diff --git a/core/modules/editor/src/EditorXssFilter/Standard.php b/core/modules/editor/src/EditorXssFilter/Standard.php index 63750aa..3cf484e 100644 --- a/core/modules/editor/src/EditorXssFilter/Standard.php +++ b/core/modules/editor/src/EditorXssFilter/Standard.php @@ -89,7 +89,7 @@ public static function filterXss($html, FilterFormatInterface $format, FilterFor // Also blacklist tags that are explicitly forbidden in either text format. $blacklisted_tags = array_merge($blacklisted_tags, $forbidden_tags); - $output = Xss::filter($html, $blacklisted_tags); + $output = parent::filter($html, $blacklisted_tags); // Since data-*-attributes can contain encoded markup that could be decoded // and interpreted by editors, we need to apply XSS filtering to their diff --git a/core/modules/filter/src/Tests/FilterUnitTest.php b/core/modules/filter/src/Tests/FilterUnitTest.php index e25b2b4..c9eff5f 100644 --- a/core/modules/filter/src/Tests/FilterUnitTest.php +++ b/core/modules/filter/src/Tests/FilterUnitTest.php @@ -9,7 +9,7 @@ use Drupal\Component\Utility\Html; use Drupal\Component\Utility\String; -use Drupal\Component\Utility\Xss; +use Drupal\filter\Entity\FilterFormat; use Drupal\editor\EditorXssFilter\Standard; use Drupal\filter\FilterPluginCollection; use Drupal\simpletest\KernelTestBase; @@ -199,8 +199,11 @@ function testCaptionFilter() { }; // Editor XSS filter. $test_editor_xss_filter = function ($input) { - $allowed_tags = array('img'); - return Standard::filter($input, $allowed_tags); + $filtered_html_format = FilterFormat::create(array( + 'format' => 'filtered_html', + 'name' => 'Filtered HTML', + )); + return Standard::filterXss($input, $filtered_html_format); }; // All the tricky cases encountered at https://drupal.org/node/2105841.