity%': '<strong>' ~ activity.name ~ '</strong>',
+        '%activity%': activity.name,
-        '%project%': '<strong>-</strong>',
+        '%project%': '-',
-        '%customer%': '<strong>-</strong>',
+        '%customer%': '-',
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
+        '%records%': stats.recordAmount,
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%duration%': stats.recordDuration|duration
     } %}
 
     {% if activity.project is not null %}
         {% set params = params|merge({
-            '%project%': '<strong>' ~ activity.project.name ~ '</strong>',
+            '%project%': activity.project.name,
-            '%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
+            '%customer%': activity.project.customer.name,
         }) %}
     {% endif %}
 
-    {% set message = '<p>' ~ ("admin_activity.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_activity.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_activity')

templates/activity/embed_budget.html.twig

@@ -4,11 +4,11 @@
     {% block box_attributes %}id="budget_box"{% endblock %}
     {% block box_body %}
         {% set params = {
-            '%activity%': '<strong>' ~ activity.name ~ '</strong>',
+            '%activity%': activity.name,
-            '%project%': '<strong>-</strong>',
+            '%project%': '-',
-            '%customer%': '<strong>-</strong>',
+            '%customer%': '-',
-            '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
+            '%records%': stats.recordAmount,
-            '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+            '%duration%': stats.recordDuration|duration
         } %}
 
         {% set currency = null %}
@@ -18,17 +18,16 @@
 
         {% if activity.project is not null %}
             {% set params = params|merge({
-                '%project%': '<strong>' ~ activity.project.name ~ '</strong>',
+                '%project%': activity.project.name,
-                '%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
+                '%customer%': activity.project.customer.name,
             }) %}
         {% endif %}
 
         <p>
-            {{ 'admin_activity.short_stats'|trans(params)|raw }}
+            {{ 'admin_activity.short_stats'|trans(params) }}
             {{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
         </p>
 
-
         {{ progress.progressbar(activity.budget, stats.recordRate, 'label.budget'|trans, stats.recordRate|money(currency) ~ ' / ' ~ activity.budget|money(currency) ) }}
         {{ progress.progressbar(activity.timeBudget, stats.recordDuration, 'label.timeBudget'|trans, stats.recordDuration|duration ~ ' / ' ~ activity.timeBudget|duration ) }}
     {% endblock %}

templates/customer/delete.html.twig

@@ -9,17 +9,15 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%activity%': '<strong>' ~ stats.activityAmount ~ '</strong>',
+        '%activity%': stats.activityAmount,
-        '%project%': '<strong>' ~ stats.projectAmount ~ '</strong>',
+        '%project%': stats.projectAmount,
-        '%customer%': '<strong>' ~ customer.name ~ '</strong>',
+        '%customer%': customer.name,
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
+        '%records%': stats.recordAmount,
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%duration%': stats.recordDuration|duration
     } %}
 
-    {% set message = '<p>' ~ ("admin_customer.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_customer.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_customer')

templates/customer/embed_budget.html.twig

@@ -6,17 +6,17 @@
         {% set currency = customer.currency %}
 
         {% set params = {
-            '%activity%': '<strong>' ~ stats.activityAmount ~ '</strong>',
+            '%activity%': stats.activityAmount,
-            '%project%': '<strong>' ~ stats.projectAmount ~ '</strong>',
+            '%project%': stats.projectAmount,
-            '%customer%': '<strong>' ~ customer.name ~ '</strong>',
+            '%customer%': customer.name,
-            '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
+            '%records%': stats.recordAmount,
-            '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>',
+            '%duration%': stats.recordDuration|duration,
-            '%rate%': '<strong>' ~ stats.recordRate|money(currency) ~ '</strong>',
+            '%rate%': stats.recordRate|money(currency),
-            '%internal_rate%': '<strong>' ~ stats.recordInternalRate|money(currency) ~ '</strong>'
+            '%internal_rate%': stats.recordInternalRate|money(currency)
         } %}
 
         <p>
-            {{ 'admin_customer.short_stats'|trans(params)|raw }}
+            {{ 'admin_customer.short_stats'|trans(params) }}
             {{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
         </p>
 

templates/default/_form_delete.html.twig

@@ -13,7 +13,7 @@
                     {{ form_widget(form) }}
                 </div>
             {% else %}
-                <p>{{ message|raw }}</p>
+                <p>{{ message }}</p>
                 {{ form_widget(form) }}
             {% endif %}            
         {% endblock %}

templates/default/_form_delete_modal.html.twig

@@ -13,7 +13,7 @@
                 {{ form_widget(form) }}
             </div>
         {% else %}
-            <p>{{ message|raw }}</p>
+            <p>{{ message }}</p>
             {{ form_widget(form) }}
         {% endif %}
     {% endblock %}

templates/export/index.html.twig

@@ -116,7 +116,7 @@
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'activity') }}">{{ widgets.label_activity(entry.activity) }}</td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }}">
-                        {{ entry.description|escape|desc2html }}
+                        {{ entry.description|desc2html }}
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'unit_price') }}">
                         {{ rate|money(currency) }}

templates/export/pdf-layout.html.twig

@@ -263,7 +263,7 @@ mpdf-->
                     {{ entry.project.customer.name }} - {{ entry.project.name }}{% if entry.activity is not null %} - {{ entry.activity.name }}{% endif %}
                     {% if entry.description is not empty %}
                         <br>
-                        <i>{{ entry.description|escape|desc2html }}</i>
+                        <i>{{ entry.description|desc2html }}</i>
                     {% endif %}
                 </td>
                 <td class="duration">{{ entry.duration|duration(decimal) }}</td>

templates/export/renderer/default.html.twig

@@ -440,7 +440,7 @@
                         </td>
                         <td class="column-description" {% if not columns.description %}style="display: none"{% endif %}>
                             {% if entry.description is not empty %}
-                                {{ entry.description|escape|desc2html }}
+                                {{ entry.description|desc2html }}
                             {% endif %}
                         </td>
                         <td class="column-exported" {% if not columns.exported %}style="display: none"{% endif %}>

templates/invoice/index.html.twig

@@ -100,7 +100,7 @@
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
                         {% if entry.description is not empty %}
-                            {{ entry.description|escape|desc2html }}
+                            {{ entry.description|desc2html }}
                         {% endif %}
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'unit_price') }} text-center">{{ rate|money(currency) }}</td>

templates/invoice/renderer/default-pdf.pdf.twig

@@ -33,10 +33,10 @@
         <tr>
             <td>
                 <strong>{{ 'label.contact'|trans }}</strong>:
-                {{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+                {{ model.template.contact|nl2str(' &ndash; ') }}
                 <br>
                 <strong>{{ 'label.invoice_bank_account'|trans }}</strong>:
-                {{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+                {{ model.template.paymentDetails|nl2str(' &ndash; ') }}
             </td>
             <td align="right">
                 {{ 'export.page_of'|trans({'%page%': '{PAGENO}', '%pages%': '{nb}'}) }}
@@ -151,9 +151,9 @@ mpdf-->
     </table>
 
     {% if model.template.paymentTerms is not empty %}
-    <p>
+    <div class="paymentTerms">
         {{ model.template.paymentTerms|md2html }}
-    </p>
+    </div>
     {% endif %}
 </div>
 </body>

templates/invoice/renderer/default.html.twig

@@ -127,7 +127,7 @@
     <div class="col-xs-12">
         {% if model.template.paymentTerms is not empty %}
         <div contenteditable="true" class="paymentTerms">
-            {{ model.template.paymentTerms|nl2br|md2html }}
+            {{ model.template.paymentTerms|md2html }}
         </div>
         {% endif %}
     </div>
@@ -135,11 +135,11 @@
 
 <footer class="footer">
     <p>
-        <strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+        <strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}
         <br>
-        <strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+        <strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|nl2str(' &ndash; ') }}
         <br>
-        <strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+        <strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|nl2str(' &ndash; ') }}
     </p>
 </footer>
 {% endblock %}

templates/invoice/renderer/freelancer.html.twig

@@ -8,7 +8,7 @@
     <div class="col-xs-12">
         <header>
             <address>
-                <p contenteditable="true">{{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}</p>
+                <p contenteditable="true">{{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}</p>
             </address>
         </header>
         <article class="address">
@@ -108,7 +108,7 @@
         {% if model.template.paymentTerms is not empty %}
             <article class="paymentTerms">
                 <div contenteditable="true">
-                    {{ model.template.paymentTerms|nl2br|md2html }}
+                    {{ model.template.paymentTerms|md2html }}
                 </div>
             </article>
         {% endif %}

templates/project/delete.html.twig

@@ -9,17 +9,15 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%project%': '<strong>' ~ project.name ~ '</strong>',
+        '%project%': project.name,
-        '%customer%': '<strong>' ~ project.customer.name ~ '</strong>',
+        '%customer%': project.customer.name,
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
+        '%records%': stats.recordAmount,
-        '%activities%': '<strong>' ~ stats.activityAmount ~ '</strong>',
+        '%activities%': stats.activityAmount,
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%duration%': stats.recordDuration|duration
     } %}
 
-    {% set message = '<p>' ~ ("admin_project.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_project.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_project')

templates/project/embed_budget.html.twig

@@ -4,17 +4,17 @@
     {% block box_attributes %}id="budget_box"{% endblock %}
     {% block box_body %}
         {% set params = {
-            '%project%': '<strong>' ~ project.name ~ '</strong>',
+            '%project%': project.name,
-            '%customer%': '<strong>' ~ project.customer.name ~ '</strong>',
+            '%customer%': project.customer.name,
-            '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
+            '%records%': stats.recordAmount,
-            '%activities%': '<strong>' ~ stats.activityAmount ~ '</strong>',
+            '%activities%': stats.activityAmount,
-            '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+            '%duration%': stats.recordDuration|duration
         } %}
 
         {% set currency = project.customer.currency %}
 
         <p>
-            {{ 'admin_project.short_stats'|trans(params)|raw }}
+            {{ 'admin_project.short_stats'|trans(params) }}
             {{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
         </p>
 

templates/project/index.html.twig

@@ -45,7 +45,7 @@
             <tr{% if is_granted('view', entry) %} class="alternative-link open-edit" data-href="{{ path('project_details', {'id': entry.id}) }}"{% endif %}>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'name') }}">{{ widgets.label_color_dot('project', true, entry.name, null, entry.color) }}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'customer') }}">{{ widgets.label_customer(entry.customer) }}</td>
-                <td class="{{ tables.data_table_column_class(tableName, columns, 'comment') }}">{{ entry.comment|comment2html() }}</td>
+                <td class="{{ tables.data_table_column_class(tableName, columns, 'comment') }}">{{ entry.comment|comment2html }}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'orderNumber') }}">{{ entry.orderNumber }}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'orderDate') }}">{% if entry.orderDate is not null %}{{ entry.orderDate|date_full }}{% endif %}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'start') }}">{% if entry.start is not null %}{{ entry.start|date_full }}{% endif %}</td>

templates/timesheet/export.html.twig

@@ -61,7 +61,7 @@
                         <td>
                             {% if entry.description is not empty %}
                                 <div>
-                                    {{ entry.description|escape|desc2html }}
+                                    {{ entry.description|desc2html }}
                                 </div>
                             {% endif %}
                             <span class="small">

templates/timesheet/layout-listing.html.twig

@@ -144,7 +144,7 @@
                 </td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
                     {% if allowMarkdown %}
-                        {{ entry.description|escape|desc2html }}
+                        {{ entry.description|desc2html }}
                     {% else %}
                         {{ entry.description|nl2br }}
                     {% endif %}

templates/user/delete.html.twig

@@ -1,6 +1,5 @@
 {% extends app.request.xmlHttpRequest ? 'form.html.twig' : 'base.html.twig' %}
 {% import "macros/widgets.html.twig" as widgets %}
-{% import "macros/datatables.html.twig" as tables %}
 
 {% block page_title %}{{ 'admin_user.title'|trans }}{% endblock %}
 
@@ -9,15 +8,13 @@
     {% set inUse = (stats.recordsTotal > 0) %}
 
     {% set params = {
-        '%user%': '<strong>' ~ widgets.username(user) ~ '</strong>',
+        '%user%': widgets.username(user),
-        '%records%': '<strong>' ~ stats.recordsTotal ~ '</strong>',
+        '%records%': stats.recordsTotal,
-        '%duration%': '<strong>' ~ stats.durationTotal|duration ~ '</strong>'
+        '%duration%': stats.durationTotal|duration
     } %}
 
-    {% set message = '<p>' ~ ("admin_user.short_stats"|trans(params)|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': "admin_user.short_stats"|trans(params),
         'form': form,
         'used': inUse,
         'back': path('admin_user')

tests/Twig/ExtensionsTest.php

@@ -14,6 +14,7 @@ use App\Entity\Activity;
 use App\Entity\User;
 use App\Twig\Extensions;
 use PHPUnit\Framework\TestCase;
+use Twig\Node\Node;
 use Twig\TwigFilter;
 use Twig\TwigFunction;
 
@@ -29,7 +30,7 @@ class ExtensionsTest extends TestCase
 
     public function testGetFilters()
     {
-        $filters = ['docu_link', 'multiline_indent', 'color', 'font_contrast'];
+        $filters = ['docu_link', 'multiline_indent', 'color', 'font_contrast', 'nl2str'];
         $sut = $this->getSut();
         $twigFilters = $sut->getFilters();
         $this->assertCount(\count($filters), $twigFilters);
@@ -39,6 +40,11 @@ class ExtensionsTest extends TestCase
             $this->assertInstanceOf(TwigFilter::class, $filter);
             $this->assertEquals($filters[$i++], $filter->getName());
         }
+
+        // make sure that the nl2str filters does proper escaping
+        self::assertEquals('nl2str', $twigFilters[4]->getName());
+        self::assertEquals('html', $twigFilters[4]->getPreEscape());
+        self::assertEquals(['html'], $twigFilters[4]->getSafe(new Node()));
     }
 
     public function testGetFunctions()
@@ -162,4 +168,25 @@ sdfsdf' . PHP_EOL . "\n" .
         self::assertEquals(1, $sut->getIsoDayByName(''));
         self::assertEquals(1, $sut->getIsoDayByName('sdfgsdf'));
     }
+
+    public function getTestDataReplaceNewline()
+    {
+        yield [',', new \stdClass(), new \stdClass()];
+        yield [',', null, null];
+        yield [',', '', ''];
+        yield ['*', PHP_EOL, '*'];
+        yield [',', 'foo' . PHP_EOL . 'bar', 'foo,bar'];
+        yield [' – ', 'foo' . PHP_EOL . 'bar', 'foo – bar'];
+        yield [' – ', "foo\r\nbar\rtest\nhello", 'foo – bar – test – hello'];
+    }
+
+    /**
+     * @dataProvider getTestDataReplaceNewline
+     */
+    public function testReplaceNewline(string $replacer, $input, $expected)
+    {
+        $sut = $this->getSut();
+
+        self::assertEquals($expected, $sut->replaceNewline($input, $replacer));
+    }
 }

tests/Twig/MarkdownExtensionTest.php

@@ -14,6 +14,7 @@ use App\Configuration\TimesheetConfiguration;
 use App\Twig\MarkdownExtension;
 use App\Utils\Markdown;
 use PHPUnit\Framework\TestCase;
+use Twig\Node\Node;
 
 /**
  * @covers \App\Twig\MarkdownExtension
@@ -27,9 +28,21 @@ class MarkdownExtensionTest extends TestCase
         $sut = new MarkdownExtension(new Markdown(), $config);
         $filters = $sut->getFilters();
         $this->assertCount(3, $filters);
+
+        // make sure that the md2html filter does proper escaping
         $this->assertEquals('md2html', $filters[0]->getName());
+        self::assertEquals('html', $filters[0]->getPreEscape());
+        self::assertEquals(['html'], $filters[0]->getSafe(new Node()));
+
+        // make sure that the desc2html filter does proper escaping
         $this->assertEquals('desc2html', $filters[1]->getName());
+        self::assertEquals('html', $filters[1]->getPreEscape());
+        self::assertEquals(['html'], $filters[1]->getSafe(new Node()));
+
+        // make sure that the comment2html filter does proper escaping
         $this->assertEquals('comment2html', $filters[2]->getName());
+        self::assertEquals('html', $filters[2]->getPreEscape());
+        self::assertEquals(['html'], $filters[2]->getSafe(new Node()));
     }
 
     public function testMarkdownToHtml()