This rule escapes output using ->escapeHtml output function. It should be run only in phtml files because right now it will do this for whichever php file you provide. That is untested. You can take look at associated tests for which scenarios are covered. escapeJs and escapeUrl are yet to be implemented

Author: Abhishek Jakhotiya

Magento2/Rector/Src/AddHtmlEscaperToOutput.php

@@ -0,0 +1,65 @@
+<?php
+/**
+ * Copyright 2021 Adobe
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento2\Rector\Src;
+
+use PhpParser\Node;
+use PhpParser\Node\Stmt\Class_;
+use PhpParser\Node\Stmt\Echo_;
+use Rector\Core\Rector\AbstractRector;
+use Symplify\RuleDocGenerator\ValueObject\CodeSample\CodeSample;
+use Symplify\RuleDocGenerator\ValueObject\RuleDefinition;
+
+class AddHtmlEscaperToOutput extends AbstractRector
+{
+    /**
+     * @inheritDoc
+     */
+    public function getNodeTypes(): array
+    {
+        return [Echo_::class];
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function refactor(Node $node): ?Node
+    {
+       // if the echo already has escapeHtml called on $block or escaper, don't do anthing
+
+       $echoContent  = $node->exprs[0];
+
+       if($echoContent instanceof  Node\Expr\Variable || $echoContent instanceof Node\Expr\FuncCall){
+           $node->exprs[0] = new Node\Expr\MethodCall(new Node\Expr\Variable('escaper'),'escapeHtml',[new Node\Arg($echoContent)]);
+           return $node;
+       }
+
+       if($echoContent instanceof Node\Expr\MethodCall && $echoContent->name != 'escapeHtml'){
+
+           $node->exprs[0] = new Node\Expr\MethodCall(new Node\Expr\Variable('escaper'),'escapeHtml',[new Node\Arg($echoContent)]);
+           return $node;
+       }
+
+        return null;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getRuleDefinition(): RuleDefinition
+    {
+        return new RuleDefinition(
+            'Add escaper methods like escapeHtml to html output',
+            [
+                new CodeSample(
+                    'echo $productName',
+                    'echo $escaper->escapeHtml($productName)'
+                ),
+            ]
+        );
+    }
+}

Magento2/Rector/Tests/AddHtmlEscaperToOutput/AddHtmlEscaperToOutputTest.php

@@ -0,0 +1,36 @@
+<?php
+/**
+ * Copyright 2021 Adobe
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento2\Rector\Tests\AddHtmlEscaperToOutput;
+
+use Iterator;
+use Rector\Testing\PHPUnit\AbstractRectorTestCase;
+use Symplify\SmartFileSystem\SmartFileInfo;
+
+class AddHtmlEscaperToOutputTest extends AbstractRectorTestCase
+{
+    /**
+     * @dataProvider provideData()
+     */
+    public function test(string $fileInfo): void
+    {
+        $this->doTestFile($fileInfo);
+    }
+
+    /**
+     * @return Iterator<SmartFileInfo>
+     */
+    public function provideData(): Iterator
+    {
+        return $this->yieldFilesFromDirectory(__DIR__ . '/Fixture');
+    }
+
+    public function provideConfigFilePath(): string
+    {
+        return __DIR__ . '/config/configured_rule.php';
+    }
+}

Magento2/Rector/Tests/AddHtmlEscaperToOutput/Fixture/already-escaped-ouput.php.inc

@@ -0,0 +1,11 @@
+<?php
+
+echo $escaper->escapeHtml($productName);
+
+?>
+-----
+<?php
+
+echo $escaper->escapeHtml($productName);
+
+?>

Magento2/Rector/Tests/AddHtmlEscaperToOutput/Fixture/function-call.php.inc

@@ -0,0 +1,11 @@
+<?php
+
+echo $customer->getName();
+echo __('Something');
+?>
+-----
+<?php
+
+echo $escaper->escapeHtml($customer->getName());
+echo $escaper->escapeHtml(__('Something'));
+?>

Magento2/Rector/Tests/AddHtmlEscaperToOutput/Fixture/simple-echo.php.inc

@@ -0,0 +1,11 @@
+<?php
+
+echo $productName;
+
+?>
+-----
+<?php
+
+echo $escaper->escapeHtml($productName);
+
+?>

Magento2/Rector/Tests/AddHtmlEscaperToOutput/config/configured_rule.php

@@ -0,0 +1,13 @@
+<?php
+/**
+ * Copyright 2022 Adobe
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+use Magento2\Rector\Src\AddArrayAccessInterfaceReturnTypes;
+use Rector\Config\RectorConfig;
+
+return static function (RectorConfig $rectorConfig): void {
+    $rectorConfig->rule(\Magento2\Rector\Src\AddHtmlEscaperToOutput::class);
+};