diff --git a/core/modules/views/src/Tests/FieldApiDataTest.php b/core/modules/views/src/Tests/FieldApiDataTest.php index 7a75c04..fbfdf00 100644 --- a/core/modules/views/src/Tests/FieldApiDataTest.php +++ b/core/modules/views/src/Tests/FieldApiDataTest.php @@ -98,7 +98,7 @@ function testViewsData() { $this->assertTrue($data[$current_table][$field_storage->getName()]['field']['click sortable'], 'String field is click sortable.'); // Click sort should only be on the primary field. $this->assertTrue(empty($data[$revision_table][$field_storage->getName()]['field']['click sortable']), 'Non-primary fields are not click sortable'); - $this->assertEqual($data[$current_table][$field_storage->getName()]['help'], 'Appears in: page, article. Also known as: Content: The giraffe2" label'); + $this->assertEqual($data[$current_table][$field_storage->getName()]['help'], 'Appears in: page, article. Also known as: Content: The giraffe2" label'); } } diff --git a/core/modules/views/views.views.inc b/core/modules/views/views.views.inc index 8e44d59..703e004 100644 --- a/core/modules/views/views.views.inc +++ b/core/modules/views/views.views.inc @@ -450,16 +450,15 @@ function views_field_default_views_data(FieldStorageConfigInterface $field_stora if ($aliases) { $data[$table_alias][$field_alias]['aliases'] = $aliases; // The $also_known variable contains markup that is HTML escaped and that - // loses safeness when imploded. In order to undo the previous escaping, - // we perform a htmlspecialchars_decode() and rely on auto-escape to re- - // escape the data on output. We do this here because what we are putting - // into the help key of the field is schema-like plain-text data that is - // not supposed to contain any markup, while t() outputs HTML data by - // default. Considering the dual use of this help data (both as metadata - // and as help text), other patterns such as use of #markup would not be - // correct here. - $also_known_list = htmlspecialchars_decode(implode(', ', $also_known), ENT_QUOTES | ENT_SUBSTITUTE); - $data[$table_alias][$field_alias]['help'] .= ' ' . t('Also known as:') . ' ' . $also_known_list; + // loses safeness when imploded. The help text is used in #description + // and therefore XSS admin filtered by default. Escaped HTML is not + // altered by XSS filtering, therefore it is safe to just concatenate the + // strings. Ideally the result would also by marked safe so that, if the + // string is used in another context it would not be escaped again. + // Considering the dual use of this help data (both as metadata and as + // help text), other patterns such as use of #markup would not be correct + // here. + $data[$table_alias][$field_alias]['help'] .= ' ' . t('Also known as:') . ' ' . implode(', ', $also_known); } $keys = array_keys($field_columns); diff --git a/core/modules/views_ui/src/Tests/HandlerTest.php b/core/modules/views_ui/src/Tests/HandlerTest.php index ffc1efd..b2110a3 100644 --- a/core/modules/views_ui/src/Tests/HandlerTest.php +++ b/core/modules/views_ui/src/Tests/HandlerTest.php @@ -139,6 +139,9 @@ public function testUICRUD() { $this->assertTrue(isset($display['display_options'][$type_info['plural']][$id]), 'Ensure the field was added to the view itself.'); } + /** + * Tests escaping of field labels in help text. + */ public function testHandlerHelpEscaping() { // Setup a field with two instances using a different label. // Ensure that the label is escaped properly. @@ -165,12 +168,12 @@ public function testHandlerHelpEscaping() { 'field_name' => 'field_test', 'entity_type' => 'node', 'bundle' => 'article', - 'label' => 'The giraffe" label ' + 'label' => 'The giraffe" label ' ]); $field_config->save(); $this->drupalGet('admin/structure/views/nojs/add-handler/content/default/field'); - $this->assertText('Appears in: page, article. Also known as: Content: The giraffe" label alert("the return of the xss")'); + $this->assertEscaped('Appears in: page, article. Also known as: Content: The giraffe" label '); } /**