diff --git a/core/includes/theme.inc b/core/includes/theme.inc
index 038aba9..4c3d0dc 100644
--- a/core/includes/theme.inc
+++ b/core/includes/theme.inc
@@ -1350,7 +1350,7 @@ function template_preprocess_page(&$variables) {
$variables['language'] = $language_interface;
$variables['logo'] = theme_get_setting('logo.url');
$variables['site_name'] = (theme_get_setting('features.name') ? SafeMarkup::checkPlain($site_config->get('name')) : '');
- $variables['site_slogan'] = (theme_get_setting('features.slogan') ? SafeMarkup::filterAdminXss($site_config->get('slogan')) : '');
+ $variables['site_slogan'] = (theme_get_setting('features.slogan') ? SafeMarkup::xssFilterAdmin($site_config->get('slogan')) : '');
// An exception might be thrown.
try {
diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index af85294..b11a65a 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -153,7 +153,7 @@ public static function escape($string) {
*
* @see \Drupal\Component\Utility\Xss::filterAdmin()
*/
- public static function filterAdminXss($string) {
+ public static function xssFilterAdmin($string) {
if (!static::isSafe($string)) {
$string = Xss::filterAdmin($string);
static::set($string);
@@ -165,12 +165,12 @@ public static function filterAdminXss($string) {
* Applies a very permissive XSS/HTML filter for admin-only use.
*
* @deprecated as of Drupal 8.0.x, will be removed before Drupal 9.0.0. Use
- * \Drupal\Component\Utility\SafeMarkup::filterAdminXss() instead.
+ * \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() instead.
*
- * @see \Drupal\Component\Utility\SafeMarkup::filterAdminXss()
+ * @see \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin()
*/
public static function checkAdminXss($string) {
- return static::filterAdminXss($string);
+ return static::xssFilterAdmin($string);
}
/**
@@ -192,7 +192,7 @@ public static function checkAdminXss($string) {
*
* @see \Drupal\Component\Utility\Xss::filter()
*/
- public static function filterXss($string, $html_tags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd')) {
+ public static function xssFilter($string, $html_tags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd')) {
$string = Xss::filter($string, $html_tags);
return static::set($string);
}
diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
index 6a79afb..5fd7c8f 100644
--- a/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -29,6 +29,11 @@ class Xss {
* Based on kses by Ulf Harnhammar, see http://sourceforge.net/projects/kses.
* For examples of various XSS attacks, see: http://ha.ckers.org/xss.html.
*
+ * This method is preferred to
+ * \Drupal\Component\Utility\SafeMarkup::xssFilter() when the result is
+ * not being used directly in the rendering system. For example, when its
+ * result is being combined with other strings before rendering.
+ *
* This code does four things:
* - Removes characters and constructs that can trick browsers.
* - Makes sure all HTML entities are well-formed.
@@ -47,7 +52,7 @@ class Xss {
* valid UTF-8.
*
* @see \Drupal\Component\Utility\Unicode::validateUtf8()
- * @see \Drupal\Component\Utility\SafeMarkup::filterXss()
+ * @see \Drupal\Component\Utility\SafeMarkup::xssFilter()
*
* @ingroup sanitization
*/
@@ -101,6 +106,11 @@ public static function filter($string, $html_tags = array('a', 'em', 'strong', '
* is desired (so \Drupal\Component\Utility\SafeMarkup::checkPlain() is
* not acceptable).
*
+ * This method is preferred to
+ * \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() when the result is
+ * not being used directly in the rendering system. For example, when its
+ * result is being combined with other strings before rendering.
+ *
* Allows all tags that can be used inside an HTML body, save
* for scripts and styles.
*
@@ -109,6 +119,8 @@ public static function filter($string, $html_tags = array('a', 'em', 'strong', '
*
* @return string
* The filtered string.
+ *
+ * @see \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin()
*/
public static function filterAdmin($string) {
return static::filter($string, static::$adminTags);
diff --git a/core/lib/Drupal/Core/Render/Element/HtmlTag.php b/core/lib/Drupal/Core/Render/Element/HtmlTag.php
index 5dc3afe..c861cf5 100644
--- a/core/lib/Drupal/Core/Render/Element/HtmlTag.php
+++ b/core/lib/Drupal/Core/Render/Element/HtmlTag.php
@@ -161,7 +161,7 @@ public static function preRenderConditionalComments($element) {
}
else {
// The IE expression might contain some user input data.
- $expression = SafeMarkup::checkAdminXss($browsers['IE']);
+ $expression = SafeMarkup::xssFilterAdmin($browsers['IE']);
}
// If the #prefix and #suffix properties are used, wrap them with
@@ -173,8 +173,8 @@ public static function preRenderConditionalComments($element) {
// Ensure what we are dealing with is safe.
// This would be done later anyway in drupal_render().
- $prefix = isset($elements['#prefix']) ? SafeMarkup::checkAdminXss($elements['#prefix']) : '';
- $suffix = isset($elements['#suffix']) ? SafeMarkup::checkAdminXss($elements['#suffix']) : '';
+ $prefix = isset($elements['#prefix']) ? SafeMarkup::xssFilterAdmin($elements['#prefix']) : '';
+ $suffix = isset($elements['#suffix']) ? SafeMarkup::xssFilterAdmin($elements['#suffix']) : '';
// Now calling SafeMarkup::set is safe, because we ensured the
// data coming in was at least admin escaped.
diff --git a/core/lib/Drupal/Core/Render/Renderer.php b/core/lib/Drupal/Core/Render/Renderer.php
index 858501b..6e56d0a 100644
--- a/core/lib/Drupal/Core/Render/Renderer.php
+++ b/core/lib/Drupal/Core/Render/Renderer.php
@@ -368,7 +368,7 @@ protected function doRender(&$elements, $is_root_call = FALSE) {
if (isset($elements['#markup'])) {
// @todo Decide how to support non-HTML in the render API in
// https://www.drupal.org/node/2501313.
- $elements['#markup'] = SafeMarkup::checkAdminXss($elements['#markup']);
+ $elements['#markup'] = SafeMarkup::xssFilterAdmin($elements['#markup']);
}
// Assume that if #theme is set it represents an implemented hook.
@@ -382,7 +382,7 @@ protected function doRender(&$elements, $is_root_call = FALSE) {
);
foreach ($markup_keys as $key) {
if (!empty($elements[$key]) && is_scalar($elements[$key])) {
- $elements[$key] = SafeMarkup::checkAdminXss($elements[$key]);
+ $elements[$key] = SafeMarkup::xssFilterAdmin($elements[$key]);
}
}
}
@@ -468,8 +468,8 @@ protected function doRender(&$elements, $is_root_call = FALSE) {
// with how render cached output gets stored. This ensures that placeholder
// replacement logic gets the same data to work with, no matter if #cache is
// disabled, #cache is enabled, there is a cache hit or miss.
- $prefix = isset($elements['#prefix']) ? SafeMarkup::checkAdminXss($elements['#prefix']) : '';
- $suffix = isset($elements['#suffix']) ? SafeMarkup::checkAdminXss($elements['#suffix']) : '';
+ $prefix = isset($elements['#prefix']) ? SafeMarkup::xssFilterAdmin($elements['#prefix']) : '';
+ $suffix = isset($elements['#suffix']) ? SafeMarkup::xssFilterAdmin($elements['#suffix']) : '';
$elements['#markup'] = $prefix . $elements['#children'] . $suffix;
diff --git a/core/modules/dblog/src/Controller/DbLogController.php b/core/modules/dblog/src/Controller/DbLogController.php
index 2e2eccf..04be50a 100644
--- a/core/modules/dblog/src/Controller/DbLogController.php
+++ b/core/modules/dblog/src/Controller/DbLogController.php
@@ -285,7 +285,7 @@ public function eventDetails($event_id) {
),
array(
array('data' => $this->t('Operations'), 'header' => TRUE),
- SafeMarkup::checkAdminXss($dblog->link),
+ SafeMarkup::xssFilterAdmin($dblog->link),
),
);
$build['dblog_table'] = array(
diff --git a/core/modules/editor/editor.module b/core/modules/editor/editor.module
index 7fa3c05..b130626 100644
--- a/core/modules/editor/editor.module
+++ b/core/modules/editor/editor.module
@@ -317,7 +317,7 @@ function editor_filter_xss($html, FilterFormatInterface $format, FilterFormatInt
$editor_xss_filter_class = '\Drupal\editor\EditorXssFilter\Standard';
\Drupal::moduleHandler()->alter('editor_xss_filter', $editor_xss_filter_class, $format, $original_format);
- return call_user_func($editor_xss_filter_class . '::filterXss', $html, $format, $original_format);
+ return call_user_func($editor_xss_filter_class . '::xssFilter', $html, $format, $original_format);
}
/**
diff --git a/core/modules/editor/editor.routing.yml b/core/modules/editor/editor.routing.yml
index dc41d18..39fff13 100644
--- a/core/modules/editor/editor.routing.yml
+++ b/core/modules/editor/editor.routing.yml
@@ -1,7 +1,7 @@
editor.filter_xss:
path: '/editor/filter_xss/{filter_format}'
defaults:
- _controller: '\Drupal\editor\EditorController::filterXss'
+ _controller: '\Drupal\editor\EditorController::xssFilter'
requirements:
_entity_access: 'filter_format.use'
diff --git a/core/modules/editor/src/EditorXssFilter/Standard.php b/core/modules/editor/src/EditorXssFilter/Standard.php
index 43ef797..d0aeb82 100644
--- a/core/modules/editor/src/EditorXssFilter/Standard.php
+++ b/core/modules/editor/src/EditorXssFilter/Standard.php
@@ -171,7 +171,7 @@ protected static function getForbiddenTags($restrictions) {
* {@inheritdoc}
*/
protected static function needsRemoval($html_tags, $elem) {
- // See static::filterXss() about how this class uses blacklisting instead
+ // See static::xssFilter() about how this class uses blacklisting instead
// of the normal whitelisting.
return !parent::needsRemoval($html_tags, $elem);
}
diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index ec687fa..d28b841 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -430,7 +430,7 @@ function template_preprocess_filter_tips(&$variables) {
foreach ($variables['tips'] as $name => $tiplist) {
foreach ($tiplist as $tip_key => $tip) {
$tiplist[$tip_key]['attributes'] = new Attribute();
- $tiplist[$tip_key]['tip'] = SafeMarkup::filterAdminXss($tiplist[$tip_key]['tip']);
+ $tiplist[$tip_key]['tip'] = SafeMarkup::xssFilterAdmin($tiplist[$tip_key]['tip']);
}
$variables['tips'][$name] = array(
diff --git a/core/modules/filter/src/Plugin/Filter/FilterCaption.php b/core/modules/filter/src/Plugin/Filter/FilterCaption.php
index e7140c4..ed241d8 100644
--- a/core/modules/filter/src/Plugin/Filter/FilterCaption.php
+++ b/core/modules/filter/src/Plugin/Filter/FilterCaption.php
@@ -45,7 +45,7 @@ public function process($text, $langcode) {
// Sanitize caption: decode HTML encoding, limit allowed HTML tags; only
// allow inline tags that are allowed by default, plus
.
$caption = Html::decodeEntities($caption);
- $caption = SafeMarkup::filterXss($caption, array('a', 'em', 'strong', 'cite', 'code', 'br'));
+ $caption = SafeMarkup::xssFilter($caption, array('a', 'em', 'strong', 'cite', 'code', 'br'));
// The caption must be non-empty.
if (Unicode::strlen($caption) === 0) {
diff --git a/core/modules/node/node.module b/core/modules/node/node.module
index 258d597..f3be5b6 100644
--- a/core/modules/node/node.module
+++ b/core/modules/node/node.module
@@ -509,7 +509,7 @@ function template_preprocess_node_add_list(&$variables) {
$variables['types'][$type->id()] = array(
'type' => $type->id(),
'add_link' => \Drupal::l($type->label(), new Url('node.add', array('node_type' => $type->id()))),
- 'description' => SafeMarkup::filterAdminXss($type->getDescription()),
+ 'description' => SafeMarkup::xssFilterAdmin($type->getDescription()),
);
}
}
diff --git a/core/modules/search/search.module b/core/modules/search/search.module
index a888b1b..25d52b5 100644
--- a/core/modules/search/search.module
+++ b/core/modules/search/search.module
@@ -767,7 +767,7 @@ function search_excerpt($keys, $text, $langcode = NULL) {
// Highlight keywords. Must be done at once to prevent conflicts ('strong'
// and '').
$text = trim(preg_replace('/' . $boundary . '(?:' . implode('|', $keys) . ')' . $boundary . '/iu', '\0', ' ' . $text . ' '));
- return SafeMarkup::filterXss($text, ['strong']);
+ return SafeMarkup::xssFilter($text, ['strong']);
}
/**
diff --git a/core/modules/simpletest/src/Form/SimpletestResultsForm.php b/core/modules/simpletest/src/Form/SimpletestResultsForm.php
index ea3447e..63dea75 100644
--- a/core/modules/simpletest/src/Form/SimpletestResultsForm.php
+++ b/core/modules/simpletest/src/Form/SimpletestResultsForm.php
@@ -313,7 +313,7 @@ public static function addResultForm(array &$form, array $results) {
$rows = array();
foreach ($assertions as $assertion) {
$row = array();
- $row[] = SafeMarkup::checkAdminXss($assertion->message);
+ $row[] = SafeMarkup::xssFilterAdmin($assertion->message);
$row[] = $assertion->message_group;
$row[] = \Drupal::service('file_system')->basename(($assertion->file));
$row[] = $assertion->line;
diff --git a/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
index c32fe51..117ba2c 100644
--- a/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
+++ b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
@@ -174,7 +174,7 @@ public function build() {
);
$build['site_slogan'] = array(
- '#markup' => SafeMarkup::filterAdminXss($site_config->get('slogan')),
+ '#markup' => SafeMarkup::xssFilterAdmin($site_config->get('slogan')),
'#access' => $this->configuration['use_site_slogan'],
);
diff --git a/core/modules/views/src/Plugin/views/field/Field.php b/core/modules/views/src/Plugin/views/field/Field.php
index 386456c..455f48e 100644
--- a/core/modules/views/src/Plugin/views/field/Field.php
+++ b/core/modules/views/src/Plugin/views/field/Field.php
@@ -671,7 +671,7 @@ public function renderItems($items) {
if (!empty($items)) {
$items = $this->prepareItemsByDelta($items);
if ($this->options['multi_type'] == 'separator' || !$this->options['group_rows']) {
- $separator = $this->options['multi_type'] == 'separator' ? SafeMarkup::checkAdminXss($this->options['separator']) : '';
+ $separator = $this->options['multi_type'] == 'separator' ? SafeMarkup::xssFilterAdmin($this->options['separator']) : '';
$build = [
'#type' => 'inline_template',
'#template' => '{{ items | safe_join(separator) }}',