Add Illuminate\Support\EncodedHtmlString

src/Illuminate/Foundation/Testing/Concerns/InteractsWithTestCaseLifecycle.php

@@ -26,6 +26,7 @@
 use Illuminate\Queue\Console\WorkCommand;
 use Illuminate\Queue\Queue;
 use Illuminate\Support\Carbon;
+use Illuminate\Support\EncodedHtmlString;
 use Illuminate\Support\Facades\Facade;
 use Illuminate\Support\Facades\ParallelTesting;
 use Illuminate\Support\Once;
@@ -171,6 +172,7 @@ protected function tearDownTheTestEnvironment(): void
         Component::forgetFactory();
         ConvertEmptyStringsToNull::flushState();
         Factory::flushState();
+        EncodedHtmlString::flushState();
         EncryptCookies::flushState();
         HandleExceptions::flushState();
         Migrator::withoutMigrations([]);

src/Illuminate/Mail/Mailable.php

@@ -13,6 +13,7 @@
 use Illuminate\Contracts\Support\Renderable;
 use Illuminate\Contracts\Translation\HasLocalePreference;
 use Illuminate\Support\Collection;
+use Illuminate\Support\EncodedHtmlString;
 use Illuminate\Support\HtmlString;
 use Illuminate\Support\Str;
 use Illuminate\Support\Traits\Conditionable;
@@ -1371,7 +1372,9 @@ public function assertHasSubject($subject)
      */
     public function assertSeeInHtml($string, $escape = true)
     {
-        $string = $escape ? e($string) : $string;
+        $flag = $this->markdown ? ENT_NOQUOTES : ENT_QUOTES;
+
+        $string = $escape ? EncodedHtmlString::convert($string, flag: $flag | ENT_SUBSTITUTE) : $string;
 
         [$html, $text] = $this->renderForAssertions();
 
@@ -1393,7 +1396,9 @@ public function assertSeeInHtml($string, $escape = true)
      */
     public function assertDontSeeInHtml($string, $escape = true)
     {
-        $string = $escape ? e($string) : $string;
+        $flag = $this->markdown ? ENT_NOQUOTES : ENT_QUOTES;
+
+        $string = $escape ? EncodedHtmlString::convert($string, flag: $flag | ENT_SUBSTITUTE) : $string;
 
         [$html, $text] = $this->renderForAssertions();
 
@@ -1415,7 +1420,11 @@ public function assertDontSeeInHtml($string, $escape = true)
      */
     public function assertSeeInOrderInHtml($strings, $escape = true)
     {
-        $strings = $escape ? array_map('e', $strings) : $strings;
+        $flag = $this->markdown ? ENT_NOQUOTES : ENT_QUOTES;
+
+        $strings = $escape ? array_map(function ($string) use ($flag) {
+            return EncodedHtmlString::convert($string, flag: $flag | ENT_SUBSTITUTE);
+        }, $strings) : $strings;
 
         [$html, $text] = $this->renderForAssertions();
 

src/Illuminate/Mail/Markdown.php

@@ -3,6 +3,7 @@
 namespace Illuminate\Mail;
 
 use Illuminate\Contracts\View\Factory as ViewFactory;
+use Illuminate\Support\EncodedHtmlString;
 use Illuminate\Support\HtmlString;
 use Illuminate\Support\Str;
 use League\CommonMark\Environment\Environment;
@@ -105,16 +106,28 @@ public function renderText($view, array $data = [])
      */
     public static function parse($text)
     {
-        $environment = new Environment([
-            'allow_unsafe_links' => false,
-        ]);
+        EncodedHtmlString::encodeUsing(function ($value) {
+            $replacements = [
+                '[' => '\[',
+                '<' => '\<',
+            ];
 
-        $environment->addExtension(new CommonMarkCoreExtension);
-        $environment->addExtension(new TableExtension);
+            $html = str_replace(array_keys($replacements), array_values($replacements), $value);
 
-        $converter = new MarkdownConverter($environment);
+            return static::converter([
+                'html_input' => 'escape',
+            ])->convert($html)->getContent();
+        });
 
-        return new HtmlString($converter->convert($text)->getContent());
+        $html = '';
+
+        try {
+            $html = static::converter()->convert($text)->getContent();
+        } finally {
+            EncodedHtmlString::flushState();
+        }
+
+        return new HtmlString($html);
     }
 
     /**
@@ -186,4 +199,22 @@ public function getTheme()
     {
         return $this->theme;
     }
+
+    /**
+     * Resolve the Markdown Converter.
+     *
+     * @param  array  $config
+     * @return \League\CommonMark\MarkdownConverter
+     */
+    public static function converter(array $config = [])
+    {
+        $environment = new Environment(array_merge([
+            'allow_unsafe_links' => false,
+        ], $config));
+
+        $environment->addExtension(new CommonMarkCoreExtension);
+        $environment->addExtension(new TableExtension);
+
+        return new MarkdownConverter($environment);
+    }
 }

src/Illuminate/Support/EncodedHtmlString.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Illuminate\Support;
+
+class EncodedHtmlString extends HtmlString
+{
+    /**
+     * The callback that should be used to encode the html strings.
+     *
+     * @var callable|null
+     */
+    protected static $encodeUsingFactory;
+
+    /**
+     * Create a new Encoded HTML string instance.
+     *
+     * @param  string  $html
+     * @param  bool  $doubleEncode
+     * @return void
+     */
+    public function __construct($html = '', protected bool $doubleEncode = true)
+    {
+        parent::__construct($html);
+    }
+
+    /**
+     * Convert using default encoding.
+     *
+     * @param  string|null  $value
+     * @param  int  $flag
+     * @param  string  $encoding
+     * @param  bool  $doubleEncode
+     * @return string
+     */
+    public static function convert($value, int $flag = ENT_QUOTES | ENT_SUBSTITUTE, string $encoding = 'UTF-8', bool $doubleEncode = true)
+    {
+        return htmlspecialchars($value ?? '', $flag, $encoding, $doubleEncode);
+    }
+
+    /**
+     * Get the HTML string.
+     *
+     * @return string
+     */
+    #[\Override]
+    public function toHtml()
+    {
+        return (static::$encodeUsingFactory ?? function ($value, bool $doubleEncode) {
+            return static::convert($value, doubleEncode: $doubleEncode);
+        })($this->html, $this->doubleEncode);
+    }
+
+    /**
+     * Set the callable that will be used to encode the html strings.
+     *
+     * @param  callable|null  $factory
+     * @return void
+     */
+    public static function encodeUsing(?callable $factory = null)
+    {
+        static::$encodeUsingFactory = $factory;
+    }
+
+    /**
+     * Flush the class's global state.
+     *
+     * @return void
+     */
+    public static function flushState()
+    {
+        static::$encodeUsingFactory = null;
+    }
+}

src/Illuminate/Support/helpers.php

@@ -4,6 +4,7 @@
 use Illuminate\Contracts\Support\Htmlable;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Arr;
+use Illuminate\Support\EncodedHtmlString;
 use Illuminate\Support\Env;
 use Illuminate\Support\Fluent;
 use Illuminate\Support\HigherOrderTapProxy;
@@ -122,7 +123,7 @@ function class_uses_recursive($class)
      *
      * @param  \Illuminate\Contracts\Support\DeferringDisplayableValue|\Illuminate\Contracts\Support\Htmlable|\BackedEnum|string|int|float|null  $value
      * @param  bool  $doubleEncode
-     * @return string
+     * @return \Illuminate\Support\EncodedHtmlString
      */
     function e($value, $doubleEncode = true)
     {
@@ -138,7 +139,7 @@ function e($value, $doubleEncode = true)
             $value = $value->value;
         }
 
-        return htmlspecialchars($value ?? '', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', $doubleEncode);
+        return new EncodedHtmlString($value ?? '', $doubleEncode);
     }
 }
 

tests/Integration/Mail/MarkdownParserTest.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Illuminate\Tests\Integration\Mail;
+
+use Illuminate\Mail\Markdown;
+use Illuminate\Support\HtmlString;
+use Orchestra\Testbench\TestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+class MarkdownParserTest extends TestCase
+{
+    #[DataProvider('markdownDataProvider')]
+    public function testItCanParseMarkdownString($given, $expected)
+    {
+        tap(Markdown::parse($given), function ($html) use ($expected) {
+            $this->assertInstanceOf(HtmlString::class, $html);
+
+            $this->assertStringEqualsStringIgnoringLineEndings($expected.PHP_EOL, (string) $html);
+            $this->assertSame((string) $html, (string) $html->toHtml());
+        });
+    }
+
+    #[DataProvider('markdownEncodedDataProvider')]
+    public function testItCanParseMarkdownEncodedString($given, $expected)
+    {
+        tap(Markdown::parse($given), function ($html) use ($expected) {
+            $this->assertInstanceOf(HtmlString::class, $html);
+
+            $this->assertStringEqualsStringIgnoringLineEndings($expected.PHP_EOL, (string) $html);
+        });
+    }
+
+    public static function markdownDataProvider()
+    {
+        yield ['[Laravel](https://laravel.com)', '<p><a href="https://laravel.com">Laravel</a></p>'];
+        yield ['\[Laravel](https://laravel.com)', '<p>[Laravel](https://laravel.com)</p>'];
+        yield ['![Welcome to Laravel](https://laravel.com/assets/img/welcome/background.svg)', '<p><img src="https://laravel.com/assets/img/welcome/background.svg" alt="Welcome to Laravel" /></p>'];
+        yield ['!\[Welcome to Laravel](https://laravel.com/assets/img/welcome/background.svg)', '<p>![Welcome to Laravel](https://laravel.com/assets/img/welcome/background.svg)</p>'];
+        yield ['Visit https://laravel.com/docs to browse the documentation', '<p>Visit https://laravel.com/docs to browse the documentation</p>'];
+        yield ['Visit <https://laravel.com/docs> to browse the documentation', '<p>Visit <a href="https://laravel.com/docs">https://laravel.com/docs</a> to browse the documentation</p>'];
+        yield ['Visit <span>https://laravel.com/docs</span> to browse the documentation', '<p>Visit <span>https://laravel.com/docs</span> to browse the documentation</p>'];
+    }
+
+    public static function markdownEncodedDataProvider()
+    {
+        yield [e('[Laravel](https://laravel.com)'), '<p>[Laravel](https://laravel.com)</p>'];
+
+        yield [
+            e('![Welcome to Laravel](https://laravel.com/assets/img/welcome/background.svg)'),
+            '<p>![Welcome to Laravel](https://laravel.com/assets/img/welcome/background.svg)</p>',
+        ];
+
+        yield [
+            e('Visit https://laravel.com/docs to browse the documentation'),
+            '<p>Visit https://laravel.com/docs to browse the documentation</p>',
+        ];
+
+        yield [
+            e('Visit <https://laravel.com/docs> to browse the documentation'),
+            '<p>Visit &lt;https://laravel.com/docs&gt; to browse the documentation</p>',
+        ];
+
+        yield [
+            e('Visit <span>https://laravel.com/docs</span> to browse the documentation'),
+            '<p>Visit &lt;span&gt;https://laravel.com/docs&lt;/span&gt; to browse the documentation</p>',
+        ];
+
+        yield [
+            '![Welcome to Laravel](https://laravel.com/assets/img/welcome/background.svg)<br />'.e('Visit <span>https://laravel.com/docs</span> to browse the documentation'),
+            '<p><img src="https://laravel.com/assets/img/welcome/background.svg" alt="Welcome to Laravel" /><br />Visit &lt;span&gt;https://laravel.com/docs&lt;/span&gt; to browse the documentation</p>',
+        ];
+    }
+}

tests/Support/SupportHelpersTest.php

@@ -8,6 +8,7 @@
 use Error;
 use Illuminate\Contracts\Support\Htmlable;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\EncodedHtmlString;
 use Illuminate\Support\Env;
 use Illuminate\Support\Optional;
 use Illuminate\Support\Sleep;
@@ -36,7 +37,11 @@ protected function tearDown(): void
     public function testE()
     {
         $str = 'A \'quote\' is <b>bold</b>';
-        $this->assertSame('A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;', e($str));
+        tap(e($str), function ($html) {
+            $this->assertInstanceOf(EncodedHtmlString::class, $html);
+            $this->assertEquals('A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;', $html->toHtml());
+            $this->assertEquals('A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;', (string) $html);
+        });
 
         $html = m::mock(Htmlable::class);
         $html->shouldReceive('toHtml')->andReturn($str);
@@ -46,16 +51,16 @@ public function testE()
     public function testEWithInvalidCodePoints()
     {
         $str = mb_convert_encoding('føø bar', 'ISO-8859-1', 'UTF-8');
-        $this->assertEquals('f�� bar', e($str));
+        $this->assertEquals('f�� bar', (string) e($str));
     }
 
     public function testEWithEnums()
     {
         $enumValue = StringBackedEnum::ADMIN_LABEL;
-        $this->assertSame('I am &#039;admin&#039;', e($enumValue));
+        $this->assertSame('I am &#039;admin&#039;', (string) e($enumValue));
 
         $enumValue = IntBackedEnum::ROLE_ADMIN;
-        $this->assertSame('1', e($enumValue));
+        $this->assertSame('1', (string) e($enumValue));
     }
 
     public function testBlank()