Escape error messages in debug mode

While one could argue that turning on debug mode is itself something you shouldn't do in production at least for some providers this seems to be the case.

Since the error messages can contain user-influenced input this can lead to XSS in the worst scenario.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Author: LukasReschke

lib/Saml2/LogoutRequest.php

@@ -380,7 +380,7 @@ public function isValid($retrieveParametersFromServer = false)
             $this->_error = $e->getMessage();
             $debug = $this->_settings->isDebugActive();
             if ($debug) {
-                echo $this->_error;
+                echo htmlentities($this->_error);
             }
             return false;
         }

lib/Saml2/LogoutResponse.php

@@ -188,7 +188,7 @@ public function isValid($requestId = null, $retrieveParametersFromServer = false
             $this->_error = $e->getMessage();
             $debug = $this->_settings->isDebugActive();
             if ($debug) {
-                echo $this->_error;
+                echo htmlentities($this->_error);
             }
             return false;
         }

lib/Saml2/Response.php

@@ -402,7 +402,7 @@ public function isValid($requestId = null)
             $this->_error = $e->getMessage();
             $debug = $this->_settings->isDebugActive();
             if ($debug) {
-                echo $this->_error;
+                echo htmlentities($this->_error);
             }
             return false;
         }

lib/Saml2/Utils.php

@@ -134,7 +134,7 @@ public static function validateXML($xml, $schema, $debug = false)
 
             if ($debug) {
                 foreach ($xmlErrors as $error) {
-                    echo $error->message."\n";
+                    echo htmlentities($error->message."\n");
                 }
             }