Add escaping of template code

Author: jissereitsma

view/adminhtml/templates/grid/columns-selector.phtml

@@ -23,43 +23,43 @@ $state = $viewModel->getState();
 <div class="admin__action-dropdown-wrap admin__data-grid-action-columns">
     <button class="admin__action-dropdown" type="button" @click="toggleColumnsSelector">
         <span class="admin__action-dropdown-text">
-            <?= __('Columns') ?>
+            <?= $escaper->escapeHtml(__('Columns')) ?>
         </span>
     </button>
     <div class="admin__action-dropdown-menu admin__data-grid-action-columns-menu _overflow" x-show="showColumnsSelector">
         <div class="admin__action-dropdown-menu-header">
-            <?= __(
+            <?= $escaper->escapeHtml(__(
                 '%1 out of %1 visible',
                 count($columns),
                 count($availableColumns),
-            ) ?>
+            )) ?>
         </div>
         <div class="admin__action-dropdown-menu-content">
             <?php foreach($availableColumns as $name => $column): ?>
             <div class="admin__field-option">
                 <input
                     class="admin__control-checkbox"
                     type="checkbox"
-                    id="col-<?= $column->getCode() ?>"
-                    data-column="<?= $column->getCode() ?>"
+                    id="col-<?= $escaper->escapeHtml($column->getCode()) ?>"
+                    data-column="<?= $escaper->escapeHtml($column->getCode()) ?>"
                     :checked="isColumnActive"
                     @change="toggleActiveColumn"
                 >
-                <label class="admin__field-label" for="col-<?= $column->getCode() ?>">
-                    <?= $column->getLabel() ?>
+                <label class="admin__field-label" for="col-<?= $escaper->escapeHtml($column->getCode()) ?>">
+                    <?= $escaper->escapeHtml($column->getLabel()) ?>
                 </label>
             </div>
             <?php endforeach; ?>
         </div>
         <div class="admin__action-dropdown-menu-footer">
             <div class="admin__action-dropdown-footer-secondary-actions">
                 <button class="action-tertiary" type="button">
-                    <?= __('Reset') ?>
+                    <?= $escaper->escapeHtml(__('Reset')) ?>
                 </button>
             </div>
             <div class="admin__action-dropdown-footer-main-actions">
                 <button class="action-tertiary" type="button" @click="toggleColumnsSelector">
-                    <?= __('Cancel') ?>
+                    <?= $escaper->escapeHtml(__('Cancel')) ?>
                 </button>
             </div>
         </div>

view/adminhtml/templates/grid/filters.phtml

@@ -44,8 +44,8 @@ if (empty($gridFilters)) {
                 <span class="condition-type"><?= $escaper->escapeHtml($gridFilterState->getConditionType()) ?></span>
                 <span class="preview"><?= $escaper->escapeHtml($gridFilterState->renderValue()) ?></span>
 
-                <button class="action-remove" type="button" @click="removeFilter" data-field="<?= $gridFilterState->getField() ?>">
-                    <span><?= __('Remove') ?></span>
+                <button class="action-remove" type="button" @click="removeFilter" data-field="<?= $escaper->escapeHtml($gridFilterState->getField()) ?>">
+                    <span><?= $escaper->escapeHtml(__('Remove')) ?></span>
                 </button>
             </li>
             <?php endforeach; ?>
@@ -67,16 +67,16 @@ if (empty($gridFilters)) {
         <div class="admin__footer-main-actions">
             <?php if (!empty($gridFilterStates)): ?>
             <button class="action-tertiary" type="button" @click="clearFilters">
-                <span><?= __('Clear all') ?></span>
+                <span><?= $escaper->escapeHtml(__('Clear all')) ?></span>
             </button>
             <?php endif; ?>
 
             <button class="action-tertiary" type="button" data-action="grid-filter-cancel" @click="toggleFilters">
-                <span><?= __('Cancel') ?></span>
+                <span><?= $escaper->escapeHtml(__('Cancel')) ?></span>
             </button>
 
             <button class="action-secondary" type="button" data-action="grid-filter-apply" @click="applyFilters">
-                <span><?= __('Apply Filters') ?></span>
+                <span><?= $escaper->escapeHtml(__('Apply Filters')) ?></span>
             </button>
         </div>
     </div>