diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index adf4c86..a532591 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -1307,7 +1307,9 @@ protected function buttonWasClicked($element, FormStateInterface &$form_state) {
// long as $form['#name'] puts the value at the top level of the tree of
// \Drupal::request()->request data.
$input = $form_state->getUserInput();
- if (isset($input[$element['#name']]) && $input[$element['#name']] == $element['#value']) {
+ // Browsers submit the unescaped version of the input value, so we need to
+ // make sure the compared values have the same "encoding".
+ if (isset($input[$element['#name']]) && Html::decodeEntities($input[$element['#name']]) == Html::decodeEntities($element['#value'])) {
return TRUE;
}
// When image buttons are clicked, browsers do NOT pass the form element
diff --git a/core/lib/Drupal/Core/Template/Attribute.php b/core/lib/Drupal/Core/Template/Attribute.php
index 3629cda..ecd1e05 100644
--- a/core/lib/Drupal/Core/Template/Attribute.php
+++ b/core/lib/Drupal/Core/Template/Attribute.php
@@ -7,6 +7,8 @@
namespace Drupal\Core\Template;
+use Drupal\Component\Utility\PlainTextOutput;
+use Drupal\Component\Utility\SafeMarkup;
use Drupal\Component\Utility\SafeStringInterface;
/**
@@ -121,7 +123,13 @@ protected function createAttributeValue($name, $value) {
$value = new AttributeBoolean($name, $value);
}
// As a development aid, we allow the value to be a safe string object.
- elseif (!is_object($value) || $value instanceof SafeStringInterface) {
+ elseif (SafeMarkup::isSafe($value)) {
+ // Attributes are not supposed to display HTML markup, so we just convert
+ // the value to plain text.
+ $value = PlainTextOutput::renderFromHtml($value);
+ $value = new AttributeString($name, $value);
+ }
+ elseif (!is_object($value)) {
$value = new AttributeString($name, $value);
}
return $value;
diff --git a/core/modules/views_ui/src/Tests/DisplayTest.php b/core/modules/views_ui/src/Tests/DisplayTest.php
index 535cd8e..89096d0 100644
--- a/core/modules/views_ui/src/Tests/DisplayTest.php
+++ b/core/modules/views_ui/src/Tests/DisplayTest.php
@@ -9,9 +9,9 @@
use Drupal\Component\Serialization\Json;
use Drupal\Component\Utility\SafeMarkup;
-
-use Drupal\views\Views;
use Drupal\Core\Template\Attribute;
+use Drupal\views\Entity\View;
+use Drupal\views\Views;
/**
* Tests the display UI.
@@ -215,6 +215,35 @@ public function testViewStatus() {
}
/**
+ * Ensures that no XSS is possible for buttons.
+ */
+ public function testDisplayTitleInButtonsXss() {
+ $xss_markup = '">';
+ $view = $this->randomView();
+ $view = View::load($view['id']);
+ \Drupal::configFactory()->getEditable('views.settings')->set('ui.show.master_display', TRUE)->save();
+
+ foreach ([$xss_markup, '">'] as $input) {
+ $display =& $view->getDisplay('page_1');
+ $display['display_title'] = $input;
+ $view->save();
+
+ $this->drupalGet("admin/structure/views/view/{$view->id()}");
+ $escaped = views_ui_truncate($input, 25);
+ $this->assertEscaped($escaped);
+ $this->assertNoRaw($xss_markup);
+
+ $this->drupalGet("admin/structure/views/view/{$view->id()}/edit/page_1");
+ $this->assertEscaped("View $escaped");
+ $this->assertNoRaw("View $xss_markup");
+ $this->assertEscaped("Duplicate $escaped");
+ $this->assertNoRaw("Duplicate $xss_markup");
+ $this->assertEscaped("Delete $escaped");
+ $this->assertNoRaw("Delete $xss_markup");
+ }
+ }
+
+ /**
* Tests the action links on the edit display UI.
*/
public function testActionLinks() {
@@ -244,4 +273,5 @@ public function testActionLinks() {
$this->assertEscaped($display_title);
$this->assertNoRaw($display_title);
}
+
}
diff --git a/core/modules/views_ui/src/ViewEditForm.php b/core/modules/views_ui/src/ViewEditForm.php
index 818984a..a2760e6 100644
--- a/core/modules/views_ui/src/ViewEditForm.php
+++ b/core/modules/views_ui/src/ViewEditForm.php
@@ -8,23 +8,20 @@
namespace Drupal\views_ui;
use Drupal\Component\Utility\Html;
-use Drupal\Component\Utility\UrlHelper;
+use Drupal\Component\Utility\SafeMarkup;
use Drupal\Component\Utility\Xss;
use Drupal\Core\Ajax\AjaxResponse;
use Drupal\Core\Ajax\HtmlCommand;
use Drupal\Core\Ajax\ReplaceCommand;
use Drupal\Core\Datetime\DateFormatter;
-use Drupal\Component\Utility\NestedArray;
-use Drupal\Component\Utility\SafeMarkup;
use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Render\Element;
use Drupal\Core\Render\ElementInfoManagerInterface;
use Drupal\Core\Url;
use Drupal\user\SharedTempStoreFactory;
use Drupal\views\Views;
-use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\RequestStack;
/**
* Form controller for the Views edit form.
@@ -402,7 +399,7 @@ public function getDisplayDetails($view, $display) {
if (!$is_enabled) {
$build['top']['actions']['enable'] = array(
'#type' => 'submit',
- '#value' => $this->t('Enable !display_title', array('!display_title' => $display_title)),
+ '#value' => $this->t('Enable @display_title', ['@display_title' => $display_title]),
'#limit_validation_errors' => array(),
'#submit' => array('::submitDisplayEnable', '::submitDelayDestination'),
'#prefix' => '
',
@@ -424,7 +421,7 @@ public function getDisplayDetails($view, $display) {
}
$build['top']['actions']['path'] = array(
'#type' => 'link',
- '#title' => $this->t('View !display_title', array('!display_title' => $display_title)),
+ '#title' => $this->t('View @display_title', ['@display_title' => $display_title]),
'#options' => array('alt' => array($this->t("Go to the real page for this display"))),
'#url' => $url,
'#prefix' => '