Cross-site scripting (XSS) from field and configuration text displayed in the Panel

@@ -8,7 +8,7 @@
     "core"
   ],
   "homepage": "https://getkirby.com",
-  "version": "3.5.7-rc.1",
+  "version": "3.5.7",
   "license": "proprietary",
   "authors": [
     {

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "42d7dee7058fc74d74622317b8c062cb",
+    "content-hash": "e02ab3eeb053451df9880dfd3ebabba8",
     "packages": [
         {
             "name": "claviska/simpleimage",
@@ -238,16 +238,16 @@
         },
         {
             "name": "laminas/laminas-zendframework-bridge",
-            "version": "1.2.0",
+            "version": "1.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laminas/laminas-zendframework-bridge.git",
-                "reference": "6cccbddfcfc742eb02158d6137ca5687d92cee32"
+                "reference": "13af2502d9bb6f7d33be2de4b51fb68c6cdb476e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-zendframework-bridge/zipball/6cccbddfcfc742eb02158d6137ca5687d92cee32",
-                "reference": "6cccbddfcfc742eb02158d6137ca5687d92cee32",
+                "url": "https://api.github.com/repos/laminas/laminas-zendframework-bridge/zipball/13af2502d9bb6f7d33be2de4b51fb68c6cdb476e",
+                "reference": "13af2502d9bb6f7d33be2de4b51fb68c6cdb476e",
                 "shasum": ""
             },
             "require": {
@@ -296,7 +296,7 @@
                     "type": "community_bridge"
                 }
             ],
-            "time": "2021-02-25T21:54:58+00:00"
+            "time": "2021-06-24T12:49:22+00:00"
         },
         {
             "name": "league/color-extractor",

@@ -1,6 +1,7 @@
 <?php
 
 use Kirby\Cms\File;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\I18n;
 
 return [
@@ -116,6 +117,13 @@
             foreach ($this->files as $file) {
                 $image = $file->panelImage($this->image);
 
+                // escape the default text
+                // TODO: no longer needed in 3.6
+                $text = $file->toString($this->text);
+                if ($this->text === '{{ file.filename }}') {
+                    $text = Escape::html($text);
+                }
+
                 $data[] = [
                     'dragText' => $file->dragText('auto', $dragTextAbsolute),
                     'extension' => $file->extension(),
@@ -127,7 +135,7 @@
                     'link'     => $file->panelUrl(true),
                     'mime'     => $file->mime(),
                     'parent'   => $file->parent()->panelPath(),
-                    'text'     => $file->toString($this->text),
+                    'text'     => $text,
                     'url'      => $file->url(),
                 ];
             }

@@ -2,6 +2,7 @@
 
 use Kirby\Cms\Blueprint;
 use Kirby\Toolkit\A;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\I18n;
 
 return [
@@ -153,10 +154,17 @@
                 $permissions = $item->permissions();
                 $image       = $item->panelImage($this->image);
 
+                // escape the default text
+                // TODO: no longer needed in 3.6
+                $text = $item->toString($this->text);
+                if ($this->text === '{{ page.title }}') {
+                    $text = Escape::html($text);
+                }
+
                 $data[] = [
                     'id'          => $item->id(),
                     'dragText'    => $item->dragText(),
-                    'text'        => $item->toString($this->text),
+                    'text'        => $text,
                     'info'        => $item->toString($this->info ?? false),
                     'parent'      => $item->parentId(),
                     'icon'        => $item->panelIcon($image),

@@ -118,7 +118,7 @@
   "error.page.duplicate.permission": "Du har inte behörighet att duplicera \"{slug}\"",
   "error.page.notFound": "Sidan \"{slug}\" kan inte hittas",
   "error.page.num.invalid": "Ange ett giltigt nummer för sortering. Numret får inte vara negativt.",
-  "error.page.slug.invalid": "Please enter a valid URL appendix",
+  "error.page.slug.invalid": "Ange en giltig URL-appendix",
   "error.page.slug.maxlength": "Permalänkens längd måste vara kortare än \"{length}\" tecken",
   "error.page.sort.permission": "Sidan \"{slug}\" kan inte sorteras",
   "error.page.status.invalid": "Sätt en giltig status för sidan",
@@ -163,7 +163,7 @@
   "error.user.password.invalid": "Ange ett giltigt lösenord. Lösenordet måste vara minst 8 tecken långt.",
   "error.user.password.notSame": "Lösenorden matchar inte",
   "error.user.password.undefined": "Användaren har inget lösenord",
-  "error.user.password.wrong": "Wrong password",
+  "error.user.password.wrong": "Fel lösenord",
   "error.user.role.invalid": "Ange en giltig roll",
   "error.user.update.permission": "Du har inte behörighet att uppdatera användaren \"{name}\"",
 
@@ -372,11 +372,11 @@
   "more": "Mer",
   "name": "Namn",
   "next": "Nästa",
-  "no": "no",
+  "no": "nej",
   "off": "av",
   "on": "på",
   "open": "Öppna",
-  "open.newWindow": "Open in new window",
+  "open.newWindow": "Öppna i nytt fönster",
   "options": "Alternativ",
   "options.none": "Inga alternativ",
 
@@ -468,9 +468,9 @@
   "toolbar.button.file.select": "Välj en fil",
   "toolbar.button.file.upload": "Ladda upp en fil",
   "toolbar.button.link": "L\u00e4nk",
-  "toolbar.button.strike": "Strike-through",
+  "toolbar.button.strike": "Genomstruken",
   "toolbar.button.ol": "Sorterad lista",
-  "toolbar.button.underline": "Underline",
+  "toolbar.button.underline": "Understruken",
   "toolbar.button.ul": "Punktlista",
 
   "translation.author": "Kirby-teamet, Ola Christensson",
@@ -523,5 +523,5 @@
 
   "welcome": "Välkommen",
   "year": "År",
-  "yes": "yes"
+  "yes": "ja"
 }

@@ -1,7 +1,7 @@
 <template>
   <k-remove-dialog
     ref="dialog"
-    :text="$t('file.delete.confirm', { filename: filename })"
+    :text="$t('file.delete.confirm', { filename: $esc(filename) })"
     @submit="submit"
   />
 </template>

@@ -7,7 +7,7 @@
     @submit="submit"
   >
     <template v-if="issue">
-      <k-box :text="issue" theme="negative" />
+      <k-box :text="issue" :html="false" theme="negative" />
     </template>
 
     <template v-else>

@@ -1,7 +1,7 @@
 <template>
   <k-remove-dialog
     ref="dialog"
-    :text="$t('language.delete.confirm', { name: language.name })"
+    :text="$t('language.delete.confirm', { name: $esc(language.name) })"
     @submit="submit"
   />
 </template>

@@ -7,7 +7,7 @@
   >
     <template v-if="page.hasChildren || page.hasDrafts">
       <!-- eslint-disable-next-line vue/no-v-html -->
-      <k-text v-html="$t('page.delete.confirm', { title: page.title })" />
+      <k-text v-html="$t('page.delete.confirm', { title: $esc(page.title) })" />
       <div class="k-page-remove-warning">
         <!-- eslint-disable-next-line vue/no-v-html -->
         <k-box theme="negative" v-html="$t('page.delete.confirm.subpages')" />
@@ -21,7 +21,7 @@
     </template>
     <template v-else>
       <!-- eslint-disable-next-line vue/no-v-html -->
-      <k-text @keydown.enter="submit" v-html="$t('page.delete.confirm', { title: page.title })" />
+      <k-text @keydown.enter="submit" v-html="$t('page.delete.confirm', { title: $esc(page.title) })" />
     </template>
   </k-remove-dialog>
 </template>

@@ -7,7 +7,7 @@
     @submit="submit"
   >
     <template v-if="issue">
-      <k-box :text="issue" theme="negative" />
+      <k-box :text="issue" :html="false" theme="negative" />
     </template>
     <template v-else>
       <header v-if="model" class="k-pages-dialog-navbar">

@@ -1,7 +1,7 @@
 <template>
   <k-remove-dialog
     ref="dialog"
-    :text="$t('user.delete.confirm', { email: user.email })"
+    :text="$t('user.delete.confirm', { email: $esc(user.email) })"
     @submit="submit"
   />
 </template>

@@ -7,7 +7,7 @@
     @submit="submit"
   >
     <template v-if="issue">
-      <k-box :text="issue" theme="negative" />
+      <k-box :text="issue" :html="false" theme="negative" />
     </template>
 
     <template v-else>

@@ -14,7 +14,8 @@
         @keydown.backspace.prevent="close"
         @keydown.delete.prevent="close"
       >
-        {{ item.text }}
+        <!-- eslint-disable-next-line vue/no-v-html -->
+        <span v-html="html ? item.text : $esc(item.text)" />
       </k-dropdown-item>
     </k-dropdown-content>
     {{ query }}
@@ -27,6 +28,13 @@
  */
 export default {
   props: {
+    /**
+     * If set to `true`, the text of the options is rendered as HTML
+     */
+    html: {
+      type: Boolean,
+      default: false
+    },
     /**
      * Maximum number of displayed results
      */
@@ -44,10 +52,10 @@ export default {
       }
     },
     /**
-     * Options for the autocomplete dropdown must be passed as an array of 
-     * objects. Each object can have as many items as you like, but a text 
+     * Options for the autocomplete dropdown must be passed as an array of
+     * objects. Each object can have as many items as you like, but a text
      * item is required to match agains the query
-     * 
+     *
      * @example [ { text: "this will be searched", id: "anything else is optional" }, ];
      */
     options: Array,
@@ -119,4 +127,4 @@ export default {
     }
   }
 }
-</script>
\ No newline at end of file
+</script>

@@ -26,7 +26,7 @@
       <p class="k-form-lock-info">
         <k-icon type="lock" />
         <!-- eslint-disable-next-line vue/no-v-html -->
-        <span v-html="$t('lock.isLocked', { email: form.lock.email })" />
+        <span v-html="$t('lock.isLocked', { email: $esc(form.lock.email) })" />
       </p>
 
       <k-icon

@@ -19,7 +19,8 @@
       @keydown.native.right="navigate('next')"
       @keydown.native.down="$refs.dropdown.open"
     >
-      {{ tag.text }}
+      <!-- eslint-disable-next-line vue/no-v-html -->
+      <span v-html="tag.text" />
     </k-tag>
 
     <k-dropdown-content

@@ -10,15 +10,16 @@
         class="k-radio-input-native"
         @change="onInput(option.value)"
       >
-      <label :for="id + '-' + index">
-        <template v-if="option.info">
-          <span class="k-radio-input-text">{{ option.text }}</span>
-          <span class="k-radio-input-info">{{ option.info }}</span>
-        </template>
-        <template v-else>
-          {{ option.text }}
-        </template>
+
+      <!-- eslint-disable vue/no-v-html -->
+      <label v-if="option.info" :for="id + '-' + index">
+        <span class="k-radio-input-text" v-html="option.text" />
+        <!-- @todo support (escaped) HTML in the info prop in 3.6.0 -->
+        <span class="k-radio-input-info">{{ option.info }}</span>
       </label>
+      <label v-else :for="id + '-' + index" v-html="option.text" />
+      <!-- eslint-enable vue/no-v-html -->
+
       <k-icon v-if="option.icon" :type="option.icon" />
     </li>
   </ul>

@@ -22,11 +22,14 @@
       @dblclick.native="edit(tag)"
       @remove="remove(tag)"
     >
-      {{ tag.text }}
+      <!-- eslint-disable-next-line vue/no-v-html -->
+      <span v-html="tag.text" />
     </k-tag>
+
     <span slot="footer" class="k-tags-input-element">
       <k-autocomplete
         ref="autocomplete"
+        :html="true"
         :options="options"
         :skip="skip"
         @select="addTag"
@@ -73,9 +76,9 @@ export default {
     },
     id: [Number, String],
     /**
-     * You can set the layout to `list` to extend the width of each tag 
-     * to 100% and show them in a list. This is handy in narrow columns 
-     * or when a list is a more appropriate design choice for the input 
+     * You can set the layout to `list` to extend the width of each tag
+     * to 100% and show them in a list. This is handy in narrow columns
+     * or when a list is a more appropriate design choice for the input
      * in general.
      */
     layout: String,
@@ -89,7 +92,7 @@ export default {
     min: Number,
     name: [Number, String],
     /**
-     * Options will be shown in the autocomplete dropdown 
+     * Options will be shown in the autocomplete dropdown
      * as soon as you start typing.
      */
     options: {

@@ -3,7 +3,10 @@
     <!-- @slot Use instead of `text` prop -->
     <slot>
       <!-- eslint-disable-next-line vue/no-v-html -->
-      <k-text v-html="text" />
+      <k-text v-if="html" v-html="text" />
+      <k-text v-else>
+        {{ text }}
+      </k-text>
     </slot>
   </div>
 </template>
@@ -27,7 +30,15 @@ export default {
     /**
      * Text to display inside the box
      */
-    text: String
+    text: String,
+    /**
+     * If set to `false`, the `text` is rendered as text only
+     * @todo Switch default value to `false` in 3.6.0
+     */
+    html: {
+      type: Boolean,
+      default: true
+    }
   }
 };
 </script>

@@ -12,7 +12,8 @@
         <k-icon v-bind="icon" />
       </span>
       <figcaption class="k-card-content">
-        <span :data-noinfo="!info" class="k-card-text">{{ text }}</span>
+        <!-- eslint-disable-next-line vue/no-v-html -->
+        <span :data-noinfo="!info" class="k-card-text" v-html="text" />
         <!-- eslint-disable-next-line vue/no-v-html -->
         <span v-if="info" class="k-card-info" v-html="info" />
       </figcaption>

@@ -4,7 +4,7 @@
       <k-headline class="k-fields-issue-headline">
         Error
       </k-headline>
-      <k-box :text="issue.message" theme="negative" />
+      <k-box :text="issue.message" :html="false" theme="negative" />
     </template>
     <k-form
       :fields="fields"

@@ -18,7 +18,6 @@ export default {
   data() {
     return {
       headline: null,
-      issue: null,
       text: null,
       theme: null
     };
@@ -29,9 +28,6 @@ export default {
         this.headline = response.options.headline;
         this.text     = response.options.text;
         this.theme    = response.options.theme || "info";
-      })
-      .catch (error => {
-        this.issue = error;
       });
   }
 };

@@ -48,7 +48,7 @@
       <k-sections
         v-if="file.id"
         :blueprint="file.blueprint.name"
-        :empty="$t('file.blueprint', { template: file.blueprint.name })"
+        :empty="$t('file.blueprint', { template: $esc(file.blueprint.name) })"
         :parent="parent"
         :tab="tab"
         :tabs="tabs"

@@ -54,7 +54,7 @@
     <k-sections
       v-if="page.id"
       :blueprint="blueprint"
-      :empty="$t('page.blueprint', { template: blueprint })"
+      :empty="$t('page.blueprint', { template: $esc(blueprint) })"
       :parent="$api.pages.url(page.id)"
       :tab="tab"
       :tabs="tabs"

@@ -118,8 +118,8 @@ export default {
               default: language.default,
               icon: { type: "globe", back: "black" },
               image: true,
-              text: language.name,
-              info: language.code,
+              text: this.$esc(language.name),
+              info: this.$esc(language.code),
               link: () => {
                 this.$refs.update.open(language.code);
               },

@@ -135,8 +135,8 @@ export default {
             let item = {
               id: user.id,
               icon: { type: "user", back: "black" },
-              text: user.name || user.email,
-              info: user.role.title,
+              text: this.$esc(user.name || user.email),
+              info: this.$esc(user.role.title),
               link: "/users/" + user.id,
               options: ready => {
                 this.$api.users

@@ -84,7 +84,7 @@
       <k-sections
         v-if="user"
         :blueprint="user.blueprint.name"
-        :empty="$t('user.blueprint', { role: user.role.name })"
+        :empty="$t('user.blueprint', { role: $esc(user.role.name) })"
         :parent="'users/' + user.id"
         :tab="tab"
         :tabs="tabs"

@@ -37,7 +37,6 @@ export default {
       });
     };
 
-
     Vue.prototype.$helper = {
       clone: clone,
       isComponent: isComponent,
@@ -53,6 +52,8 @@ export default {
       validate: validate,
     };
 
+    Vue.prototype.$esc = string.escapeHTML;
+
   }
 
 };

@@ -0,0 +1,10 @@
+import string from "./string.js";
+
+describe("$helper.string.escapeHTML", () => {
+
+  it("should escape HTML", () => {
+    const result = string.escapeHTML("<div class=\"button\">This text includes `&<>\"'/=` characters</div>");
+    expect(result).to.equal("&lt;div class&#x3D;&quot;button&quot;&gt;This text includes &#x60;&amp;&lt;&gt;&quot;&#39;&#x2F;&#x3D;&#x60; characters&lt;&#x2F;div&gt;");
+  });
+
+});

@@ -2,6 +2,48 @@ export default {
   camelToKebab(string) {
     return string.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
   },
+  escapeHTML(string) {
+    /**
+     * Source: https://github.com/janl/mustache.js/blob/v4.2.0/mustache.js#L60-L75
+     * 
+     * The MIT License
+     *
+     * Copyright (c) 2009 Chris Wanstrath (Ruby)
+     * Copyright (c) 2010-2014 Jan Lehnardt (JavaScript)
+     * Copyright (c) 2010-2015 The mustache.js community
+     * 
+     * Permission is hereby granted, free of charge, to any person obtaining a
+     * copy of this software and associated documentation files (the "Software"),
+     * to deal in the Software without restriction, including without limitation
+     * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+     * and/or sell copies of the Software, and to permit persons to whom the
+     * Software is furnished to do so, subject to the following conditions:
+     * 
+     * The above copyright notice and this permission notice shall be included
+     * in all copies or substantial portions of the Software.
+     * 
+     * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+     * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+     * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+     * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+     * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+     * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+     */
+    const entityMap = {
+      '&': '&',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#39;',
+      '/': '&#x2F;',
+      '`': '&#x60;',
+      '=': '&#x3D;'
+    };
+
+    return String(string).replace(/[&<>"'`=/]/g, (char) => {
+      return entityMap[char];
+    });
+  },
   hasEmoji(string) {
     if (typeof string !== "string") {
       return false;

@@ -4,6 +4,7 @@
 
 use Kirby\Image\Image;
 use Kirby\Toolkit\A;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\F;
 use Throwable;
 
@@ -561,6 +562,14 @@ public function panelPickerData(array $params = []): array
             $absolute = $this->parent() !== $params['model'];
         }
 
+        // escape the default text
+        // TODO: no longer needed in 3.6
+        $textQuery = $params['text'] ?? '{{ file.filename }}';
+        $text = $this->toString($textQuery);
+        if ($textQuery === '{{ file.filename }}') {
+            $text = Escape::html($text);
+        }
+
         return [
             'filename' => $this->filename(),
             'dragText' => $this->dragText('auto', $absolute ?? false),
@@ -569,7 +578,7 @@ public function panelPickerData(array $params = []): array
             'image'    => $image,
             'info'     => $this->toString($params['info'] ?? false),
             'link'     => $this->panelUrl(true),
-            'text'     => $this->toString($params['text'] ?? '{{ file.filename }}'),
+            'text'     => $text,
             'type'     => $this->type(),
             'url'      => $this->url(),
             'uuid'     => $uuid,

@@ -7,6 +7,7 @@
 use Kirby\Exception\NotFoundException;
 use Kirby\Http\Uri;
 use Kirby\Toolkit\A;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\F;
 
 /**
@@ -995,6 +996,14 @@ public function panelPickerData(array $params = []): array
         $image = $this->panelImage($params['image'] ?? []);
         $icon  = $this->panelIcon($image);
 
+        // escape the default text
+        // TODO: no longer needed in 3.6
+        $textQuery = $params['text'] ?? '{{ page.title }}';
+        $text  = $this->toString($textQuery);
+        if ($textQuery === '{{ page.title }}') {
+            $text = Escape::html($text);
+        }
+
         return [
             'dragText'    => $this->dragText(),
             'hasChildren' => $this->hasChildren(),
@@ -1003,7 +1012,7 @@ public function panelPickerData(array $params = []): array
             'image'       => $image,
             'info'        => $this->toString($params['info'] ?? false),
             'link'        => $this->panelUrl(true),
-            'text'        => $this->toString($params['text'] ?? '{{ page.title }}'),
+            'text'        => $text,
             'url'         => $this->url(),
         ];
     }

@@ -5,6 +5,7 @@
 use Exception;
 use Kirby\Exception\InvalidArgumentException;
 use Kirby\Exception\NotFoundException;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\F;
 use Kirby\Toolkit\Str;
 
@@ -628,14 +629,22 @@ public function panelPickerData(array $params = null): array
         $image = $this->panelImage($params['image'] ?? []);
         $icon  = $this->panelIcon($image);
 
+        // escape the default text
+        // TODO: no longer needed in 3.6
+        $textQuery = $params['text'] ?? '{{ user.username }}';
+        $text = $this->toString($textQuery);
+        if ($textQuery === '{{ user.username }}') {
+            $text = Escape::html($text);
+        }
+
         return [
             'icon'     => $icon,
             'id'       => $this->id(),
             'image'    => $image,
             'email'    => $this->email(),
             'info'     => $this->toString($params['info'] ?? false),
             'link'     => $this->panelUrl(true),
-            'text'     => $this->toString($params['text'] ?? '{{ user.username }}'),
+            'text'     => $text,
             'username' => $this->username(),
         ];
     }

@@ -6,6 +6,7 @@
 use Kirby\Exception\InvalidArgumentException;
 use Kirby\Exception\NotFoundException;
 use Kirby\Toolkit\Collection;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\Obj;
 use Kirby\Toolkit\Properties;
 use Kirby\Toolkit\Query;
@@ -102,7 +103,26 @@ protected function template(string $object, string $field, array $data)
             $value = $value[$object];
         }
 
-        return Str::template($value, $data);
+        $result = Str::template($value, $data);
+
+        // escape the default queries for the `text` field
+        // TODO: remove after default escape implemented for query templates in 3.6
+        if ($field === 'text') {
+            $defaults = [
+                'arrayItem'     => '{{ arrayItem.value }}',
+                'block'         => '{{ block.type }}: {{ block.id }}',
+                'file'          => '{{ file.filename }}',
+                'page'          => '{{ page.title }}',
+                'structureItem' => '{{ structureItem.title }}',
+                'user'          => '{{ user.username }}',
+            ];
+
+            if ($value === $defaults[$object]) {
+                $result = Escape::html($result);
+            }
+        }
+
+        return $result;
     }
 
     /**

@@ -6,8 +6,8 @@
 $baseDir = dirname($vendorDir);
 
 return array(
-    '7e9bd612cc444b3eed788ebbe46263a0' => $vendorDir . '/laminas/laminas-zendframework-bridge/src/autoload.php',
     '0e6d7bf4a5811bfa5cf40c5ccd6fae6a' => $vendorDir . '/symfony/polyfill-mbstring/bootstrap.php',
+    '7e9bd612cc444b3eed788ebbe46263a0' => $vendorDir . '/laminas/laminas-zendframework-bridge/src/autoload.php',
     '04c6c5c2f7095ccf6c481d3e53e1776f' => $vendorDir . '/mustangostang/spyc/Spyc.php',
     'f864ae44e8154e5ff6f4eec32f46d37f' => $baseDir . '/config/setup.php',
     '87988fc7b1c1f093da22a1a3de972f3a' => $baseDir . '/config/helpers.php',

@@ -7,8 +7,8 @@
 class ComposerStaticInitc26333d865e0329b638bdc17afd29896
 {
     public static $files = array (
-        '7e9bd612cc444b3eed788ebbe46263a0' => __DIR__ . '/..' . '/laminas/laminas-zendframework-bridge/src/autoload.php',
         '0e6d7bf4a5811bfa5cf40c5ccd6fae6a' => __DIR__ . '/..' . '/symfony/polyfill-mbstring/bootstrap.php',
+        '7e9bd612cc444b3eed788ebbe46263a0' => __DIR__ . '/..' . '/laminas/laminas-zendframework-bridge/src/autoload.php',
         '04c6c5c2f7095ccf6c481d3e53e1776f' => __DIR__ . '/..' . '/mustangostang/spyc/Spyc.php',
         'f864ae44e8154e5ff6f4eec32f46d37f' => __DIR__ . '/../..' . '/config/setup.php',
         '87988fc7b1c1f093da22a1a3de972f3a' => __DIR__ . '/../..' . '/config/helpers.php',

@@ -244,17 +244,17 @@
         },
         {
             "name": "laminas/laminas-zendframework-bridge",
-            "version": "1.2.0",
-            "version_normalized": "1.2.0.0",
+            "version": "1.3.0",
+            "version_normalized": "1.3.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laminas/laminas-zendframework-bridge.git",
-                "reference": "6cccbddfcfc742eb02158d6137ca5687d92cee32"
+                "reference": "13af2502d9bb6f7d33be2de4b51fb68c6cdb476e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-zendframework-bridge/zipball/6cccbddfcfc742eb02158d6137ca5687d92cee32",
-                "reference": "6cccbddfcfc742eb02158d6137ca5687d92cee32",
+                "url": "https://api.github.com/repos/laminas/laminas-zendframework-bridge/zipball/13af2502d9bb6f7d33be2de4b51fb68c6cdb476e",
+                "reference": "13af2502d9bb6f7d33be2de4b51fb68c6cdb476e",
                 "shasum": ""
             },
             "require": {
@@ -266,7 +266,7 @@
                 "squizlabs/php_codesniffer": "^3.5",
                 "vimeo/psalm": "^4.6"
             },
-            "time": "2021-02-25T21:54:58+00:00",
+            "time": "2021-06-24T12:49:22+00:00",
             "type": "library",
             "extra": {
                 "laminas": {

@@ -1,8 +1,8 @@
 <?php return array (
   'root' => 
   array (
-    'pretty_version' => '3.5.7-rc.1',
-    'version' => '3.5.7.0-RC1',
+    'pretty_version' => '3.5.7',
+    'version' => '3.5.7.0',
     'aliases' => 
     array (
     ),
@@ -31,8 +31,8 @@
     ),
     'getkirby/cms' => 
     array (
-      'pretty_version' => '3.5.7-rc.1',
-      'version' => '3.5.7.0-RC1',
+      'pretty_version' => '3.5.7',
+      'version' => '3.5.7.0',
       'aliases' => 
       array (
       ),
@@ -58,12 +58,12 @@
     ),
     'laminas/laminas-zendframework-bridge' => 
     array (
-      'pretty_version' => '1.2.0',
-      'version' => '1.2.0.0',
+      'pretty_version' => '1.3.0',
+      'version' => '1.3.0.0',
       'aliases' => 
       array (
       ),
-      'reference' => '6cccbddfcfc742eb02158d6137ca5687d92cee32',
+      'reference' => '13af2502d9bb6f7d33be2de4b51fb68c6cdb476e',
     ),
     'league/color-extractor' => 
     array (

@@ -27,8 +27,8 @@ class InstalledVersions
 private static $installed = array (
   'root' => 
   array (
-    'pretty_version' => '3.5.7-rc.1',
-    'version' => '3.5.7.0-RC1',
+    'pretty_version' => '3.5.7',
+    'version' => '3.5.7.0',
     'aliases' => 
     array (
     ),
@@ -57,8 +57,8 @@ class InstalledVersions
     ),
     'getkirby/cms' => 
     array (
-      'pretty_version' => '3.5.7-rc.1',
-      'version' => '3.5.7.0-RC1',
+      'pretty_version' => '3.5.7',
+      'version' => '3.5.7.0',
       'aliases' => 
       array (
       ),
@@ -84,12 +84,12 @@ class InstalledVersions
     ),
     'laminas/laminas-zendframework-bridge' => 
     array (
-      'pretty_version' => '1.2.0',
-      'version' => '1.2.0.0',
+      'pretty_version' => '1.3.0',
+      'version' => '1.3.0.0',
       'aliases' => 
       array (
       ),
-      'reference' => '6cccbddfcfc742eb02158d6137ca5687d92cee32',
+      'reference' => '13af2502d9bb6f7d33be2de4b51fb68c6cdb476e',
     ),
     'league/color-extractor' => 
     array (

@@ -1,11 +1,5 @@
 <?php
 
-/**
- * @see       https://github.com/laminas/laminas-zendframework-bridge for the canonical source repository
- * @copyright https://github.com/laminas/laminas-zendframework-bridge/blob/master/COPYRIGHT.md
- * @license   https://github.com/laminas/laminas-zendframework-bridge/blob/master/LICENSE.md New BSD License
- */
-
 namespace Laminas\ZendFrameworkBridge;
 
 use ArrayObject;

@@ -1,9 +1,3 @@
 <?php
 
-/**
- * @see       https://github.com/laminas/laminas-zendframework-bridge for the canonical source repository
- * @copyright https://github.com/laminas/laminas-zendframework-bridge/blob/master/COPYRIGHT.md
- * @license   https://github.com/laminas/laminas-zendframework-bridge/blob/master/LICENSE.md New BSD License
- */
-
 Laminas\ZendFrameworkBridge\Autoloader::load();

@@ -1,18 +1,10 @@
 <?php
 
-/**
- * @see       https://github.com/laminas/laminas-zendframework-bridge for the canonical source repository
- * @copyright https://github.com/laminas/laminas-zendframework-bridge/blob/master/COPYRIGHT.md
- * @license   https://github.com/laminas/laminas-zendframework-bridge/blob/master/LICENSE.md New BSD License
- */
-
 namespace Laminas\ZendFrameworkBridge;
 
 use function array_intersect_key;
 use function array_key_exists;
 use function array_pop;
-use function array_push;
-use function count;
 use function in_array;
 use function is_array;
 use function is_callable;
@@ -76,7 +68,7 @@ function ($value) {
             function ($value, array $keys) {
                 $key = array_pop($keys);
                 // Only worried about a top-level "router" key.
-                return $key === 'router' && count($keys) === 0 && is_array($value)
+                return $key === 'router' && $keys === [] && is_array($value)
                     ? [$this, 'noopReplacement']
                     : null;
             },
@@ -90,7 +82,7 @@ function ($value) {
 
             // Array values
             function ($value, array $keys) {
-                return 0 !== count($keys) && is_array($value)
+                return $keys !== [] && is_array($value)
                     ? [$this, '__invoke']
                     : null;
             },
@@ -159,7 +151,7 @@ private function replace($value, array $keys, $key = null)
     {
         // Add new key to the list of keys.
         // We do not need to remove it later, as we are working on a copy of the array.
-        array_push($keys, $key);
+        $keys[] = $key;
 
         // Identify rewrite strategy and perform replacements
         $rewriteRule = $this->replacementRuleMatch($value, $keys);

@@ -1,11 +1,5 @@
 <?php
 
-/**
- * @see       https://github.com/laminas/laminas-zendframework-bridge for the canonical source repository
- * @copyright https://github.com/laminas/laminas-zendframework-bridge/blob/master/COPYRIGHT.md
- * @license   https://github.com/laminas/laminas-zendframework-bridge/blob/master/LICENSE.md New BSD License
- */
-
 namespace Laminas\ZendFrameworkBridge;
 
 use Laminas\ModuleManager\Listener\ConfigMergerInterface;

@@ -1,11 +1,5 @@
 <?php
 
-/**
- * @see       https://github.com/laminas/laminas-zendframework-bridge for the canonical source repository
- * @copyright https://github.com/laminas/laminas-zendframework-bridge/blob/master/COPYRIGHT.md
- * @license   https://github.com/laminas/laminas-zendframework-bridge/blob/master/LICENSE.md New BSD License
- */
-
 namespace Laminas\ZendFrameworkBridge;
 
 use function array_merge;

@@ -1,11 +1,5 @@
 <?php
 
-/**
- * @see       https://github.com/laminas/laminas-zendframework-bridge for the canonical source repository
- * @copyright https://github.com/laminas/laminas-zendframework-bridge/blob/master/COPYRIGHT.md
- * @license   https://github.com/laminas/laminas-zendframework-bridge/blob/master/LICENSE.md New BSD License
- */
-
 namespace Laminas\ZendFrameworkBridge;
 
 class RewriteRules