Merge pull request #728 from flightphp/fix-ghsa-r8g9-view-e

fix: escape single quotes in View::e()

flight/template/View.php

@@ -191,7 +191,7 @@ class View
      */
     public function e(string $str): string
     {
-        $value = \htmlentities($str);
+        $value = \htmlentities($str, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
         echo $value;
         return $value;
     }

tests/ViewTest.php

@@ -133,6 +133,17 @@ class ViewTest extends TestCase
         $this->assertEquals('script', $result);
     }
 
+    public function testEEscapesSingleQuote(): void
+    {
+        $expected = htmlentities("'", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+
+        $this->expectOutputString($expected);
+        $result = $this->view->e("'");
+
+        $this->assertEquals($expected, $result);
+        $this->assertEquals(''', $result);
+    }
+
     public function testNormalizePath(): void
     {
         $viewMock = new class extends View