Add escaping to alt tags

magento · Feb 28, 2020 · 463c460 · 463c460
1 parent 56fde6c
commit 463c460
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 12 deletions.
diff --git a/app/code/Magento/Catalog/view/frontend/templates/product/image.phtml b/app/code/Magento/Catalog/view/frontend/templates/product/image.phtml
@@ -10,9 +10,9 @@
 ?>
 
 <img class="photo image <?= $escaper->escapeHtmlAttr($block->getClass()) ?>"
-     <?= $escaper->escapeHtml($block->getCustomAttributes()) ?>
-     src="<?= $escaper->escapeUrl($block->getImageUrl()) ?>"
-     loading="lazy"
-     width="<?= $escaper->escapeHtmlAttr($block->getWidth()) ?>"
-     height="<?= $escaper->escapeHtmlAttr($block->getHeight()) ?>"
-     alt="<?= /* @noEscape */ $block->stripTags($block->getLabel(), null, true) ?>" />
+    <?= $escaper->escapeHtml($block->getCustomAttributes()) ?>
+    src="<?= $escaper->escapeUrl($block->getImageUrl()) ?>"
+    loading="lazy"
+    width="<?= $escaper->escapeHtmlAttr($block->getWidth()) ?>"
+    height="<?= $escaper->escapeHtmlAttr($block->getHeight()) ?>"
+    alt="<?= $escaper->escapeHtmlAttr($block->getLabel()) ?>" />
diff --git a/app/code/Magento/Catalog/view/frontend/templates/product/image_with_borders.phtml b/app/code/Magento/Catalog/view/frontend/templates/product/image_with_borders.phtml
@@ -14,10 +14,10 @@
     <span class="product-image-wrapper"
           style="padding-bottom: <?= ($block->getRatio() * 100) ?>%;">
         <img class="<?= $escaper->escapeHtmlAttr($block->getClass()) ?>"
-             <?= $escaper->escapeHtmlAttr($block->getCustomAttributes()) ?>
-             src="<?= $escaper->escapeUrl($block->getImageUrl()) ?>"
-             loading="lazy"
-             width="<?= $escaper->escapeHtmlAttr($block->getWidth()) ?>"
-             height="<?= $escaper->escapeHtmlAttr($block->getHeight()) ?>"
-             alt="<?= /* @noEscape */ $block->stripTags($block->getLabel(), null, true) ?>"/></span>
+            <?= $escaper->escapeHtmlAttr($block->getCustomAttributes()) ?>
+            src="<?= $escaper->escapeUrl($block->getImageUrl()) ?>"
+            loading="lazy"
+            width="<?= $escaper->escapeHtmlAttr($block->getWidth()) ?>"
+            height="<?= $escaper->escapeHtmlAttr($block->getHeight()) ?>"
+            alt="<?= $escaper->escapeHtmlAttr($block->getLabel()) ?>"/></span>
 </span>