Merge branch 'security/escaper-usage'

Fixes a number of components that were not using Zend\Escaper to escape HTML,
HTML attributes, and/or URLs.

src/Uri.php

@@ -10,6 +10,7 @@
 
 namespace Zend\Uri;
 
+use Zend\Escaper\Escaper;
 use Zend\Validator;
 
 /**
@@ -125,6 +126,11 @@ class Uri implements UriInterface
      */
     protected static $defaultPorts = array();
 
+    /**
+     * @var Escaper
+     */
+    protected static $escaper;
+
     /**
      * Create a new URI object
      *
@@ -152,6 +158,31 @@ public function __construct($uri = null)
         }
     }
 
+    /**
+     * Set Escaper instance
+     * 
+     * @param  Escaper $escaper 
+     */
+    public static function setEscaper(Escaper $escaper)
+    {
+        static::$escaper = $escaper;
+    }
+
+    /**
+     * Retrieve Escaper instance
+     *
+     * Lazy-loads one if none provided
+     * 
+     * @return Escaper
+     */
+    public static function getEscaper()
+    {
+        if (null === static::$escaper) {
+            static::setEscaper(new Escaper());
+        }
+        return static::$escaper;
+    }
+
     /**
      * Check if the URI is valid
      *
@@ -935,8 +966,9 @@ public static function encodeUserInfo($userInfo)
         }
 
         $regex   = '/(?:[^' . self::CHAR_UNRESERVED . self::CHAR_SUB_DELIMS . '%:]|%(?![A-Fa-f0-9]{2}))/';
-        $replace = function($match) {
-            return rawurlencode($match[0]);
+        $escaper = static::getEscaper();
+        $replace = function ($match) use ($escaper) {
+            return $escaper->escapeUrl($match[0]);
         };
 
         return preg_replace_callback($regex, $replace, $userInfo);
@@ -962,8 +994,9 @@ public static function encodePath($path)
         }
 
         $regex   = '/(?:[^' . self::CHAR_UNRESERVED . ':@&=\+\$,\/;%]+|%(?![A-Fa-f0-9]{2}))/';
-        $replace = function($match) {
-            return rawurlencode($match[0]);
+        $escaper = static::getEscaper();
+        $replace = function ($match) use ($escaper) {
+            return $escaper->escapeUrl($match[0]);
         };
 
         return preg_replace_callback($regex, $replace, $path);
@@ -990,8 +1023,9 @@ public static function encodeQueryFragment($input)
         }
 
         $regex   = '/(?:[^' . self::CHAR_UNRESERVED . self::CHAR_SUB_DELIMS . '%:@\/\?]+|%(?![A-Fa-f0-9]{2}))/';
-        $replace = function($match) {
-            return rawurlencode($match[0]);
+        $escaper = static::getEscaper();
+        $replace = function ($match) use ($escaper) {
+            return $escaper->escapeUrl($match[0]);
         };
 
         return preg_replace_callback($regex, $replace, $input);