From 2d982b0f32311b942c763463edc001acc93ba71c Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun, 23 Aug 2026 13:39:24 -0400
Subject: [PATCH 1/2] Use consistent HTML escaping in error details fragment

The exception message and trace in renderExceptionFragment() used bare
htmlentities(), whose default flags differ across PHP versions and
inherit the default_charset ini, while the title and description are
escaped with explicit ENT_QUOTES | ENT_SUBSTITUTE flags and a pinned
UTF-8 charset. Align the fragment escaping with the same explicit call
so behavior is identical on every supported PHP version.
---
 Slim/Error/Renderers/HtmlErrorRenderer.php | 11 ++++++++---
 tests/Error/AbstractErrorRendererTest.php  | 17 +++++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/Slim/Error/Renderers/HtmlErrorRenderer.php b/Slim/Error/Renderers/HtmlErrorRenderer.php
index 58f5b5630..75af44837 100644
--- a/Slim/Error/Renderers/HtmlErrorRenderer.php
+++ b/Slim/Error/Renderers/HtmlErrorRenderer.php
@@ -14,7 +14,6 @@
 use Throwable;
 
 use function get_class;
-use function htmlentities;
 use function htmlspecialchars;
 use function sprintf;
 
@@ -51,14 +50,20 @@ private function renderExceptionFragment(Throwable $exception): string
         $code = $exception->getCode();
         $html .= sprintf('<div><strong>Code:</strong> %s</div>', $code);
 
-        $html .= sprintf('<div><strong>Message:</strong> %s</div>', htmlentities($exception->getMessage()));
+        $html .= sprintf(
+            '<div><strong>Message:</strong> %s</div>',
+            htmlspecialchars($exception->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
+        );
 
         $html .= sprintf('<div><strong>File:</strong> %s</div>', $exception->getFile());
 
         $html .= sprintf('<div><strong>Line:</strong> %s</div>', $exception->getLine());
 
         $html .= '<h2>Trace</h2>';
-        $html .= sprintf('<pre>%s</pre>', htmlentities($exception->getTraceAsString()));
+        $html .= sprintf(
+            '<pre>%s</pre>',
+            htmlspecialchars($exception->getTraceAsString(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
+        );
 
         return $html;
     }
diff --git a/tests/Error/AbstractErrorRendererTest.php b/tests/Error/AbstractErrorRendererTest.php
index f47fee4c8..e71d2b259 100644
--- a/tests/Error/AbstractErrorRendererTest.php
+++ b/tests/Error/AbstractErrorRendererTest.php
@@ -74,6 +74,23 @@ public function testHTMLErrorRendererRenderFragmentMethod()
         $this->assertMatchesRegularExpression('/.*Line*/', $output);
     }
 
+    public function testHTMLErrorRendererEscapesQuotesInErrorDetails()
+    {
+        $exception = new Exception("O'Brien <script>");
+        $renderer = new HtmlErrorRenderer();
+        $reflectionRenderer = new ReflectionClass(HtmlErrorRenderer::class);
+
+        $method = $reflectionRenderer->getMethod('renderExceptionFragment');
+        $this->setAccessible($method);
+        $output = $method->invoke($renderer, $exception);
+
+        $this->assertStringContainsString(
+            htmlspecialchars("O'Brien <script>", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+            $output,
+            'Message must be HTML-escaped including quotes'
+        );
+    }
+
     public function testHTMLErrorRendererRenderHttpException()
     {
         $exceptionTitle = 'title';

From d6d2d28430304c66e26e1706e97806e1a0a261bd Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun, 23 Aug 2026 16:08:58 -0400
Subject: [PATCH 2/2] Escape remaining HTML error fragment fields

File, Type, Code, and Line were interpolated into the details fragment
without escaping. File paths and anonymous class names can contain HTML
metacharacters, and Throwable::getCode() is untyped. Route every fragment
field through the same htmlspecialchars() flags as title and description.
---
 Slim/Error/Renderers/HtmlErrorRenderer.php | 37 +++++-------
 tests/Error/AbstractErrorRendererTest.php  | 65 ++++++++++++++++++++--
 2 files changed, 74 insertions(+), 28 deletions(-)

diff --git a/Slim/Error/Renderers/HtmlErrorRenderer.php b/Slim/Error/Renderers/HtmlErrorRenderer.php
index 75af44837..e9064ad0c 100644
--- a/Slim/Error/Renderers/HtmlErrorRenderer.php
+++ b/Slim/Error/Renderers/HtmlErrorRenderer.php
@@ -32,11 +32,7 @@ public function __invoke(Throwable $exception, bool $displayErrorDetails): strin
             $html .= '<h2>Details</h2>';
             $html .= $this->renderExceptionFragment($exception);
         } else {
-            $description = htmlspecialchars(
-                $this->getErrorDescription($exception),
-                ENT_QUOTES | ENT_SUBSTITUTE,
-                'UTF-8'
-            );
+            $description = $this->escapeHtml($this->getErrorDescription($exception));
             $html = "<p>{$description}</p>";
         }
 
@@ -45,32 +41,25 @@ public function __invoke(Throwable $exception, bool $displayErrorDetails): strin
 
     private function renderExceptionFragment(Throwable $exception): string
     {
-        $html = sprintf('<div><strong>Type:</strong> %s</div>', get_class($exception));
-
-        $code = $exception->getCode();
-        $html .= sprintf('<div><strong>Code:</strong> %s</div>', $code);
-
-        $html .= sprintf(
-            '<div><strong>Message:</strong> %s</div>',
-            htmlspecialchars($exception->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
-        );
-
-        $html .= sprintf('<div><strong>File:</strong> %s</div>', $exception->getFile());
-
-        $html .= sprintf('<div><strong>Line:</strong> %s</div>', $exception->getLine());
-
+        $html = sprintf('<div><strong>Type:</strong> %s</div>', $this->escapeHtml(get_class($exception)));
+        $html .= sprintf('<div><strong>Code:</strong> %s</div>', $this->escapeHtml((string) $exception->getCode()));
+        $html .= sprintf('<div><strong>Message:</strong> %s</div>', $this->escapeHtml($exception->getMessage()));
+        $html .= sprintf('<div><strong>File:</strong> %s</div>', $this->escapeHtml($exception->getFile()));
+        $html .= sprintf('<div><strong>Line:</strong> %s</div>', $this->escapeHtml((string) $exception->getLine()));
         $html .= '<h2>Trace</h2>';
-        $html .= sprintf(
-            '<pre>%s</pre>',
-            htmlspecialchars($exception->getTraceAsString(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
-        );
+        $html .= sprintf('<pre>%s</pre>', $this->escapeHtml($exception->getTraceAsString()));
 
         return $html;
     }
 
+    private function escapeHtml(string $text): string
+    {
+        return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+    }
+
     public function renderHtmlBody(string $title = '', string $html = ''): string
     {
-        $title = htmlspecialchars($title, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+        $title = $this->escapeHtml($title);
 
         return sprintf(
             '<!doctype html>' .
diff --git a/tests/Error/AbstractErrorRendererTest.php b/tests/Error/AbstractErrorRendererTest.php
index e71d2b259..d0bc97fc1 100644
--- a/tests/Error/AbstractErrorRendererTest.php
+++ b/tests/Error/AbstractErrorRendererTest.php
@@ -21,10 +21,18 @@
 use Slim\Tests\TestCase;
 use stdClass;
 
+use function bin2hex;
+use function file_put_contents;
+use function get_class;
 use function htmlspecialchars;
 use function json_decode;
 use function json_encode;
+use function mkdir;
+use function random_bytes;
+use function rmdir;
 use function simplexml_load_string;
+use function sys_get_temp_dir;
+use function unlink;
 
 use const ENT_QUOTES;
 use const ENT_SUBSTITUTE;
@@ -76,7 +84,19 @@ public function testHTMLErrorRendererRenderFragmentMethod()
 
     public function testHTMLErrorRendererEscapesQuotesInErrorDetails()
     {
-        $exception = new Exception("O'Brien <script>");
+        $unsafe = "O'Brien <script>";
+        $escaped = htmlspecialchars($unsafe, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+
+        $exception = new class ($unsafe) extends Exception {
+            public function __construct(string $unsafe)
+            {
+                parent::__construct($unsafe, 0);
+                $this->file = '/tmp/' . $unsafe . '.php';
+                $this->code = "SQL'" . $unsafe;
+                $this->line = 7;
+            }
+        };
+
         $renderer = new HtmlErrorRenderer();
         $reflectionRenderer = new ReflectionClass(HtmlErrorRenderer::class);
 
@@ -84,11 +104,48 @@ public function testHTMLErrorRendererEscapesQuotesInErrorDetails()
         $this->setAccessible($method);
         $output = $method->invoke($renderer, $exception);
 
+        $this->assertStringNotContainsString($unsafe, $output);
+        $this->assertStringContainsString($escaped, $output);
         $this->assertStringContainsString(
-            htmlspecialchars("O'Brien <script>", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
-            $output,
-            'Message must be HTML-escaped including quotes'
+            htmlspecialchars('/tmp/' . $unsafe . '.php', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+            $output
         );
+        $this->assertStringContainsString(
+            htmlspecialchars("SQL'" . $unsafe, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+            $output
+        );
+        $this->assertStringContainsString('<div><strong>Line:</strong> 7</div>', $output);
+    }
+
+    public function testHTMLErrorRendererEscapesAnonymousClassType()
+    {
+        $unsafe = "O'Brien <script>";
+        $dir = sys_get_temp_dir() . '/slim-html-' . bin2hex(random_bytes(4));
+        $unsafeDir = $dir . '/' . $unsafe;
+        mkdir($unsafeDir, 0700, true);
+        $file = $unsafeDir . '/anon.php';
+        file_put_contents($file, '<?php return new class extends Exception {};');
+
+        try {
+            /** @var Exception $exception */
+            $exception = require $file;
+            $renderer = new HtmlErrorRenderer();
+            $reflectionRenderer = new ReflectionClass(HtmlErrorRenderer::class);
+
+            $method = $reflectionRenderer->getMethod('renderExceptionFragment');
+            $this->setAccessible($method);
+            $output = $method->invoke($renderer, $exception);
+
+            $this->assertStringNotContainsString($unsafe, $output);
+            $this->assertStringContainsString(
+                htmlspecialchars(get_class($exception), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'),
+                $output
+            );
+        } finally {
+            unlink($file);
+            rmdir($unsafeDir);
+            rmdir($dir);
+        }
     }
 
     public function testHTMLErrorRendererRenderHttpException()