Add escaping of js translation version

[ihor-sviziev]

As it was discussed in #10378 (comment) - we need to escape js translation version.

Description

Previously value of $version variable was always sha1, that can be not escaped, but from now it uses raw value from public method, that could be overridden by plugin.

Fixed Issues (if relevant)

N/A

Manual testing scenarios

1. Put following code to getTranslationFileVersion method (directly or via plugin):

return "' || alert(1) || '";

2. Go to any page

Actual result:

1. Alert with message 1 is shown

Expected result:

1. Alert mustn't be shown

Contribution checklist

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds on Travis CI are green)

[orlangur]

Sorry, does not sound reasonable to me :) One can put some alert into plugin, but why?

Such approach means we shall escape output of EVERY public non-final method as it can be pluginized.

I'll tell you more, escapeJsQuote can be pluginized as well. Magento is pretty flexible thus if somebody really wants to shoot in the foot we cannot prevent it.

Cc: @ishakhsuvarov @hostep since you liked the idea, please share your thoughts. I may be a bit out of context.

[hostep]

@orlangur: I think if a value is outputted in a javascript string, it should be escaped, so if the value contains single quotes, it won't break the javascript.

This is not really to prevent injecting other javascript code to be executed, but in this case, so that the $version can contain single quotes in itself. Suppose someone (for some reason) wants to use a different hashing method that can contain single quotes in the hash, then those single quotes should be escaped in the output, otherwise the javascript code will break.

[orlangur]

@hostep ok, thanks, that's a bit closer to reality, just I'm not sure if there are actually some hash functions with single quotes in output. Generally I'm a bigger fan of "escape everything by default" approach, like Twig does, not sure why Magento picked up an opposite approach.