Do not escape $css() with escapeHtmlAttr() but escapeHtml()

Author: jissereitsma

view/base/templates/component/messages.phtml

@@ -10,7 +10,7 @@ use Loki\CssUtils\Util\CssClass;
 /** @var CssClass $css */
 ?>
 <div
-    class="<?= $escaper->escapeHtmlAttr($css('container mx-auto py-3')) ?>"
+    class="<?= $escaper->escapeHtml($css('container mx-auto py-3')) ?>"
     x-data="LokiMessagesComponent" x-cloak x-show="hasMessages">
     <template x-for="message in messages">
         <div
@@ -19,17 +19,17 @@ use Loki\CssUtils\Util\CssClass;
             @dblclick="removeMessage"
             @keyup.escape.window="removeMessage"
             x-autoremove="timeout"
-            class="<?= $escaper->escapeHtmlAttr($css('message', 'message')) ?>"
+            class="<?= $escaper->escapeHtml($css('message', 'message')) ?>"
             :class="message.type">
             <div
-                class="<?= $escaper->escapeHtmlAttr($css('inline-block', 'message-text')) ?>"
+                class="<?= $escaper->escapeHtml($css('inline-block', 'message-text')) ?>"
                 x-html="message.text"
             ></div>
             <button
                 :data-message-type="message.type"
                 :data-message-text="message.text"
                 @click.prevent="removeMessage"
-                class="<?= $escaper->escapeHtmlAttr($css('close', 'button')) ?>">
+                class="<?= $escaper->escapeHtml($css('close', 'button')) ?>">
                 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512" width="20" height="20"><path d="M342.6 150.6c12.5-12.5 12.5-32.8 0-45.3s-32.8-12.5-45.3 0L192 210.7 86.6 105.4c-12.5-12.5-32.8-12.5-45.3 0s-12.5 32.8 0 45.3L146.7 256 41.4 361.4c-12.5 12.5-12.5 32.8 0 45.3s32.8 12.5 45.3 0L192 301.3 297.4 406.6c12.5 12.5 32.8 12.5 45.3 0s12.5-32.8 0-45.3L237.3 256 342.6 150.6z"/></svg>
             </button>
         </div>

view/base/templates/container.phtml

@@ -10,6 +10,6 @@ use Magento\Framework\View\Element\Template;
 /** @var Template $block */
 /** @var CssClass $css */
 ?>
-<div class="<?= $escaper->escapeHtmlAttr($css('')) ?>">
+<div class="<?= $escaper->escapeHtml($css('')) ?>">
     <?= /* @noEscape */ $block->getChildHtml(); ?>
 </div>

view/base/templates/message/exception.phtml

@@ -15,7 +15,7 @@ use Magento\Framework\View\Element\Template;
 <details>
     <summary><?= $escaper->escapeHtml($block->getMessage()) ?></summary>
     [<?= $escaper->escapeHtml($block->getFile()) ?> line <?= (int)$block->getLine() ?>]<br/>
-    <code class="<?= $escaper->escapeHtmlAttr($css('block mt-4 text-sm', 'trace')) ?>">
+    <code class="<?= $escaper->escapeHtml($css('block mt-4 text-sm', 'trace')) ?>">
         <?php foreach ($block->getTrace() as $trace): ?>
             <?= $escaper->escapeHtml($trace) ?><br/>
         <?php endforeach; ?>