1 files changed, 42 insertions, 35 deletions

diff --git a/lib/private/AppFramework/OCS/BaseResponse.php b/lib/private/AppFramework/OCS/BaseResponse.php
index d3904065102..05ce133db24 100644
--- a/lib/private/AppFramework/OCS/BaseResponse.php
+++ b/lib/private/AppFramework/OCS/BaseResponse.php
@@ -1,28 +1,8 @@
 <?php
+
 /**
- * @copyright 2016 Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Daniel Kesselberg <mail@danielkesselberg.de>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 namespace OC\AppFramework\OCS;
 
@@ -30,6 +10,13 @@ use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\Http\Response;
 
+/**
+ * @psalm-import-type DataResponseType from DataResponse
+ * @template S of Http::STATUS_*
+ * @template-covariant T of DataResponseType
+ * @template H of array<string, mixed>
+ * @template-extends Response<Http::STATUS_*, array<string, mixed>>
+ */
 abstract class BaseResponse extends Response {
 	/** @var array */
 	protected $data;
@@ -49,17 +36,17 @@ abstract class BaseResponse extends Response {
 	/**
 	 * BaseResponse constructor.
 	 *
-	 * @param DataResponse $dataResponse
+	 * @param DataResponse<S, T, H> $dataResponse
 	 * @param string $format
 	 * @param string|null $statusMessage
 	 * @param int|null $itemsCount
 	 * @param int|null $itemsPerPage
 	 */
 	public function __construct(DataResponse $dataResponse,
-								$format = 'xml',
-								$statusMessage = null,
-								$itemsCount = null,
-								$itemsPerPage = null) {
+		$format = 'xml',
+		$statusMessage = null,
+		$itemsCount = null,
+		$itemsPerPage = null) {
 		parent::__construct();
 
 		$this->format = $format;
@@ -97,9 +84,9 @@ abstract class BaseResponse extends Response {
 	 */
 	protected function renderResult(array $meta): string {
 		$status = $this->getStatus();
-		if ($status === Http::STATUS_NO_CONTENT ||
-			$status === Http::STATUS_NOT_MODIFIED ||
-			($status >= 100 && $status <= 199)) {
+		if ($status === Http::STATUS_NO_CONTENT
+			|| $status === Http::STATUS_NOT_MODIFIED
+			|| ($status >= 100 && $status <= 199)) {
 			// Those status codes are not supposed to have a body:
 			// https://stackoverflow.com/q/8628725
 			return '';
@@ -113,7 +100,7 @@ abstract class BaseResponse extends Response {
 		];
 
 		if ($this->format === 'json') {
-			return json_encode($response, JSON_HEX_TAG);
+			return $this->toJson($response);
 		}
 
 		$writer = new \XMLWriter();
@@ -125,6 +112,14 @@ abstract class BaseResponse extends Response {
 		return $writer->outputMemory(true);
 	}
 
+	/**
+	 * @psalm-taint-escape has_quotes
+	 * @psalm-taint-escape html
+	 */
+	protected function toJson(array $array): string {
+		return \json_encode($array, \JSON_HEX_TAG);
+	}
+
 	protected function toXML(array $array, \XMLWriter $writer): void {
 		foreach ($array as $k => $v) {
 			if ($k === '@attributes' && is_array($v)) {
@@ -134,7 +129,7 @@ abstract class BaseResponse extends Response {
 				continue;
 			}
 
-			if (\is_string($k) && strpos($k, '@') === 0) {
+			if (\is_string($k) && str_starts_with($k, '@')) {
 				$writer->writeAttribute(substr($k, 1), $v);
 				continue;
 			}
@@ -143,12 +138,24 @@ abstract class BaseResponse extends Response {
 				$k = 'element';
 			}
 
-			if (\is_array($v)) {
+			if ($v instanceof \stdClass) {
+				$v = [];
+			}
+
+			if ($k === '$comment') {
+				$writer->writeComment($v);
+			} elseif (\is_array($v)) {
 				$writer->startElement($k);
 				$this->toXML($v, $writer);
 				$writer->endElement();
+			} elseif ($v instanceof \JsonSerializable) {
+				$writer->startElement($k);
+				$this->toXML($v->jsonSerialize(), $writer);
+				$writer->endElement();
+			} elseif ($v === null) {
+				$writer->writeElement($k);
 			} else {
-				$writer->writeElement($k, $v);
+				$writer->writeElement($k, (string)$v);
 			}
 		}
 	}