SKU allows characters that are invalid for Varnish ESI loading

[CNanninga]

Steps to reproduce

1. Configure Magento to use Varnish for the full page cache
2. Create a product with an apostrophe in the SKU
3. Browse to the product on the front-end

Result

Result will depend on your level of error reporting. (Either there will be blank areas on the page where specific pieces of content being loaded via ESI should appear, with the PHP warning written to the error log, or the PHP warning will be output directly on the page:

Warning: SimpleXMLElement::xpath(): Invalid predicate in /server/sites/strancommerce.dev/vendor/magento/framework/View/Model/Layout/Merge.php on line 523

Cause

The apostrophe in the SKU is also included in the resulting layout update handle. When using Varnish, blocks being loaded via ESI result in requests like the following being issued from Varnish to the web server:

http://www.mysite.com/page_cache/block/esi/blocks/[%22catalog.topnav%22]/handles/[%22default%22,%22catalog_product_view%22,%22catalog_product_view_id_231%22,%22catalog_product_view_sku_Men%27s%20Shirt,%22catalog_product_view_type_configurable%22]/

In \Magento\Framework\View\Model\Layout\Merge::_fetchPackageLayoutUpdates, the update handle containing the SKU is passed straight to an xpath expression, where the special character results in the error.

---

If special characters like apostrophes are considered valid in a SKU, the ESI/layout processing should be modified accordingly to avoid the error. If they are not considered valid, sanitation should be done on SKUs to remove them when saving a product.

[adragus-inviqa]

/cc #874

[veloraven]

@CNanninga thank you for your report.
Please, provide the used Magento version.

[veloraven]

According to contributor guide, tickets without response for two weeks should be closed.
If this issue still reproducible please feel free to create the new one: format new issue according to the Issue reporting guidelines: with steps to reproduce, actual result and expected result and specify Magento version.

[Crafter47]

Please CHECK for the URL.

URL should not contain any of illegal characters " : ' / ¨% ï ^^ $ ! ... " etc...