diff -u b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
--- b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
@@ -192,7 +192,7 @@
public function testAdminXss() {
// Mark the string as safe. This is for test purposes only.
$text = '';
- SafeMarkup::set($text);
+ $this->safeMarkupSet($text);
// SafeMarkup::escape() will not escape the markup tag since the string was
// marked safe above.
@@ -213,7 +213,7 @@
public function testAdminXss() {
// Mark the string as safe. This is for test purposes only.
$text = '';
- $this->safeMarkupSet($text);
+ SafeMarkup::set($text);
// SafeMarkup::escape() will not escape the markup tag since the string was
// marked safe above.
@@ -223,7 +223,7 @@
* Marks text as safe.
*
* SafeMarkupTestSafeString is used to mark text as safe because
- * SafeMarkup::set() is a global static that affects all tests.
+ * SafeMarkup::$safeStrings is a global static that affects all tests.
*/
class SafeMarkupTestSafeString implements SafeStringInterface {
@@ -301,7 +301,7 @@
* Marks text as safe.
*
* SafeMarkupTestSafeString is used to mark text as safe because
- * SafeMarkup::$safeStrings is a global static that affects all tests.
+ * SafeMarkup::set() is a global static that affects all tests.
*/
class SafeMarkupTestSafeString implements SafeStringInterface {
only in patch2:
unchanged:
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -35,57 +35,22 @@ class SafeMarkup {
/**
* The list of safe strings.
*
+ * Strings in this list are marked as secure for the entire page render, not
+ * just the code or element that set it. Therefore, only valid HTML should be
+ * marked as safe (never partial markup). For example, you should never mark
+ * string such as '<' or '