{% if modules %} + {% set module_list = modules|join(', ') %} - {% set module_list = modules|safe_join(', ') %} {% trans %}Updates for: {{ module_list }}{% endtrans %} {% elseif missing_updates_status %} {{ missing_updates_status }} reverted: --- b/core/modules/node/node.install +++ a/core/modules/node/node.install @@ -5,7 +5,6 @@ * Install, update and uninstall functions for the node module. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Uuid\Uuid; use Drupal\Core\Language\Language; @@ -30,9 +29,7 @@ $requirements['node_access'] = array( 'title' => t('Node Access Permissions'), 'value' => $value, + 'description' => $description . ' ' . l(t('Rebuild permissions'), 'admin/reports/status/rebuild'), - // The result of t() is safe and so is the result of l(). Preserving - // safe object. - 'description' => SafeMarkup::set($description . ' ' . l(t('Rebuild permissions'), 'admin/reports/status/rebuild')), ); } return $requirements; reverted: --- b/core/modules/node/src/Plugin/Search/NodeSearch.php +++ a/core/modules/node/src/Plugin/Search/NodeSearch.php @@ -7,7 +7,6 @@ namespace Drupal\node\Plugin\Search; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Core\Config\Config; use Drupal\Core\Database\Connection; @@ -267,12 +266,10 @@ $node = $node_storage->load($item->sid)->getTranslation($item->langcode); $build = $node_render->view($node, 'search_result', $item->langcode); unset($build['#theme']); + $node->rendered = drupal_render($build); // Fetch comment count for snippet. + $node->rendered .= ' ' . $this->moduleHandler->invoke('comment', 'node_update_index', array($node, $item->langcode)); - $node->rendered = SafeMarkup::set( - drupal_render($build) . ' ' . - SafeMarkup::escape($this->moduleHandler->invoke('comment', 'node_update_index', array($node, $item->langcode))) - ); $extra = $this->moduleHandler->invokeAll('node_search_result', array($node, $item->langcode)); reverted: --- b/core/modules/node/src/Plugin/views/row/Rss.php +++ a/core/modules/node/src/Plugin/views/row/Rss.php @@ -7,7 +7,6 @@ namespace Drupal\node\Plugin\views\row; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\views\Plugin\views\row\RowPluginBase; @@ -163,7 +162,7 @@ } $item = new \stdClass(); + $item->description = $item_text; - $item->description = SafeMarkup::set($item_text); $item->title = $node->label(); $item->link = $node->link; $item->elements = $node->rss_elements; reverted: --- b/core/modules/rdf/rdf.module +++ a/core/modules/rdf/rdf.module @@ -5,7 +5,6 @@ * Enables semantically enriched output for Drupal sites in the form of RDFa. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Core\Routing\RouteMatchInterface; use Drupal\Core\Template\Attribute; @@ -445,8 +444,8 @@ $author_attributes = array('rel' => $author_mapping['properties']); // Wraps the author variable and the submitted variable which are both // available in comment.html.twig. + $variables['author'] = '' . $variables['author'] . ''; + $variables['submitted'] = '' . $variables['submitted'] . ''; - $variables['author'] = SafeMarkup::set('' . $variables['author'] . ''); - $variables['submitted'] = SafeMarkup::set('' . $variables['submitted'] . ''); } // Adds RDFa markup for the date of the comment. $created_mapping = $mapping->getPreparedFieldMapping('created'); @@ -462,8 +461,8 @@ $created_metadata_markup = drupal_render($rdf_metadata); // Appends the markup to the created variable and the submitted variable // which are both available in comment.html.twig. + $variables['created'] .= $created_metadata_markup; + $variables['submitted'] .= $created_metadata_markup; - $variables['created'] = SafeMarkup::set(SafeMarkup::escape($variables['created']) . $created_metadata_markup); - $variables['submitted'] = SafeMarkup::set($variables['submitted'] . $created_metadata_markup); } $title_mapping = $mapping->getPreparedFieldMapping('subject'); if (!empty($title_mapping)) { reverted: --- b/core/modules/responsive_image/responsive_image.module +++ a/core/modules/responsive_image/responsive_image.module @@ -6,7 +6,6 @@ */ use Drupal\breakpoint\Entity\Breakpoint; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Routing\RouteMatchInterface; use \Drupal\Core\Template\Attribute; @@ -196,6 +195,7 @@ } $sources = array(); + $output = array(); // Fallback image, output as source with media query. $sources[] = array( @@ -239,7 +239,6 @@ } if (!empty($sources)) { - $output = array(); $output[] = ''; + return implode("\n", $output); - return SafeMarkup::set(implode("\n", $output)); } } reverted: --- b/core/modules/search/search.module +++ a/core/modules/search/search.module @@ -5,7 +5,6 @@ * Enables site-wide keyword searching. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; use Drupal\Core\Routing\RouteMatchInterface; @@ -721,7 +720,7 @@ // Highlight keywords. Must be done at once to prevent conflicts ('strong' // and ''). $text = trim(preg_replace('/' . $boundary . '(?:' . implode('|', $keys) . ')' . $boundary . '/iu', '\0', ' ' . $text . ' ')); + return $text; - return SafeMarkup::set($text); } /** reverted: --- b/core/modules/search/tests/modules/search_embedded_form/search_embedded_form.module +++ a/core/modules/search/tests/modules/search_embedded_form/search_embedded_form.module @@ -9,12 +9,10 @@ * individual product (node) listed in the search results. */ -use Drupal\Component\Utility\SafeMarkup; - /** * Adds the test form to search results. */ function search_embedded_form_preprocess_search_result(&$variables) { $form = \Drupal::formBuilder()->getForm('Drupal\search_embedded_form\Form\SearchEmbeddedForm'); + $variables['snippet'] .= drupal_render($form); - $variables['snippet'] = SafeMarkup::set(SafeMarkup::escape($variables['snippet']) . drupal_render($form)); } reverted: --- b/core/modules/search/tests/modules/search_extra_type/src/Plugin/Search/SearchExtraTypeSearch.php +++ a/core/modules/search/tests/modules/search_extra_type/src/Plugin/Search/SearchExtraTypeSearch.php @@ -7,7 +7,6 @@ namespace Drupal\search_extra_type\Plugin\Search; -use Drupal\Component\Utility\SafeMarkup; use Drupal\search\Plugin\ConfigurableSearchPluginBase; /** @@ -59,7 +58,7 @@ 'link' => url('node'), 'type' => 'Dummy result type', 'title' => 'Dummy title', + 'snippet' => "Dummy search snippet to display. Keywords: {$this->keywords}\n\nConditions: " . print_r($this->searchParameters, TRUE), - 'snippet' => SafeMarkup::set("Dummy search snippet to display. Keywords: {$this->keywords}\n\nConditions: " . print_r($this->searchParameters, TRUE)), ), ); } reverted: --- b/core/modules/simpletest/src/Form/SimpletestResultsForm.php +++ a/core/modules/simpletest/src/Form/SimpletestResultsForm.php @@ -7,7 +7,6 @@ namespace Drupal\simpletest\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Connection; use Drupal\Core\Form\FormBase; use Symfony\Component\DependencyInjection\ContainerInterface; @@ -156,8 +155,7 @@ $rows = array(); foreach ($assertions as $assertion) { $row = array(); + $row[] = $assertion->message; - // Assertion messages are in code, so we assume they are safe. - $row[] = SafeMarkup::set($assertion->message); $row[] = $assertion->message_group; $row[] = drupal_basename($assertion->file); $row[] = $assertion->line; reverted: --- b/core/modules/system/src/Form/DateFormatFormBase.php +++ a/core/modules/system/src/Form/DateFormatFormBase.php @@ -124,7 +124,7 @@ '#machine_name' => array( 'exists' => array($this, 'exists'), 'replace_pattern' =>'([^a-z0-9_]+)|(^custom$)', + 'error' => 'The machine-readable name must be unique, and can only contain lowercase letters, numbers, and underscores. Additionally, it can not be the reserved word "custom".', - 'error' => t('The machine-readable name must be unique, and can only contain lowercase letters, numbers, and underscores. Additionally, it can not be the reserved word "custom".'), ), ); reverted: --- b/core/modules/system/src/Form/ModulesListForm.php +++ a/core/modules/system/src/Form/ModulesListForm.php @@ -7,7 +7,6 @@ namespace Drupal\system\Form; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Component\Utility\Unicode; use Drupal\Core\Entity\EntityManagerInterface; reverted: --- b/core/modules/system/system.admin.inc +++ a/core/modules/system/system.admin.inc @@ -5,7 +5,6 @@ * Admin page callbacks for the system module. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Xss; use Drupal\Core\Cache\Cache; use Drupal\Core\Extension\Extension; @@ -232,7 +231,7 @@ // Add the module label and expand/collapse functionalty. $col2 = '' . drupal_render($module['name']) . ''; + $row[] = array('class' => array('module'), 'data' => $col2); - $row[] = array('class' => array('module'), 'data' => SafeMarkup::set($col2)); // Add the description, along with any modules it requires. $description = ''; @@ -260,9 +259,9 @@ } $details = array( '#type' => 'details', + '#title' => ' ' . drupal_render($module['description']) . '', - '#title' => SafeMarkup::set(' ' . drupal_render($module['description']) . ''), '#attributes' => array('id' => $module['enable']['#id'] . '-description'), + '#description' => $description, - '#description' => SafeMarkup::set($description), ); $col4 = drupal_render($details); $row[] = array('class' => array('description', 'expand'), 'data' => $col4); reverted: --- b/core/modules/system/system.install +++ a/core/modules/system/system.install @@ -7,7 +7,6 @@ use Drupal\Component\Utility\Crypt; use Drupal\Component\Utility\Environment; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Database\Database; use Drupal\Core\Language\Language; use Drupal\Core\Site\Settings; @@ -58,8 +57,7 @@ if (function_exists('phpinfo')) { $requirements['php'] = array( 'title' => t('PHP'), + 'value' => ($phase == 'runtime') ? $phpversion .' ('. l(t('more information'), 'admin/reports/status/php') .')' : $phpversion, - // $phpversion is safe and output of l() is safe, so this value is safe. - 'value' => SafeMarkup::set(($phase == 'runtime') ? $phpversion . ' (' . l(t('more information'), 'admin/reports/status/php') . ')' : $phpversion), ); } else { @@ -322,11 +320,7 @@ 'title' => t('Cron maintenance tasks'), 'severity' => $severity, 'value' => $summary, + 'description' => $description - // @todo This string is concatenated from t() calls, safe drupal_render() - // output, whitespace, and
tags, so is safe. However, as a best - // practice, we should not use SafeMarkup::set() around a variable. Fix - // in: https://www.drupal.org/node/2296929 - 'description' => SafeMarkup::set($description), ); } if ($phase != 'install') { reverted: --- b/core/modules/system/templates/block--system-branding-block.html.twig +++ a/core/modules/system/templates/block--system-branding-block.html.twig @@ -23,7 +23,7 @@ {% endif %} {% if site_name %}
+ {{ site_name|e }} - {{ site_name }}
{% endif %} {% if site_slogan %} reverted: --- b/core/modules/system/templates/datetime.html.twig +++ a/core/modules/system/templates/datetime.html.twig @@ -25,4 +25,5 @@ * @see http://www.w3.org/TR/html5-author/the-time-element.html#attr-time-datetime */ #} +{# @todo Revisit once http://drupal.org/node/1825952 is resolved. #} +{{ html ? text|raw : text|escape }} -{{ html ? text|raw : text }} reverted: --- b/core/modules/system/templates/system-themes-page.html.twig +++ a/core/modules/system/templates/system-themes-page.html.twig @@ -39,7 +39,7 @@
{{- theme.name }} {{ theme.version -}} {% if theme.notes %} + ({{ theme.notes|join(', ') }}) - ({{ theme.notes|safe_join(', ') }}) {%- endif -%}

{{ theme.description }}
reverted: --- b/core/modules/system/tests/modules/batch_test/batch_test.callbacks.inc +++ a/core/modules/system/tests/modules/batch_test/batch_test.callbacks.inc @@ -5,8 +5,6 @@ * Batch callbacks for the Batch API tests. */ -use Drupal\Component\Utility\SafeMarkup; - /** * Performs a simple batch operation. */ @@ -83,7 +81,7 @@ $messages = array("results for batch $batch_id"); if ($results) { foreach ($results as $op => $op_results) { + $messages[] = 'op '. $op . ': processed ' . count($op_results) . ' elements'; - $messages[] = 'op '. SafeMarkup::escape($op) . ': processed ' . count($op_results) . ' elements'; } } else { @@ -96,7 +94,7 @@ $messages[] = t('An error occurred while processing @op with arguments:
@args', array('@op' => $error_operation[0], '@args' => print_r($error_operation[1], TRUE))); } + drupal_set_message(implode('
', $messages)); - drupal_set_message(SafeMarkup::set(implode('
', $messages))); } /** reverted: --- b/core/modules/system/tests/themes/test_theme/templates/theme-test-specific-suggestions--variant--foo.html.twig +++ a/core/modules/system/tests/themes/test_theme/templates/theme-test-specific-suggestions--variant--foo.html.twig @@ -2,4 +2,4 @@ Template overridden based on suggestion alter hook determined by the base hook.
Theme hook suggestions: +{{ theme_hook_suggestions|join("
") }}
-{{ theme_hook_suggestions|safe_join("
") }}
reverted: --- b/core/modules/system/tests/themes/test_theme/templates/theme-test-specific-suggestions--variant.html.twig +++ a/core/modules/system/tests/themes/test_theme/templates/theme-test-specific-suggestions--variant.html.twig @@ -2,4 +2,4 @@ Template matching the specific theme call.
Theme hook suggestions: +{{ theme_hook_suggestions|join("
") }}
-{{ theme_hook_suggestions|safe_join("
") }}
reverted: --- b/core/modules/text/src/TextProcessed.php +++ a/core/modules/text/src/TextProcessed.php @@ -7,7 +7,6 @@ namespace Drupal\text; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Core\TypedData\DataDefinitionInterface; use Drupal\Core\TypedData\TypedDataInterface; @@ -61,7 +60,7 @@ else { // Escape all HTML and retain newlines. // @see \Drupal\Core\Field\Plugin\Field\FieldFormatter\StringFormatter + $this->processed = nl2br(String::checkPlain($text)); - $this->processed = SafeMarkup::set(nl2br(String::checkPlain($text))); } return $this->processed; } reverted: --- b/core/modules/update/update.module +++ a/core/modules/update/update.module @@ -11,7 +11,6 @@ * ability to install contributed modules and themes via an user interface. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\Routing\RouteMatchInterface; use Drupal\Core\Site\Settings; use Symfony\Cmf\Component\Routing\RouteObjectInterface; @@ -538,8 +537,7 @@ } } + return $text; - // All strings are t() and empty space concatenated so return SafeMarkup. - return SafeMarkup::set($text); } /** reverted: --- b/core/modules/update/update.report.inc +++ a/core/modules/update/update.report.inc @@ -5,7 +5,6 @@ * Code required only when rendering the available updates report. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; /** @@ -28,12 +27,8 @@ $output = drupal_render($update_last_check); if (!is_array($data)) { - // @todo When converting this theme function to Twig, double-check with the - // caller to ensure $data is not double-escaped. At present, we cannot - // guarantee within this function that it is safe. Address in: - // https://www.drupal.org/node/1898466 $output .= '
' . $data . '
'; + return $output; - return SafeMarkup::set($output); } $header = array(); @@ -274,7 +269,7 @@ $row_key = isset($project['title']) ? drupal_strtolower($project['title']) : drupal_strtolower($project['name']); $rows[$project['project_type']][$row_key] = array( 'class' => array($class), + 'data' => array($row), - 'data' => array(SafeMarkup::set($row)), ); } @@ -310,7 +305,7 @@ ); drupal_render($assets); + return $output; - return SafeMarkup::set($output); } /** reverted: --- b/core/modules/views/src/Plugin/views/field/FieldPluginBase.php +++ a/core/modules/views/src/Plugin/views/field/FieldPluginBase.php @@ -8,7 +8,6 @@ namespace Drupal\views\Plugin\views\field; use Drupal\Component\Utility\Html; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Component\Utility\UrlHelper; use Drupal\Component\Utility\Xss; @@ -900,7 +899,7 @@ $form['alter']['help'] = array( '#type' => 'details', '#title' => t('Replacement patterns'), + '#value' => $output, - '#value' => SafeMarkup::set($output), '#states' => array( 'visible' => array( array( @@ -1182,9 +1181,6 @@ $this->last_render = $this->renderText($alter); } } - // @todo Fix this in https://www.drupal.org/node/2280961 - $this->last_render = SafeMarkup::set($this->last_render); - return $this->last_render; } reverted: --- b/core/modules/views/src/Plugin/views/style/Rss.php +++ a/core/modules/views/src/Plugin/views/style/Rss.php @@ -7,8 +7,6 @@ namespace Drupal\views\Plugin\views\style; -use Drupal\Component\Utility\SafeMarkup; - /** * Default style plugin to render an RSS feed. * @@ -140,7 +138,7 @@ '#theme' => $this->themeFunctions(), '#view' => $this->view, '#options' => $this->options, + '#rows' => $rows, - '#rows' => SafeMarkup::set($rows), ); unset($this->view->row_index); return drupal_render($build); reverted: --- b/core/modules/views/views.module +++ a/core/modules/views/views.module @@ -9,7 +9,6 @@ * incoming page and block requests. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Core\Cache\Cache; use Drupal\Core\Database\Query\AlterableInterface; reverted: --- b/core/modules/views/views.theme.inc +++ a/core/modules/views/views.theme.inc @@ -5,7 +5,6 @@ * Preprocessors and helper functions to make theming easier. */ -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Component\Utility\Xss; use Drupal\Core\Template\Attribute; @@ -542,8 +541,7 @@ '#theme' => 'tablesort_indicator', '#style' => $initial, ); + $label .= drupal_render($tablesort_indicator); - $markup = drupal_render($tablesort_indicator); - $label = SafeMarkup::set($label . $markup); } $query['order'] = $field; @@ -634,7 +632,7 @@ $field_output = $handler->getField($num, $field); $element_type = $fields[$field]->elementType(TRUE, TRUE); if ($element_type) { + $field_output = '<' . $element_type . '>' . $field_output . ''; - $field_output = SafeMarkup::set('<' . $element_type . '>' . SafeMarkup::escape($field_output) . ''); } // Only bother with separators and stuff if the field shows up. @@ -642,17 +640,13 @@ // Place the field into the column, along with an optional separator. if (!empty($column_reference['content'])) { if (!empty($options['info'][$column]['separator'])) { + $column_reference['content'] .= Xss::filterAdmin($options['info'][$column]['separator']); - $safe_content = SafeMarkup::escape($column_reference['content']); - $safe_separator = Xss::filterAdmin($options['info'][$column]['separator']); - $column_reference['content'] = SafeMarkup::set($safe_content . $safe_separator); } } else { $column_reference['content'] = ''; } + $column_reference['content'] .= $field_output; - $safe_content = SafeMarkup::escape($column_reference['content']); - $safe_field_output = SafeMarkup::escape($field_output); - $column_reference['content'] = SafeMarkup::set($safe_content . $safe_field_output); } } $column_reference['attributes'] = new Attribute($column_reference['attributes']); reverted: --- b/core/modules/views_ui/src/Controller/ViewsUIController.php +++ a/core/modules/views_ui/src/Controller/ViewsUIController.php @@ -7,7 +7,6 @@ namespace Drupal\views_ui\Controller; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Core\Controller\ControllerBase; use Drupal\views\ViewExecutable; @@ -93,7 +92,7 @@ foreach ($views as $view) { $rows[$field_name]['data'][1][] = $this->l($view, 'views_ui.edit', array('view' => $view)); } + $rows[$field_name]['data'][1] = implode(', ', $rows[$field_name]['data'][1]); - $rows[$field_name]['data'][1] = SafeMarkup::set(implode(', ', $rows[$field_name]['data'][1])); } // Sort rows by field name. @@ -121,7 +120,7 @@ foreach ($row['views'] as $row_name => $view) { $row['views'][$row_name] = $this->l($view, 'views_ui.edit', array('view' => $view)); } + $row['views'] = implode(', ', $row['views']); - $row['views'] = SafeMarkup::set(implode(', ', $row['views'])); } // Sort rows by field name. reverted: --- b/core/modules/views_ui/src/ViewListBuilder.php +++ a/core/modules/views_ui/src/ViewListBuilder.php @@ -7,7 +7,6 @@ namespace Drupal\views_ui; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Component\Plugin\PluginManagerInterface; use Drupal\Core\Entity\EntityInterface; @@ -81,12 +80,6 @@ */ public function buildRow(EntityInterface $view) { $row = parent::buildRow($view); - $display_paths = ''; - $separator = ''; - foreach ($this->getDisplayPaths($view) as $display_path) { - $display_paths .= $separator . SafeMarkup::escape($display_path); - $separator = ', '; - } return array( 'data' => array( 'view_name' => array( @@ -103,7 +96,7 @@ 'class' => array('views-table-filter-text-source'), ), 'tag' => $view->get('tag'), + 'path' => implode(', ', $this->getDisplayPaths($view)), - 'path' => SafeMarkup::set($display_paths), 'operations' => $row['operations'], ), 'title' => $this->t('Machine name: @name', array('@name' => $view->id())), reverted: --- b/core/modules/views_ui/src/ViewUI.php +++ a/core/modules/views_ui/src/ViewUI.php @@ -7,7 +7,6 @@ namespace Drupal\views_ui; -use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\String; use Drupal\Component\Utility\Timer; use Drupal\Component\Utility\Xss; @@ -203,7 +202,7 @@ } public static function getDefaultAJAXMessage() { + return '
' . t("Click on an item to edit that item's details.") . '
'; - return SafeMarkup::set('
' . t("Click on an item to edit that item's details.") . '
'); } /** @@ -678,10 +677,7 @@ } } } + $rows['query'][] = array('' . t('Query') . '', '
' . String::checkPlain(strtr($query_string, $quoted)) . '
'); - $rows['query'][] = array( - SafeMarkup::set('' . t('Query') . ''), - SafeMarkup::set('
' . String::checkPlain(strtr($query_string, $quoted)) . '
'), - ); if (!empty($this->additionalQueries)) { $queries = '' . t('These queries were run during view rendering:') . ''; foreach ($this->additionalQueries as $query) { @@ -692,24 +688,18 @@ $queries .= t('[@time ms] @query', array('@time' => round($query['time'] * 100000, 1) / 100000.0, '@query' => $query_string)); } + $rows['query'][] = array('' . t('Other queries') . '', '
' . $queries . '
'); - $rows['query'][] = array( - SafeMarkup::set('' . t('Other queries') . ''), - SafeMarkup::set('
' . $queries . '
'), - ); } } if ($show_info) { + $rows['query'][] = array('' . t('Title') . '', Xss::filterAdmin($this->executable->getTitle())); - $rows['query'][] = array( - SafeMarkup::set('' . t('Title') . ''), - Xss::filterAdmin($this->executable->getTitle()), - ); if (isset($path)) { $path = l($path, $path); } else { $path = t('This display has no path.'); } + $rows['query'][] = array('' . t('Path') . '', $path); - $rows['query'][] = array(SafeMarkup::set('' . t('Path') . ''), $path); } if ($show_stats) { @@ -724,10 +714,10 @@ // No query was run. Display that information in place of either the // query or the performance statistics, whichever comes first. if ($combined || ($show_location === 'above')) { + $rows['query'] = array(array('' . t('Query') . '', t('No query was run'))); - $rows['query'] = array(array(SafeMarkup::set('' . t('Query') . ''), t('No query was run'))); } else { + $rows['statistics'] = array(array('' . t('Query') . '', t('No query was run'))); - $rows['statistics'] = array(array(SafeMarkup::set('' . t('Query') . ''), t('No query was run'))); } } } reverted: --- b/core/modules/views_ui/templates/views-ui-display-tab-setting.html.twig +++ a/core/modules/views_ui/templates/views-ui-display-tab-setting.html.twig @@ -20,6 +20,6 @@ {{ description }} {%- endif %} {% if settings_links %} + {{ settings_links|join(' | ') }} - {{ settings_links|safe_join(' | ') }} {% endif %}

", 'SafeMarkup::set() accepts HTML'); - - return $tests; - } - - /** - * Tests SafeMarkup::set() and SafeMarkup::isSafe() with different providers. - * - * @covers ::isSafe() - */ - public function testStrategy() { - $returned = SafeMarkup::set('string0', 'html'); - $this->assertTrue(SafeMarkup::isSafe($returned), 'String set with "html" provider is safe for default (html)'); - $returned = SafeMarkup::set('string1', 'all'); - $this->assertTrue(SafeMarkup::isSafe($returned), 'String set with "all" provider is safe for default (html)'); - $returned = SafeMarkup::set('string2', 'css'); - $this->assertFalse(SafeMarkup::isSafe($returned), 'String set with "css" provider is not safe for default (html)'); - $returned = SafeMarkup::set('string3'); - $this->assertFalse(SafeMarkup::isSafe($returned, 'all'), 'String set with "html" provider is not safe for "all"'); - } - - /** - * Tests SafeMarkup::setMultiple(). - * - * @covers ::setMultiple() - */ - public function testSetMultiple() { - $texts = array( - 'multistring0' => array('html' => TRUE), - 'multistring1' => array('all' => TRUE), - ); - SafeMarkup::setMultiple($texts); - foreach ($texts as $string => $providers) { - $this->assertTrue(SafeMarkup::isSafe($string), 'The value has been marked as safe for html'); - } - } - /** - * Tests SafeMarkup::setMultiple(). - * - * Only TRUE may be passed in as the value. - * - * @covers ::setMultiple() - * - * @expectedException \UnexpectedValueException - */ - public function testInvalidSetMultiple() { - $texts = array( - 'invalidstring0' => array('html' => 1), - ); - SafeMarkup::setMultiple($texts); - } - -} reverted: --- b/core/tests/Drupal/Tests/Component/Utility/TextWrapper.php +++ /dev/null @@ -1,39 +0,0 @@ -text = $text; - } - - /** - * Magic method - * - * @return string - */ - public function __toString() { - return $this->text; - } - -} reverted: --- b/core/themes/bartik/templates/block--system-branding-block.html.twig +++ a/core/themes/bartik/templates/block--system-branding-block.html.twig @@ -23,7 +23,7 @@

{% if site_name %} + {{ site_name|e }} - {{ site_name }} {% endif %} {% if site_slogan %} reverted: --- b/core/themes/engines/twig/twig.engine +++ a/core/themes/engines/twig/twig.engine @@ -5,8 +5,6 @@ * Handles integration of Twig templates with the Drupal theme system. */ -use Drupal\Component\Utility\SafeMarkup; -use Drupal\Component\Utility\String; use Drupal\Core\Extension\Extension; /** @@ -47,7 +45,6 @@ * The output generated by the template, plus any debug information. */ function twig_render_template($template_file, $variables) { - /** @var \Twig_Environment $twig_service */ $twig_service = \Drupal::service('twig'); $output = array( 'debug_prefix' => '', @@ -96,7 +93,7 @@ $output['debug_info'] .= "\n\n"; $output['debug_suffix'] .= "\n\n\n"; } + return implode('', $output); - return SafeMarkup::set(implode('', $output)); } /** @@ -130,8 +127,8 @@ return NULL; } + // Keep Twig_Markup objects intact to prepare for later autoescaping support. + if ($arg instanceOf Twig_Markup) { - // Optimize for strings as it is likely they come from the escape filter. - if (is_string($arg)) { return $arg; } @@ -143,9 +140,7 @@ if (method_exists($arg, '__toString')) { return (string) $arg; } + throw new Exception(t('Object of type "@class" cannot be printed.', array('@class' => get_class($arg)))); - else { - throw new Exception(t('Object of type "@class" cannot be printed.', array('@class' => get_class($arg)))); - } } // This is a normal render array. @@ -184,97 +179,3 @@ } return $filtered_element; } - -/** - * Overrides twig_escape_filter(). - * - * Replacement function for twig's escape filter. - * - * @param Twig_Environment $env - * A Twig_Environment instance. - * @param string $string - * The value to be escaped. - * @param string $strategy - * The escaping strategy. Defaults to 'html'. - * @param string $charset - * The charset. - * @param Boolean $autoescape - * Whether the function is called by the auto-escaping feature (TRUE) or by - * the developer (FALSE). - * - * @return string|null - * The escaped, rendered output, or NULL if there is no valid output. - */ -function twig_drupal_escape_filter(\Twig_Environment $env, $arg, $strategy = 'html', $charset = NULL, $autoescape = FALSE) { - // Check for a numeric zero. - if ($arg === 0) { - return 0; - } - - // Return early for NULL or an empty array. - if ($arg == NULL) { - return NULL; - } - - // Keep Twig_Markup objects intact to support autoescaping. - if ($autoescape && $arg instanceOf \Twig_Markup) { - return $arg; - } - - $return = NULL; - - if (is_scalar($arg)) { - $return = (string) $arg; - } - elseif (is_object($arg)) { - if (method_exists($arg, '__toString')) { - $return = (string) $arg; - } - else { - throw new \Exception(t('Object of type "@class" cannot be printed.', array('@class' => get_class($arg)))); - } - } - - // We have a string or an object converted to a string: Autoescape it! - if (isset($return)) { - if ($strategy != 'html') { - // Drupal only supports the HTML escaping strategy, so provide a - // fallback for other strategies. - // @todo Add an optional strategy parameter to SafeMarkup function calls, - // to avoid this when it is already safe for this strategy. - return twig_escape_filter($env, $return, $strategy, $charset, $autoescape); - } - if (!SafeMarkup::isSafe($return)) { - return String::checkPlain($return); - } - return $return; - } - - // This is a normal render array, which is safe by definition. - return render($arg); -} - -/** - * Overrides twig_join_filter(). - * - * Safely joins several strings together. - * - * @param array|Traversable $value - * The pieces to join. - * @param string $glue - * The delimiter with which to join the string. Defaults to an empty string. - * - * @return \Drupal\Component\Utility\SafeMarkup|string - * The imploded string, which is now also marked as safe. - */ -function twig_drupal_join_filter($value, $glue = '') { - $glue = SafeMarkup::escape($glue); - $separator = ''; - $output = ''; - foreach ($value as $item) { - $output .= $separator . SafeMarkup::escape($item); - $separator = $glue; - } - - return SafeMarkup::set($output); -} only in patch2: unchanged: --- c/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ w/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -8,10 +8,14 @@ namespace Drupal\Component\Utility; /** - * Marks strings that are already escaped for XSS prevention. + * Manages known safe strings for rendering at the theme layer. * - * @todo Add detailed documentation about how to use SafeMarkup and how it is - * handled during rendering and in the theme layer. + * As Twig autoescapes string variables in the template, it is possible for a + * string of markup to become double-escaped. SafeMarkup provides a store for + * known safe strings and methods to manage them throughout the page request. + * This class should be limited to interal use only. Module developers should + * instead use render arrays or String::checkPlain() or Xss::filter() to + * sanitize strings for output. * * @see sanitization */

{{ format.name|escape }}

{{ format.name }}

{{- theme.name }} {{ theme.version -}} {% if theme.notes %} + ({{ theme.notes|join(', ') }}) - ({{ theme.notes|safe_join(', ') }}) {%- endif -%}