fix(php): Escape $ in double-quoted string literals to prevent code injection

[peombwa]

Summary

Kiota's PHP writer emits schema-derived strings into PHP double-quoted literals using SanitizeDoubleQuote(), which escapes ", \, and control characters but not $. Because PHP evaluates $var, ${...}, and {$...} inside double-quoted strings, an attacker-controlled OpenAPI description (e.g. a media type like application/json${system('whoami && id')}) is emitted verbatim into the generated SDK source and executes arbitrary PHP/OS commands when the generated client runs.

This is a regression/coverage gap in the literal-injection hardening pass (#7603), which already added the equivalent $ escape for the Dart writer (Dart interpolates $ the same way). The PHP surface was missed.

Root cause

SanitizeForQuotedLiteral in StringExtensions.cs is language-agnostic and has no $ case, so $ falls through unescaped. The 2024 change that switched PHP enum values from single- to double-quotes (d472aeb2e) widened the exposure.

Fix

Add a PHP-specific SanitizePhpDoubleQuoteLiteral on PhpConventionService that runs the shared SanitizeDoubleQuote() and then escapes $ → \$, and route every PHP double-quoted emission site through it. This mirrors the existing SanitizeDartDoubleQuoteLiteral on DartConventionService exactly (same name pattern, signature, placement, and implementation), satisfying the project's cross-language consistency rule.

internal static string SanitizePhpDoubleQuoteLiteral(string? value) =>
    string.IsNullOrEmpty(value) ? string.Empty
        : value.SanitizeDoubleQuote().Replace("$", "\\$", StringComparison.Ordinal);

[Copilot]

Pull request overview

This PR hardens Kiota’s PHP code generator against generated-source injection / unintended PHP variable interpolation by ensuring schema-derived values emitted into PHP double-quoted string literals also escape $ (in addition to the existing SanitizeDoubleQuote() behavior).

Changes:

• Added PhpConventionService.SanitizePhpDoubleQuoteLiteral to escape $ after SanitizeDoubleQuote().
• Routed PHP writer emission sites that use double-quoted literals (enum wire values, request content-type, accept header, discriminator property name, and query-parameter annotation) through the new sanitizer.
• Added a regression test ensuring $ in enum wire values is emitted as \$ and not ${...}.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/Kiota.Builder.Tests/Writers/Php/CodeEnumWriterTests.cs	Adds regression coverage to ensure $ is escaped in generated PHP enum constants.
src/Kiota.Builder/Writers/Php/PhpConventionService.cs	Introduces PHP-specific double-quote literal sanitizer that escapes $ to prevent interpolation.
src/Kiota.Builder/Writers/Php/CodePropertyWriter.cs	Uses the new sanitizer for query-parameter annotation string content.
src/Kiota.Builder/Writers/Php/CodeMethodWriter.cs	Uses the new sanitizer for request body content-type, Accept header value, and discriminator property name string literals.
src/Kiota.Builder/Writers/Php/CodeEnumWriter.cs	Uses the new sanitizer when emitting enum wire values into double-quoted PHP literals.

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall coverage in the peombwa/fix-php-doll... branch is 71%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	peombwa/fix-php-doll... c93a400	+/-
/home/runner/wo...guageRefiner.cs	—	98%	—
/home/runner/wo...criptRefiner.cs	—	98%	—
/home/runner/wo...MethodWriter.cs	—	97%	—
/home/runner/wo...MethodWriter.cs	—	96%	—
/home/runner/wo...MethodWriter.cs	—	96%	—
/home/runner/wo...MethodWriter.cs	—	95%	—
/home/runner/wo...rs/GoRefiner.cs	—	93%	—
/home/runner/wo...KiotaBuilder.cs	—	90%	—
/home/runner/wo...ationService.cs	—	89%	—
/home/runner/wo...xGenerator.g.cs	—	72%	—

---

_{Code Coverage is in Public Preview. Learn more and provide us with your feedback.}