Chore: Theme - Replace Block Escaping with Escaper

app/code/Magento/Theme/view/adminhtml/templates/browser/content/files.phtml

@@ -3,22 +3,26 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
-/** @var $block \Magento\Theme\Block\Adminhtml\Wysiwyg\Files\Content\Files */
-?>
+use Magento\Framework\Escaper;
+use Magento\Theme\Block\Adminhtml\Wysiwyg\Files\Content\Files;
 
+/** @var Escaper $escaper */
+/** @var Files $block */
+?>
 <?php if ($block->getFilesCount() > 0) : ?>
     <?php foreach ($block->getFiles() as $file) : ?>
-        <div class="filecnt file-font" id="<?= $block->escapeHtmlAttr($file['id']) ?>">
+        <div class="filecnt file-font" id="<?= $escaper->escapeHtmlAttr($file['id']) ?>">
             <p class="nm">
-                <?= $block->escapeHtml($file['text']) ?>
+                <?= $escaper->escapeHtml($file['text']) ?>
                 <?php if (isset($file['thumbnailParams'])) : ?>
-                    <img src="<?= $block->escapeUrl($block->getUrl('*/*/previewImage', $file['thumbnailParams'])) ?>"
-                         alt="<?= $block->escapeHtmlAttr(__('thumbnail')) ?>">
+                    <img src="<?= $escaper->escapeUrl($block->getUrl('*/*/previewImage', $file['thumbnailParams'])) ?>"
+                         alt="<?= $escaper->escapeHtmlAttr(__('thumbnail')) ?>">
                 <?php endif; ?>
             </p>
         </div>
     <?php endforeach; ?>
 <?php else : ?>
-    <?= $block->escapeHtml(__('We found no files.')) ?>
+    <?= $escaper->escapeHtml(__('We found no files.')) ?>
 <?php endif; ?>

app/code/Magento/Theme/view/adminhtml/templates/browser/content/uploader.phtml

@@ -3,17 +3,23 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+use Magento\Framework\View\Helper\SecureHtmlRenderer;
+use Magento\Theme\Block\Adminhtml\Wysiwyg\Files\Content\Uploader;
+
+/** @var Escaper $escaper */
+/** @var Uploader $block */
+/** @var SecureHtmlRenderer $secureRenderer */
 
 // phpcs:disable PHPCompatibility.Miscellaneous.RemovedAlternativePHPTags.MaybeASPOpenTagFound
-/** @var $block \Magento\Theme\Block\Adminhtml\Wysiwyg\Files\Content\Uploader */
-/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
 ?>
-
 <div id="<?= $block->getHtmlId() ?>" class="uploader">
     <span class="fileinput-button form-buttons">
-        <span><?= $block->escapeHtml(__('Browse Files')) ?></span>
-        <input id="fileupload" type="file" name="<?= $block->escapeHtmlAttr($block->getConfig()->getFileField()) ?>"
-            data-url="<?= $block->escapeUrl($block->getConfig()->getUrl()) ?>" multiple>
+        <span><?= $escaper->escapeHtml(__('Browse Files')) ?></span>
+        <input id="fileupload" type="file" name="<?= $escaper->escapeHtmlAttr($block->getConfig()->getFileField()) ?>"
+            data-url="<?= $escaper->escapeUrl($block->getConfig()->getUrl()) ?>" multiple>
     </span>
     <div class="clear"></div>
     <script id="<?= $block->getHtmlId() ?>-template" type="text/x-magento-template">
@@ -47,7 +53,7 @@ require([
             form_key: FORM_KEY
         },
         sequentialUploads: true,
-        maxFileSize: {$block->escapeJs($block->getFileSizeService()->getMaxFileSize())} ,
+        maxFileSize: {$escaper->escapeJs($block->getFileSizeService()->getMaxFileSize())} ,
         add: function (e, data) {
             var progressTmpl = mageTemplate('#{$block->getHtmlId()}-template'),
                 fileSize,

app/code/Magento/Theme/view/adminhtml/templates/design/config/edit/scope.phtml

@@ -3,11 +3,15 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
-/* @var $block \Magento\Theme\Block\Adminhtml\Design\Config\Edit\Scope */
-?>
+use Magento\Framework\Escaper;
+use Magento\Theme\Block\Adminhtml\Design\Config\Edit\Scope;
 
+/** @var Escaper $escaper */
+/* @var Scope $block */
+?>
 <div class="store-view">
-    <span class="store-switcher-label"><?= $block->escapeHtml(__('Scope:')) ?></span>
-    <span class="store-switcher-value"><?= $block->escapeHtml($block->getScopeTitle()) ?></span>
+    <span class="store-switcher-label"><?= $escaper->escapeHtml(__('Scope:')) ?></span>
+    <span class="store-switcher-value"><?= $escaper->escapeHtml($block->getScopeTitle()) ?></span>
 </div>

app/code/Magento/Theme/view/adminhtml/templates/tabs/css.phtml

@@ -3,12 +3,16 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
-/**
- * @var $block \Magento\Theme\Block\Adminhtml\System\Design\Theme\Edit\Tab\Css
- * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
- */
-?>
+declare(strict_types=1);
 
+use Magento\Framework\Escaper;
+use Magento\Framework\View\Helper\SecureHtmlRenderer;
+use Magento\Theme\Block\Adminhtml\System\Design\Theme\Edit\Tab\Css;
+
+/** @var Escaper $escaper */
+/** @var Css $block */
+/** @var SecureHtmlRenderer $secureRenderer */
+?>
 <?= $block->getFormHtml() ?>
 
 <?php $scriptString = <<<script
@@ -23,7 +27,7 @@ require([
     $( '#css_file_uploader' ).fileupload({
         dataType: 'json',
         replaceFileInput: false,
-        url : '{$block->escapeJs($block->getUrl('*/system_design_theme/uploadcss'))}',
+        url : '{$escaper->escapeJs($block->getUrl('*/system_design_theme/uploadcss'))}',
         acceptFileTypes: /(.|\/)(css)$/i,
 
         /**

app/code/Magento/Theme/view/adminhtml/templates/tabs/fieldset/js.phtml

@@ -3,17 +3,21 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
-// phpcs:disable PHPCompatibility.Miscellaneous.RemovedAlternativePHPTags.MaybeASPOpenTagFound
-/**
- * @var $block \Magento\Backend\Block\Widget\Form\Renderer\Fieldset
- * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
- */
+use Magento\Backend\Block\Widget\Form\Renderer\Fieldset;
+use Magento\Framework\Escaper;
+use Magento\Framework\Json\Helper\Data;
+use Magento\Framework\View\Helper\SecureHtmlRenderer;
 
-/** @var \Magento\Framework\Json\Helper\Data $jsonHelper */
+/** @var Escaper $escaper */
+/** @var SecureHtmlRenderer $secureRenderer */
+/** @var Fieldset $block */
+/** @var Data $jsonHelper */
 $jsonHelper = $block->getData('jsonHelper');
-?>
 
+// phpcs:disable PHPCompatibility.Miscellaneous.RemovedAlternativePHPTags.MaybeASPOpenTagFound
+?>
 <div id="js-file-uploader" class="uploader">
 </div>
 <script id="js-file-uploader-template" type="text/x-magento-template">
@@ -42,7 +46,7 @@ $jsonHelper = $block->getData('jsonHelper');
                 id="remove_js_files_<%- data.id %>"
                 name="js_removed_files[]"
                 value="<%- data.id %>" />
-            <label for="remove_js_files_<%- data.id %>"><?= $block->escapeHtml(__('Remove')) ?></label>
+            <label for="remove_js_files_<%- data.id %>"><?= $escaper->escapeHtml(__('Remove')) ?></label>
         </div>
     </div>
 

app/code/Magento/Theme/view/adminhtml/templates/tabs/js.phtml

@@ -3,11 +3,15 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
-/**
- * @var $block \Magento\Theme\Block\Adminhtml\System\Design\Theme\Edit\Tab\Js
- * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
- */
+use Magento\Framework\Escaper;
+use Magento\Framework\View\Helper\SecureHtmlRenderer;
+use Magento\Theme\Block\Adminhtml\System\Design\Theme\Edit\Tab\Js;
+
+/** @var Escaper $escaper */
+/** @var Js $block */
+/** @var SecureHtmlRenderer $secureRenderer */
 ?>
 <?= $block->getFormHtml() ?>
 
@@ -26,7 +30,7 @@ require([
         dataType: 'json',
         replaceFileInput: false,
         sequentialUploads: true,
-        url: '{$block->escapeJs($block->getJsUploadUrl())}',
+        url: '{$escaper->escapeJs($block->getJsUploadUrl())}',
 
         /**
          * Add data

app/code/Magento/Theme/view/adminhtml/templates/title.phtml

@@ -3,16 +3,18 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
-/**
- * @var $block \Magento\Theme\Block\Html\Title
- */
-$titleIdHtml = ($block->getTitleId()) ? ' id="' . $block->escapeHtmlAttr($block->getTitleId()) . '"' : '';
+use Magento\Framework\Escaper;
+use Magento\Theme\Block\Html\Title;
+
+/** @var Escaper $escaper */
+/** @var Title $block */
+$titleIdHtml = ($block->getTitleId()) ? ' id="' . $escaper->escapeHtmlAttr($block->getTitleId()) . '"' : '';
 $titleClass = ($block->getTitleClass()) ? ' ' . $block->getTitleClass() : '';
 $title = $block->getPageTitle();
 ?>
-
-<div class="page-title-wrapper<?= $block->escapeHtmlAttr($titleClass) ?>">
-    <h1 class="page-title"<?= /* @noEscape */ $titleIdHtml ?>><?= $block->escapeHtml($title) ?></h1>
+<div class="page-title-wrapper<?= $escaper->escapeHtmlAttr($titleClass) ?>">
+    <h1 class="page-title"<?= /* @noEscape */ $titleIdHtml ?>><?= $escaper->escapeHtml($title) ?></h1>
     <?= $block->getChildHtml() ?>
 </div>

app/code/Magento/Theme/view/frontend/templates/callouts/left_col.phtml

@@ -3,21 +3,26 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+
+/** @var Escaper $escaper */
 ?>
 <div class="block block-banner">
     <div class="block-content">
         <?php if ($block->getLinkUrl() && strtolower(substr($block->getLinkUrl(), 0, 4)) === 'http'): ?>
-            <a href="<?= $block->escapeUrl($block->getLinkUrl()) ?>"
-               title="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>">
+            <a href="<?= $escaper->escapeUrl($block->getLinkUrl()) ?>"
+               title="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>">
         <?php elseif ($block->getLinkUrl()): ?>
-            <a href="<?= $block->escapeUrl($block->getUrl($block->getLinkUrl())) ?>"
-               title="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>">
+            <a href="<?= $escaper->escapeUrl($block->getUrl($block->getLinkUrl())) ?>"
+               title="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>">
         <?php endif; ?>
-            <img src="<?= $block->escapeUrl($block->getViewFileUrl($block->getImgSrc())) ?>"
+            <img src="<?= $escaper->escapeUrl($block->getViewFileUrl($block->getImgSrc())) ?>"
                 <?php if (!$block->getLinkUrl()): ?>
-                    title="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>"
+                    title="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>"
                 <?php endif; ?>
-                 alt="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>" />
+                 alt="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>" />
         <?php if ($block->getLinkUrl()): ?>
         </a>
         <?php endif ?>

app/code/Magento/Theme/view/frontend/templates/callouts/right_col.phtml

@@ -3,21 +3,26 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+
+/** @var Escaper $escaper */
 ?>
 <div class="block block-banner">
     <div class="block-content">
         <?php if ($block->getLinkUrl() && strtolower(substr($block->getLinkUrl(), 0, 4)) === 'http'): ?>
-            <a href="<?= $block->escapeUrl($block->getLinkUrl()) ?>"
-               title="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>">
+            <a href="<?= $escaper->escapeUrl($block->getLinkUrl()) ?>"
+               title="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>">
         <?php elseif ($block->getLinkUrl()): ?>
-            <a href="<?= $block->escapeUrl($block->getUrl($block->getLinkUrl())) ?>"
-               title="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>">
+            <a href="<?= $escaper->escapeUrl($block->getUrl($block->getLinkUrl())) ?>"
+               title="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>">
         <?php endif; ?>
-            <img src="<?= $block->escapeUrl($block->getViewFileUrl($block->getImgSrc())) ?>"
+            <img src="<?= $escaper->escapeUrl($block->getViewFileUrl($block->getImgSrc())) ?>"
                 <?php if (!$block->getLinkUrl()): ?>
-                    title="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>"
+                    title="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>"
                 <?php endif; ?>
-                 alt="<?= $block->escapeHtmlAttr(__($block->getImgAlt())) ?>" />
+                 alt="<?= $escaper->escapeHtmlAttr(__($block->getImgAlt())) ?>" />
         <?php if ($block->getLinkUrl()): ?>
         </a>
         <?php endif ?>

app/code/Magento/Theme/view/frontend/templates/html/block.phtml

@@ -3,12 +3,17 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+
+/** @var Escaper $escaper */
 ?>
-<div class="block <?= $block->escapeHtmlAttr($block->getBlockCss()) ?>">
-    <div class="block-title <?= $block->escapeHtmlAttr($block->getBlockCss()) ?>-title">
-        <strong><?= $block->escapeHtml($block->getBlockTitle()) ?></strong>
+<div class="block <?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>">
+    <div class="block-title <?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>-title">
+        <strong><?= $escaper->escapeHtml($block->getBlockTitle()) ?></strong>
     </div>
-    <div class="block-content <?= $block->escapeHtmlAttr($block->getBlockCss()) ?>-content">
+    <div class="block-content <?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>-content">
         <?= $block->getChildHtml() ?>
     </div>
 </div>

app/code/Magento/Theme/view/frontend/templates/html/breadcrumbs.phtml

@@ -3,21 +3,26 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+
+/** @var Escaper $escaper */
 ?>
 <?php if ($crumbs && is_array($crumbs)) : ?>
 <div class="breadcrumbs">
     <ul class="items">
         <?php foreach ($crumbs as $crumbName => $crumbInfo) : ?>
-            <li class="item <?= $block->escapeHtmlAttr($crumbName) ?>">
+            <li class="item <?= $escaper->escapeHtmlAttr($crumbName) ?>">
             <?php if ($crumbInfo['link']) : ?>
-                <a href="<?= $block->escapeUrl($crumbInfo['link']) ?>"
-                   title="<?= $block->escapeHtml($crumbInfo['title']) ?>">
-                    <?= $block->escapeHtml($crumbInfo['label']) ?>
+                <a href="<?= $escaper->escapeUrl($crumbInfo['link']) ?>"
+                   title="<?= $escaper->escapeHtml($crumbInfo['title']) ?>">
+                    <?= $escaper->escapeHtml($crumbInfo['label']) ?>
                 </a>
             <?php elseif ($crumbInfo['last']) : ?>
-                <strong><?= $block->escapeHtml($crumbInfo['label']) ?></strong>
+                <strong><?= $escaper->escapeHtml($crumbInfo['label']) ?></strong>
             <?php else : ?>
-                <?= $block->escapeHtml($crumbInfo['label']) ?>
+                <?= $escaper->escapeHtml($crumbInfo['label']) ?>
             <?php endif; ?>
             </li>
         <?php endforeach; ?>

app/code/Magento/Theme/view/frontend/templates/html/bugreport.phtml

@@ -3,11 +3,16 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+
+/** @var Escaper $escaper */
 ?>
 <small class="bugs">
-    <span><?= $block->escapeHtml(__('Help Us Keep Magento Healthy')) ?></span>
+    <span><?= $escaper->escapeHtml(__('Help Us Keep Magento Healthy')) ?></span>
     <a href="http://www.magentocommerce.com/bug-tracking"
-       target="_blank" title="<?= $block->escapeHtmlAttr(__('Report All Bugs')) ?>">
-        <?= $block->escapeHtml(__('Report All Bugs')) ?>
+       target="_blank" title="<?= $escaper->escapeHtmlAttr(__('Report All Bugs')) ?>">
+        <?= $escaper->escapeHtml(__('Report All Bugs')) ?>
     </a>
 </small>

app/code/Magento/Theme/view/frontend/templates/html/collapsible.phtml

@@ -3,17 +3,22 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
+use Magento\Framework\Escaper;
+
+/** @var Escaper $escaper */
 ?>
 
-<div class="block <?= $block->escapeHtmlAttr($block->getBlockCss()) ?>">
-    <div class="title <?= $block->escapeHtmlAttr($block->getBlockCss()) ?>-title"
-         data-mage-init='{"toggleAdvanced": {"toggleContainers": "#<?= $block->escapeHtmlAttr($block->getBlockCss()) ?>", "selectorsToggleClass": "active"}}'>
+<div class="block <?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>">
+    <div class="title <?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>-title"
+         data-mage-init='{"toggleAdvanced": {"toggleContainers": "#<?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>", "selectorsToggleClass": "active"}}'>
         <strong>
-            <?= $block->escapeHtml(__($block->getBlockTitle())) ?>
+            <?= $escaper->escapeHtml(__($block->getBlockTitle())) ?>
         </strong>
     </div>
-    <div class="content <?= $block->escapeHtmlAttr($block->getBlockCss()) ?>-content"
-         id="<?= $block->escapeHtmlAttr($block->getBlockCss()) ?>">
+    <div class="content <?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>-content"
+         id="<?= $escaper->escapeHtmlAttr($block->getBlockCss()) ?>">
         <?= $block->getChildHtml() ?>
     </div>
 </div>