symfony/symfony — pull request #11845 by jeremy-derusse (2014-09-03 21:00:23+00:00)
Title: Escape parameter on generated response

| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR | NA

If a template with an `` tag is configured with an URL containing a `'` (in `src` or `alt`) ; the HttpCache will generate invalide php code.

It's not a security issue, given the template and the `` tag is written by the developper, but, as the character quote is allowed in URL (https://tools.ietf.org/html/rfc3986) it coud be a potential bug.