diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php index fdca0cf..bcb6722 100644 --- a/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -139,18 +139,20 @@ public static function escape($string) { } /** - * Applies a very permissive XSS/HTML filter for admin-only use, if not safe. + * Applies a very permissive XSS/HTML filter for admin-only use. + * + * Note: this methods only filters if $string is not marked safe already. * * @deprecated as of Drupal 8.0.x, will be removed before Drupal 8.0.0. Most - * calls can be removed. If it's used as part of a render array use #markup - * to allow the render system to filter automatically or just allow the Twig - * to autoescape the value. If the result is not being used directly in the - * rendering system (for example, when its result is being combined with - * other strings before rendering), use Xss::filterAdmin(). Otherwise, use - * SafeMarkup::xssFilter() and the tag list provided by - * Xss::getAdminTagList() instead. If the caller does not want to filter - * strings that are marked safe already it needs to check - * SafeMarkup::isSafe() itself. + * calls can be removed. If the string used as part of a render array use + * #markup to allow the render system to filter automatically or just allow + * the Twig to autoescape the value. If the result is not being used + * directly in the rendering system (for example, when its result is being + * combined with other strings before rendering), use Xss::filterAdmin(). + * Otherwise, use SafeMarkup::xssFilter() and the tag list provided by + * Xss::getAdminTagList() instead. In the rare instance that the caller does + * not want to filter strings that are marked safe already, it needs to + * check SafeMarkup::isSafe() itself. * * @see \Drupal\Component\Utility\SafeMarkup::xssFilter() * @see \Drupal\Component\Utility\SafeMarkup::isSafe() @@ -167,23 +169,23 @@ public static function checkAdminXss($string) { * Calling this method unnecessarily will result in bloating the safe string * list and increases the chance of unintended side-effects. * - * If twig receives a value that is not marked as safe then it will + * If Twig receives a value that is not marked as safe then it will * automatically encode special characters in a plain-text string for display * as HTML. Therefore, SafeMarkup::filterXss() should only be used when the * string might contain HTML that needs to be rendered properly by the * browser. * * If you need to filter for admin use, like Xss::filterAdmin(), then: - * - If it's used as part of a render array use #markup to allow the render - * system to filter by the admin tag list automatically. + * - If the string is used as part of a render array, use #markup to allow the + * render system to filter by the admin tag list automatically. * - Otherwise, use the SafeMarkup::xssFilter() with tag list provided by * Xss::getAdminTagList() instead. * * This method should only be used instead of Xss::filter() when the result is * being added to a render array that is constructed before rendering begins. * - * If the caller does not want to filter strings that are marked safe already - * it needs to use SafeMarkup::isSafe() to check the string. + * In the rare instance that the caller does not want to filter strings that + * are marked safe already, it needs to check SafeMarkup::isSafe() itself. * * @param $string * The string with raw HTML in it. It will be stripped of everything that diff --git a/core/lib/Drupal/Core/Render/Renderer.php b/core/lib/Drupal/Core/Render/Renderer.php index e0d53ac..ef470d3 100644 --- a/core/lib/Drupal/Core/Render/Renderer.php +++ b/core/lib/Drupal/Core/Render/Renderer.php @@ -652,10 +652,10 @@ public function addCacheableDependency(array &$elements, $dependency) { } /** - * Applies a very permissive XSS/HTML filter for admin-only use, if not safe. + * Applies a very permissive XSS/HTML filter for admin-only use. * - * We check if the string has been marked safe to ensure we do not filter - * strings intended for display. + * Note: this methods only filters if $string is not marked safe already. This + * ensures that HTML intended for display is not filtered. * * @param string $string * A string. diff --git a/core/modules/block_content/block_content.pages.inc b/core/modules/block_content/block_content.pages.inc index 04e0f91..84b1a81 100644 --- a/core/modules/block_content/block_content.pages.inc +++ b/core/modules/block_content/block_content.pages.inc @@ -5,7 +5,6 @@ * Provides page callbacks for custom blocks. */ -use Drupal\Component\Utility\Xss; use Drupal\Core\Url; use Drupal\block_content\Entity\BlockContentType; use Drupal\block_content\Entity\BlockContent; diff --git a/core/modules/block_content/src/BlockContentTypeListBuilder.php b/core/modules/block_content/src/BlockContentTypeListBuilder.php index c69f43c..c625021 100644 --- a/core/modules/block_content/src/BlockContentTypeListBuilder.php +++ b/core/modules/block_content/src/BlockContentTypeListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\block_content; -use Drupal\Component\Utility\Xss; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Entity\EntityInterface; diff --git a/core/modules/node/node.module b/core/modules/node/node.module index 940142e..6bcd177 100644 --- a/core/modules/node/node.module +++ b/core/modules/node/node.module @@ -9,7 +9,6 @@ */ use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Xss; use Drupal\Core\Access\AccessResult; use Drupal\Core\Cache\Cache; diff --git a/core/modules/node/src/NodeTypeListBuilder.php b/core/modules/node/src/NodeTypeListBuilder.php index 9f764cd..dd1a1d9 100644 --- a/core/modules/node/src/NodeTypeListBuilder.php +++ b/core/modules/node/src/NodeTypeListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\node; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Config\Entity\ConfigEntityListBuilder; use Drupal\Core\Url; use Drupal\Core\Entity\EntityInterface;