diff --git a/core/modules/views/src/Tests/FieldApiDataTest.php b/core/modules/views/src/Tests/FieldApiDataTest.php
index 7a75c04..fbfdf00 100644
--- a/core/modules/views/src/Tests/FieldApiDataTest.php
+++ b/core/modules/views/src/Tests/FieldApiDataTest.php
@@ -98,7 +98,7 @@ function testViewsData() {
$this->assertTrue($data[$current_table][$field_storage->getName()]['field']['click sortable'], 'String field is click sortable.');
// Click sort should only be on the primary field.
$this->assertTrue(empty($data[$revision_table][$field_storage->getName()]['field']['click sortable']), 'Non-primary fields are not click sortable');
- $this->assertEqual($data[$current_table][$field_storage->getName()]['help'], 'Appears in: page, article. Also known as: Content: The giraffe2" label');
+ $this->assertEqual($data[$current_table][$field_storage->getName()]['help'], 'Appears in: page, article. Also known as: Content: The giraffe2" label');
}
}
diff --git a/core/modules/views/views.views.inc b/core/modules/views/views.views.inc
index 8e44d59..703e004 100644
--- a/core/modules/views/views.views.inc
+++ b/core/modules/views/views.views.inc
@@ -450,16 +450,15 @@ function views_field_default_views_data(FieldStorageConfigInterface $field_stora
if ($aliases) {
$data[$table_alias][$field_alias]['aliases'] = $aliases;
// The $also_known variable contains markup that is HTML escaped and that
- // loses safeness when imploded. In order to undo the previous escaping,
- // we perform a htmlspecialchars_decode() and rely on auto-escape to re-
- // escape the data on output. We do this here because what we are putting
- // into the help key of the field is schema-like plain-text data that is
- // not supposed to contain any markup, while t() outputs HTML data by
- // default. Considering the dual use of this help data (both as metadata
- // and as help text), other patterns such as use of #markup would not be
- // correct here.
- $also_known_list = htmlspecialchars_decode(implode(', ', $also_known), ENT_QUOTES | ENT_SUBSTITUTE);
- $data[$table_alias][$field_alias]['help'] .= ' ' . t('Also known as:') . ' ' . $also_known_list;
+ // loses safeness when imploded. The help text is used in #description
+ // and therefore XSS admin filtered by default. Escaped HTML is not
+ // altered by XSS filtering, therefore it is safe to just concatenate the
+ // strings. Ideally the result would also by marked safe so that, if the
+ // string is used in another context it would not be escaped again.
+ // Considering the dual use of this help data (both as metadata and as
+ // help text), other patterns such as use of #markup would not be correct
+ // here.
+ $data[$table_alias][$field_alias]['help'] .= ' ' . t('Also known as:') . ' ' . implode(', ', $also_known);
}
$keys = array_keys($field_columns);
diff --git a/core/modules/views_ui/src/Tests/HandlerTest.php b/core/modules/views_ui/src/Tests/HandlerTest.php
index ffc1efd..b2110a3 100644
--- a/core/modules/views_ui/src/Tests/HandlerTest.php
+++ b/core/modules/views_ui/src/Tests/HandlerTest.php
@@ -139,6 +139,9 @@ public function testUICRUD() {
$this->assertTrue(isset($display['display_options'][$type_info['plural']][$id]), 'Ensure the field was added to the view itself.');
}
+ /**
+ * Tests escaping of field labels in help text.
+ */
public function testHandlerHelpEscaping() {
// Setup a field with two instances using a different label.
// Ensure that the label is escaped properly.
@@ -165,12 +168,12 @@ public function testHandlerHelpEscaping() {
'field_name' => 'field_test',
'entity_type' => 'node',
'bundle' => 'article',
- 'label' => 'The giraffe" label '
+ 'label' => 'The giraffe" label '
]);
$field_config->save();
$this->drupalGet('admin/structure/views/nojs/add-handler/content/default/field');
- $this->assertText('Appears in: page, article. Also known as: Content: The giraffe" label alert("the return of the xss")');
+ $this->assertEscaped('Appears in: page, article. Also known as: Content: The giraffe" label ');
}
/**