Merge pull request #9370 from magento-cia/cia-2.4.8-beta2-develop-bugfix-11182024

Cia 2.4.8 beta2 develop bugfix 11182024

Author: pawan-adobe-security

app/code/Magento/Customer/Block/Adminhtml/Edit/Tab/View/Grid/Renderer/Item.php

@@ -3,6 +3,8 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
 namespace Magento\Customer\Block\Adminhtml\Edit\Tab\View\Grid\Renderer;
 
 use Magento\Catalog\Model\Product;
@@ -123,7 +125,8 @@ public function render(\Magento\Framework\DataObject $item)
         $this->setItem($item);
         $product = $this->getProduct();
         $options = $this->getOptionList();
-        return $options ? $this->_renderItemOptions($product, $options) : $this->escapeHtml($product->getName());
+        return $options ? $this->_renderItemOptions($product, $options)
+            : $this->_escaper->escapeHtml($product->getName());
     }
 
     /**
@@ -135,13 +138,13 @@ public function render(\Magento\Framework\DataObject $item)
      */
     protected function _renderItemOptions(Product $product, array $options)
     {
-        $html = '<div class="product-title">' . $this->escapeHtml(
+        $html = '<div class="product-title">' . $this->_escaper->escapeHtml(
             $product->getName()
         ) . '</div>' . '<dl class="item-options">';
         foreach ($options as $option) {
             $formattedOption = $this->getFormattedOptionValue($option);
-            $html .= '<dt>' . $this->escapeHtml($option['label']) . '</dt>';
-            $html .= '<dd>' . $formattedOption['value'] . '</dd>';
+            $html .= '<dt>' . $this->_escaper->escapeHtml($option['label']) . '</dt>';
+            $html .= '<dd>' . $this->_escaper->escapeHtml($formattedOption['value']) . '</dd>';
         }
         $html .= '</dl>';
 

app/code/Magento/Customer/Test/Unit/Block/Adminhtml/Edit/Tab/View/Grid/Renderer/ItemTest.php

@@ -115,6 +115,7 @@ public function testRender($amountOption, $expectedHtml)
      */
     public function optionHtmlProvider()
     {
+        //phpcs:disable
         return [
             [
                 2,
@@ -123,9 +124,9 @@ public function optionHtmlProvider()
                             <div class="product-title">testProductName</div>
                             <dl class="item-options">
                                 <dt>testLabel1</dt>
-                                <dd>1 x Configurable Product 49-option 3 <span class="price">$10.00</span></dd>
+                                <dd>1 x Configurable Product 49-option 3 &lt;span class="price"&gt;$10.00&lt;/span&gt;</dd>
                                 <dt>testLabel2</dt>
-                                <dd>1 x Configurable Product 49-option 3 <span class="price">$10.00</span></dd>
+                                <dd>1 x Configurable Product 49-option 3 &lt;span class="price"&gt;$10.00&lt;/span&gt;</dd>
                             </dl>
                         </xhtml>
 HTML
@@ -137,11 +138,11 @@ public function optionHtmlProvider()
                             <div class="product-title">testProductName</div>
                             <dl class="item-options">
                                 <dt>testLabel1</dt>
-                                <dd>1 x Configurable Product 49-option 3 <span class="price">$10.00</span></dd>
+                                <dd>1 x Configurable Product 49-option 3 &lt;span class="price"&gt;$10.00&lt;/span&gt;</dd>
                             </dl>
                         </xhtml>
 HTML
             ],
-        ];
+        ];//phpcs:enable
     }
 }

dev/tests/integration/testsuite/Magento/Customer/Block/Adminhtml/Edit/Tab/View/Grid/Renderer/AbstractItemTestCase.php

@@ -109,7 +109,7 @@ private function getOptionsValueXPath(Item $quoteItem): array
             if (isset($option['option_type'])
                 && $option['option_type'] == ProductCustomOptionInterface::OPTION_GROUP_FILE) {
                 $value = explode(" ", $option['print_value']);
-                $options[$key]['xpath'] .= "/a[contains(text(), '{$value[0]}')]";
+                $options[$key]['xpath'] .= "[contains(text(), '{$value[0]}')]";
             } else {
                 $options[$key]['xpath'] .= "[contains(text(), '{$option['value']}')]";
             }