25
25
26
26
/**
27
27
* Context specific methods for use in secure output escaping
28
+ *
29
+ * @final
28
30
*/
29
31
class Escaper
30
32
{
@@ -49,7 +51,7 @@ class Escaper
49
51
* Current encoding for escaping. If not UTF-8, we convert strings from this encoding
50
52
* pre-escaping and back to this encoding post-escaping.
51
53
*
52
- * @var string
54
+ * @var non-empty- string
53
55
*/
54
56
protected $ encoding = 'utf-8 ' ;
55
57
@@ -88,7 +90,7 @@ class Escaper
88
90
/**
89
91
* List of all encoding supported by this class
90
92
*
91
- * @var array
93
+ * @var list<non-empty-string>
92
94
*/
93
95
protected $ supportedEncodings = [
94
96
'iso-8859-1 ' ,
@@ -131,6 +133,7 @@ class Escaper
131
133
* Constructor: Single parameter allows setting of global encoding for use by
132
134
* the current object.
133
135
*
136
+ * @param non-empty-string|null $encoding
134
137
* @throws Exception\InvalidArgumentException
135
138
*/
136
139
public function __construct (?string $ encoding = null )
@@ -159,25 +162,19 @@ public function __construct(?string $encoding = null)
159
162
// set matcher callbacks
160
163
$ this ->htmlAttrMatcher =
161
164
/** @param array<array-key, string> $matches */
162
- function (array $ matches ): string {
163
- return $ this ->htmlAttrMatcher ($ matches );
164
- };
165
+ fn (array $ matches ): string => $ this ->htmlAttrMatcher ($ matches );
165
166
$ this ->jsMatcher =
166
167
/** @param array<array-key, string> $matches */
167
- function (array $ matches ): string {
168
- return $ this ->jsMatcher ($ matches );
169
- };
168
+ fn (array $ matches ): string => $ this ->jsMatcher ($ matches );
170
169
$ this ->cssMatcher =
171
170
/** @param array<array-key, string> $matches */
172
- function (array $ matches ): string {
173
- return $ this ->cssMatcher ($ matches );
174
- };
171
+ fn (array $ matches ): string => $ this ->cssMatcher ($ matches );
175
172
}
176
173
177
174
/**
178
175
* Return the encoding that all output/input is expected to be encoded in.
179
176
*
180
- * @return string
177
+ * @return non-empty- string
181
178
*/
182
179
public function getEncoding ()
183
180
{
@@ -188,7 +185,7 @@ public function getEncoding()
188
185
* Escape a string for the HTML Body context where there are very few characters
189
186
* of special meaning. Internally this will use htmlspecialchars().
190
187
*
191
- * @return string
188
+ * @return ($ string is non-empty-string ? non-empty-string : string)
192
189
*/
193
190
public function escapeHtml (string $ string )
194
191
{
@@ -200,7 +197,7 @@ public function escapeHtml(string $string)
200
197
* to escape that are not covered by htmlspecialchars() to cover cases where an attribute
201
198
* might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE).
202
199
*
203
- * @return string
200
+ * @return ($ string is non-empty-string ? non-empty-string : string)
204
201
*/
205
202
public function escapeHtmlAttr (string $ string )
206
203
{
@@ -222,7 +219,7 @@ public function escapeHtmlAttr(string $string)
222
219
* Backslash escaping is not used as it still leaves the escaped character as-is and so
223
220
* is not useful in a HTML context.
224
221
*
225
- * @return string
222
+ * @return ($ string is non-empty-string ? non-empty-string : string)
226
223
*/
227
224
public function escapeJs (string $ string )
228
225
{
@@ -240,7 +237,7 @@ public function escapeJs(string $string)
240
237
* an entire URI - only a subcomponent being inserted. The function is a simple proxy
241
238
* to rawurlencode() which now implements RFC 3986 since PHP 5.3 completely.
242
239
*
243
- * @return string
240
+ * @return ($ string is non-empty-string ? non-empty-string : string)
244
241
*/
245
242
public function escapeUrl (string $ string )
246
243
{
@@ -251,7 +248,7 @@ public function escapeUrl(string $string)
251
248
* Escape a string for the CSS context. CSS escaping can be applied to any string being
252
249
* inserted into CSS and escapes everything except alphanumerics.
253
250
*
254
- * @return string
251
+ * @return ($ string is non-empty-string ? non-empty-string : string)
255
252
*/
256
253
public function escapeCss (string $ string )
257
254
{
0 commit comments