diff -u b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php --- b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php +++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php @@ -192,7 +192,7 @@ public function testAdminXss() { // Mark the string as safe. This is for test purposes only. $text = 'text'; - SafeMarkup::set($text); + $this->safeMarkupSet($text); // SafeMarkup::escape() will not escape the markup tag since the string was // marked safe above. @@ -213,7 +213,7 @@ public function testAdminXss() { // Mark the string as safe. This is for test purposes only. $text = 'text'; - $this->safeMarkupSet($text); + SafeMarkup::set($text); // SafeMarkup::escape() will not escape the markup tag since the string was // marked safe above. @@ -223,7 +223,7 @@ * Marks text as safe. * * SafeMarkupTestSafeString is used to mark text as safe because - * SafeMarkup::set() is a global static that affects all tests. + * SafeMarkup::$safeStrings is a global static that affects all tests. */ class SafeMarkupTestSafeString implements SafeStringInterface { @@ -301,7 +301,7 @@ * Marks text as safe. * * SafeMarkupTestSafeString is used to mark text as safe because - * SafeMarkup::$safeStrings is a global static that affects all tests. + * SafeMarkup::set() is a global static that affects all tests. */ class SafeMarkupTestSafeString implements SafeStringInterface { only in patch2: unchanged: --- a/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -35,57 +35,22 @@ class SafeMarkup { /** * The list of safe strings. * + * Strings in this list are marked as secure for the entire page render, not + * just the code or element that set it. Therefore, only valid HTML should be + * marked as safe (never partial markup). For example, you should never mark + * string such as '<' or '