Technical review issues

.php-version

@@ -0,0 +1 @@
+8.2.20

.phpcs.xml

@@ -5,6 +5,7 @@
 	<exclude-pattern>vendor</exclude-pattern>
 	<exclude-pattern>node_modules</exclude-pattern>
 	<exclude-pattern>registration.php</exclude-pattern>
+	<exclude-pattern>tmp</exclude-pattern>
 
 	<arg value="ps"/>
 	<arg name="colors"/>
@@ -14,9 +15,6 @@
 
 	<rule ref="Magento2">
 		<exclude name="PSR12.Properties.ConstantVisibility.NotFound" />
-
-		<!-- TODO: Upgrade obsolete migration scripts to Declarative Schema and Data Patches -->
-		<exclude name="Magento2.Legacy.InstallUpgrade" />
 	</rule>
 	<rule ref="PHPCompatibility"/>
 </ruleset>

Block/Adminhtml/SelectWidgetBlock.php

@@ -18,6 +18,7 @@
 
 namespace Tawk\Widget\Block\Adminhtml;
 
+use Magento\Framework\Escaper;
 use Magento\Backend\Block\Template;
 use Tawk\Widget\Model\WidgetFactory;
 
@@ -51,19 +52,32 @@ class SelectWidgetBlock extends Template
      */
     private static $validPatternList;
 
+    /**
+     * Escaper instance
+     *
+     * @var Escaper $escaper
+     */
+    protected $escaper;
+
     /**
      * Constructor
      *
      * @param Template\Context $context Template context
      * @param WidgetFactory $modelFactory Tawk.to Widget Model instance
+     * @param Escaper $escaper Escaper instance
      * @param array $data Template data
      */
-    public function __construct(Template\Context $context, WidgetFactory $modelFactory, array $data = [])
-    {
+    public function __construct(
+        Template\Context $context,
+        WidgetFactory $modelFactory,
+        Escaper $escaper,
+        array $data = []
+    ) {
         parent::__construct($context, $data);
         $this->logger  = $context->getLogger();
         $this->modelWidgetFactory = $modelFactory;
         $this->request = $context->getRequest();
+        $this->escaper = $escaper;
     }
 
     /**
@@ -256,4 +270,24 @@ private function getCurrentValuesFor($id)
 
         return [];
     }
+
+    /**
+     * Escapes URL
+     *
+     * @param string $url URL to escape
+     */
+    public function escaperEscapeUrl($url)
+    {
+        return $this->escaper->escapeUrl($url);
+    }
+
+    /**
+     * Escapes JavaScript
+     *
+     * @param string $js JavaScript to escape
+     */
+    public function escaperEscapeJs($js)
+    {
+        return $this->escaper->escapeJs($js);
+    }
 }

Block/Embed.php

@@ -19,6 +19,7 @@
 namespace Tawk\Widget\Block;
 
 use Magento\Framework\View\Element\Template;
+use Magento\Framework\Escaper;
 use Magento\Customer\Model\SessionFactory;
 
 use Tawk\Modules\UrlPatternMatcher;
@@ -68,18 +69,27 @@ class Embed extends Template
      */
     protected $modelSessionFactory;
 
+    /**
+     * Escaper instance
+     *
+     * @var Escaper $escaper
+     */
+    protected $escaper;
+
     /**
      * Constructor
      *
      * @param SessionFactory $sessionFactory Session Factory instance
      * @param WidgetFactory $modelFactory Tawk.to Widget Model instance
      * @param Template\Context $context Template Context
+     * @param Escaper $escaper Escaper instance
      * @param array $data Template data
      */
     public function __construct(
         SessionFactory $sessionFactory,
         WidgetFactory $modelFactory,
         Template\Context $context,
+        Escaper $escaper,
         array $data = []
     ) {
         parent::__construct($context, $data);
@@ -89,6 +99,7 @@ public function __construct(
         $this->model = $this->getWidgetModel();
         $this->request = $context->getRequest();
         $this->modelSessionFactory = $sessionFactory->create();
+        $this->escaper = $escaper;
     }
 
     /**
@@ -99,8 +110,8 @@ public function __construct(
     public function getEmbedUrl()
     {
         return 'https://embed.tawk.to'.
-            '/'.htmlspecialchars($this->model->getPageId()).
-            '/'.htmlspecialchars($this->model->getWidgetId());
+            '/'.$this->escaper->escapeUrl($this->model->getPageId()).
+            '/'.$this->escaper->escapeUrl($this->model->getWidgetId());
     }
 
     /**
@@ -227,4 +238,24 @@ protected function _toHtml()
             return '';
         }
     }
+
+    /**
+     * Escapes URL
+     *
+     * @param string $url URL to escape
+     */
+    public function escaperEscapeUrl($url)
+    {
+        return $this->escaper->escapeUrl($url);
+    }
+
+    /**
+     * Escapes JavaScript
+     *
+     * @param string $js JavaScript to escape
+     */
+    public function escaperEscapeJs($js)
+    {
+        return $this->escaper->escapeJs($js);
+    }
 }