Remove ComponentAttributeFactory and inject EscaperRuntime directly

Author: smnandre

CHANGELOG.md

@@ -1,11 +1,17 @@
 # CHANGELOG
 
+## 2.25.1
+
+-   [SECURITY] `ComponentAttributes` now requires a `Twig\Runtime\EscaperRuntime`
+    instance as second argument
+-   Remove `HtmlAttributeEscaperInterface`, `TwigHtmlAttributeEscaper` and `ComponentAttributesFactory`
+
 ## 2.25.0
 
 -   [SECURITY] Make `ComponentAttributes` responsible for attribute escaping ensuring
-    consistent and secure HTML output across all rendering contexts.
+    consistent and secure HTML output across all rendering contexts
 -   Deprecate not passing an `HtmlAttributeEscaperInterface` to the `ComponentAttributes`
-    constructor.
+    constructor
 
 ## 2.20.0
 

src/ComponentAttributes.php

@@ -12,8 +12,8 @@
 namespace Symfony\UX\TwigComponent;
 
 use Symfony\UX\StimulusBundle\Dto\StimulusAttributes;
-use Symfony\UX\TwigComponent\Escaper\HtmlAttributeEscaperInterface;
 use Symfony\WebpackEncoreBundle\Dto\AbstractStimulusDto;
+use Twig\Runtime\EscaperRuntime;
 
 /**
  * @author Kevin Bond <kevinbond@gmail.com>
@@ -29,19 +29,13 @@ final class ComponentAttributes implements \Stringable, \IteratorAggregate, \Cou
     /** @var array<string,true> */
     private array $rendered = [];
 
-    private readonly ?HtmlAttributeEscaperInterface $escaper;
-
     /**
      * @param array<string, string|bool> $attributes
      */
     public function __construct(
         private array $attributes,
-        ?HtmlAttributeEscaperInterface $escaper = null,
+        private readonly EscaperRuntime $escaper,
     ) {
-        // Third argument used as internal flag to prevent multiple deprecations
-        if ((null === $this->escaper = $escaper) && 3 > func_num_args()) {
-            trigger_deprecation('symfony/ux-twig-component', '2.24', 'Not passing an "%s" to "%s" is deprecated and will throw in 3.0.', HtmlAttributeEscaperInterface::class, self::class);
-        }
     }
 
     public function __toString(): string
@@ -87,13 +81,17 @@ public function __toString(): string
             // - special syntax names (Vue.js, Svelte, Alpine.js, ...)
             //      v-*, x-*, @*, :*
             if (!ctype_alpha(str_replace(['-', '_', ':', '@', '.'], '', $key))) {
-                $key = $this->escaper?->escapeName($key) ?? $key;
+                $key = (string) $this->escaper->escape($key, 'html_attr');
             }
 
             if (true === $value) {
                 $attributes .= ' '.$key;
             } else {
-                $attributes .= ' '.\sprintf('%s="%s"', $key, $this->escaper?->escapeValue($value) ?? $value);
+                if (!ctype_alnum(str_replace(['-', '_'], '', $value))) {
+                    $value = $this->escaper->escape($value, 'html');
+                }
+
+                $attributes .= ' '.\sprintf('%s="%s"', $key, $value);
             }
         }
 
@@ -167,7 +165,7 @@ public function defaults(iterable $attributes): self
             unset($attributes[$attribute]);
         }
 
-        return new self($attributes, $this->escaper, true);
+        return new self($attributes, $this->escaper);
     }
 
     /**
@@ -183,7 +181,7 @@ public function only(string ...$keys): self
             }
         }
 
-        return new self($attributes, $this->escaper, true);
+        return new self($attributes, $this->escaper);
     }
 
     /**
@@ -221,7 +219,7 @@ public function add($stimulusDto): self
         )));
         unset($controllersAttributes['data-controller']);
 
-        $clone = new self($attributes, $this->escaper, true);
+        $clone = new self($attributes, $this->escaper);
 
         // add the remaining attributes for values/classes
         return $clone->defaults($controllersAttributes);
@@ -233,7 +231,7 @@ public function remove($key): self
 
         unset($attributes[$key]);
 
-        return new self($attributes, $this->escaper, true);
+        return new self($attributes, $this->escaper);
     }
 
     public function nested(string $namespace): self
@@ -249,7 +247,7 @@ public function nested(string $namespace): self
             }
         }
 
-        return new self($attributes, $this->escaper, true);
+        return new self($attributes, $this->escaper);
     }
 
     public function getIterator(): \Traversable

src/ComponentAttributesFactory.php

@@ -17,6 +17,8 @@
 use Symfony\Contracts\Service\ResetInterface;
 use Symfony\UX\TwigComponent\Event\PostMountEvent;
 use Symfony\UX\TwigComponent\Event\PreMountEvent;
+use Twig\Environment;
+use Twig\Runtime\EscaperRuntime;
 
 /**
  * @author Kevin Bond <kevinbond@gmail.com>
@@ -38,7 +40,7 @@ public function __construct(
         private EventDispatcherInterface $eventDispatcher,
         private array $config,
         private readonly array $classMap,
-        private ComponentAttributesFactory $componentAttributesFactory,
+        private readonly Environment $twig,
     ) {
     }
 
@@ -120,7 +122,7 @@ public function mountFromObject(object $component, array $data, ComponentMetadat
         return new MountedComponent(
             $componentMetadata->getName(),
             $component,
-            $this->componentAttributesFactory->create([...$attributes, ...$data]),
+            new ComponentAttributes([...$attributes, ...$data], $this->twig->getRuntime(EscaperRuntime::class)),
             $originalData,
             $postMount->getExtraMetadata(),
         );

src/ComponentFactory.php

@@ -30,7 +30,6 @@
 use Symfony\UX\TwigComponent\Attribute\AsTwigComponent;
 use Symfony\UX\TwigComponent\CacheWarmer\TwigComponentCacheWarmer;
 use Symfony\UX\TwigComponent\Command\TwigComponentDebugCommand;
-use Symfony\UX\TwigComponent\ComponentAttributesFactory;
 use Symfony\UX\TwigComponent\ComponentFactory;
 use Symfony\UX\TwigComponent\ComponentProperties;
 use Symfony\UX\TwigComponent\ComponentRenderer;
@@ -93,7 +92,7 @@ static function (ChildDefinition $definition, AsTwigComponent $attribute) {
                 new Reference('event_dispatcher'),
                 new AbstractArgument(\sprintf('Added in %s.', TwigComponentPass::class)),
                 new AbstractArgument(\sprintf('Added in %s.', TwigComponentPass::class)),
-                new Reference('ux.twig_component.component_attributes_factory'),
+                new Reference('twig'),
             ])
             ->addTag('kernel.reset', ['method' => 'reset'])
         ;
@@ -108,12 +107,6 @@ static function (ChildDefinition $definition, AsTwigComponent $attribute) {
             ])
         ;
 
-        $container->register('ux.twig_component.component_attributes_factory', ComponentAttributesFactory::class)
-            ->setArguments([
-                new Reference('twig'),
-            ])
-        ;
-
         $container->register('ux.twig_component.component_renderer', ComponentRenderer::class)
             ->setArguments([
                 new Reference('twig'),