yiisoft/yii — pull request #1552 by resurtm (2012-10-09 16:34:00+00:00)
Title: Fixed potential vulnerability in CJavaScript::encode(): $safe parameter didn't used to be passed to the recursive method calls

Let's assume situation where we're building JS library to be used together with some widget:

```php

options,true);
Yii::app()->getClientScript()->registerScript('TestWidget','(function() {
new testWidget('.$options.');
})();');
echo CHtml::tag('div',array('id'=>'testWidget'));
}
}

$this->widget('TestWidget',array('options'=>array(
'value1'=>'js:function() { alert("insecure JS function, which comes from user, #1"); }',
'value2'=>new CJavaScriptExpression('function() { alert("secure JS function, which comes from developer, #2"); }'),
)));
?>
```

Resulting JS generated AFTER applying patch provided in this PR:

```js
new testWidget({'value1':'js:function() { alert(\"insecure JS function, which comes from user, #1\"); }','value2':function() { alert("secure JS function, which comes from developer, #2"); }});
```

And BEFORE (even CJavaScript::encode() were called with $safe equal to true):

```js
new testWidget({'value1':function() { alert("insecure JS function, which comes from user, #1"); },'value2':function() { alert("secure JS function, which comes from developer, #2"); }});
```