diff --git a/core/includes/common.inc b/core/includes/common.inc index 4b83cc5..1a8f4dd 100644 --- a/core/includes/common.inc +++ b/core/includes/common.inc @@ -16,7 +16,6 @@ use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Number; use Drupal\Component\Utility\SortArray; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Tags; use Drupal\Component\Utility\UrlHelper; use Drupal\Core\Asset\AttachedAssets; @@ -281,10 +280,10 @@ function valid_email_address($mail) { * \Drupal\Component\Utility\UrlHelper::stripDangerousProtocols() instead. * * @see \Drupal\Component\Utility\UrlHelper::stripDangerousProtocols() - * @see \Drupal\Component\Utility\SafeMarkup::checkPlain() + * @see \Drupal\Component\Utility\Html::escape() */ function check_url($uri) { - return SafeMarkup::checkPlain(UrlHelper::stripDangerousProtocols($uri)); + return Html::escape(UrlHelper::stripDangerousProtocols($uri)); } /** diff --git a/core/includes/form.inc b/core/includes/form.inc index efbac99..ce99976 100644 --- a/core/includes/form.inc +++ b/core/includes/form.inc @@ -568,10 +568,13 @@ function template_preprocess_form_element_label(&$variables) { * Note: if the batch 'title', 'init_message', 'progress_message', or * 'error_message' could contain any user input, it is the responsibility of * the code calling batch_set() to sanitize them first with a function like - * \Drupal\Component\Utility\SafeMarkup::checkPlain() or + * \Drupal\Component\Utility\Html::escape() or * \Drupal\Component\Utility\Xss::filter(). Furthermore, if the batch operation - * returns any user input in the 'results' or 'message' keys of $context, it - * must also sanitize them first. + * returns any user input in the 'message' key of $context, it must also + * sanitize it first. The 'result' key is not displayed to the user and + * therefore it is responsibility the of the batch callbacks to handle + * sanitization if required. If the 'result' key is being theme using item_list + * the callback can rely on Twig auto-escape. * * Sample callback_batch_operation(): * @code @@ -595,8 +598,11 @@ function template_preprocess_form_element_label(&$variables) { * * $nodes = entity_load_multiple_by_properties('node', array('uid' => $uid, 'type' => $type)); * $node = reset($nodes); - * $context['results'][] = $node->id() . ' : ' . SafeMarkup::checkPlain($node->label()); - * $context['message'] = SafeMarkup::checkPlain($node->label()); + * // This can be used by the batch finished callback. If this is displayed to + * // the user via the item list theme then it will be auto-escaped. + * $context['results'][] = $node->id() . ' : ' . $node->label(); + * // This is used in JavaScript and should be escaped. + * $context['message'] = Html::escape($node->label()); * } * * // A more advanced example is a multi-step operation that loads all rows, @@ -615,10 +621,13 @@ function template_preprocess_form_element_label(&$variables) { * ->range(0, $limit) * ->execute(); * foreach ($result as $row) { - * $context['results'][] = $row->id . ' : ' . SafeMarkup::checkPlain($row->title); + * // This can be used by the batch finished callback. If this is displayed to + * // the user via the item list theme then it will be auto-escaped. + * $context['results'][] = $row->id . ' : ' . $row->title; * $context['sandbox']['progress']++; * $context['sandbox']['current_id'] = $row->id; - * $context['message'] = SafeMarkup::checkPlain($row->title); + * // This is used in JavaScript and should be escaped. + * $context['message'] = Html::escape($row->title); * } * if ($context['sandbox']['progress'] != $context['sandbox']['max']) { * $context['finished'] = $context['sandbox']['progress'] / $context['sandbox']['max']; diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc index 7bf9eab..36612ecf 100644 --- a/core/includes/install.core.inc +++ b/core/includes/install.core.inc @@ -2052,7 +2052,7 @@ function install_check_translations($langcode, $server_pattern) { 'title' => t('Translation'), 'value' => t('The %language translation is not available.', array('%language' => $language)), 'severity' => REQUIREMENT_ERROR, - 'description' => t('The %language translation file is not available at the translation server. Choose a different language or select English and translate your website later.', array('%language' => $language, '!url' => check_url($_SERVER['SCRIPT_NAME']))), + 'description' => t('The %language translation file is not available at the translation server. Choose a different language or select English and translate your website later.', array('%language' => $language, '@url' => UrlHelper::stripDangerousProtocols($_SERVER['SCRIPT_NAME']))), ); } else { @@ -2071,7 +2071,7 @@ function install_check_translations($langcode, $server_pattern) { 'title' => t('Translation'), 'value' => t('The %language translation could not be downloaded.', array('%language' => $language)), 'severity' => REQUIREMENT_ERROR, - 'description' => t('The %language translation file could not be downloaded. Choose a different language or select English and translate your website later.', array('%language' => $language, '!url' => check_url($_SERVER['SCRIPT_NAME']))), + 'description' => t('The %language translation file could not be downloaded. Choose a different language or select English and translate your website later.', array('%language' => $language, '@url' => UrlHelper::stripDangerousProtocols($_SERVER['SCRIPT_NAME']))), ); } } @@ -2281,11 +2281,11 @@ function install_display_requirements($install_state, $requirements) { $build['report']['#requirements'] = $requirements; if ($severity == REQUIREMENT_WARNING) { $build['#title'] = t('Requirements review'); - $build['#suffix'] = t('Check the messages and retry, or you may choose to continue anyway.', array('!retry' => check_url(drupal_requirements_url(REQUIREMENT_ERROR)), '!cont' => check_url(drupal_requirements_url($severity)))); + $build['#suffix'] = t('Check the messages and retry, or you may choose to continue anyway.', array('@retry' => UrlHelper::stripDangerousProtocols(drupal_requirements_url(REQUIREMENT_ERROR)), '@cont' => UrlHelper::stripDangerousProtocols(drupal_requirements_url($severity)))); } else { $build['#title'] = t('Requirements problem'); - $build['#suffix'] = t('Check the messages and try again.', array('!url' => check_url(drupal_requirements_url($severity)))); + $build['#suffix'] = t('Check the messages and try again.', array('@url' => UrlHelper::stripDangerousProtocols(drupal_requirements_url($severity)))); } return $build; } diff --git a/core/includes/schema.inc b/core/includes/schema.inc index b74c270..bba4eab 100644 --- a/core/includes/schema.inc +++ b/core/includes/schema.inc @@ -130,12 +130,6 @@ function drupal_install_schema($module) { * * @param string $module * The module for which the tables will be removed. - * - * @return array - * An array of arrays with the following key/value pairs: - * - success: a boolean indicating whether the query succeeded. - * - query: the SQL query(s) executed, passed through - * \Drupal\Component\Utility\SafeMarkup::checkPlain(). */ function drupal_uninstall_schema($module) { $schema = drupal_get_module_schema($module); diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php index b4e0989..b5ea87c 100644 --- a/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -16,8 +16,8 @@ * throughout the page request. * * Strings sanitized by self::checkPlain() and self::escape() are automatically - * marked safe, as are markup strings created from @link theme_render render - * arrays @endlink via drupal_render(). + * marked safe. The output of the render system is automatically filtered or + * escaped as necessary and then marked as safe. * * This class should be limited to internal use only. Module developers should * instead use the appropriate @@ -138,7 +138,11 @@ public static function setMultiple(array $safe_strings) { * self::set(), it won't be escaped again. */ public static function escape($string) { - return static::isSafe($string) ? $string : static::checkPlain($string); + if (!static::isSafe($string)) { + $string = Html::escape($string); + static::$safeStrings[$string]['html'] = TRUE; + } + return $string; } /** @@ -209,8 +213,8 @@ public static function checkPlain($text) { * use this when the resulting string is being generated for one of: * - Non-HTML usage, such as a plain-text email. * - Non-direct HTML output, such as a plain-text variable that will be - * printed as an HTML attribute value and therefore formatted with - * self::checkPlain() as part of that. + * printed as an HTML attribute value and therefore escaped as part of + * that. * - Some other special reason for suppressing sanitization. * * @return string diff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php index 608a5da..df20c23 100644 --- a/core/lib/Drupal/Component/Utility/UrlHelper.php +++ b/core/lib/Drupal/Component/Utility/UrlHelper.php @@ -303,7 +303,7 @@ public static function setAllowedProtocols(array $protocols = array()) { * check_url() or Drupal\Component\Utility\Xss::filter(), but those functions * return an HTML-encoded string, so this function can be called independently * when the output needs to be a plain-text string for passing to functions - * that will call \Drupal\Component\Utility\SafeMarkup::checkPlain() separately. + * that will call \Drupal\Component\Utility\Html::escape() separately. * * @param string $uri * A plain-text URI that might contain dangerous protocols. diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php index d61d821..67cfa9c 100644 --- a/core/lib/Drupal/Component/Utility/Xss.php +++ b/core/lib/Drupal/Component/Utility/Xss.php @@ -104,10 +104,9 @@ public static function filter($string, array $html_tags = NULL) { /** * Applies a very permissive XSS/HTML filter for admin-only use. * - * Use only for fields where it is impractical to use the - * whole filter system, but where some (mainly inline) mark-up - * is desired (so \Drupal\Component\Utility\SafeMarkup::checkPlain() is - * not acceptable). + * Use only for fields where it is impractical to use the whole filter system, + * but where some (mainly inline) mark-up is desired (so + * \Drupal\Component\Utility\Html::escape() is not acceptable). * * Allows all tags that can be used inside an HTML body, save * for scripts and styles. diff --git a/core/lib/Drupal/Core/Block/BlockBase.php b/core/lib/Drupal/Core/Block/BlockBase.php index ef127e9..8c97809 100644 --- a/core/lib/Drupal/Core/Block/BlockBase.php +++ b/core/lib/Drupal/Core/Block/BlockBase.php @@ -8,7 +8,6 @@ namespace Drupal\Core\Block; use Drupal\block\BlockInterface; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Access\AccessResult; use Drupal\Core\Cache\CacheableDependencyInterface; use Drupal\Core\Form\FormStateInterface; @@ -166,7 +165,7 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta $form['admin_label'] = array( '#type' => 'item', '#title' => $this->t('Block description'), - '#markup' => SafeMarkup::checkPlain($definition['admin_label']), + '#plain_text' => $definition['admin_label'], ); $form['label'] = array( '#type' => 'textfield', diff --git a/core/lib/Drupal/Core/Controller/TitleResolverInterface.php b/core/lib/Drupal/Core/Controller/TitleResolverInterface.php index bedfd17..fa72e11 100644 --- a/core/lib/Drupal/Core/Controller/TitleResolverInterface.php +++ b/core/lib/Drupal/Core/Controller/TitleResolverInterface.php @@ -17,18 +17,20 @@ /** * Returns a static or dynamic title for the route. * - * The returned title string must be safe to output in HTML. For example, an - * implementation should call \Drupal\Component\Utility\SafeMarkup::checkPlain() - * or \Drupal\Component\Utility\Xss::filterAdmin() on the string, or use - * appropriate placeholders to sanitize dynamic content inside a localized - * string before returning it. The title may contain HTML such as EM tags. + * If the returned title can contain HTML that should not be escaped it should + * return a render array, for example: + * @code + * ['#markup' => 'title', '#allowed_tags' => ['em']] + * @endcode + * If the method returns a string and it is not marked safe then it will be + * auto-escaped. * * @param \Symfony\Component\HttpFoundation\Request $request * The request object passed to the title callback. * @param \Symfony\Component\Routing\Route $route * The route information of the route to fetch the title. * - * @return string|null + * @return array|string|null * The title for the route. */ public function getTitle(Request $request, Route $route); diff --git a/core/lib/Drupal/Core/Diff/DiffFormatter.php b/core/lib/Drupal/Core/Diff/DiffFormatter.php index cfd6bb8..cf44b72 100644 --- a/core/lib/Drupal/Core/Diff/DiffFormatter.php +++ b/core/lib/Drupal/Core/Diff/DiffFormatter.php @@ -9,7 +9,7 @@ use Drupal\Component\Diff\DiffFormatter as DiffFormatterBase; use Drupal\Component\Diff\WordLevelDiff; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Config\ConfigFactoryInterface; /** @@ -107,7 +107,9 @@ protected function addedLine($line) { 'class' => 'diff-marker', ), array( - 'data' => $line, + 'data' => [ + '#plain_text' => $line, + ], 'class' => 'diff-context diff-addedline', ) ); @@ -129,7 +131,9 @@ protected function deletedLine($line) { 'class' => 'diff-marker', ), array( - 'data' => $line, + 'data' => [ + '#plain_text' => $line, + ], 'class' => 'diff-context diff-deletedline', ) ); @@ -148,7 +152,9 @@ protected function contextLine($line) { return array( ' ', array( - 'data' => $line, + 'data' => [ + '#plain_text' => $line, + ], 'class' => 'diff-context', ) ); @@ -172,7 +178,7 @@ protected function emptyLine() { */ protected function _added($lines) { foreach ($lines as $line) { - $this->rows[] = array_merge($this->emptyLine(), $this->addedLine(SafeMarkup::checkPlain($line))); + $this->rows[] = array_merge($this->emptyLine(), $this->addedLine($line)); } } @@ -181,7 +187,7 @@ protected function _added($lines) { */ protected function _deleted($lines) { foreach ($lines as $line) { - $this->rows[] = array_merge($this->deletedLine(SafeMarkup::checkPlain($line)), $this->emptyLine()); + $this->rows[] = array_merge($this->deletedLine($line), $this->emptyLine()); } } @@ -190,7 +196,7 @@ protected function _deleted($lines) { */ protected function _context($lines) { foreach ($lines as $line) { - $this->rows[] = array_merge($this->contextLine(SafeMarkup::checkPlain($line)), $this->contextLine(SafeMarkup::checkPlain($line))); + $this->rows[] = array_merge($this->contextLine($line), $this->contextLine($line)); } } diff --git a/core/lib/Drupal/Core/Entity/EntityListBuilder.php b/core/lib/Drupal/Core/Entity/EntityListBuilder.php index 6fbdeda..b4e54b1 100644 --- a/core/lib/Drupal/Core/Entity/EntityListBuilder.php +++ b/core/lib/Drupal/Core/Entity/EntityListBuilder.php @@ -9,7 +9,6 @@ use Drupal\Core\Extension\ModuleHandlerInterface; use Symfony\Component\DependencyInjection\ContainerInterface; -use Drupal\Component\Utility\SafeMarkup; /** * Defines a generic implementation to build a listing of entities. @@ -112,10 +111,10 @@ protected function getEntityIds() { * The entity being listed. * * @return string - * The escaped entity label. + * The entity label. */ protected function getLabel(EntityInterface $entity) { - return SafeMarkup::checkPlain($entity->label()); + return $entity->label(); } /** diff --git a/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php b/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php index cb8c7d6..f05844a 100644 --- a/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php +++ b/core/lib/Drupal/Core/Entity/Plugin/EntityReferenceSelection/SelectionBase.php @@ -7,7 +7,6 @@ namespace Drupal\Core\Entity\Plugin\EntityReferenceSelection; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Query\AlterableInterface; use Drupal\Core\Database\Query\SelectInterface; use Drupal\Core\Entity\EntityManagerInterface; @@ -235,7 +234,7 @@ public function getReferenceableEntities($match = NULL, $match_operator = 'CONTA $entities = entity_load_multiple($target_type, $result); foreach ($entities as $entity_id => $entity) { $bundle = $entity->bundle(); - $options[$bundle][$entity_id] = SafeMarkup::checkPlain($entity->label()); + $options[$bundle][$entity_id] = $entity->label(); } return $options; diff --git a/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php index 6a2bd6c..a6f5e84 100644 --- a/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php +++ b/core/lib/Drupal/Core/EventSubscriber/ExceptionLoggingSubscriber.php @@ -7,7 +7,6 @@ namespace Drupal\Core\EventSubscriber; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Logger\LoggerChannelFactoryInterface; use Drupal\Core\Utility\Error; use Symfony\Component\EventDispatcher\EventSubscriberInterface; @@ -45,7 +44,7 @@ public function __construct(LoggerChannelFactoryInterface $logger) { */ public function on403(GetResponseForExceptionEvent $event) { $request = $event->getRequest(); - $this->logger->get('access denied')->warning(SafeMarkup::checkPlain($request->getRequestUri())); + $this->logger->get('access denied')->warning('%uri', ['%uri' => $request->getRequestUri()]); } /** @@ -56,7 +55,7 @@ public function on403(GetResponseForExceptionEvent $event) { */ public function on404(GetResponseForExceptionEvent $event) { $request = $event->getRequest(); - $this->logger->get('page not found')->warning(SafeMarkup::checkPlain($request->getRequestUri())); + $this->logger->get('page not found')->warning('%uri', ['%uri' => $request->getRequestUri()]); } /** diff --git a/core/lib/Drupal/Core/Extension/ThemeHandler.php b/core/lib/Drupal/Core/Extension/ThemeHandler.php index 2eb56bc..83465bf 100644 --- a/core/lib/Drupal/Core/Extension/ThemeHandler.php +++ b/core/lib/Drupal/Core/Extension/ThemeHandler.php @@ -7,7 +7,6 @@ namespace Drupal\Core\Extension; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Config\ConfigFactoryInterface; use Drupal\Core\State\StateInterface; @@ -431,7 +430,7 @@ public function getName($theme) { if (!isset($themes[$theme])) { throw new \InvalidArgumentException("Requested the name of a non-existing theme $theme"); } - return SafeMarkup::checkPlain($themes[$theme]->info['name']); + return $themes[$theme]->info['name']; } /** diff --git a/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php b/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php index 95b1864..c58096a 100644 --- a/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php +++ b/core/lib/Drupal/Core/Field/AllowedTagsXssTrait.php @@ -24,7 +24,7 @@ * * Used for items entered by administrators, like field descriptions, allowed * values, where some (mainly inline) mark-up may be desired (so - * \Drupal\Component\Utility\SafeMarkup::checkPlain() is not acceptable). + * \Drupal\Component\Utility\Html::escape() is not acceptable). * * @param string $string * The string with raw HTML in it. diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php index c03b96d..9d2b730 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php @@ -7,7 +7,7 @@ namespace Drupal\Core\Field\Plugin\Field\FieldFormatter; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Field\FormatterBase; use Drupal\Core\Field\FieldItemListInterface; @@ -37,7 +37,7 @@ public function viewElements(FieldItemListInterface $items) { foreach ($items as $delta => $item) { // The text value has no text format assigned to it, so the user input // should equal the output, including newlines. - $elements[$delta] = array('#markup' => nl2br(SafeMarkup::checkPlain($item->value))); + $elements[$delta] = array('#markup' => nl2br(Html::escape($item->value))); } return $elements; diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php index 69b5b9f..3f73939 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceIdFormatter.php @@ -8,7 +8,6 @@ namespace Drupal\Core\Field\Plugin\Field\FieldFormatter; use Drupal\Core\Field\FieldItemListInterface; -use Drupal\Component\Utility\SafeMarkup; /** * Plugin implementation of the 'entity reference ID' formatter. @@ -33,7 +32,7 @@ public function viewElements(FieldItemListInterface $items) { foreach ($this->getEntitiesToView($items) as $delta => $entity) { if ($entity->id()) { $elements[$delta] = array( - '#markup' => SafeMarkup::checkPlain($entity->id()), + '#plain_text' => $entity->id(), // Create a cache tag entry for the referenced entity. In the case // that the referenced entity is deleted, the cache for referring // entities must be cleared. diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php index c362a80..68d28ad 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/EntityReferenceLabelFormatter.php @@ -7,7 +7,6 @@ namespace Drupal\Core\Field\Plugin\Field\FieldFormatter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\Exception\UndefinedLinkTemplateException; use Drupal\Core\Field\FieldItemListInterface; use Drupal\Core\Form\FormStateInterface; @@ -98,7 +97,7 @@ public function viewElements(FieldItemListInterface $items) { } } else { - $elements[$delta] = array('#markup' => SafeMarkup::checkPlain($label)); + $elements[$delta] = array('#plain_text' => $label); } $elements[$delta]['#cache']['tags'] = $entity->getCacheTags(); } diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php index dea2989..c8185aa 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php @@ -7,7 +7,6 @@ namespace Drupal\Core\Field\Plugin\Field\FieldFormatter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Field\FieldDefinitionInterface; use Drupal\Core\Field\FieldItemInterface; @@ -123,7 +122,7 @@ protected function viewValue(FieldItemInterface $item) { // storage by LanguageManager::getLanguages()) or in its native language // name. That only depends on formatter settings and no language condition. $languages = $this->getSetting('native_language') ? $this->languageManager->getNativeLanguages(LanguageInterface::STATE_ALL) : $this->languageManager->getLanguages(LanguageInterface::STATE_ALL); - return $item->language && isset($languages[$item->language->getId()]) ? SafeMarkup::checkPlain($languages[$item->language->getId()]->getName()) : ''; + return $item->language && isset($languages[$item->language->getId()]) ? $languages[$item->language->getId()]->getName() : ''; } } diff --git a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php index 6276f95..1379282 100644 --- a/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php +++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php @@ -7,7 +7,7 @@ namespace Drupal\Core\Field\Plugin\Field\FieldFormatter; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Entity\RevisionableInterface; use Drupal\Core\Field\FieldDefinitionInterface; @@ -128,17 +128,16 @@ public function viewElements(FieldItemListInterface $items) { } foreach ($items as $delta => $item) { - $string = $this->viewValue($item); + $elements[$delta] = ['#markup' => $this->viewValue($item)]; + + // Wrap in a link if configured to. if ($url) { $elements[$delta] = [ '#type' => 'link', - '#title' => $string, + '#title' => $elements[$delta], '#url' => $url, ]; } - else { - $elements[$delta] = ['#markup' => $string]; - } } return $elements; } @@ -155,7 +154,7 @@ public function viewElements(FieldItemListInterface $items) { protected function viewValue(FieldItemInterface $item) { // The text value has no text format assigned to it, so the user input // should equal the output, including newlines. - return nl2br(SafeMarkup::checkPlain($item->value)); + return nl2br(Html::escape($item->value)); } } diff --git a/core/lib/Drupal/Core/Field/WidgetBase.php b/core/lib/Drupal/Core/Field/WidgetBase.php index 0103071..4b0b5d3 100644 --- a/core/lib/Drupal/Core/Field/WidgetBase.php +++ b/core/lib/Drupal/Core/Field/WidgetBase.php @@ -10,7 +10,6 @@ use Drupal\Component\Utility\Html; use Drupal\Component\Utility\NestedArray; use Drupal\Component\Utility\SortArray; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\Element; use Symfony\Component\Validator\ConstraintViolationInterface; @@ -85,7 +84,7 @@ public function form(FieldItemListInterface $items, array &$form, FormStateInter if ($this->handlesMultipleValues() || isset($get_delta)) { $delta = isset($get_delta) ? $get_delta : 0; $element = array( - '#title' => SafeMarkup::checkPlain($this->fieldDefinition->getLabel()), + '#title' => $this->fieldDefinition->getLabel(), '#description' => FieldFilteredString::create(\Drupal::token()->replace($this->fieldDefinition->getDescription())), ); $element = $this->formSingleElement($items, $delta, $element, $form, $form_state); @@ -164,7 +163,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f break; } - $title = SafeMarkup::checkPlain($this->fieldDefinition->getLabel()); + $title = $this->fieldDefinition->getLabel(); $description = FieldFilteredString::create(\Drupal::token()->replace($this->fieldDefinition->getDescription())); $elements = array(); diff --git a/core/lib/Drupal/Core/Form/form.api.php b/core/lib/Drupal/Core/Form/form.api.php index 9173231..12ce8d1 100644 --- a/core/lib/Drupal/Core/Form/form.api.php +++ b/core/lib/Drupal/Core/Form/form.api.php @@ -5,8 +5,6 @@ * Callbacks and hooks related to form system. */ -use Drupal\Component\Utility\SafeMarkup; - /** * @addtogroup callbacks * @{ @@ -79,7 +77,7 @@ function callback_batch_operation($MULTIPLE_PARAMS, &$context) { node_save($node); // Store some result for post-processing in the finished callback. - $context['results'][] = SafeMarkup::checkPlain($node->title); + $context['results'][] = $node->title; // Update our progress information. $context['sandbox']['progress']++; diff --git a/core/lib/Drupal/Core/Menu/menu.api.php b/core/lib/Drupal/Core/Menu/menu.api.php index e68b795..45396fd 100644 --- a/core/lib/Drupal/Core/Menu/menu.api.php +++ b/core/lib/Drupal/Core/Menu/menu.api.php @@ -611,7 +611,7 @@ function hook_system_breadcrumb_alter(\Drupal\Core\Breadcrumb\Breadcrumb &$bread * Drupal\Core\Template\Attribute($options['attributes']). * - html: Whether or not HTML should be allowed as the link text. If FALSE, * the text will be run through - * \Drupal\Component\Utility\SafeMarkup::checkPlain() before being output. + * \Drupal\Component\Utility\Html::escape() before being output. * * @see \Drupal\Core\Routing\UrlGenerator::generateFromPath() * @see \Drupal\Core\Routing\UrlGenerator::generateFromRoute() diff --git a/core/lib/Drupal/Core/Render/Element/Checkbox.php b/core/lib/Drupal/Core/Render/Element/Checkbox.php index 5f39bcc..28b15a6 100644 --- a/core/lib/Drupal/Core/Render/Element/Checkbox.php +++ b/core/lib/Drupal/Core/Render/Element/Checkbox.php @@ -7,8 +7,11 @@ namespace Drupal\Core\Render\Element; +use Drupal\Component\Utility\Html as HtmlUtility; +use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\Element; +use Drupal\Core\Render\SafeString; /** * Provides a form element for a single checkbox. @@ -106,6 +109,12 @@ public static function preRenderCheckbox($element) { } static::setAttributes($element, array('form-checkbox')); + // Ensure the title is safe. Default to escaping to make this the same as + // Twig's auto-escape feature. + if (isset($element['#title']) && !SafeMarkup::isSafe($element['#title'])) { + $element['#title'] = SafeString::create(HtmlUtility::escape($element['#title'])); + } + return $element; } diff --git a/core/lib/Drupal/Core/Render/Element/Radio.php b/core/lib/Drupal/Core/Render/Element/Radio.php index 2e8b28c..663fb9e 100644 --- a/core/lib/Drupal/Core/Render/Element/Radio.php +++ b/core/lib/Drupal/Core/Render/Element/Radio.php @@ -7,7 +7,10 @@ namespace Drupal\Core\Render\Element; +use Drupal\Component\Utility\Html as HtmlUtility; +use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Render\Element; +use Drupal\Core\Render\SafeString; /** * Provides a form element for a single radio button. @@ -66,6 +69,12 @@ public static function preRenderRadio($element) { } static::setAttributes($element, array('form-radio')); + // Ensure the title is safe. Default to escaping to make this the same as + // Twig's auto-escape feature. + if (isset($element['#title']) && !SafeMarkup::isSafe($element['#title'])) { + $element['#title'] = SafeString::create(HtmlUtility::escape($element['#title'])); + } + return $element; } diff --git a/core/lib/Drupal/Core/Session/AccountInterface.php b/core/lib/Drupal/Core/Session/AccountInterface.php index fa437c0..96aeb2d 100644 --- a/core/lib/Drupal/Core/Session/AccountInterface.php +++ b/core/lib/Drupal/Core/Session/AccountInterface.php @@ -116,10 +116,7 @@ public function getPreferredAdminLangcode($fallback_to_default = TRUE); * @see hook_user_format_name_alter() * * @return - * An unsanitized string with the username to display. The code receiving - * this result must ensure that \Drupal\Component\Utility\SafeMarkup::checkPlain() - * is called on it before it is - * printed to the page. + * An unsanitized string with the username to display. */ public function getUsername(); diff --git a/core/lib/Drupal/Core/Utility/Token.php b/core/lib/Drupal/Core/Utility/Token.php index 9966726..1db2a04 100644 --- a/core/lib/Drupal/Core/Utility/Token.php +++ b/core/lib/Drupal/Core/Utility/Token.php @@ -164,7 +164,7 @@ public function __construct(ModuleHandlerInterface $module_handler, CacheBackend * display to a web browser. Defaults to TRUE. Developers who set this * option to FALSE assume responsibility for running * \Drupal\Component\Utility\Xss::filter(), - * \Drupal\Component\Utility\SafeMarkup::checkPlain() or other appropriate + * \Drupal\Component\Utility\Html::escape() or other appropriate * scrubbing functions before displaying data to users. * @param \Drupal\Core\Render\BubbleableMetadata $bubbleable_metadata|null * (optional) An object to which static::generate() and the hooks and @@ -285,7 +285,7 @@ public function scan($text) { * - sanitize: A boolean flag indicating that tokens should be sanitized for * display to a web browser. Developers who set this option to FALSE assume * responsibility for running \Drupal\Component\Utility\Xss::filter(), - * \Drupal\Component\Utility\SafeMarkup::checkPlain() or other appropriate + * \Drupal\Component\Utility\Html::escape() or other appropriate * scrubbing functions before displaying data to users. * @param \Drupal\Core\Render\BubbleableMetadata $bubbleable_metadata * The bubbleable metadata. This is passed to the token replacement diff --git a/core/modules/action/action.views_execution.inc b/core/modules/action/action.views_execution.inc index db7fef5..5b4f71f 100644 --- a/core/modules/action/action.views_execution.inc +++ b/core/modules/action/action.views_execution.inc @@ -5,8 +5,6 @@ * Provides views runtime hooks for action.module. */ -use Drupal\Component\Utility\SafeMarkup; - /** * Implements hook_views_form_substitutions(). */ diff --git a/core/modules/aggregator/aggregator.theme.inc b/core/modules/aggregator/aggregator.theme.inc index e2a4591..a47a611 100644 --- a/core/modules/aggregator/aggregator.theme.inc +++ b/core/modules/aggregator/aggregator.theme.inc @@ -5,6 +5,7 @@ * Preprocessors and theme functions of Aggregator module. */ +use Drupal\Component\Utility\UrlHelper; use Drupal\Core\Render\Element; /** @@ -24,7 +25,7 @@ function template_preprocess_aggregator_item(&$variables) { $variables['content'][$key] = $variables['elements'][$key]; } - $variables['url'] = check_url($item->getLink()); + $variables['url'] = UrlHelper::stripDangerousProtocols($item->getLink()); $variables['title'] = $item->label(); } diff --git a/core/modules/aggregator/src/Plugin/views/argument/Fid.php b/core/modules/aggregator/src/Plugin/views/argument/Fid.php index b4abeca..f219d17 100644 --- a/core/modules/aggregator/src/Plugin/views/argument/Fid.php +++ b/core/modules/aggregator/src/Plugin/views/argument/Fid.php @@ -9,7 +9,6 @@ use Drupal\Core\Entity\EntityManagerInterface; use Drupal\views\Plugin\views\argument\NumericArgument; -use Drupal\Component\Utility\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; /** @@ -60,7 +59,7 @@ public function titleQuery() { $feeds = $this->entityManager->getStorage('aggregator_feed')->loadMultiple($this->value); foreach ($feeds as $feed) { - $titles[] = SafeMarkup::checkPlain($feed->label()); + $titles[] = $feed->label(); } return $titles; } diff --git a/core/modules/aggregator/src/Plugin/views/argument/Iid.php b/core/modules/aggregator/src/Plugin/views/argument/Iid.php index a125856..d04968b 100644 --- a/core/modules/aggregator/src/Plugin/views/argument/Iid.php +++ b/core/modules/aggregator/src/Plugin/views/argument/Iid.php @@ -9,7 +9,6 @@ use Drupal\Core\Entity\EntityManagerInterface; use Drupal\views\Plugin\views\argument\NumericArgument; -use Drupal\Component\Utility\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; /** @@ -60,7 +59,7 @@ public function titleQuery() { $items = $this->entityManager->getStorage('aggregator_item')->loadMultiple($this->value); foreach ($items as $feed) { - $titles[] = SafeMarkup::checkPlain($feed->label()); + $titles[] = $feed->label(); } return $titles; } diff --git a/core/modules/block/src/BlockListBuilder.php b/core/modules/block/src/BlockListBuilder.php index 43d7a1c..c0a3b2e 100644 --- a/core/modules/block/src/BlockListBuilder.php +++ b/core/modules/block/src/BlockListBuilder.php @@ -9,7 +9,6 @@ use Drupal\Component\Utility\Html; use Drupal\Component\Serialization\Json; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityStorageInterface; @@ -261,7 +260,7 @@ protected function buildBlocksForm() { $form[$entity_id]['#attributes']['class'][] = 'js-block-placed'; } $form[$entity_id]['info'] = array( - '#markup' => SafeMarkup::checkPlain($info['label']), + '#plain_text' => $info['label'], '#wrapper_attributes' => array( 'class' => array('block'), ), diff --git a/core/modules/block/src/BlockViewBuilder.php b/core/modules/block/src/BlockViewBuilder.php index 187692d..3ff8ae7 100644 --- a/core/modules/block/src/BlockViewBuilder.php +++ b/core/modules/block/src/BlockViewBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\block; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\Cache; use Drupal\Core\Cache\CacheableMetadata; use Drupal\Core\Entity\EntityViewBuilder; @@ -83,7 +82,7 @@ public function viewMultiple(array $entities = array(), $view_mode = 'full', $la // Add the entity so that it can be used in the #pre_render method. '#block' => $entity, ); - $build[$entity_id]['#configuration']['label'] = SafeMarkup::checkPlain($configuration['label']); + $build[$entity_id]['#configuration']['label'] = $configuration['label']; // Don't run in ::buildBlock() to ensure cache keys can be altered. If an // alter hook wants to modify the block contents, it can append another diff --git a/core/modules/block/src/Controller/BlockLibraryController.php b/core/modules/block/src/Controller/BlockLibraryController.php index 2a0148f..972dd73 100644 --- a/core/modules/block/src/Controller/BlockLibraryController.php +++ b/core/modules/block/src/Controller/BlockLibraryController.php @@ -8,7 +8,6 @@ namespace Drupal\block\Controller; use Drupal\Component\Serialization\Json; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Block\BlockManagerInterface; use Drupal\Core\Controller\ControllerBase; use Drupal\Core\EventSubscriber\MainContentViewSubscriber; @@ -109,7 +108,7 @@ public function listBlocks(Request $request, $theme) { '#prefix' => '
', '#suffix' => '
', ]; - $row['category']['data'] = SafeMarkup::checkPlain($plugin_definition['category']); + $row['category']['data'] = $plugin_definition['category']; $links['add'] = [ 'title' => $this->t('Place block'), 'url' => Url::fromRoute('block.admin_add', ['plugin_id' => $plugin_id, 'theme' => $theme]), diff --git a/core/modules/block/src/Controller/CategoryAutocompleteController.php b/core/modules/block/src/Controller/CategoryAutocompleteController.php index 0f6a011..aa5bc97 100644 --- a/core/modules/block/src/Controller/CategoryAutocompleteController.php +++ b/core/modules/block/src/Controller/CategoryAutocompleteController.php @@ -8,7 +8,7 @@ namespace Drupal\block\Controller; use Drupal\Core\Block\BlockManagerInterface; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\DependencyInjection\ContainerInjectionInterface; use Symfony\Component\DependencyInjection\ContainerInterface; use Symfony\Component\HttpFoundation\JsonResponse; @@ -59,7 +59,7 @@ public function autocomplete(Request $request) { $matches = array(); foreach ($this->blockManager->getCategories() as $category) { if (stripos($category, $typed_category) === 0) { - $matches[] = array('value' => $category, 'label' => SafeMarkup::checkPlain($category)); + $matches[] = array('value' => $category, 'label' => Html::escape($category)); } } return new JsonResponse($matches); diff --git a/core/modules/block/src/Tests/BlockInterfaceTest.php b/core/modules/block/src/Tests/BlockInterfaceTest.php index 5e8b54c..7215765 100644 --- a/core/modules/block/src/Tests/BlockInterfaceTest.php +++ b/core/modules/block/src/Tests/BlockInterfaceTest.php @@ -8,7 +8,6 @@ namespace Drupal\block\Tests; use Drupal\Core\Cache\Cache; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormState; use Drupal\simpletest\KernelTestBase; use Drupal\block\BlockInterface; @@ -73,7 +72,7 @@ public function testBlockInterface() { 'admin_label' => array( '#type' => 'item', '#title' => t('Block description'), - '#markup' => SafeMarkup::checkPlain($definition['admin_label']), + '#plain_text' => $definition['admin_label'], ), 'label' => array( '#type' => 'textfield', diff --git a/core/modules/block/tests/src/Unit/CategoryAutocompleteTest.php b/core/modules/block/tests/src/Unit/CategoryAutocompleteTest.php index 065a25b..a4c65b2 100644 --- a/core/modules/block/tests/src/Unit/CategoryAutocompleteTest.php +++ b/core/modules/block/tests/src/Unit/CategoryAutocompleteTest.php @@ -8,7 +8,7 @@ namespace Drupal\Tests\block\Unit; use Drupal\block\Controller\CategoryAutocompleteController; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Tests\UnitTestCase; use Symfony\Component\HttpFoundation\Request; @@ -48,7 +48,7 @@ protected function setUp() { */ public function testAutocompleteSuggestions($string, $suggestions) { $suggestions = array_map(function ($suggestion) { - return array('value' => $suggestion, 'label' => SafeMarkup::checkPlain($suggestion)); + return array('value' => $suggestion, 'label' => Html::escape($suggestion)); }, $suggestions); $result = $this->autocompleteController->autocomplete(new Request(array('q' => $string))); $this->assertSame($suggestions, json_decode($result->getContent(), TRUE)); diff --git a/core/modules/color/color.module b/core/modules/color/color.module index fa9499b..46ddce5 100644 --- a/core/modules/color/color.module +++ b/core/modules/color/color.module @@ -8,7 +8,6 @@ use Drupal\Core\Asset\CssOptimizer; use Drupal\Component\Utility\Bytes; use Drupal\Component\Utility\Environment; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\Cache; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Language\LanguageInterface; @@ -251,7 +250,7 @@ function color_scheme_form($complete_form, FormStateInterface $form_state, $them if (isset($names[$name])) { $form['palette'][$name] = array( '#type' => 'textfield', - '#title' => SafeMarkup::checkPlain($names[$name]), + '#title' => $names[$name], '#value_callback' => 'color_palette_color_value', '#default_value' => $value, '#size' => 8, diff --git a/core/modules/comment/comment.module b/core/modules/comment/comment.module index 20ba4a3..1d9168e 100644 --- a/core/modules/comment/comment.module +++ b/core/modules/comment/comment.module @@ -16,7 +16,6 @@ use Drupal\comment\Entity\CommentType; use Drupal\Core\Entity\FieldableEntityInterface; use Drupal\comment\Plugin\Field\FieldType\CommentItemInterface; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Routing\RouteMatchInterface; @@ -575,7 +574,7 @@ function comment_preview(CommentInterface $comment, FormStateInterface $form_sta if (!empty($account) && $account->isAuthenticated()) { $comment->setOwner($account); - $comment->setAuthorName(SafeMarkup::checkPlain($account->getUsername())); + $comment->setAuthorName($account->getUsername()); } elseif (empty($author_name)) { $comment->setAuthorName(\Drupal::config('user.settings')->get('anonymous')); diff --git a/core/modules/comment/comment.tokens.inc b/core/modules/comment/comment.tokens.inc index 5b11466..500533e 100644 --- a/core/modules/comment/comment.tokens.inc +++ b/core/modules/comment/comment.tokens.inc @@ -6,6 +6,7 @@ */ use Drupal\Component\Utility\Html; +use Drupal\Component\Utility\UrlHelper; use Drupal\Component\Utility\Xss; use Drupal\Core\Datetime\Entity\DateFormat; use Drupal\Core\Render\BubbleableMetadata; @@ -149,7 +150,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM break; case 'homepage': - $replacements[$original] = $sanitize ? check_url($comment->getHomepage()) : $comment->getHomepage(); + $replacements[$original] = $sanitize ? UrlHelper::filterBadProtocol($comment->getHomepage()) : $comment->getHomepage(); break; case 'title': diff --git a/core/modules/comment/src/CommentTypeListBuilder.php b/core/modules/comment/src/CommentTypeListBuilder.php index 4f99871..f8a3451 100644 --- a/core/modules/comment/src/CommentTypeListBuilder.php +++ b/core/modules/comment/src/CommentTypeListBuilder.php @@ -7,8 +7,6 @@ namespace Drupal\comment; -use Drupal\Component\Utility\SafeMarkup; -use Drupal\Component\Utility\Xss; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Entity\EntityInterface; @@ -45,7 +43,7 @@ public function buildHeader() { * {@inheritdoc} */ public function buildRow(EntityInterface $entity) { - $row['type'] = SafeMarkup::checkPlain($entity->label()); + $row['type'] = $entity->label(); $row['description']['data'] = ['#markup' => $entity->getDescription()]; return $row + parent::buildRow($entity); } diff --git a/core/modules/comment/src/Plugin/views/argument/UserUid.php b/core/modules/comment/src/Plugin/views/argument/UserUid.php index 5195a7a..c408f31 100644 --- a/core/modules/comment/src/Plugin/views/argument/UserUid.php +++ b/core/modules/comment/src/Plugin/views/argument/UserUid.php @@ -7,7 +7,6 @@ namespace Drupal\comment\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Connection; use Drupal\views\Plugin\views\argument\ArgumentPluginBase; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -65,7 +64,7 @@ function title() { return $this->t('No user'); } - return SafeMarkup::checkPlain($title); + return $title; } protected function defaultActions($which = NULL) { diff --git a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php index 0267346..c6d07ae 100644 --- a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php +++ b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php @@ -7,6 +7,7 @@ namespace Drupal\comment\Tests; +use Drupal\Component\Utility\UrlHelper; use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Xss; use Drupal\comment\Entity\Comment; @@ -55,7 +56,7 @@ function testCommentTokenReplacement() { $tests['[comment:hostname]'] = Html::escape($comment->getHostname()); $tests['[comment:author]'] = Xss::filter($comment->getAuthorName()); $tests['[comment:mail]'] = Html::escape($this->adminUser->getEmail()); - $tests['[comment:homepage]'] = check_url($comment->getHomepage()); + $tests['[comment:homepage]'] = UrlHelper::filterBadProtocol($comment->getHomepage()); $tests['[comment:title]'] = Xss::filter($comment->getSubject()); $tests['[comment:body]'] = $comment->comment_body->processed; $tests['[comment:langcode]'] = Html::escape($comment->language()->getId()); diff --git a/core/modules/config/src/Tests/ConfigImportUITest.php b/core/modules/config/src/Tests/ConfigImportUITest.php index dd00edf..16838c0 100644 --- a/core/modules/config/src/Tests/ConfigImportUITest.php +++ b/core/modules/config/src/Tests/ConfigImportUITest.php @@ -7,6 +7,7 @@ namespace Drupal\config\Tests; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Config\InstallStorage; use Drupal\simpletest\WebTestBase; @@ -275,23 +276,41 @@ function testImportDiff() { $change_key = 'foo'; $remove_key = '404'; $add_key = 'biff'; - $add_data = 'bangpow'; - $change_data = 'foobar'; + $add_data = 'bangpow'; + $change_data = 'foobar'; $original_data = array( - 'foo' => 'bar', - '404' => 'herp', + 'foo' => 'bar', + 'baz' => 'no change', + '404' => 'herp', ); + // Update active storage to have html in config data. + $this->config($config_name)->setData($original_data)->save(); // Change a configuration value in staging. $staging_data = $original_data; $staging_data[$change_key] = $change_data; $staging_data[$add_key] = $add_data; + unset($staging_data[$remove_key]); $staging->write($config_name, $staging_data); // Load the diff UI and verify that the diff reflects the change. $this->drupalGet('admin/config/development/configuration/sync/diff/' . $config_name); $this->assertTitle(format_string('View changes of @config_name | Drupal', array('@config_name' => $config_name))); + // The following assertions do not use $this::assertEscaped() because + // \Drupal\Component\Diff\DiffFormatter adds markup that signifies what has + // changed. + + // Changed values are escaped. + $this->assertText(Html::escape('foobar')); + $this->assertText(Html::escape('bar')); + // The no change values are escaped. + $this->assertText(Html::escape('no change')); + // Added value is escaped. + $this->assertText(Html::escape('bangpow')); + // Deleted value is escaped. + $this->assertText(Html::escape('herp')); + // Reset data back to original, and remove a key $staging_data = $original_data; unset($staging_data[$remove_key]); diff --git a/core/modules/config_translation/src/Controller/ConfigTranslationBlockListBuilder.php b/core/modules/config_translation/src/Controller/ConfigTranslationBlockListBuilder.php index 275dfed..8046dc3 100644 --- a/core/modules/config_translation/src/Controller/ConfigTranslationBlockListBuilder.php +++ b/core/modules/config_translation/src/Controller/ConfigTranslationBlockListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\config_translation\Controller; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityStorageInterface; use Drupal\Core\Entity\EntityTypeInterface; @@ -70,12 +69,12 @@ public function buildRow(EntityInterface $entity) { ); $row['theme'] = array( - 'data' => SafeMarkup::checkPlain($this->themes[$theme]->info['name']), + 'data' => $this->themes[$theme]->info['name'], 'class' => 'table-filter-text-source', ); $row['category'] = array( - 'data' => SafeMarkup::checkPlain($plugin_definition['category']), + 'data' => $plugin_definition['category'], 'class' => 'table-filter-text-source', ); diff --git a/core/modules/config_translation/src/Controller/ConfigTranslationFieldListBuilder.php b/core/modules/config_translation/src/Controller/ConfigTranslationFieldListBuilder.php index a340707..850bbc6 100644 --- a/core/modules/config_translation/src/Controller/ConfigTranslationFieldListBuilder.php +++ b/core/modules/config_translation/src/Controller/ConfigTranslationFieldListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\config_translation\Controller; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityManagerInterface; @@ -123,7 +122,7 @@ public function buildRow(EntityInterface $entity) { if ($this->displayBundle()) { $bundle = $entity->get('bundle'); $row['bundle'] = array( - 'data' => SafeMarkup::checkPlain($this->baseEntityBundles[$bundle]['label']), + 'data' => $this->baseEntityBundles[$bundle]['label'], 'class' => 'table-filter-text-source', ); } diff --git a/core/modules/config_translation/src/Controller/ConfigTranslationMapperList.php b/core/modules/config_translation/src/Controller/ConfigTranslationMapperList.php index e32714b..5c95452 100644 --- a/core/modules/config_translation/src/Controller/ConfigTranslationMapperList.php +++ b/core/modules/config_translation/src/Controller/ConfigTranslationMapperList.php @@ -7,7 +7,6 @@ namespace Drupal\config_translation\Controller; -use Drupal\Component\Utility\SafeMarkup; use Drupal\config_translation\ConfigMapperInterface; use Drupal\Core\Controller\ControllerBase; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -94,7 +93,7 @@ public function render() { * A render array structure of fields for this mapper. */ public function buildRow(ConfigMapperInterface $mapper) { - $row['label'] = SafeMarkup::checkPlain($mapper->getTypeLabel()); + $row['label'] = $mapper->getTypeLabel(); $row['operations']['data'] = $this->buildOperations($mapper); return $row; } diff --git a/core/modules/config_translation/src/Tests/ConfigTranslationOverviewTest.php b/core/modules/config_translation/src/Tests/ConfigTranslationOverviewTest.php index 0916dcd..0dbab3e 100644 --- a/core/modules/config_translation/src/Tests/ConfigTranslationOverviewTest.php +++ b/core/modules/config_translation/src/Tests/ConfigTranslationOverviewTest.php @@ -7,7 +7,6 @@ namespace Drupal\config_translation\Tests; -use Drupal\Component\Utility\SafeMarkup; use Drupal\language\Entity\ConfigurableLanguage; use Drupal\simpletest\WebTestBase; @@ -101,7 +100,7 @@ public function testMapperListPage() { $base_url = 'admin/structure/config_test/manage/' . $test_entity->id(); $this->drupalGet('admin/config/regional/config-translation/config_test'); $this->assertLinkByHref($base_url . '/translate'); - $this->assertText(SafeMarkup::checkPlain($test_entity->label())); + $this->assertEscaped($test_entity->label()); // Make sure there is only a single 'Translate' operation for each // dropbutton. diff --git a/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php b/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php index f220d1a..86da2f8 100644 --- a/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php +++ b/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php @@ -751,9 +751,9 @@ public function testFieldConfigTranslation() { $this->clickLink('Add'); $this->assertText('Translatable field setting'); - $this->assertRaw(SafeMarkup::checkPlain($translatable_field_setting)); + $this->assertEscaped($translatable_field_setting); $this->assertText('Translatable storage setting'); - $this->assertRaw(SafeMarkup::checkPlain($translatable_storage_setting)); + $this->assertEscaped($translatable_storage_setting); } /** diff --git a/core/modules/contact/src/ContactFormListBuilder.php b/core/modules/contact/src/ContactFormListBuilder.php index 4ba3b36..ab75e0e 100644 --- a/core/modules/contact/src/ContactFormListBuilder.php +++ b/core/modules/contact/src/ContactFormListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\contact; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Link; diff --git a/core/modules/contact/src/Controller/ContactController.php b/core/modules/contact/src/Controller/ContactController.php index 7233bb8..1abd33c 100644 --- a/core/modules/contact/src/Controller/ContactController.php +++ b/core/modules/contact/src/Controller/ContactController.php @@ -11,7 +11,6 @@ use Drupal\contact\ContactFormInterface; use Drupal\Core\Render\RendererInterface; use Drupal\user\UserInterface; -use Drupal\Component\Utility\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; @@ -87,7 +86,7 @@ public function contactSitePage(ContactFormInterface $contact_form = NULL) { )); $form = $this->entityFormBuilder()->getForm($message); - $form['#title'] = SafeMarkup::checkPlain($contact_form->label()); + $form['#title'] = $contact_form->label(); $form['#cache']['contexts'][] = 'user.permissions'; $this->renderer->addCacheableDependency($form, $config); return $form; diff --git a/core/modules/contact/src/MessageForm.php b/core/modules/contact/src/MessageForm.php index 9cb5e54..b054dff 100644 --- a/core/modules/contact/src/MessageForm.php +++ b/core/modules/contact/src/MessageForm.php @@ -7,7 +7,6 @@ namespace Drupal\contact; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Datetime\DateFormatter; use Drupal\Core\Entity\ContentEntityForm; use Drupal\Core\Entity\EntityManagerInterface; diff --git a/core/modules/contact/src/MessageViewBuilder.php b/core/modules/contact/src/MessageViewBuilder.php index 24f58f5..def70f9 100644 --- a/core/modules/contact/src/MessageViewBuilder.php +++ b/core/modules/contact/src/MessageViewBuilder.php @@ -9,7 +9,6 @@ use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityViewBuilder; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Mail\MailFormatHelper; use Drupal\Core\Render\Element; @@ -42,7 +41,7 @@ public function buildComponents(array &$build, array $entities, array $displays, $build[$id]['message'] = array( '#type' => 'item', '#title' => t('Message'), - '#markup' => SafeMarkup::checkPlain($entity->getMessage()), + '#plain_text' => $entity->getMessage(), ); } } diff --git a/core/modules/content_translation/content_translation.admin.inc b/core/modules/content_translation/content_translation.admin.inc index 5623f75..2312d22 100644 --- a/core/modules/content_translation/content_translation.admin.inc +++ b/core/modules/content_translation/content_translation.admin.inc @@ -5,7 +5,7 @@ * The content translation administration forms. */ -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Config\Entity\ThirdPartySettingsInterface; use Drupal\Core\Entity\ContentEntityTypeInterface; use Drupal\Core\Entity\EntityTypeInterface; @@ -216,10 +216,10 @@ function _content_translation_preprocess_language_content_settings_table(&$varia 'bundle' => array( '#prefix' => ' ', - '#markup' => SafeMarkup::checkPlain($element[$bundle]['settings']['#label']), + '#plain_text' => $element[$bundle]['settings']['#label'], ), 'field' => array( - '#markup' => SafeMarkup::checkPlain($field_element['#label']), + '#plain_text' => $field_element['#label'], ), ), 'class' => array('field'), @@ -250,15 +250,15 @@ function _content_translation_preprocess_language_content_settings_table(&$varia 'bundle' => array( '#prefix' => ' ', - '#markup' => SafeMarkup::checkPlain($element[$bundle]['settings']['#label']), + '#plain_text' => $element[$bundle]['settings']['#label'], ), 'field' => array( '#prefix' => ' ', - '#markup' => SafeMarkup::checkPlain($field_element['#label']), + '#plain_text' => $field_element['#label'], ), 'columns' => array( - '#markup' => SafeMarkup::checkPlain($column_label), + '#plain_text' => $column_label, ), ), 'class' => array('column'), diff --git a/core/modules/dblog/src/Controller/DbLogController.php b/core/modules/dblog/src/Controller/DbLogController.php index 08d826b..eff6626 100644 --- a/core/modules/dblog/src/Controller/DbLogController.php +++ b/core/modules/dblog/src/Controller/DbLogController.php @@ -8,9 +8,7 @@ namespace Drupal\dblog\Controller; use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; -use Drupal\Component\Utility\Xss; use Drupal\Core\Controller\ControllerBase; use Drupal\Core\Database\Connection; use Drupal\Core\Datetime\DateFormatter; @@ -283,7 +281,7 @@ public function eventDetails($event_id) { ), array( array('data' => $this->t('Hostname'), 'header' => TRUE), - SafeMarkup::checkPlain($dblog->hostname), + $dblog->hostname, ), array( array('data' => $this->t('Operations'), 'header' => TRUE), diff --git a/core/modules/entity_reference/src/ConfigurableEntityReferenceItem.php b/core/modules/entity_reference/src/ConfigurableEntityReferenceItem.php index be11617..09d1edd 100644 --- a/core/modules/entity_reference/src/ConfigurableEntityReferenceItem.php +++ b/core/modules/entity_reference/src/ConfigurableEntityReferenceItem.php @@ -7,7 +7,6 @@ namespace Drupal\entity_reference; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityTypeInterface; use Drupal\Core\Field\Plugin\Field\FieldType\EntityReferenceItem; use Drupal\Core\Field\PreconfiguredFieldUiOptionsInterface; @@ -80,7 +79,7 @@ public function getSettableOptions(AccountInterface $account = NULL) { $return = array(); foreach ($options as $bundle => $entity_ids) { - $bundle_label = SafeMarkup::checkPlain($bundles[$bundle]['label']); + $bundle_label = $bundles[$bundle]['label']; $return[$bundle_label] = $entity_ids; } @@ -135,11 +134,11 @@ public function fieldSettingsForm(array $form, FormStateInterface $form_state) { // entity type specific plugins (e.g., 'default:node', 'default:user', // etc.). if (array_key_exists($selection_group_id, $selection_plugins[$selection_group_id])) { - $handlers_options[$selection_group_id] = SafeMarkup::checkPlain($selection_plugins[$selection_group_id][$selection_group_id]['label']); + $handlers_options[$selection_group_id] = $selection_plugins[$selection_group_id][$selection_group_id]['label']; } elseif (array_key_exists($selection_group_id . ':' . $this->getSetting('target_type'), $selection_plugins[$selection_group_id])) { $selection_group_plugin = $selection_group_id . ':' . $this->getSetting('target_type'); - $handlers_options[$selection_group_plugin] = SafeMarkup::checkPlain($selection_plugins[$selection_group_id][$selection_group_plugin]['base_plugin_label']); + $handlers_options[$selection_group_plugin] = $selection_plugins[$selection_group_id][$selection_group_plugin]['base_plugin_label']; } } diff --git a/core/modules/field/src/Tests/EntityReference/EntityReferenceFormatterTest.php b/core/modules/field/src/Tests/EntityReference/EntityReferenceFormatterTest.php index c897764..6bdbd26 100644 --- a/core/modules/field/src/Tests/EntityReference/EntityReferenceFormatterTest.php +++ b/core/modules/field/src/Tests/EntityReference/EntityReferenceFormatterTest.php @@ -174,7 +174,7 @@ public function testIdFormatter() { $formatter = 'entity_reference_entity_id'; $build = $this->buildRenderArray([$this->referencedEntity, $this->unsavedReferencedEntity], $formatter); - $this->assertEqual($build[0]['#markup'], $this->referencedEntity->id(), sprintf('The markup returned by the %s formatter is correct for an item with a saved entity.', $formatter)); + $this->assertEqual($build[0]['#plain_text'], $this->referencedEntity->id(), sprintf('The markup returned by the %s formatter is correct for an item with a saved entity.', $formatter)); $this->assertEqual($build[0]['#cache']['tags'], $this->referencedEntity->getCacheTags(), sprintf('The %s formatter has the expected cache tags.', $formatter)); $this->assertTrue(!isset($build[1]), sprintf('The markup returned by the %s formatter is correct for an item with a unsaved entity.', $formatter)); } @@ -244,7 +244,7 @@ public function testLabelFormatter() { // The second referenced entity is "autocreated", therefore not saved and // lacking any URL info. $expected_item_2 = array( - '#markup' => $this->unsavedReferencedEntity->label(), + '#plain_text' => $this->unsavedReferencedEntity->label(), '#cache' => array( 'contexts' => [ 'user.permissions', @@ -257,8 +257,8 @@ public function testLabelFormatter() { // Test with the 'link' setting set to FALSE. $build = $this->buildRenderArray([$this->referencedEntity, $this->unsavedReferencedEntity], $formatter, array('link' => FALSE)); - $this->assertEqual($build[0]['#markup'], $this->referencedEntity->label(), sprintf('The markup returned by the %s formatter is correct for an item with a saved entity.', $formatter)); - $this->assertEqual($build[1]['#markup'], $this->unsavedReferencedEntity->label(), sprintf('The markup returned by the %s formatter is correct for an item with a unsaved entity.', $formatter)); + $this->assertEqual($build[0]['#plain_text'], $this->referencedEntity->label(), sprintf('The markup returned by the %s formatter is correct for an item with a saved entity.', $formatter)); + $this->assertEqual($build[1]['#plain_text'], $this->unsavedReferencedEntity->label(), sprintf('The markup returned by the %s formatter is correct for an item with a unsaved entity.', $formatter)); // Test an entity type that doesn't have any link templates, which means // \Drupal\Core\Entity\EntityInterface::urlInfo() will throw an exception @@ -273,7 +273,7 @@ public function testLabelFormatter() { $referenced_entity_with_no_link_template->save(); $build = $this->buildRenderArray([$referenced_entity_with_no_link_template], $formatter, array('link' => TRUE)); - $this->assertEqual($build[0]['#markup'], $referenced_entity_with_no_link_template->label(), sprintf('The markup returned by the %s formatter is correct for an entity type with no valid link template.', $formatter)); + $this->assertEqual($build[0]['#plain_text'], $referenced_entity_with_no_link_template->label(), sprintf('The markup returned by the %s formatter is correct for an entity type with no valid link template.', $formatter)); } /** diff --git a/core/modules/field/src/Tests/String/UuidFormatterTest.php b/core/modules/field/src/Tests/String/UuidFormatterTest.php index 2eaf7e9..4d849cd 100644 --- a/core/modules/field/src/Tests/String/UuidFormatterTest.php +++ b/core/modules/field/src/Tests/String/UuidFormatterTest.php @@ -51,7 +51,7 @@ public function testUuidStringFormatter() { $render_array = $uuid_field->view(['settings' => ['link_to_entity' => TRUE]]); $this->assertIdentical($render_array[0]['#type'], 'link'); - $this->assertIdentical($render_array[0]['#title'], $entity->uuid()); + $this->assertIdentical($render_array[0]['#title']['#markup'], $entity->uuid()); $this->assertIdentical($render_array[0]['#url']->toString(), $entity->url()); } diff --git a/core/modules/field_ui/src/FieldConfigListBuilder.php b/core/modules/field_ui/src/FieldConfigListBuilder.php index d3feac1..1dd2c7c 100644 --- a/core/modules/field_ui/src/FieldConfigListBuilder.php +++ b/core/modules/field_ui/src/FieldConfigListBuilder.php @@ -8,7 +8,6 @@ namespace Drupal\field_ui; use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityManagerInterface; @@ -131,7 +130,7 @@ public function buildRow(EntityInterface $field_config) { $row = array( 'id' => Html::getClass($field_config->getName()), 'data' => array( - 'label' => SafeMarkup::checkPlain($field_config->getLabel()), + 'label' => $field_config->getLabel(), 'field_name' => $field_config->getName(), 'field_type' => array( 'data' => array( diff --git a/core/modules/field_ui/src/Form/EntityDisplayFormBase.php b/core/modules/field_ui/src/Form/EntityDisplayFormBase.php index b2275d0..e807073 100644 --- a/core/modules/field_ui/src/Form/EntityDisplayFormBase.php +++ b/core/modules/field_ui/src/Form/EntityDisplayFormBase.php @@ -10,7 +10,6 @@ use Drupal\Component\Plugin\Factory\DefaultFactory; use Drupal\Component\Plugin\PluginManagerBase; use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityForm; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityWithPluginCollectionInterface; @@ -290,7 +289,7 @@ protected function buildFieldRow(FieldDefinitionInterface $field_definition, arr 'defaultPlugin' => $this->getDefaultPlugin($field_definition->getType()), ), 'human_name' => array( - '#markup' => SafeMarkup::checkPlain($label), + '#plain_text' => $label, ), 'weight' => array( '#type' => 'textfield', diff --git a/core/modules/field_ui/src/Form/FieldConfigEditForm.php b/core/modules/field_ui/src/Form/FieldConfigEditForm.php index 153b8c0..ecb20f3 100644 --- a/core/modules/field_ui/src/Form/FieldConfigEditForm.php +++ b/core/modules/field_ui/src/Form/FieldConfigEditForm.php @@ -7,7 +7,6 @@ namespace Drupal\field_ui\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityForm; use Drupal\Core\Field\AllowedTagsXssTrait; use Drupal\Core\Field\FieldFilteredString; @@ -203,7 +202,7 @@ public function save(array $form, FormStateInterface $form_state) { * The label of the field. */ public function getTitle(FieldConfigInterface $field_config) { - return SafeMarkup::checkPlain($field_config->label()); + return $field_config->label(); } } diff --git a/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php b/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php index fb69d9c..acba472 100644 --- a/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php +++ b/core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php @@ -7,7 +7,6 @@ namespace Drupal\file\Plugin\Field\FieldWidget; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\NestedArray; use Drupal\Core\Field\FieldDefinitionInterface; use Drupal\Core\Field\FieldFilteredString; @@ -119,7 +118,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f break; } - $title = SafeMarkup::checkPlain($this->fieldDefinition->getLabel()); + $title = $this->fieldDefinition->getLabel(); $description = FieldFilteredString::create($this->fieldDefinition->getDescription()); $elements = array(); diff --git a/core/modules/file/src/Plugin/views/argument/Fid.php b/core/modules/file/src/Plugin/views/argument/Fid.php index d935386..100b735 100644 --- a/core/modules/file/src/Plugin/views/argument/Fid.php +++ b/core/modules/file/src/Plugin/views/argument/Fid.php @@ -10,7 +10,6 @@ use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Entity\Query\QueryFactory; use Drupal\views\Plugin\views\argument\NumericArgument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Plugin\ContainerFactoryPluginInterface; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -81,7 +80,7 @@ public function titleQuery() { $files = $controller->loadMultiple($fids); $titles = array(); foreach ($files as $file) { - $titles[] = SafeMarkup::checkPlain($file->getFilename()); + $titles[] = $file->getFilename(); } return $titles; } diff --git a/core/modules/filter/src/FilterFormatFormBase.php b/core/modules/filter/src/FilterFormatFormBase.php index 77b5433..37b26e7 100644 --- a/core/modules/filter/src/FilterFormatFormBase.php +++ b/core/modules/filter/src/FilterFormatFormBase.php @@ -79,7 +79,7 @@ public function form(array $form, FormStateInterface $form_state) { $form['roles'] = array( '#type' => 'checkboxes', '#title' => $this->t('Roles'), - '#options' => array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names()), + '#options' => user_role_names(), '#disabled' => $is_fallback, '#weight' => -10, ); diff --git a/core/modules/filter/src/FilterFormatListBuilder.php b/core/modules/filter/src/FilterFormatListBuilder.php index 89b4c96..0b8e67d 100644 --- a/core/modules/filter/src/FilterFormatListBuilder.php +++ b/core/modules/filter/src/FilterFormatListBuilder.php @@ -110,7 +110,7 @@ public function buildRow(EntityInterface $entity) { $row['roles']['#suffix'] = ''; } else { - $roles = array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', filter_get_roles_by_format($entity)); + $roles = filter_get_roles_by_format($entity); $roles_markup = $roles ? implode(', ', $roles) : $this->t('No roles may use this format'); } diff --git a/core/modules/filter/src/Plugin/Filter/FilterHtml.php b/core/modules/filter/src/Plugin/Filter/FilterHtml.php index 63e3f57..4708cc6 100644 --- a/core/modules/filter/src/Plugin/Filter/FilterHtml.php +++ b/core/modules/filter/src/Plugin/Filter/FilterHtml.php @@ -149,7 +149,7 @@ public function tips($long = FALSE) { array('data' => array( '#prefix' => '', - '#markup' => Html::escape($tips[$tag][1]), + '#plain_text' => $tips[$tag][1], '#suffix' => '' ), 'class' => array('type')), @@ -193,7 +193,7 @@ public function tips($long = FALSE) { array( 'data' => array( '#prefix' => '', - '#markup' => Html::escape($entity[1]), + '#plain_text' => $entity[1], '#suffix' => '', ), 'class' => array('type'), diff --git a/core/modules/filter/src/Tests/FilterUnitTest.php b/core/modules/filter/src/Tests/FilterUnitTest.php index 9bf0fdb..003e4d0 100644 --- a/core/modules/filter/src/Tests/FilterUnitTest.php +++ b/core/modules/filter/src/Tests/FilterUnitTest.php @@ -8,7 +8,6 @@ namespace Drupal\filter\Tests; use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Render\RenderContext; use Drupal\editor\EditorXssFilter\Standard; use Drupal\filter\Entity\FilterFormat; @@ -480,7 +479,7 @@ function testNoFollowFilter() { /** * Tests the HTML escaping filter. * - * \Drupal\Component\Utility\SafeMarkup::checkPlain() is not tested here. + * \Drupal\Component\Utility\Html::escape() is not tested here. */ function testHtmlEscapeFilter() { // Get FilterHtmlEscape object. diff --git a/core/modules/help/src/Controller/HelpController.php b/core/modules/help/src/Controller/HelpController.php index 802f9d9..4ebd4c8 100644 --- a/core/modules/help/src/Controller/HelpController.php +++ b/core/modules/help/src/Controller/HelpController.php @@ -12,7 +12,6 @@ use Drupal\Core\Url; use Symfony\Component\DependencyInjection\ContainerInterface; use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; -use Drupal\Component\Utility\SafeMarkup; /** * Controller routines for help routes. @@ -115,7 +114,7 @@ public function helpPage($name) { $build = array(); if ($this->moduleHandler()->implementsHook($name, 'help')) { $module_name = $this->moduleHandler()->getName($name); - $build['#title'] = SafeMarkup::checkPlain($module_name); + $build['#title'] = $module_name; $temp = $this->moduleHandler()->invoke($name, 'help', array("help.page.$name", $this->routeMatch)); if (empty($temp)) { diff --git a/core/modules/image/src/Form/ImageStyleEditForm.php b/core/modules/image/src/Form/ImageStyleEditForm.php index b07090b..d17a129 100644 --- a/core/modules/image/src/Form/ImageStyleEditForm.php +++ b/core/modules/image/src/Form/ImageStyleEditForm.php @@ -12,7 +12,6 @@ use Drupal\Core\Url; use Drupal\image\ConfigurableImageEffectInterface; use Drupal\image\ImageEffectManager; -use Drupal\Component\Utility\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; /** @@ -99,7 +98,7 @@ public function form(array $form, FormStateInterface $form_state) { '#tree' => FALSE, 'data' => array( 'label' => array( - '#markup' => SafeMarkup::checkPlain($effect->label()), + '#plain_text' => $effect->label(), ), ), ); diff --git a/core/modules/language/language.admin.inc b/core/modules/language/language.admin.inc index 8c35c6b..3f860de 100644 --- a/core/modules/language/language.admin.inc +++ b/core/modules/language/language.admin.inc @@ -5,7 +5,6 @@ * Administration functions for language.module. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Render\Element; use Drupal\Core\Template\Attribute; use Drupal\Core\Url; @@ -170,7 +169,7 @@ function template_preprocess_language_content_settings_table(&$variables) { 'data' => array( '#prefix' => '', - '#markup' => SafeMarkup::checkPlain($element[$bundle]['settings']['#label']), + '#plain_text' => $element[$bundle]['settings']['#label'], ), 'class' => array('bundle'), ), diff --git a/core/modules/language/src/Form/NegotiationConfigureForm.php b/core/modules/language/src/Form/NegotiationConfigureForm.php index 938564e..f1ebc15 100644 --- a/core/modules/language/src/Form/NegotiationConfigureForm.php +++ b/core/modules/language/src/Form/NegotiationConfigureForm.php @@ -8,7 +8,6 @@ namespace Drupal\language\Form; use Drupal\Core\Block\BlockManagerInterface; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\Xss; use Drupal\Core\Config\ConfigFactoryInterface; @@ -277,11 +276,11 @@ protected function configureFormTable(array &$form, $type) { if (isset($types[$type])) { $table_form['#language_negotiation_info'][$method_id] = $method; - $method_name = SafeMarkup::checkPlain($method['name']); + $method_name = $method['name']; $table_form['weight'][$method_id] = array( '#type' => 'weight', - '#title' => $this->t('Weight for !title language detection method', array('!title' => Unicode::strtolower($method_name))), + '#title' => $this->t('Weight for @title language detection method', array('@title' => Unicode::strtolower($method_name))), '#title_display' => 'invisible', '#default_value' => $weight, '#attributes' => array('class' => array("language-method-weight-$type")), @@ -292,7 +291,7 @@ protected function configureFormTable(array &$form, $type) { $table_form['enabled'][$method_id] = array( '#type' => 'checkbox', - '#title' => $this->t('Enable !title language detection method', array('!title' => Unicode::strtolower($method_name))), + '#title' => $this->t('Enable @title language detection method', array('@title' => Unicode::strtolower($method_name))), '#title_display' => 'invisible', '#default_value' => $enabled, ); diff --git a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php index eb3804a..ed80376 100644 --- a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php +++ b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php @@ -7,7 +7,6 @@ namespace Drupal\link\Plugin\Field\FieldFormatter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\UrlHelper; use Drupal\Core\Field\FieldDefinitionInterface; @@ -201,7 +200,7 @@ public function viewElements(FieldItemListInterface $items) { if (!empty($settings['url_only']) && !empty($settings['url_plain'])) { $element[$delta] = array( - '#markup' => SafeMarkup::checkPlain($link_title), + '#plain_text' => $link_title, ); if (!empty($item->_attributes)) { diff --git a/core/modules/locale/src/Form/TranslateEditForm.php b/core/modules/locale/src/Form/TranslateEditForm.php index e9c5359..dbd450a 100644 --- a/core/modules/locale/src/Form/TranslateEditForm.php +++ b/core/modules/locale/src/Form/TranslateEditForm.php @@ -7,7 +7,6 @@ namespace Drupal\locale\Form; -use Drupal\Component\Utility\Html; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\Element; use Drupal\locale\SourceString; @@ -73,7 +72,9 @@ public function buildForm(array $form, FormStateInterface $form_state) { '#type' => 'item', '#title' => $this->t('Source string (@language)', array('@language' => $this->t('Built-in English'))), '#title_display' => 'invisible', - '#markup' => '' . Html::escape($source_array[0]) . '', + '#plain_text' => $source_array[0], + '#preffix' => '', + '#suffix' => '', ); } else { @@ -82,13 +83,16 @@ public function buildForm(array $form, FormStateInterface $form_state) { $original_singular = [ '#type' => 'item', '#title' => $this->t('Singular form'), - '#markup' => '' . Html::escape($source_array[0]) . '', - '#prefix' => '', + '#plain_text' => $source_array[0], + '#prefix' => '', + '#suffix' => '', ]; $original_plural = [ '#type' => 'item', '#title' => $this->t('Plural form'), - '#markup' => '' . Html::escape($source_array[1]) . '', + '#plain_text' => $source_array[1], + '#preffix' => '', + '#suffix' => '', ]; $form['strings'][$string->lid]['original'] = [ $original_singular, diff --git a/core/modules/locale/src/Form/TranslationStatusForm.php b/core/modules/locale/src/Form/TranslationStatusForm.php index d257139..f71ec52 100644 --- a/core/modules/locale/src/Form/TranslationStatusForm.php +++ b/core/modules/locale/src/Form/TranslationStatusForm.php @@ -7,7 +7,6 @@ namespace Drupal\locale\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; @@ -82,7 +81,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { // Build data options for the select table. foreach ($updates as $langcode => $update) { - $title = SafeMarkup::checkPlain($languages[$langcode]->getName()); + $title = $languages[$langcode]->getName(); $locale_translation_update_info = array('#theme' => 'locale_translation_update_info'); foreach (array('updates', 'not_found') as $update_status) { if (isset($update[$update_status])) { @@ -94,7 +93,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { 'class' => array('label'), 'data' => array( '#title' => $title, - '#markup' => $title, + '#plain_text' => $title, ), ), 'status' => array( diff --git a/core/modules/node/src/Controller/NodePreviewController.php b/core/modules/node/src/Controller/NodePreviewController.php index 96b65b5..b1009be 100644 --- a/core/modules/node/src/Controller/NodePreviewController.php +++ b/core/modules/node/src/Controller/NodePreviewController.php @@ -7,7 +7,6 @@ namespace Drupal\node\Controller; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\Controller\EntityViewController; @@ -61,7 +60,7 @@ public function view(EntityInterface $node_preview, $view_mode_id = 'full', $lan * The page title. */ public function title(EntityInterface $node_preview) { - return SafeMarkup::checkPlain($this->entityManager->getTranslationFromContext($node_preview)->label()); + return $this->entityManager->getTranslationFromContext($node_preview)->label(); } } diff --git a/core/modules/node/src/NodeListBuilder.php b/core/modules/node/src/NodeListBuilder.php index 7acbfc9..26f2876 100644 --- a/core/modules/node/src/NodeListBuilder.php +++ b/core/modules/node/src/NodeListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\node; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Datetime\DateFormatter; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityListBuilder; @@ -119,7 +118,7 @@ public function buildRow(EntityInterface $entity) { '#suffix' => ' ' . drupal_render($mark), '#url' => $uri, ); - $row['type'] = SafeMarkup::checkPlain(node_get_type_label($entity)); + $row['type'] = node_get_type_label($entity); $row['author']['data'] = array( '#theme' => 'username', '#account' => $entity->getOwner(), diff --git a/core/modules/node/src/NodeTypeForm.php b/core/modules/node/src/NodeTypeForm.php index ff757f9..24b47b3 100644 --- a/core/modules/node/src/NodeTypeForm.php +++ b/core/modules/node/src/NodeTypeForm.php @@ -9,7 +9,6 @@ use Drupal\Core\Entity\EntityForm; use Drupal\Core\Entity\EntityManagerInterface; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityTypeInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Url; @@ -55,7 +54,7 @@ public function form(array $form, FormStateInterface $form_state) { $type = $this->entity; if ($this->operation == 'add') { - $form['#title'] = SafeMarkup::checkPlain($this->t('Add content type')); + $form['#title'] = $this->t('Add content type'); $fields = $this->entityManager->getBaseFieldDefinitions('node'); // Create a node with a fake bundle using the type's UUID so that we can // get the default values for workflow settings. diff --git a/core/modules/node/src/Plugin/Search/NodeSearch.php b/core/modules/node/src/Plugin/Search/NodeSearch.php index bab5cc9..e068bf0 100644 --- a/core/modules/node/src/Plugin/Search/NodeSearch.php +++ b/core/modules/node/src/Plugin/Search/NodeSearch.php @@ -7,7 +7,7 @@ namespace Drupal\node\Plugin\Search; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Access\AccessResult; use Drupal\Core\Config\Config; use Drupal\Core\Database\Connection; @@ -346,7 +346,7 @@ protected function prepareResults(StatementInterface $found) { $result = array( 'link' => $node->url('canonical', array('absolute' => TRUE, 'language' => $language)), - 'type' => SafeMarkup::checkPlain($type->label()), + 'type' => $type->label(), 'title' => $node->label(), 'node' => $node, 'extra' => $extra, @@ -446,9 +446,15 @@ protected function indexNode(NodeInterface $node) { $build = $node_render->view($node, 'search_index', $language->getId()); unset($build['#theme']); - $rendered = $this->renderer->renderPlain($build); - $text = '

' . SafeMarkup::checkPlain($node->label($language->getId())) . '

' . $rendered; + // Add the title to text so it is searchable. + $build['search_title'] = [ + '#prefix' => '

', + '#plain_text' => $node->label($language->getId()), + '#suffix' => '

', + '#weight' => -1000 + ]; + $text = $this->renderer->renderPlain($build); // Fetch extra data normally not visible. $extra = $this->moduleHandler->invokeAll('node_update_index', array($node, $language->getId())); @@ -549,7 +555,6 @@ public function searchFormAlter(array &$form, FormStateInterface $form_state) { ); // Add node types. - $types = array_map(array('\Drupal\Component\Utility\SafeMarkup', 'checkPlain'), node_type_get_names()); $form['advanced']['types-fieldset'] = array( '#type' => 'fieldset', '#title' => t('Types'), @@ -559,7 +564,7 @@ public function searchFormAlter(array &$form, FormStateInterface $form_state) { '#title' => t('Only of the type(s)'), '#prefix' => '
', '#suffix' => '
', - '#options' => $types, + '#options' => node_type_get_names(), '#default_value' => isset($defaults['type']) ? $defaults['type'] : array(), ); diff --git a/core/modules/node/src/Plugin/views/argument/Nid.php b/core/modules/node/src/Plugin/views/argument/Nid.php index 879ac9d..f0692f8 100644 --- a/core/modules/node/src/Plugin/views/argument/Nid.php +++ b/core/modules/node/src/Plugin/views/argument/Nid.php @@ -7,7 +7,6 @@ namespace Drupal\node\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\node\NodeStorageInterface; use Drupal\views\Plugin\views\argument\NumericArgument; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -62,7 +61,7 @@ public function titleQuery() { $nodes = $this->nodeStorage->loadMultiple($this->value); foreach ($nodes as $node) { - $titles[] = SafeMarkup::checkPlain($node->label()); + $titles[] = $node->label(); } return $titles; } diff --git a/core/modules/node/src/Plugin/views/argument/Type.php b/core/modules/node/src/Plugin/views/argument/Type.php index 26ab17a..62ab17d 100644 --- a/core/modules/node/src/Plugin/views/argument/Type.php +++ b/core/modules/node/src/Plugin/views/argument/Type.php @@ -7,7 +7,6 @@ namespace Drupal\node\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityStorageInterface; use Drupal\views\Plugin\views\argument\StringArgument; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -76,7 +75,7 @@ function title() { function node_type($type_name) { $type = $this->nodeTypeStorage->load($type_name); $output = $type ? $type->label() : $this->t('Unknown content type'); - return SafeMarkup::checkPlain($output); + return $output; } } diff --git a/core/modules/node/src/Plugin/views/argument/Vid.php b/core/modules/node/src/Plugin/views/argument/Vid.php index c223a72..77f2bb5 100644 --- a/core/modules/node/src/Plugin/views/argument/Vid.php +++ b/core/modules/node/src/Plugin/views/argument/Vid.php @@ -7,7 +7,6 @@ namespace Drupal\node\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Connection; use Drupal\views\Plugin\views\argument\NumericArgument; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -84,7 +83,7 @@ public function titleQuery() { foreach ($results as $result) { $nodes[$result['nid']]->set('title', $result['title']); - $titles[] = SafeMarkup::checkPlain($nodes[$result['nid']]->label()); + $titles[] = $nodes[$result['nid']]->label(); } return $titles; diff --git a/core/modules/node/src/Plugin/views/row/Rss.php b/core/modules/node/src/Plugin/views/row/Rss.php index 098012f..e73d527 100644 --- a/core/modules/node/src/Plugin/views/row/Rss.php +++ b/core/modules/node/src/Plugin/views/row/Rss.php @@ -7,7 +7,6 @@ namespace Drupal\node\Plugin\views\row; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\views\Plugin\views\row\RssPluginBase; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -78,7 +77,7 @@ public function buildOptionsForm_summary_options() { public function summaryTitle() { $options = $this->buildOptionsForm_summary_options(); - return SafeMarkup::checkPlain($options[$this->options['view_mode']]); + return $options[$this->options['view_mode']]; } public function preRender($values) { diff --git a/core/modules/node/src/Tests/NodeTitleXSSTest.php b/core/modules/node/src/Tests/NodeTitleXSSTest.php index f0e80ea..70e4498 100644 --- a/core/modules/node/src/Tests/NodeTitleXSSTest.php +++ b/core/modules/node/src/Tests/NodeTitleXSSTest.php @@ -7,6 +7,8 @@ namespace Drupal\node\Tests; +use Drupal\Component\Utility\Html; + /** * Create a node with dangerous tags in its title and test that they are * escaped. @@ -34,8 +36,8 @@ function testNodeTitleXSS() { $node = $this->drupalCreateNode($settings); $this->drupalGet('node/' . $node->id()); - // assertTitle() decodes HTML-entities inside the element. - $this->assertTitle($title . ' | Drupal', 'Title is displayed when viewing a node.'); + // Titles should be escaped. + $this->assertTitle(Html::escape($title) . ' | Drupal', 'Title is displayed when viewing a node.'); $this->assertNoRaw($xss, 'Harmful tags are escaped when viewing a node.'); $this->drupalGet('node/' . $node->id() . '/edit'); diff --git a/core/modules/options/src/Plugin/views/argument/NumberListField.php b/core/modules/options/src/Plugin/views/argument/NumberListField.php index 4e22f9c..a96f27e 100644 --- a/core/modules/options/src/Plugin/views/argument/NumberListField.php +++ b/core/modules/options/src/Plugin/views/argument/NumberListField.php @@ -7,7 +7,6 @@ namespace Drupal\options\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Field\AllowedTagsXssTrait; use Drupal\Core\Field\FieldFilteredString; use Drupal\Core\Form\FormStateInterface; @@ -85,7 +84,7 @@ public function summaryName($data) { } // Else, fallback to the key. else { - return SafeMarkup::checkPlain($value); + return $value; } } diff --git a/core/modules/options/src/Plugin/views/argument/StringListField.php b/core/modules/options/src/Plugin/views/argument/StringListField.php index ddf764a..d03ad70 100644 --- a/core/modules/options/src/Plugin/views/argument/StringListField.php +++ b/core/modules/options/src/Plugin/views/argument/StringListField.php @@ -14,7 +14,6 @@ use Drupal\views\ViewExecutable; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\Plugin\views\argument\StringArgument; -use Drupal\Component\Utility\SafeMarkup; /** * Argument handler for list field to show the human readable name in summary. diff --git a/core/modules/path/src/Form/EditForm.php b/core/modules/path/src/Form/EditForm.php index fc85a42..a1f4a77 100644 --- a/core/modules/path/src/Form/EditForm.php +++ b/core/modules/path/src/Form/EditForm.php @@ -7,7 +7,6 @@ namespace Drupal\path\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Url; @@ -36,7 +35,7 @@ protected function buildPath($pid) { public function buildForm(array $form, FormStateInterface $form_state, $pid = NULL) { $form = parent::buildForm($form, $form_state, $pid); - $form['#title'] = SafeMarkup::checkPlain($this->path['alias']); + $form['#title'] = $this->path['alias']; $form['pid'] = array( '#type' => 'hidden', '#value' => $this->path['pid'], diff --git a/core/modules/quickedit/src/MetadataGenerator.php b/core/modules/quickedit/src/MetadataGenerator.php index 1de5fc6..289ad53 100644 --- a/core/modules/quickedit/src/MetadataGenerator.php +++ b/core/modules/quickedit/src/MetadataGenerator.php @@ -8,7 +8,6 @@ namespace Drupal\quickedit; use Drupal\Component\Plugin\PluginManagerInterface; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Field\FieldItemListInterface; use Drupal\quickedit\Access\EditEntityFieldAccessCheckInterface; diff --git a/core/modules/rest/src/Plugin/views/display/RestExport.php b/core/modules/rest/src/Plugin/views/display/RestExport.php index e3a587c..03706b5 100644 --- a/core/modules/rest/src/Plugin/views/display/RestExport.php +++ b/core/modules/rest/src/Plugin/views/display/RestExport.php @@ -7,6 +7,7 @@ namespace Drupal\rest\Plugin\views\display; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\CacheableMetadata; use Drupal\Core\Cache\CacheableResponse; @@ -318,11 +319,12 @@ public function render() { $this->view->element['#content_type'] = $this->getMimeType(); $this->view->element['#cache_properties'][] = '#content_type'; - // Wrap the output in a pre tag if this is for a live preview. + // Encode and wrap the output in a pre tag if this is for a live preview. if (!empty($this->view->live_preview)) { $build['#prefix'] = '<pre>'; - $build['#markup'] = SafeMarkup::checkPlain($build['#markup']); + $build['#plain_text'] = $build['#markup']; $build['#suffix'] = '</pre>'; + unset($build['#markup']); } elseif ($this->view->getRequest()->getFormat($this->view->element['#content_type']) !== 'html') { // This display plugin is primarily for returning non-HTML formats. diff --git a/core/modules/rest/src/Tests/Views/StyleSerializerTest.php b/core/modules/rest/src/Tests/Views/StyleSerializerTest.php index de114d4..498942f 100644 --- a/core/modules/rest/src/Tests/Views/StyleSerializerTest.php +++ b/core/modules/rest/src/Tests/Views/StyleSerializerTest.php @@ -480,16 +480,16 @@ public function testLivePreview() { $entities[] = $row->_entity; } - $expected = Html::escape($serializer->serialize($entities, 'json')); + $expected = $serializer->serialize($entities, 'json'); $view->live_preview = TRUE; $build = $view->preview(); - $rendered_json = $build['#markup']; - $this->assertEqual($rendered_json, $expected, 'Ensure the previewed json is escaped.'); + $rendered_json = $build['#plain_text']; + $this->assertTrue(!isset($build['#markup']) && $rendered_json == $expected, 'Ensure the previewed json is escaped.'); $view->destroy(); - $expected = Html::escape($serializer->serialize($entities, 'xml')); + $expected = $serializer->serialize($entities, 'xml'); // Change the request format to xml. $view->setDisplay('rest_export_1'); @@ -505,7 +505,7 @@ public function testLivePreview() { $this->executeView($view); $build = $view->preview(); - $rendered_xml = $build['#markup']; + $rendered_xml = $build['#plain_text']; $this->assertEqual($rendered_xml, $expected, 'Ensure we preview xml when we change the request format.'); } diff --git a/core/modules/search/search.pages.inc b/core/modules/search/search.pages.inc index 518a08b..409ce2d 100644 --- a/core/modules/search/search.pages.inc +++ b/core/modules/search/search.pages.inc @@ -5,6 +5,7 @@ * User page callbacks for the Search module. */ +use Drupal\Component\Utility\UrlHelper; use Drupal\Core\Language\LanguageInterface; /** @@ -34,7 +35,7 @@ function template_preprocess_search_result(&$variables) { $language_interface = \Drupal::languageManager()->getCurrentLanguage(); $result = $variables['result']; - $variables['url'] = check_url($result['link']); + $variables['url'] = UrlHelper::stripDangerousProtocols($result['link']); $variables['title'] = $result['title']; if (isset($result['language']) && $result['language'] != $language_interface->getId() && $result['language'] != LanguageInterface::LANGCODE_NOT_SPECIFIED) { $variables['title_attributes']['lang'] = $result['language']; diff --git a/core/modules/shortcut/src/Form/SwitchShortcutSet.php b/core/modules/shortcut/src/Form/SwitchShortcutSet.php index 5388db5..9bc34ca 100644 --- a/core/modules/shortcut/src/Form/SwitchShortcutSet.php +++ b/core/modules/shortcut/src/Form/SwitchShortcutSet.php @@ -7,7 +7,6 @@ namespace Drupal\shortcut\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Routing\RouteMatchInterface; @@ -71,7 +70,7 @@ public function buildForm(array $form, FormStateInterface $form_state, UserInter // Prepare the list of shortcut sets. $options = array_map(function (ShortcutSet $set) { - return SafeMarkup::checkPlain($set->label()); + return $set->label(); }, $this->shortcutSetStorage->loadMultiple()); $current_set = shortcut_current_displayed_set($this->user); diff --git a/core/modules/simpletest/src/Form/SimpletestTestForm.php b/core/modules/simpletest/src/Form/SimpletestTestForm.php index aadc4a9..a46be86 100644 --- a/core/modules/simpletest/src/Form/SimpletestTestForm.php +++ b/core/modules/simpletest/src/Form/SimpletestTestForm.php @@ -8,7 +8,6 @@ namespace Drupal\simpletest\Form; use Drupal\Component\Utility\SortArray; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\RendererInterface; @@ -179,7 +178,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { ); $form['tests'][$class]['description'] = array( '#prefix' => '<div class="description">', - '#markup' => SafeMarkup::checkPlain($info['description']), + '#plain_text' => $info['description'], '#suffix' => '</div>', '#wrapper_attributes' => array( 'class' => array('simpletest-test-description', 'table-filter-text-source'), diff --git a/core/modules/system/src/Form/ModulesListForm.php b/core/modules/system/src/Form/ModulesListForm.php index 289928f..0a52d2f 100644 --- a/core/modules/system/src/Form/ModulesListForm.php +++ b/core/modules/system/src/Form/ModulesListForm.php @@ -7,7 +7,6 @@ namespace Drupal\system\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Unicode; use Drupal\Core\Config\PreExistingConfigException; use Drupal\Core\Config\UnmetDependenciesException; @@ -169,7 +168,7 @@ public function getFormId() { */ public function buildForm(array $form, FormStateInterface $form_state) { require_once DRUPAL_ROOT . '/core/includes/install.inc'; - $distribution = SafeMarkup::checkPlain(drupal_install_profile_distribution_name()); + $distribution = drupal_install_profile_distribution_name(); // Include system.admin.inc so we can use the sort callbacks. $this->moduleHandler->loadInclude('system', 'inc', 'system.admin'); diff --git a/core/modules/system/src/Tests/Common/UrlTest.php b/core/modules/system/src/Tests/Common/UrlTest.php index e597139..7584c10 100644 --- a/core/modules/system/src/Tests/Common/UrlTest.php +++ b/core/modules/system/src/Tests/Common/UrlTest.php @@ -33,14 +33,14 @@ function testLinkXSS() { // Test \Drupal::l(). $text = $this->randomMachineName(); $path = "<SCRIPT>alert('XSS')</SCRIPT>"; + $encoded_path = "3CSCRIPT%3Ealert%28%27XSS%27%29%3C/SCRIPT%3E"; + $link = \Drupal::l($text, Url::fromUserInput('/' . $path)); - $sanitized_path = check_url(Url::fromUri('base:' . $path)->toString()); - $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by _l().', array('@path' => $path))); + $this->assertTrue(strpos($link, $encoded_path) !== FALSE && strpos($link, $path) === FALSE, format_string('XSS attack @path was filtered by _l().', array('@path' => $path))); // Test \Drupal\Core\Url. $link = Url::fromUri('base:' . $path)->toString(); - $sanitized_path = check_url(Url::fromUri('base:' . $path)->toString()); - $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by #theme', ['@path' => $path])); + $this->assertTrue(strpos($link, $encoded_path) !== FALSE && strpos($link, $path) === FALSE, format_string('XSS attack @path was filtered by #theme', ['@path' => $path])); } /** diff --git a/core/modules/system/src/Tests/Common/XssUnitTest.php b/core/modules/system/src/Tests/Common/XssUnitTest.php index f1358e0..95bec89 100644 --- a/core/modules/system/src/Tests/Common/XssUnitTest.php +++ b/core/modules/system/src/Tests/Common/XssUnitTest.php @@ -56,6 +56,7 @@ function testBadProtocolStripping() { $expected_plain = 'http://www.example.com/?x=1&y=2'; $expected_html = 'http://www.example.com/?x=1&y=2'; $this->assertIdentical(check_url($url), $expected_html, 'check_url() filters a URL and encodes it for HTML.'); + $this->assertIdentical(UrlHelper::filterBadProtocol($url), $expected_html, 'Drupal\Component\Utility\Url::filterBadProtocol() filters a URL and encodes it for HTML.'); $this->assertIdentical(UrlHelper::stripDangerousProtocols($url), $expected_plain, '\Drupal\Component\Utility\Url::stripDangerousProtocols() filters a URL and returns plain text.'); } } diff --git a/core/modules/system/src/Tests/Form/ElementTest.php b/core/modules/system/src/Tests/Form/ElementTest.php index 6555a4f..1dcc36f 100644 --- a/core/modules/system/src/Tests/Form/ElementTest.php +++ b/core/modules/system/src/Tests/Form/ElementTest.php @@ -62,6 +62,12 @@ function testOptions() { } } + // Verify that the choices are escaped as expected. + $this->assertEscaped("<em>Special Char</em><scrip>alert('checkboxes');</script>"); + $this->assertEscaped("<em>Special Char</em><scrip>alert('radios');</script>"); + $this->assertRaw('<em>Bar - checkboxes</em>'); + $this->assertRaw('<em>Bar - radios</em>'); + // Enable customized option sub-elements. $this->drupalGet('form-test/checkboxes-radios/customize'); diff --git a/core/modules/system/tests/modules/database_test/src/Form/DatabaseTestForm.php b/core/modules/system/tests/modules/database_test/src/Form/DatabaseTestForm.php index 342151e..73f39b1 100644 --- a/core/modules/system/tests/modules/database_test/src/Form/DatabaseTestForm.php +++ b/core/modules/system/tests/modules/database_test/src/Form/DatabaseTestForm.php @@ -7,7 +7,6 @@ namespace Drupal\database_test\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; use Drupal\user\Entity\User; @@ -56,8 +55,8 @@ public function buildForm(array $form, FormStateInterface $form_state) { foreach (User::loadMultiple($uids) as $account) { $options[$account->id()] = array( - 'title' => array('data' => array('#title' => SafeMarkup::checkPlain($account->getUsername()))), - 'username' => SafeMarkup::checkPlain($account->getUsername()), + 'title' => array('data' => array('#title' => $account->getUsername())), + 'username' => $account->getUsername(), 'status' => $account->isActive() ? t('active') : t('blocked'), ); } diff --git a/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilder.php b/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilder.php index 7cfec16..e1042e9 100644 --- a/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilder.php +++ b/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\entity_test; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Entity\EntityViewBuilder; @@ -36,7 +35,7 @@ public function buildComponents(array &$build, array $entities, array $displays, foreach ($entities as $id => $entity) { $build[$id]['label'] = array( '#weight' => -100, - '#markup' => SafeMarkup::checkPlain($entity->label()), + '#plain_text' => $entity->label(), ); $build[$id]['separator'] = array( '#weight' => -150, @@ -44,7 +43,7 @@ public function buildComponents(array &$build, array $entities, array $displays, ); $build[$id]['view_mode'] = array( '#weight' => -200, - '#markup' => SafeMarkup::checkPlain($view_mode), + '#plain_text' => $view_mode, ); } } diff --git a/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilderOverriddenView.php b/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilderOverriddenView.php index f4b719f..cd064cd 100644 --- a/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilderOverriddenView.php +++ b/core/modules/system/tests/modules/entity_test/src/EntityTestViewBuilderOverriddenView.php @@ -7,7 +7,6 @@ namespace Drupal\entity_test; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityInterface; /** @@ -20,7 +19,9 @@ class EntityTestViewBuilderOverriddenView extends EntityTestViewBuilder { */ public function view(EntityInterface $entity, $view_mode = 'full', $langcode = NULL) { $build = []; - $build[$entity->id()]['#markup'] = SafeMarkup::checkPlain($entity->label()); + $build[$entity->id()] = [ + '#plain_text' => $entity->label(), + ]; return $build; } diff --git a/core/modules/system/tests/modules/form_test/src/Form/FormTestCheckboxesRadiosForm.php b/core/modules/system/tests/modules/form_test/src/Form/FormTestCheckboxesRadiosForm.php index 7bd4374..819cdd5 100644 --- a/core/modules/system/tests/modules/form_test/src/Form/FormTestCheckboxesRadiosForm.php +++ b/core/modules/system/tests/modules/form_test/src/Form/FormTestCheckboxesRadiosForm.php @@ -9,6 +9,7 @@ use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; +use Drupal\Core\Render\SafeString; use Symfony\Component\HttpFoundation\JsonResponse; /** @@ -36,8 +37,8 @@ public function buildForm(array $form, FormStateInterface $form_state, $customiz 0 => 'Zero', 'foo' => 'Foo', 1 => 'One', - 'bar' => 'Bar', - '>' => 'Special Char', + 'bar' => $this->t('<em>Bar - checkboxes</em>'), + '>' => "<em>Special Char</em><scrip>alert('checkboxes');</script>", ), ); if ($customize) { @@ -60,8 +61,8 @@ public function buildForm(array $form, FormStateInterface $form_state, $customiz 0 => 'Zero', 'foo' => 'Foo', 1 => 'One', - 'bar' => 'Bar', - '>' => 'Special Char', + 'bar' => $this->t('<em>Bar - radios</em>'), + '>' => "<em>Special Char</em><scrip>alert('radios');</script>", ), ); if ($customize) { diff --git a/core/modules/system/tests/modules/form_test/src/Form/FormTestStoragePageCacheForm.php b/core/modules/system/tests/modules/form_test/src/Form/FormTestStoragePageCacheForm.php index 9f3ab5a..1bc1a1e 100644 --- a/core/modules/system/tests/modules/form_test/src/Form/FormTestStoragePageCacheForm.php +++ b/core/modules/system/tests/modules/form_test/src/Form/FormTestStoragePageCacheForm.php @@ -7,7 +7,6 @@ namespace Drupal\form_test\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; @@ -57,7 +56,9 @@ public function buildForm(array $form, FormStateInterface $form_state) { */ function form_test_storage_page_cache_old_build_id($form) { if (isset($form['#build_id_old'])) { - $form['test_build_id_old']['#markup'] = SafeMarkup::checkPlain($form['#build_id_old']); + $form['test_build_id_old'] = [ + '#plain_text' => $form['#build_id_old'], + ]; } return $form; } diff --git a/core/modules/system/tests/modules/form_test/src/FormTestArgumentsObject.php b/core/modules/system/tests/modules/form_test/src/FormTestArgumentsObject.php index a7fa82c..9c347be 100644 --- a/core/modules/system/tests/modules/form_test/src/FormTestArgumentsObject.php +++ b/core/modules/system/tests/modules/form_test/src/FormTestArgumentsObject.php @@ -7,7 +7,6 @@ namespace Drupal\form_test; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\ConfigFormBase; use Drupal\Core\Form\FormStateInterface; @@ -38,7 +37,7 @@ public function buildForm(array $form, FormStateInterface $form_state, $arg = NU $form['bananas'] = array( '#type' => 'textfield', - '#default_value' => SafeMarkup::checkPlain($arg), + '#default_value' => $arg, '#title' => $this->t('Bananas'), ); diff --git a/core/modules/system/tests/modules/test_page_test/src/Controller/Test.php b/core/modules/system/tests/modules/test_page_test/src/Controller/Test.php index b0d4136..c5e45ee 100644 --- a/core/modules/system/tests/modules/test_page_test/src/Controller/Test.php +++ b/core/modules/system/tests/modules/test_page_test/src/Controller/Test.php @@ -7,8 +7,6 @@ namespace Drupal\test_page_test\Controller; -use Drupal\Component\Utility\SafeMarkup; - /** * Defines a test controller for page titles. */ @@ -55,16 +53,21 @@ public function dynamicTitle() { * Defines a controller with a cached render array. * * @param bool $mark_safe - * Whether or not to mark the title as safe use SafeMarkup::checkPlain. + * If TRUE, mark string as safe. * * @return array * A render array */ public function controllerWithCache($mark_safe = FALSE) { $build = []; - $build['#title'] = '<span>Cached title</span>'; if ($mark_safe) { - $build['#title'] = SafeMarkup::checkPlain($build['#title']); + $render = [ + '#plain_text' => '<span>Cached title</span>', + ]; + $build['#title'] = \Drupal::service('renderer')->renderPlain($render); + } + else { + $build['#title'] = '<span>Cached title</span>'; } $build['#cache']['keys'] = ['test_controller', 'with_title', $mark_safe]; diff --git a/core/modules/taxonomy/src/Plugin/EntityReferenceSelection/TermSelection.php b/core/modules/taxonomy/src/Plugin/EntityReferenceSelection/TermSelection.php index ddf99ca..28bddff 100644 --- a/core/modules/taxonomy/src/Plugin/EntityReferenceSelection/TermSelection.php +++ b/core/modules/taxonomy/src/Plugin/EntityReferenceSelection/TermSelection.php @@ -7,7 +7,6 @@ namespace Drupal\taxonomy\Plugin\EntityReferenceSelection; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Query\SelectInterface; use Drupal\Core\Entity\Plugin\EntityReferenceSelection\SelectionBase; use Drupal\Core\Form\FormStateInterface; @@ -73,7 +72,7 @@ public function getReferenceableEntities($match = NULL, $match_operator = 'CONTA if ($vocabulary = Vocabulary::load($bundle)) { if ($terms = $this->entityManager->getStorage('taxonomy_term')->loadTree($vocabulary->id(), 0, NULL, TRUE)) { foreach ($terms as $term) { - $options[$vocabulary->id()][$term->id()] = str_repeat('-', $term->depth) . SafeMarkup::checkPlain($term->getName()); + $options[$vocabulary->id()][$term->id()] = str_repeat('-', $term->depth) . $term->getName(); } } } diff --git a/core/modules/taxonomy/src/Plugin/views/argument/IndexTid.php b/core/modules/taxonomy/src/Plugin/views/argument/IndexTid.php index 3b4798a..6018b06 100644 --- a/core/modules/taxonomy/src/Plugin/views/argument/IndexTid.php +++ b/core/modules/taxonomy/src/Plugin/views/argument/IndexTid.php @@ -9,7 +9,6 @@ use Drupal\taxonomy\Entity\Term; use Drupal\views\Plugin\views\argument\ManyToOne; -use Drupal\Component\Utility\SafeMarkup; /** * Allow taxonomy term ID(s) as argument. @@ -24,7 +23,7 @@ public function titleQuery() { $titles = array(); $terms = Term::loadMultiple($this->value); foreach ($terms as $term) { - $titles[] = SafeMarkup::checkPlain(\Drupal::entityManager()->getTranslationFromContext($term)->label()); + $titles[] = \Drupal::entityManager()->getTranslationFromContext($term)->label(); } return $titles; } diff --git a/core/modules/taxonomy/src/Plugin/views/argument/IndexTidDepth.php b/core/modules/taxonomy/src/Plugin/views/argument/IndexTidDepth.php index f5bd524..e2df37f 100644 --- a/core/modules/taxonomy/src/Plugin/views/argument/IndexTidDepth.php +++ b/core/modules/taxonomy/src/Plugin/views/argument/IndexTidDepth.php @@ -11,7 +11,6 @@ use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Plugin\ContainerFactoryPluginInterface; use Drupal\views\Plugin\views\argument\ArgumentPluginBase; -use Drupal\Component\Utility\SafeMarkup; use Drupal\taxonomy\Entity\Term; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -140,7 +139,7 @@ public function query($group_by = FALSE) { function title() { $term = $this->termStorage->load($this->argument); if (!empty($term)) { - return SafeMarkup::checkPlain($term->getName()); + return $term->getName(); } // TODO review text return $this->t('No name'); diff --git a/core/modules/taxonomy/src/Plugin/views/argument/Taxonomy.php b/core/modules/taxonomy/src/Plugin/views/argument/Taxonomy.php index ca36597..ecf27f9 100644 --- a/core/modules/taxonomy/src/Plugin/views/argument/Taxonomy.php +++ b/core/modules/taxonomy/src/Plugin/views/argument/Taxonomy.php @@ -10,7 +10,6 @@ use Drupal\Core\Entity\EntityStorageInterface; use Drupal\Core\Plugin\ContainerFactoryPluginInterface; use Drupal\views\Plugin\views\argument\NumericArgument; -use Drupal\Component\Utility\SafeMarkup; use Symfony\Component\DependencyInjection\ContainerInterface; /** @@ -56,7 +55,7 @@ function title() { if ($this->argument) { $term = $this->termStorage->load($this->argument); if (!empty($term)) { - return SafeMarkup::checkPlain($term->getName()); + return $term->getName(); } } // TODO review text diff --git a/core/modules/taxonomy/src/Plugin/views/argument/VocabularyVid.php b/core/modules/taxonomy/src/Plugin/views/argument/VocabularyVid.php index 7aedd51..80c27b8 100644 --- a/core/modules/taxonomy/src/Plugin/views/argument/VocabularyVid.php +++ b/core/modules/taxonomy/src/Plugin/views/argument/VocabularyVid.php @@ -8,7 +8,6 @@ namespace Drupal\taxonomy\Plugin\views\argument; use Drupal\views\Plugin\views\argument\NumericArgument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\taxonomy\VocabularyStorageInterface; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -63,7 +62,7 @@ public static function create(ContainerInterface $container, array $configuratio function title() { $vocabulary = $this->vocabularyStorage->load($this->argument); if ($vocabulary) { - return SafeMarkup::checkPlain($vocabulary->label()); + return $vocabulary->label(); } return $this->t('No vocabulary'); diff --git a/core/modules/taxonomy/src/Plugin/views/field/TaxonomyIndexTid.php b/core/modules/taxonomy/src/Plugin/views/field/TaxonomyIndexTid.php index 3f40fc8..3049f6f 100644 --- a/core/modules/taxonomy/src/Plugin/views/field/TaxonomyIndexTid.php +++ b/core/modules/taxonomy/src/Plugin/views/field/TaxonomyIndexTid.php @@ -11,7 +11,6 @@ use Drupal\views\ViewExecutable; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\Plugin\views\field\PrerenderList; -use Drupal\Component\Utility\SafeMarkup; use Drupal\taxonomy\Entity\Vocabulary; use Symfony\Component\DependencyInjection\ContainerInterface; use Drupal\taxonomy\VocabularyStorageInterface; @@ -153,7 +152,7 @@ public function preRender(&$values) { $this->items[$node_nid][$tid]['name'] = \Drupal::entityManager()->getTranslationFromContext($term)->label(); $this->items[$node_nid][$tid]['tid'] = $tid; $this->items[$node_nid][$tid]['vocabulary_vid'] = $term->getVocabularyId(); - $this->items[$node_nid][$tid]['vocabulary'] = SafeMarkup::checkPlain($vocabularies[$term->getVocabularyId()]->label()); + $this->items[$node_nid][$tid]['vocabulary'] = $vocabularies[$term->getVocabularyId()]->label(); if (!empty($this->options['link_to_taxonomy'])) { $this->items[$node_nid][$tid]['make_link'] = TRUE; diff --git a/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php b/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php index 7adaa16..4a50d81 100644 --- a/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php +++ b/core/modules/taxonomy/src/Plugin/views/filter/TaxonomyIndexTid.php @@ -16,7 +16,6 @@ use Drupal\views\ViewExecutable; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\Plugin\views\filter\ManyToOne; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Tags; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -183,7 +182,7 @@ protected function valueForm(&$form, FormStateInterface $form_state) { if ($tree) { foreach ($tree as $term) { $choice = new \stdClass(); - $choice->option = array($term->id() => str_repeat('-', $term->depth) . SafeMarkup::checkPlain(\Drupal::entityManager()->getTranslationFromContext($term)->label())); + $choice->option = array($term->id() => str_repeat('-', $term->depth) . \Drupal::entityManager()->getTranslationFromContext($term)->label()); $options[] = $choice; } } @@ -201,7 +200,7 @@ protected function valueForm(&$form, FormStateInterface $form_state) { } $terms = Term::loadMultiple($query->execute()); foreach ($terms as $term) { - $options[$term->id()] = SafeMarkup::checkPlain(\Drupal::entityManager()->getTranslationFromContext($term)->label()); + $options[$term->id()] = \Drupal::entityManager()->getTranslationFromContext($term)->label(); } } @@ -359,7 +358,7 @@ public function adminSummary() { $this->value = array_filter($this->value); $terms = Term::loadMultiple($this->value); foreach ($terms as $term) { - $this->valueOptions[$term->id()] = SafeMarkup::checkPlain(\Drupal::entityManager()->getTranslationFromContext($term)->label()); + $this->valueOptions[$term->id()] = \Drupal::entityManager()->getTranslationFromContext($term)->label(); } } return parent::adminSummary(); diff --git a/core/modules/text/src/Plugin/Field/FieldType/TextItemBase.php b/core/modules/text/src/Plugin/Field/FieldType/TextItemBase.php index 13d15c9..410ee71 100644 --- a/core/modules/text/src/Plugin/Field/FieldType/TextItemBase.php +++ b/core/modules/text/src/Plugin/Field/FieldType/TextItemBase.php @@ -43,7 +43,7 @@ public static function propertyDefinitions(FieldStorageDefinitionInterface $fiel * {@inheritdoc} */ public function applyDefaultValue($notify = TRUE) { - // Default to a simple \Drupal\Component\Utility\SafeMarkup::checkPlain(). + // Default to a simple \Drupal\Component\Utility\Html::escape(). // @todo: Add in the filter default format here. $this->setValue(array('format' => NULL), $notify); return $this; diff --git a/core/modules/text/src/TextProcessed.php b/core/modules/text/src/TextProcessed.php index 364937b..d41cb92 100644 --- a/core/modules/text/src/TextProcessed.php +++ b/core/modules/text/src/TextProcessed.php @@ -49,8 +49,7 @@ public function getValue($langcode = NULL) { $item = $this->getParent(); $text = $item->{($this->definition->getSetting('text source'))}; - // Avoid running check_markup() or - // \Drupal\Component\Utility\SafeMarkup::checkPlain() on empty strings. + // Avoid running check_markup() on empty strings. if (!isset($text) || $text === '') { $this->processed = ''; } diff --git a/core/modules/tracker/src/Controller/TrackerUserTab.php b/core/modules/tracker/src/Controller/TrackerUserTab.php index ae21548..3aca4c0 100644 --- a/core/modules/tracker/src/Controller/TrackerUserTab.php +++ b/core/modules/tracker/src/Controller/TrackerUserTab.php @@ -9,7 +9,6 @@ use Drupal\Core\Controller\ControllerBase; use Drupal\user\UserInterface; -use Drupal\Component\Utility\SafeMarkup; /** * Controller for tracker.user_tab route. @@ -28,6 +27,6 @@ public function getContent(UserInterface $user) { * Title callback for the tracker.user_tab route. */ public function getTitle(UserInterface $user) { - return SafeMarkup::checkPlain($user->getUsername()); + return $user->getUsername(); } } diff --git a/core/modules/tracker/tracker.pages.inc b/core/modules/tracker/tracker.pages.inc index ffbf316..47bd3ef 100644 --- a/core/modules/tracker/tracker.pages.inc +++ b/core/modules/tracker/tracker.pages.inc @@ -5,7 +5,6 @@ * User page callbacks for tracker.module. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\Cache; use Drupal\node\Entity\Node; @@ -85,7 +84,7 @@ function tracker_page($account = NULL) { } $row = array( - 'type' => SafeMarkup::checkPlain(node_get_type_label($node)), + 'type' => node_get_type_label($node), 'title' => array( 'data' => array( '#type' => 'link', diff --git a/core/modules/update/src/Form/UpdateManagerUpdate.php b/core/modules/update/src/Form/UpdateManagerUpdate.php index f0f64ea..cafa4d1 100644 --- a/core/modules/update/src/Form/UpdateManagerUpdate.php +++ b/core/modules/update/src/Form/UpdateManagerUpdate.php @@ -7,7 +7,6 @@ namespace Drupal\update\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; @@ -115,14 +114,14 @@ public function buildForm(array $form, FormStateInterface $form_state) { $project_name = $this->l($project['title'], Url::fromUri($project['link'])); } else { - $project_name = SafeMarkup::checkPlain($project['title']); + $project_name = $project['title']; } } elseif (!empty($project['info']['name'])) { - $project_name = SafeMarkup::checkPlain($project['info']['name']); + $project_name = $project['info']['name']; } else { - $project_name = SafeMarkup::checkPlain($name); + $project_name = $name; } if ($project['project_type'] == 'theme' || $project['project_type'] == 'theme-disabled') { $project_name .= ' ' . $this->t('(Theme)'); diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php index 0bcfad9..2fdbcea 100644 --- a/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -205,7 +205,7 @@ public function form(array $form, FormStateInterface $form_state) { '#access' => $admin, ); - $roles = array_map(array('\Drupal\Component\Utility\SafeMarkup', 'checkPlain'), user_role_names(TRUE)); + $roles = user_role_names(TRUE); $form['account']['roles'] = array( '#type' => 'checkboxes', diff --git a/core/modules/user/src/Form/UserPermissionsForm.php b/core/modules/user/src/Form/UserPermissionsForm.php index 0e0a01a..e96efda 100644 --- a/core/modules/user/src/Form/UserPermissionsForm.php +++ b/core/modules/user/src/Form/UserPermissionsForm.php @@ -7,7 +7,6 @@ namespace Drupal\user\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormBase; use Drupal\Core\Form\FormStateInterface; @@ -94,7 +93,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { $admin_roles = array(); foreach ($this->getRoles() as $role_name => $role) { // Retrieve role names for columns. - $role_names[$role_name] = SafeMarkup::checkPlain($role->label()); + $role_names[$role_name] = $role->label(); // Fetch permissions for the roles. $role_permissions[$role_name] = $role->getPermissions(); $admin_roles[$role_name] = $role->isAdmin(); diff --git a/core/modules/user/src/Plugin/Condition/UserRole.php b/core/modules/user/src/Plugin/Condition/UserRole.php index 3316cbc..bd98a75 100644 --- a/core/modules/user/src/Plugin/Condition/UserRole.php +++ b/core/modules/user/src/Plugin/Condition/UserRole.php @@ -33,7 +33,7 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta '#type' => 'checkboxes', '#title' => $this->t('When the user has the following roles'), '#default_value' => $this->configuration['roles'], - '#options' => array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names()), + '#options' => user_role_names(), '#description' => $this->t('If you select no roles, the condition will evaluate to TRUE for all users.'), ); return parent::buildConfigurationForm($form, $form_state); diff --git a/core/modules/user/src/Plugin/views/access/Permission.php b/core/modules/user/src/Plugin/views/access/Permission.php index 0dc5165..fab8f88 100644 --- a/core/modules/user/src/Plugin/views/access/Permission.php +++ b/core/modules/user/src/Plugin/views/access/Permission.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\access; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Session\AccountInterface; @@ -121,7 +120,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { foreach ($permissions as $perm => $perm_item) { $provider = $perm_item['provider']; $display_name = $this->moduleHandler->getName($provider); - $perms[$display_name][$perm] = SafeMarkup::checkPlain(strip_tags($perm_item['title'])); + $perms[$display_name][$perm] = strip_tags($perm_item['title']); } $form['perm'] = array( diff --git a/core/modules/user/src/Plugin/views/access/Role.php b/core/modules/user/src/Plugin/views/access/Role.php index 4c2b732..360fe08 100644 --- a/core/modules/user/src/Plugin/views/access/Role.php +++ b/core/modules/user/src/Plugin/views/access/Role.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\access; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\user\RoleStorageInterface; use Drupal\views\Plugin\CacheablePluginInterface; @@ -97,7 +96,7 @@ public function summaryTitle() { else { $rids = user_role_names(); $rid = reset($this->options['role']); - return SafeMarkup::checkPlain($rids[$rid]); + return $rids[$rid]; } } @@ -115,7 +114,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { '#type' => 'checkboxes', '#title' => $this->t('Role'), '#default_value' => $this->options['role'], - '#options' => array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names()), + '#options' => user_role_names(), '#description' => $this->t('Only the checked roles will be able to access this display.'), ); } diff --git a/core/modules/user/src/Plugin/views/argument/RolesRid.php b/core/modules/user/src/Plugin/views/argument/RolesRid.php index 7fd209d..c43989c 100644 --- a/core/modules/user/src/Plugin/views/argument/RolesRid.php +++ b/core/modules/user/src/Plugin/views/argument/RolesRid.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\views\Plugin\views\argument\ManyToOne; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -60,7 +59,7 @@ public function title_query() { $entities = $this->roleStorage->loadMultiple($this->value); $titles = array(); foreach ($entities as $entity) { - $titles[] = SafeMarkup::checkPlain($entity->label()); + $titles[] = $entity->label(); } return $titles; } diff --git a/core/modules/user/src/Plugin/views/argument/Uid.php b/core/modules/user/src/Plugin/views/argument/Uid.php index c365009..1cd76e9 100644 --- a/core/modules/user/src/Plugin/views/argument/Uid.php +++ b/core/modules/user/src/Plugin/views/argument/Uid.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityStorageInterface; use Drupal\views\Plugin\views\argument\NumericArgument; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -61,7 +60,7 @@ public static function create(ContainerInterface $container, array $configuratio */ public function titleQuery() { return array_map(function($account) { - return SafeMarkup::checkPlain($account->label()); + return $account->label(); }, $this->storage->loadMultiple($this->value)); } diff --git a/core/modules/user/src/Plugin/views/argument_validator/User.php b/core/modules/user/src/Plugin/views/argument_validator/User.php index ede8dd5..49277c8 100644 --- a/core/modules/user/src/Plugin/views/argument_validator/User.php +++ b/core/modules/user/src/Plugin/views/argument_validator/User.php @@ -65,7 +65,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { $form['roles'] = array( '#type' => 'checkboxes', '#title' => $this->t('Restrict to the selected roles'), - '#options' => array_map(array('\Drupal\Component\Utility\SafeMarkup', 'checkPlain'), user_role_names(TRUE)), + '#options' => user_role_names(TRUE), '#default_value' => $this->options['roles'], '#description' => $this->t('If no roles are selected, users from any role will be allowed.'), '#states' => array( diff --git a/core/modules/user/src/Plugin/views/field/Roles.php b/core/modules/user/src/Plugin/views/field/Roles.php index 00a1918..e00da61 100644 --- a/core/modules/user/src/Plugin/views/field/Roles.php +++ b/core/modules/user/src/Plugin/views/field/Roles.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\field; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Connection; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\ViewExecutable; @@ -81,7 +80,7 @@ public function preRender(&$values) { $roles = user_roles(); $result = $this->database->query('SELECT u.entity_id as uid, u.roles_target_id as rid FROM {user__roles} u WHERE u.entity_id IN ( :uids[] ) AND u.roles_target_id IN ( :rids[] )', array(':uids[]' => $uids, ':rids[]' => array_keys($roles))); foreach ($result as $role) { - $this->items[$role->uid][$role->rid]['role'] = SafeMarkup::checkPlain($roles[$role->rid]->label()); + $this->items[$role->uid][$role->rid]['role'] = $roles[$role->rid]->label(); $this->items[$role->uid][$role->rid]['rid'] = $role->rid; } // Sort the roles for each user by role weight. diff --git a/core/modules/user/src/Plugin/views/filter/Permissions.php b/core/modules/user/src/Plugin/views/filter/Permissions.php index a637705..f38344b 100644 --- a/core/modules/user/src/Plugin/views/filter/Permissions.php +++ b/core/modules/user/src/Plugin/views/filter/Permissions.php @@ -7,7 +7,6 @@ namespace Drupal\user\Plugin\views\filter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Extension\ModuleHandlerInterface; use Drupal\user\PermissionHandlerInterface; use Drupal\views\Plugin\views\filter\ManyToOne; @@ -76,7 +75,7 @@ public function getValueOptions() { foreach ($permissions as $perm => $perm_item) { $provider = $perm_item['provider']; $display_name = $this->moduleHandler->getName($provider); - $this->valueOptions[$display_name][$perm] = SafeMarkup::checkPlain(strip_tags($perm_item['title'])); + $this->valueOptions[$display_name][$perm] = strip_tags($perm_item['title']); } } else { diff --git a/core/modules/user/src/Tests/Views/AccessPermissionTest.php b/core/modules/user/src/Tests/Views/AccessPermissionTest.php index 3e77e2a..918d66f 100644 --- a/core/modules/user/src/Tests/Views/AccessPermissionTest.php +++ b/core/modules/user/src/Tests/Views/AccessPermissionTest.php @@ -35,7 +35,9 @@ function testAccessPerm() { $access_plugin = $view->display_handler->getPlugin('access'); $this->assertTrue($access_plugin instanceof Permission, 'Make sure the right class got instantiated.'); - $this->assertEqual($access_plugin->pluginTitle(), t('Permission')); + // The plugin title will be a TranslationWrapper object, cast to a string to + // test the value. + $this->assertEqual((string) $access_plugin->pluginTitle(), t('Permission')); $this->assertFalse($view->display_handler->access($this->webUser)); $this->assertTrue($view->display_handler->access($this->normalUser)); diff --git a/core/modules/user/src/UserListBuilder.php b/core/modules/user/src/UserListBuilder.php index 7575b86..85b52f2 100644 --- a/core/modules/user/src/UserListBuilder.php +++ b/core/modules/user/src/UserListBuilder.php @@ -138,7 +138,7 @@ public function buildRow(EntityInterface $entity) { ); $row['status'] = $entity->isActive() ? $this->t('active') : $this->t('blocked'); - $roles = array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names(TRUE)); + $roles = user_role_names(TRUE); unset($roles[RoleInterface::AUTHENTICATED_ID]); $users_roles = array(); foreach ($entity->getRoles() as $role) { diff --git a/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php b/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php index f382579..57699fb 100644 --- a/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php +++ b/core/modules/user/tests/src/Unit/Views/Argument/RolesRidTest.php @@ -7,7 +7,6 @@ namespace Drupal\Tests\user\Unit\Views\Argument; -use Drupal\Component\Utility\Html; use Drupal\Core\DependencyInjection\ContainerBuilder; use Drupal\Tests\UnitTestCase; use Drupal\user\Entity\Role; @@ -81,7 +80,7 @@ public function testTitleQuery() { $roles_rid_argument->value = array('test_rid_1', 'test_rid_2'); $titles = $roles_rid_argument->title_query(); - $this->assertEquals(array('test rid 1', Html::escape('test <strong>rid 2</strong>')), $titles); + $this->assertEquals(array('test rid 1', 'test <strong>rid 2</strong>'), $titles); } } diff --git a/core/modules/user/user.module b/core/modules/user/user.module index 55473bb..2009857 100644 --- a/core/modules/user/user.module +++ b/core/modules/user/user.module @@ -396,9 +396,7 @@ function user_preprocess_block(&$variables) { * The account object for the user whose name is to be formatted. * * @return string - * An unsanitized string with the username to display. The code receiving - * this result must ensure that \Drupal\Component\Utility\SafeMarkup::checkPlain() - * is called on it before it is printed to the page. + * An unsanitized string with the username to display. * * @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0. * Use \Drupal\Core\Session\Interface::getUsername(). @@ -435,7 +433,7 @@ function user_template_preprocess_default_variables_alter(&$variables) { * * Modules that make any changes to variables like 'name' or 'extra' must ensure * that the final string is safe to include directly in the output by using - * \Drupal\Component\Utility\SafeMarkup::checkPlain() or + * \Drupal\Component\Utility\Html::escape() or * \Drupal\Component\Utility\Xss::filter(). */ function template_preprocess_username(&$variables) { diff --git a/core/modules/views/src/Plugin/views/HandlerBase.php b/core/modules/views/src/Plugin/views/HandlerBase.php index f2e5604..a891fbf 100644 --- a/core/modules/views/src/Plugin/views/HandlerBase.php +++ b/core/modules/views/src/Plugin/views/HandlerBase.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Unicode; use Drupal\Component\Utility\UrlHelper; use Drupal\Component\Utility\Xss; @@ -181,8 +181,7 @@ protected function defineOptions() { */ public function adminLabel($short = FALSE) { if (!empty($this->options['admin_label'])) { - $title = SafeMarkup::checkPlain($this->options['admin_label']); - return $title; + return $this->options['admin_label']; } $title = ($short && isset($this->definition['title short'])) ? $this->definition['title short'] : $this->definition['title']; return $this->t('!group: !title', array('!group' => $this->definition['group'], '!title' => $title)); @@ -230,10 +229,10 @@ public function sanitizeValue($value, $type = NULL) { $value = Xss::filterAdmin($value); break; case 'url': - $value = SafeMarkup::checkPlain(UrlHelper::stripDangerousProtocols($value)); + $value = Html::escape(UrlHelper::stripDangerousProtocols($value)); break; default: - $value = SafeMarkup::checkPlain($value); + $value = Html::escape($value); break; } return $value; diff --git a/core/modules/views/src/Plugin/views/PluginBase.php b/core/modules/views/src/Plugin/views/PluginBase.php index 49b7f1d..70ab8bc 100644 --- a/core/modules/views/src/Plugin/views/PluginBase.php +++ b/core/modules/views/src/Plugin/views/PluginBase.php @@ -8,7 +8,7 @@ namespace Drupal\views\Plugin\views; use Drupal\Component\Plugin\DependentPluginInterface; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Xss; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Language\LanguageInterface; @@ -314,9 +314,9 @@ public function summaryTitle() { public function pluginTitle() { // Short_title is optional so its defaults to an empty string. if (!empty($this->definition['short_title'])) { - return SafeMarkup::checkPlain($this->definition['short_title']); + return $this->definition['short_title']; } - return SafeMarkup::checkPlain($this->definition['title']); + return $this->definition['title']; } /** diff --git a/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php b/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php index 1775d99..6916fbb 100644 --- a/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php +++ b/core/modules/views/src/Plugin/views/ViewsHandlerInterface.php @@ -72,7 +72,8 @@ public function getJoin(); * @param $value * The value being rendered. * @param $type - * The type of sanitization needed. If not provided, SafeMarkup::checkPlain() is used. + * The type of sanitization needed. If not provided, + * \Drupal\Component\Utility\Html::escape() is used. * * @return string * Returns the safe value. diff --git a/core/modules/views/src/Plugin/views/area/Result.php b/core/modules/views/src/Plugin/views/area/Result.php index 02017e3..3079f0d 100644 --- a/core/modules/views/src/Plugin/views/area/Result.php +++ b/core/modules/views/src/Plugin/views/area/Result.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views\area; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Xss; use Drupal\Core\Form\FormStateInterface; use Drupal\views\Plugin\views\style\DefaultSummary; @@ -87,7 +87,7 @@ public function render($empty = FALSE) { // @TODO: Maybe use a possible is views empty functionality. // Not every view has total_rows set, use view->result instead. $total = isset($this->view->total_rows) ? $this->view->total_rows : count($this->view->result); - $label = SafeMarkup::checkPlain($this->view->storage->label()); + $label = Html::escape($this->view->storage->label()); if ($per_page === 0) { $page_count = 1; $start = 1; diff --git a/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php b/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php index a1f1c5e..b95e942 100644 --- a/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php +++ b/core/modules/views/src/Plugin/views/argument/ArgumentPluginBase.php @@ -10,7 +10,6 @@ use Drupal\Component\Plugin\DependentPluginInterface; use Drupal\Component\Utility\Html; use Drupal\Component\Utility\NestedArray; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Render\Element; use Drupal\views\Plugin\CacheablePluginInterface; @@ -882,7 +881,7 @@ public function summaryName($data) { if (empty($value) && !empty($this->definition['empty field name'])) { $value = $this->definition['empty field name']; } - return SafeMarkup::checkPlain($value); + return $value; } /** @@ -901,7 +900,7 @@ public function query($group_by = FALSE) { * This usually needs to be overridden to provide a proper title. */ function title() { - return SafeMarkup::checkPlain($this->argument); + return $this->argument; } /** diff --git a/core/modules/views/src/Plugin/views/argument/FieldList.php b/core/modules/views/src/Plugin/views/argument/FieldList.php index 36c50ac..54b7883 100644 --- a/core/modules/views/src/Plugin/views/argument/FieldList.php +++ b/core/modules/views/src/Plugin/views/argument/FieldList.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Field\AllowedTagsXssTrait; use Drupal\Core\Field\FieldFilteredString; use Drupal\Core\Form\FormStateInterface; @@ -75,7 +74,7 @@ public function summaryName($data) { } // else fallback to the key. else { - return SafeMarkup::checkPlain($value); + return $value; } } diff --git a/core/modules/views/src/Plugin/views/argument/ListString.php b/core/modules/views/src/Plugin/views/argument/ListString.php index 5b10132..9be41c2 100644 --- a/core/modules/views/src/Plugin/views/argument/ListString.php +++ b/core/modules/views/src/Plugin/views/argument/ListString.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\argument; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Field\AllowedTagsXssTrait; use Drupal\Core\Field\FieldFilteredString; use Drupal\Core\Form\FormStateInterface; diff --git a/core/modules/views/src/Plugin/views/argument/StringArgument.php b/core/modules/views/src/Plugin/views/argument/StringArgument.php index d417e81..a9c146d 100644 --- a/core/modules/views/src/Plugin/views/argument/StringArgument.php +++ b/core/modules/views/src/Plugin/views/argument/StringArgument.php @@ -317,7 +317,7 @@ function title() { * Override for specific title lookups. */ public function titleQuery() { - return array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', array_combine($this->value, $this->value)); + return array_combine($this->value, $this->value); } public function summaryName($data) { diff --git a/core/modules/views/src/Plugin/views/display/Attachment.php b/core/modules/views/src/Plugin/views/display/Attachment.php index dcc4282..8a36066 100644 --- a/core/modules/views/src/Plugin/views/display/Attachment.php +++ b/core/modules/views/src/Plugin/views/display/Attachment.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\display; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\views\ViewExecutable; @@ -92,7 +91,7 @@ public function optionsSummary(&$categories, &$options) { elseif (count($displays) == 1) { $display = array_shift($displays); if ($display = $this->view->storage->getDisplay($display)) { - $attach_to = SafeMarkup::checkPlain($display['display_title']); + $attach_to = $display['display_title']; } } diff --git a/core/modules/views/src/Plugin/views/display/Block.php b/core/modules/views/src/Plugin/views/display/Block.php index 411c50e..08e4467 100644 --- a/core/modules/views/src/Plugin/views/display/Block.php +++ b/core/modules/views/src/Plugin/views/display/Block.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\display; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\views\Plugin\Block\ViewsBlock; @@ -149,7 +148,7 @@ public function optionsSummary(&$categories, &$options) { if (empty($block_description)) { $block_description = $this->t('None'); } - $block_category = SafeMarkup::checkPlain($this->getOption('block_category')); + $block_category = $this->getOption('block_category'); $options['block_description'] = array( 'category' => 'block', diff --git a/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php b/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php index f9ae57a..708f67a 100644 --- a/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php +++ b/core/modules/views/src/Plugin/views/display/DisplayPluginBase.php @@ -1062,7 +1062,7 @@ public function getArgumentsTokens() { } // Use strip tags as there should never be HTML in the path. // However, we need to preserve special characters like " that - // were removed by SafeMarkup::checkPlain(). + // were removed by \Drupal\Component\Utility\Html::escape(). $tokens["!$count"] = isset($this->view->args[$count - 1]) ? strip_tags(Html::decodeEntities($this->view->args[$count - 1])) : ''; } @@ -1394,7 +1394,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { if ($this->defaultableSections($section)) { views_ui_standard_display_dropdown($form, $form_state, $section); } - $form['#title'] = SafeMarkup::checkPlain($this->display['display_title']) . ': '; + $form['#title'] = $this->display['display_title'] . ': '; // Set the 'section' to highlight on the form. // If it's the item we're looking at is pulling from the default display, diff --git a/core/modules/views/src/Plugin/views/display/Feed.php b/core/modules/views/src/Plugin/views/display/Feed.php index e4da10e..62485e0 100644 --- a/core/modules/views/src/Plugin/views/display/Feed.php +++ b/core/modules/views/src/Plugin/views/display/Feed.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\display; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Cache\CacheableMetadata; use Drupal\Core\Cache\CacheableResponse; use Drupal\Core\Form\FormStateInterface; @@ -99,7 +98,7 @@ public function preview() { if (!empty($this->view->live_preview)) { $output = array( '#prefix' => '<pre>', - '#markup' => SafeMarkup::checkPlain(drupal_render_root($output)), + '#plain_text' => drupal_render_root($output), '#suffix' => '</pre>', ); } @@ -204,7 +203,7 @@ public function optionsSummary(&$categories, &$options) { $display = array_shift($displays); $displays = $this->view->storage->get('display'); if (!empty($displays[$display])) { - $attach_to = SafeMarkup::checkPlain($displays[$display]['display_title']); + $attach_to = $displays[$display]['display_title']; } } diff --git a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php index d17f70c..d4eb125 100644 --- a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php +++ b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\exposed_form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormState; use Drupal\Core\Form\FormStateInterface; use Drupal\views\Form\ViewsExposedForm; @@ -211,7 +210,7 @@ public function exposedFormAlter(&$form, FormStateInterface $form_state) { $exposed_sorts = array(); foreach ($this->view->sort as $id => $handler) { if ($handler->canExpose() && $handler->isExposed()) { - $exposed_sorts[$id] = SafeMarkup::checkPlain($handler->options['expose']['label']); + $exposed_sorts[$id] = $handler->options['expose']['label']; } } diff --git a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php index 152d4e9..e7792c1 100644 --- a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php +++ b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php @@ -1395,7 +1395,7 @@ protected function renderAsLink($alter, $text, $tokens) { // Use strip tags as there should never be HTML in the path. // However, we need to preserve special characters like " that - // were removed by SafeMarkup::checkPlain(). + // were removed by \Drupal\Component\Utility\Html::escape(). $path = strip_tags(Html::decodeEntities($this->viewsTokenReplace($path, $tokens))); if (!empty($alter['path_case']) && $alter['path_case'] != 'none' && !$alter['url']->isRouted()) { @@ -1481,8 +1481,7 @@ protected function renderAsLink($alter, $text, $tokens) { $options['attributes']['rel'] = $rel; } - // Not sure if this SafeMarkup::checkPlain() is needed here? - $target = SafeMarkup::checkPlain(trim($this->viewsTokenReplace($alter['target'], $tokens))); + $target = trim($this->viewsTokenReplace($alter['target'], $tokens)); if (!empty($target)) { $options['attributes']['target'] = $target; } @@ -1564,7 +1563,7 @@ public function getRenderTokens($item) { // Use strip tags as there should never be HTML in the path. // However, we need to preserve special characters like " that - // were removed by SafeMarkup::checkPlain(). + // were removed by \Drupal\Component\Utility\Html::escape(). $tokens['!' . $count] = isset($this->view->args[$count - 1]) ? strip_tags(Html::decodeEntities($this->view->args[$count - 1])) : ''; } diff --git a/core/modules/views/src/Plugin/views/field/MachineName.php b/core/modules/views/src/Plugin/views/field/MachineName.php index 0c289cd..55ab72b 100644 --- a/core/modules/views/src/Plugin/views/field/MachineName.php +++ b/core/modules/views/src/Plugin/views/field/MachineName.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\field; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\views\ResultRow; @@ -83,7 +82,7 @@ public function preRender(&$values) { public function render(ResultRow $values) { $value = $values->{$this->field_alias}; if (!empty($this->options['machine_name']) || !isset($this->valueOptions[$value])) { - $result = SafeMarkup::checkPlain($value); + $result = $value; } else { $result = $this->valueOptions[$value]; diff --git a/core/modules/views/src/Plugin/views/field/Serialized.php b/core/modules/views/src/Plugin/views/field/Serialized.php index f7f5a22..796440b 100644 --- a/core/modules/views/src/Plugin/views/field/Serialized.php +++ b/core/modules/views/src/Plugin/views/field/Serialized.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\field; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormStateInterface; use Drupal\views\ResultRow; @@ -76,11 +75,11 @@ public function render(ResultRow $values) { $value = $values->{$this->field_alias}; if ($this->options['format'] == 'unserialized') { - return SafeMarkup::checkPlain(print_r(unserialize($value), TRUE)); + return print_r(unserialize($value), TRUE); } elseif ($this->options['format'] == 'key' && !empty($this->options['key'])) { $value = (array) unserialize($value); - return SafeMarkup::checkPlain($value[$this->options['key']]); + return $value[$this->options['key']]; } return $value; diff --git a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php index d2e9fe8..96121f7 100644 --- a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php +++ b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php @@ -14,7 +14,6 @@ use Drupal\views\Plugin\CacheablePluginInterface; use Drupal\views\Plugin\views\HandlerBase; use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\views\Plugin\views\display\DisplayPluginBase; use Drupal\views\ViewExecutable; @@ -172,7 +171,7 @@ protected function defineOptions() { * Display the filter on the administrative summary */ public function adminSummary() { - return SafeMarkup::checkPlain((string) $this->operator) . ' ' . SafeMarkup::checkPlain((string) $this->value); + return Html::escape((string) $this->operator) . ' ' . Html::escape((string) $this->value); } /** @@ -595,7 +594,7 @@ public function buildExposeForm(&$form, FormStateInterface $form_state) { '#default_value' => $this->options['expose']['remember'], ); - $role_options = array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', user_role_names()); + $role_options = user_role_names(); $form['expose']['remember_roles'] = array( '#type' => 'checkboxes', '#title' => $this->t('User roles'), @@ -766,7 +765,7 @@ public function groupForm(&$form, FormStateInterface $form_state) { $value = $this->options['group_info']['identifier']; $form[$value] = array( - '#title' => SafeMarkup::checkPlain($this->options['group_info']['label']), + '#title' => $this->options['group_info']['label'], '#type' => $this->options['group_info']['widget'], '#default_value' => $this->group_info, '#options' => $groups, diff --git a/core/modules/views/src/Plugin/views/filter/InOperator.php b/core/modules/views/src/Plugin/views/filter/InOperator.php index d08aa00..469974c 100644 --- a/core/modules/views/src/Plugin/views/filter/InOperator.php +++ b/core/modules/views/src/Plugin/views/filter/InOperator.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views\filter; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Component\Utility\Unicode; use Drupal\Core\Form\FormStateInterface; use Drupal\views\Plugin\views\display\DisplayPluginBase; @@ -335,7 +335,7 @@ public function adminSummary() { return; } - $operator = SafeMarkup::checkPlain($info[$this->operator]['short']); + $operator = $info[$this->operator]['short']; $values = ''; if (in_array($this->operator, $this->operatorValues(1))) { // Remove every element which is not known. @@ -351,13 +351,13 @@ public function adminSummary() { else if (count($this->value) == 1) { // If any, use the 'single' short name of the operator instead. if (isset($info[$this->operator]['short_single'])) { - $operator = SafeMarkup::checkPlain($info[$this->operator]['short_single']); + $operator = $info[$this->operator]['short_single']; } $keys = $this->value; $value = array_shift($keys); if (isset($this->valueOptions[$value])) { - $values = SafeMarkup::checkPlain($this->valueOptions[$value]); + $values = $this->valueOptions[$value]; } else { $values = ''; @@ -373,13 +373,13 @@ public function adminSummary() { break; } if (isset($this->valueOptions[$value])) { - $values .= SafeMarkup::checkPlain($this->valueOptions[$value]); + $values .= $this->valueOptions[$value]; } } } } - return $operator . (($values !== '') ? ' ' . $values : ''); + return Html::escape($operator . (($values !== '') ? ' ' . $values : '')); } public function query() { diff --git a/core/modules/views/src/Plugin/views/filter/NumericFilter.php b/core/modules/views/src/Plugin/views/filter/NumericFilter.php index f88e3a6..51bd8f7 100644 --- a/core/modules/views/src/Plugin/views/filter/NumericFilter.php +++ b/core/modules/views/src/Plugin/views/filter/NumericFilter.php @@ -7,7 +7,6 @@ namespace Drupal\views\Plugin\views\filter; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Database; use Drupal\Core\Form\FormStateInterface; @@ -292,12 +291,12 @@ public function adminSummary() { } $options = $this->operatorOptions('short'); - $output = SafeMarkup::checkPlain($options[$this->operator]); + $output = $options[$this->operator]; if (in_array($this->operator, $this->operatorValues(2))) { $output .= ' ' . $this->t('@min and @max', array('@min' => $this->value['min'], '@max' => $this->value['max'])); } elseif (in_array($this->operator, $this->operatorValues(1))) { - $output .= ' ' . SafeMarkup::checkPlain($this->value['value']); + $output .= ' ' . $this->value['value']; } return $output; } diff --git a/core/modules/views/src/Plugin/views/filter/StringFilter.php b/core/modules/views/src/Plugin/views/filter/StringFilter.php index 9713351..972aa3c 100644 --- a/core/modules/views/src/Plugin/views/filter/StringFilter.php +++ b/core/modules/views/src/Plugin/views/filter/StringFilter.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views\filter; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Database\Database; use Drupal\Core\Form\FormStateInterface; @@ -162,10 +162,10 @@ public function adminSummary() { $options = $this->operatorOptions('short'); $output = ''; if (!empty($options[$this->operator])) { - $output = SafeMarkup::checkPlain($options[$this->operator]); + $output = Html::escape($options[$this->operator]); } if (in_array($this->operator, $this->operatorValues(1))) { - $output .= ' ' . SafeMarkup::checkPlain($this->value); + $output .= ' ' . Html::escape($this->value); } return $output; } diff --git a/core/modules/views/src/Plugin/views/row/EntityRow.php b/core/modules/views/src/Plugin/views/row/EntityRow.php index e95e5fa..bfe1cea 100644 --- a/core/modules/views/src/Plugin/views/row/EntityRow.php +++ b/core/modules/views/src/Plugin/views/row/EntityRow.php @@ -7,7 +7,7 @@ namespace Drupal\views\Plugin\views\row; -use Drupal\Component\Utility\SafeMarkup; +use Drupal\Component\Utility\Html; use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Form\FormStateInterface; use Drupal\Core\Language\LanguageManagerInterface; @@ -160,7 +160,7 @@ public function buildOptionsForm(&$form, FormStateInterface $form_state) { public function summaryTitle() { $options = \Drupal::entityManager()->getViewModeOptions($this->entityTypeId); if (isset($options[$this->options['view_mode']])) { - return SafeMarkup::checkPlain($options[$this->options['view_mode']]); + return $options[$this->options['view_mode']]; } else { return $this->t('No view mode selected'); diff --git a/core/modules/views/src/Tests/SearchIntegrationTest.php b/core/modules/views/src/Tests/SearchIntegrationTest.php index 2edd22d..78c43ac 100644 --- a/core/modules/views/src/Tests/SearchIntegrationTest.php +++ b/core/modules/views/src/Tests/SearchIntegrationTest.php @@ -108,15 +108,16 @@ public function testSearchIntegration() { 'type' => $type->id(), ]; $this->drupalCreateNode($node); - $node['title'] = "Drupal's search rocks really rocks!"; + $node['title'] = "Drupal's search rocks <em>really</em> rocks!"; $this->drupalCreateNode($node); $this->cronRun(); $this->drupalGet('test-arg/rocks'); $xpath = '//div[@class="views-row"]//a'; /** @var \SimpleXMLElement[] $results */ $results = $this->xpath($xpath); - $this->assertEqual((string) $results[0], "Drupal's search rocks really rocks!"); + $this->assertEqual((string) $results[0], "Drupal's search rocks <em>really</em> rocks!"); $this->assertEqual((string) $results[1], "Drupal's search rocks."); + $this->assertEscaped("Drupal's search rocks <em>really</em> rocks!"); // Test sorting with another set of titles. $node = [ diff --git a/core/modules/views/src/Views.php b/core/modules/views/src/Views.php index 33570ae..6f11b4a 100644 --- a/core/modules/views/src/Views.php +++ b/core/modules/views/src/Views.php @@ -7,8 +7,6 @@ namespace Drupal\views; -use Drupal\Component\Utility\SafeMarkup; - /** * Static service container wrapper for views. */ @@ -398,8 +396,8 @@ public static function pluginList() { if (!isset($plugins[$key])) { $plugins[$key] = array( 'type' => $type, - 'title' => SafeMarkup::checkPlain($info[$name]['title']), - 'provider' => SafeMarkup::checkPlain($info[$name]['provider']), + 'title' => $info[$name]['title'], + 'provider' => $info[$name]['provider'], 'views' => array(), ); } diff --git a/core/modules/views/views.module b/core/modules/views/views.module index 22424a1..19af30d 100644 --- a/core/modules/views/views.module +++ b/core/modules/views/views.module @@ -67,8 +67,8 @@ function views_views_pre_render($view) { 'views_dom_id:' . $view->dom_id => array( 'view_name' => $view->storage->id(), 'view_display_id' => $view->current_display, - 'view_args' => SafeMarkup::checkPlain(implode('/', $view->args)), - 'view_path' => SafeMarkup::checkPlain(Url::fromRoute('<current>')->toString()), + 'view_args' => Html::escape(implode('/', $view->args)), + 'view_path' => Html::escape(Url::fromRoute('<current>')->toString()), 'view_base_path' => $view->getPath(), 'view_dom_id' => $view->dom_id, // To fit multiple views on a page, the programmer may have diff --git a/core/modules/views_ui/src/Controller/ViewsUIController.php b/core/modules/views_ui/src/Controller/ViewsUIController.php index bed5aaa..85143a4 100644 --- a/core/modules/views_ui/src/Controller/ViewsUIController.php +++ b/core/modules/views_ui/src/Controller/ViewsUIController.php @@ -7,7 +7,6 @@ namespace Drupal\views_ui\Controller; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Controller\ControllerBase; use Drupal\Core\Url; use Drupal\views\ViewExecutable; @@ -89,7 +88,7 @@ public function reportFields() { $header = array(t('Field name'), t('Used in')); $rows = array(); foreach ($fields as $field_name => $views) { - $rows[$field_name]['data'][0] = SafeMarkup::checkPlain($field_name); + $rows[$field_name]['data'][0] = $field_name; foreach ($views as $view) { $rows[$field_name]['data'][1][] = $this->l($view, new Url('entity.view.edit_form', array('view' => $view))); } diff --git a/core/modules/views_ui/src/Tests/RowUITest.php b/core/modules/views_ui/src/Tests/RowUITest.php index 6056b58..71fa544 100644 --- a/core/modules/views_ui/src/Tests/RowUITest.php +++ b/core/modules/views_ui/src/Tests/RowUITest.php @@ -7,6 +7,7 @@ namespace Drupal\views_ui\Tests; +use Drupal\Core\Entity\Entity\EntityViewMode; use Drupal\views\Views; /** @@ -87,6 +88,13 @@ public function testRowUI() { $this->drupalPostForm(NULL, ['row[type]' => 'entity:node'], t('Apply')); $this->assertUrl($row_options_url); $this->assertFieldByName('row_options[view_mode]', 'teaser'); + + // Change the teaser label to have markup so we can test escaping. + $teaser = EntityViewMode::load('node.teaser'); + $teaser->set('label', 'Teaser <em>markup</em>'); + $teaser->save(); + $this->drupalGet('admin/structure/views/view/frontpage/edit/default'); + $this->assertEscaped('Teaser <em>markup</em>'); } } diff --git a/core/modules/views_ui/src/Tests/XssTest.php b/core/modules/views_ui/src/Tests/XssTest.php index 21080cb..36b227c 100644 --- a/core/modules/views_ui/src/Tests/XssTest.php +++ b/core/modules/views_ui/src/Tests/XssTest.php @@ -23,14 +23,14 @@ class XssTest extends UITestBase { public function testViewsUi() { $this->drupalGet('admin/structure/views'); - $this->assertRaw('<script>alert("foo");</script>, <marquee>test</marquee>', 'The view tag is properly escaped.'); + $this->assertEscaped('<script>alert("foo");</script>, <marquee>test</marquee>', 'The view tag is properly escaped.'); $this->drupalGet('admin/structure/views/view/sa_contrib_2013_035'); - $this->assertRaw('&lt;marquee&gt;test&lt;/marquee&gt;', 'Field admin label is properly escaped.'); + $this->assertEscaped('<marquee>test</marquee>', 'Field admin label is properly escaped.'); $this->drupalGet('admin/structure/views/nojs/handler/sa_contrib_2013_035/page_1/header/area'); - $this->assertRaw('[title] == &lt;marquee&gt;test&lt;/marquee&gt;', 'Token label is properly escaped.'); - $this->assertRaw('[title_1] == &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;', 'Token label is properly escaped.'); + $this->assertEscaped('[title] == <marquee>test</marquee>', 'Token label is properly escaped.'); + $this->assertEscaped('[title_1] == <script>alert("XSS")</script>', 'Token label is properly escaped.'); } } diff --git a/core/modules/views_ui/src/ViewEditForm.php b/core/modules/views_ui/src/ViewEditForm.php index 05bc5fd..15d092c 100644 --- a/core/modules/views_ui/src/ViewEditForm.php +++ b/core/modules/views_ui/src/ViewEditForm.php @@ -494,7 +494,7 @@ public function getDisplayDetails($view, $display) { $build['top']['display_title'] = array( '#theme' => 'views_ui_display_tab_setting', '#description' => $this->t('Display name'), - '#link' => $view->getExecutable()->displayHandlers->get($display['id'])->optionLink(SafeMarkup::checkPlain($display_title), 'display_title'), + '#link' => $view->getExecutable()->displayHandlers->get($display['id'])->optionLink(Html::escape($display_title), 'display_title'), ); } @@ -1060,7 +1060,7 @@ public function getFormBucket(ViewUI $view, $type, $display) { continue; } - $field_name = SafeMarkup::checkPlain($handler->adminLabel(TRUE)); + $field_name = $handler->adminLabel(TRUE); if (!empty($field['relationship']) && !empty($relationships[$field['relationship']])) { $field_name = '(' . $relationships[$field['relationship']] . ') ' . $field_name; } diff --git a/core/modules/views_ui/src/ViewListBuilder.php b/core/modules/views_ui/src/ViewListBuilder.php index 16abf60..0d8125b 100644 --- a/core/modules/views_ui/src/ViewListBuilder.php +++ b/core/modules/views_ui/src/ViewListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\views_ui; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Plugin\PluginManagerInterface; use Drupal\Core\Entity\EntityInterface; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; @@ -102,7 +101,7 @@ public function buildRow(EntityInterface $view) { ), 'description' => array( 'data' => array( - '#markup' => SafeMarkup::checkPlain($view->get('description')), + '#plain_text' => $view->get('description'), ), 'class' => array('views-table-filter-text-source'), ), @@ -278,7 +277,7 @@ protected function getDisplayPaths(EntityInterface $view) { $all_paths[] = \Drupal::l('/' . $path, Url::fromUserInput('/' . $path)); } else { - $all_paths[] = SafeMarkup::checkPlain('/' . $path); + $all_paths[] = '/' . $path; } } } diff --git a/core/modules/views_ui/tests/src/Unit/ViewListBuilderTest.php b/core/modules/views_ui/tests/src/Unit/ViewListBuilderTest.php index d4bc2b6..4089d3a 100644 --- a/core/modules/views_ui/tests/src/Unit/ViewListBuilderTest.php +++ b/core/modules/views_ui/tests/src/Unit/ViewListBuilderTest.php @@ -7,6 +7,7 @@ namespace Drupal\Tests\views_ui\Unit; +use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\DependencyInjection\ContainerBuilder; use Drupal\Core\Entity\EntityInterface; use Drupal\Tests\UnitTestCase; @@ -165,7 +166,10 @@ public function testBuildRowEntityList() { $this->assertEquals($expected_displays, $row['data']['view_name']['data']['#displays']); $display_paths = $row['data']['path']['data']['#items']; - $this->assertEquals('/test_page, /<object>malformed_path</object>, /<script>alert("placeholder_page/%")</script>', implode(', ', $display_paths)); + // These values will be escaped by Twig when rendered. + $this->assertEquals('/test_page, /<object>malformed_path</object>, /<script>alert("placeholder_page/%")</script>', implode(', ', $display_paths)); + $this->assertFalse(SafeMarkup::isSafe('/<object>malformed_path</object>'), '/<script>alert("/<object>malformed_path</object> is not marked safe.'); + $this->assertFalse(SafeMarkup::isSafe('/<script>alert("placeholder_page/%")'), '/<script>alert("/<script>alert("placeholder_page/%") is not marked safe.'); } } diff --git a/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php b/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php index 178a662..28a2846 100644 --- a/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php +++ b/core/tests/Drupal/Tests/Component/Utility/HtmlTest.php @@ -231,7 +231,7 @@ public function testDecodeEntities($text, $expected) { /** * Data provider for testDecodeEntities(). * - * @see testCheckPlain() + * @see testDecodeEntities() */ public function providerDecodeEntities() { return array( @@ -272,7 +272,7 @@ public function testEscape($expected, $text) { /** * Data provider for testEscape(). * - * @see testCheckPlain() + * @see testEscape() */ public function providerEscape() { return array( diff --git a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php index 1278a6d..1f3ad0c 100644 --- a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php +++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php @@ -197,18 +197,17 @@ function providerFormat() { * * @covers ::escape */ - public function testAdminXss() { - // Mark the string as safe. This is for test purposes only. + public function testEscape() { $text = '<marquee>text</marquee>'; + // SafeMarkup::escape() will escape the tag since the string is not safe. + $this->assertEquals('<marquee>text</marquee>', SafeMarkup::escape($text)); + + // Mark the string as safe. This is for test purposes only. SafeMarkup::set($text); // SafeMarkup::escape() will not escape the markup tag since the string was // marked safe above. $this->assertEquals('<marquee>text</marquee>', SafeMarkup::escape($text)); - - // SafeMarkup::checkPlain() will escape the markup tag even though the - // string was marked safe above. - $this->assertEquals('<marquee>text</marquee>', SafeMarkup::checkPlain($text)); } } diff --git a/core/tests/Drupal/Tests/Core/Entity/EntityListBuilderTest.php b/core/tests/Drupal/Tests/Core/Entity/EntityListBuilderTest.php index b76ce38..79447e5 100644 --- a/core/tests/Drupal/Tests/Core/Entity/EntityListBuilderTest.php +++ b/core/tests/Drupal/Tests/Core/Entity/EntityListBuilderTest.php @@ -137,64 +137,6 @@ public function testGetOperations() { $this->assertArrayHasKey('title', $operations[$operation_name]); } - /** - * Tests that buildRow() returns a string which has been run through - * SafeMarkup::checkPlain(). - * - * @dataProvider providerTestBuildRow - * - * @param string $input - * The entity label being passed into buildRow. - * @param string $expected - * The expected output of the label from buildRow. - * @param string $message - * The message to provide as output for the test. - * @param bool $ignorewarnings - * Whether or not to ignore PHP 5.3+ invalid multibyte sequence warnings. - * - * @see \Drupal\Core\Entity\EntityListBuilder::buildRow() - */ - public function testBuildRow($input, $expected, $message, $ignorewarnings = FALSE) { - $this->role->expects($this->any()) - ->method('label') - ->will($this->returnValue($input)); - - if ($ignorewarnings) { - $built_row = @$this->entityListBuilder->buildRow($this->role); - } - else { - $built_row = $this->entityListBuilder->buildRow($this->role); - } - - $this->assertEquals($built_row['label'], $expected, $message); - } - - /** - * Data provider for testBuildRow(). - * - * @see self::testBuildRow() - * @see \Drupal\Tests\Component\Utility\SafeMarkupTest::providerCheckPlain() - * - * @return array - * An array containing a string, the expected return from - * SafeMarkup::checkPlain, a message to be output for failures, and whether the - * test should be processed as multibyte. - */ - public function providerTestBuildRow() { - $tests = array(); - // Checks that invalid multi-byte sequences are escaped. - $tests[] = array("Foo\xC0barbaz", 'Foo�barbaz', 'EntityTestListBuilder::buildRow() escapes invalid sequence "Foo\xC0barbaz"', TRUE); - $tests[] = array("\xc2\"", '�"', 'EntityTestListBuilder::buildRow escapes invalid sequence "\xc2\""', TRUE); - $tests[] = array("Fooÿñ", "Fooÿñ", 'EntityTestListBuilder::buildR does not escape valid sequence "Fooÿñ"'); - - // Checks that special characters are escaped. - $tests[] = array("<script>", '<script>', 'EntityTestListBuilder::buildRow() escapes <script>'); - $tests[] = array('<>&"\'', '<>&"'', 'EntityTestListBuilder::buildRow() escapes reserved HTML characters.'); - - return $tests; - - } - } class TestEntityListBuilder extends EntityTestListBuilder { diff --git a/core/tests/Drupal/Tests/Core/Form/FormErrorHandlerTest.php b/core/tests/Drupal/Tests/Core/Form/FormErrorHandlerTest.php index cd8e3b2..1d1f4f9 100644 --- a/core/tests/Drupal/Tests/Core/Form/FormErrorHandlerTest.php +++ b/core/tests/Drupal/Tests/Core/Form/FormErrorHandlerTest.php @@ -7,7 +7,10 @@ namespace Drupal\Tests\Core\Form; +use Drupal\Component\Utility\Html; +use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Form\FormState; +use Drupal\Core\Url; use Drupal\Tests\UnitTestCase; /** @@ -24,7 +27,11 @@ public function testDisplayErrorMessages() { $link_generator = $this->getMock('Drupal\Core\Utility\LinkGeneratorInterface'); $link_generator->expects($this->any()) ->method('generate') - ->willReturnArgument(0); + ->willReturnCallback(function($text, Url $url, $collect_bubbleable_metadata = FALSE) { + return Html::escape($text); + }); + + $renderer = $this->getMock('\Drupal\Core\Render\RendererInterface'); $form_error_handler = $this->getMockBuilder('Drupal\Core\Form\FormErrorHandler') ->setConstructorArgs([$this->getStringTranslationStub(), $link_generator, $renderer]) @@ -102,6 +109,9 @@ public function testDisplayErrorMessages() { $form_state->setErrorByName('missing_element', 'this missing element is invalid'); $form_error_handler->handleFormErrors($form, $form_state); $this->assertSame('invalid', $form['test1']['#errors']); + // Ensure that error messages have not been marked safe so that the render + // system will do the escaping. + $this->assertFalse(SafeMarkup::isSafe('3 errors have been found: Test 1, Test 2 & a half, Test 3')); } /** diff --git a/core/tests/Drupal/Tests/Core/Render/RendererTest.php b/core/tests/Drupal/Tests/Core/Render/RendererTest.php index 3d72633..515d3e4 100644 --- a/core/tests/Drupal/Tests/Core/Render/RendererTest.php +++ b/core/tests/Drupal/Tests/Core/Render/RendererTest.php @@ -740,7 +740,7 @@ public function testRenderCacheProperties(array $expected_results) { 'child1' => ['#markup' => SafeString::create('1')], 'child2' => ['#markup' => SafeString::create('2')], // Mark the value as safe. - '#custom_property' => SafeMarkup::checkPlain('custom_value'), + '#custom_property' => SafeMarkup::set('custom_value'), '#custom_property_array' => ['custom value'], ];