Add helper method to use implode() with HTML escaping

ChangeLog

@@ -38,6 +38,7 @@ Bug fixes:
 
 * Upload files button stay disabled when there are other submit buttons on the same page
 * Hiding subtasks from hidden tasks in dashboard
+* Avoid potential XSS in project overview when listing users (was avoided by default CSP rules)
 
 Version 1.0.39 (Feb 12, 2017)
 -----------------------------

app/Helper/TextHelper.php

@@ -24,6 +24,19 @@ class TextHelper extends Base
         return htmlspecialchars($value, ENT_QUOTES, 'UTF-8', false);
     }
 
+    /**
+     * Join with HTML escaping
+     *
+     * @param  $glue
+     * @param  array $list
+     * @return string
+     */
+    public function implode($glue, array $list)
+    {
+        array_walk($list, function (&$value) { $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8', false); });
+        return implode($glue, $list);
+    }
+
     /**
      * Markdown transformation
      *

app/Template/project_overview/information.php

@@ -13,8 +13,8 @@
                     <?php foreach ($roles as $role => $role_name): ?>
                         <?php if (isset($users[$role])): ?>
                             <li>
-                                <?= $role_name ?>:
+                                <?= $this->text->e($role_name) ?>:
-                                <strong><?= implode(', ', $users[$role]) ?></strong>
+                                <strong><?= $this->text->implode(', ', $users[$role]) ?></strong>
                             </li>
                         <?php endif ?>
                     <?php endforeach ?>

tests/units/Helper/TextHelperTest.php

@@ -9,6 +9,13 @@ use Kanboard\Model\UserModel;
 
 class TextHelperTest extends Base
 {
+    public function testImplode()
+    {
+        $textHelper = new TextHelper($this->container);
+        $html = '<img src=x onerror=alert(0)>';
+        $this->assertEquals($html, $textHelper->implode(', ', array('<img src=x onerror=alert(0)>')));
+    }
+
     public function testMarkdownTaskLink()
     {
         $textHelper = new TextHelper($this->container);