diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php index 9925ae1..d00ccda 100644 --- a/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -143,24 +143,21 @@ public static function escape($string) { * * Note: This method only filters if $string is not marked safe already. * - * @deprecated as of Drupal 8.0.x, will be removed before Drupal 8.0.0. If the - * string used as part of a @link theme_render render array @endlink use - * #markup to allow the render system to filter automatically or just allow - * the Twig to autoescape the value. If the result is not being used - * directly in the rendering system (for example, when its result is being - * combined with other strings before rendering), use Xss::filterAdmin(). - * Otherwise, use SafeMarkup::xssFilter() and the tag list provided by - * Xss::getAdminTagList() instead. In the rare instance that the caller does - * not want to filter strings that are marked safe already, it needs to - * check SafeMarkup::isSafe() itself. - * - * @see \Drupal\Component\Utility\SafeMarkup::xssFilter() + * @deprecated as of Drupal 8.0.x, will be removed before Drupal 8.0.0. If + * the string is used as part of a @link theme_render render array @endlink + * use #markup to allow the render system to filter automatically. If the + * result is not being used directly in the rendering system (for example, + * when its result is being combined with other strings before rendering), + * use Xss::filterAdmin(). Otherwise, use SafeMarkup::xssFilterAdmin(). In + * the rare instance that the caller does not want to filter strings that + * are marked safe already, it needs to check SafeMarkup::isSafe() itself. + * + * @see \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() * @see \Drupal\Component\Utility\SafeMarkup::isSafe() * @see \Drupal\Component\Utility\Xss::filterAdmin() - * @see \Drupal\Component\Utility\Xss::getAdminTagList() */ public static function checkAdminXss($string) { - return static::isSafe($string) ? $string : static::xssFilter($string, Xss::getAdminTagList()); + return static::isSafe($string) ? $string : static::xssFilterAdmin($string); } /** @@ -175,13 +172,6 @@ public static function checkAdminXss($string) { * string might contain HTML that needs to be rendered properly by the * browser. * - * If you need to filter for admin use, like Xss::filterAdmin(), then: - * - If the string is used as part of a @link theme_render render array @endlink, - * use #markup to allow the render system to filter by the admin tag list - * automatically. - * - Otherwise, use the SafeMarkup::xssFilter() with tag list provided by - * Xss::getAdminTagList() instead. - * * This method should only be used instead of Xss::filter() when the result is * being added to a render array that is constructed before rendering begins. * @@ -203,8 +193,7 @@ public static function checkAdminXss($string) { * @ingroup sanitization * * @see \Drupal\Component\Utility\Xss::filter() - * @see \Drupal\Component\Utility\Xss::filterAdmin() - * @see \Drupal\Component\Utility\Xss::getAdminTagList() + * @see \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() * @see \Drupal\Component\Utility\SafeMarkup::isSafe() */ public static function xssFilter($string, $html_tags = NULL) { @@ -218,6 +207,46 @@ public static function xssFilter($string, $html_tags = NULL) { } /** + * Filters HTML intended for admin use for XSS and marks the result as safe. + * + * This allows all tags that can be used inside an HTML body, save for + * scripts and styles, and is therefore a much more permissive filter than + * SafeMarkup::xssFilter(). + * + * Calling this method unnecessarily will result in bloating the safe string + * list and increases the chance of unintended side effects. Consider these + * alternatives before using this method: + * - If the string is used in a @link theme_render render array @endlink use + * #markup to allow the render system to filter for admin XSS + * automatically. + * - If the result is not being used directly in the rendering system (for + * example, when its result is being combined with other strings before + * rendering), use Xss::filterAdmin(). + * + * In the rare instance that the caller does not want to filter strings that + * are marked safe already, it needs to check SafeMarkup::isSafe() itself. + * + * @param $string + * The string with raw HTML in it. It will be stripped of everything that + * can cause an XSS attack. The string provided will always be escaped + * regardless of whether the string is already marked as safe. + * + * @return string + * An XSS-safe version of $string, or an empty string if $string is not + * valid UTF-8. The string is marked as safe. + * + * @ingroup sanitization + * + * @see \Drupal\Component\Utility\Xss::filterAdmin() + * @see \Drupal\Component\Utility\SafeMarkup::xssFilter() + * @see \Drupal\Component\Utility\SafeMarkup::isSafe() + */ + public static function xssFilterAdmin($string) { + $string = Xss::filterAdmin($string); + return static::set($string); + } + + /** * Gets all strings currently marked as safe. * * This is useful for the batch and form APIs, where it is important to diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php index a68ca2b..02a4547 100644 --- a/core/lib/Drupal/Component/Utility/Xss.php +++ b/core/lib/Drupal/Component/Utility/Xss.php @@ -109,7 +109,7 @@ public static function filter($string, $html_tags = array('a', 'em', 'strong', ' * not acceptable). * * This method is preferred to - * \Drupal\Component\Utility\SafeMarkup::xssFilter() when the result is + * \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() when the result is * not being used directly in the rendering system (for example, when its * result is being combined with other strings before rendering). This avoids * bloating the safe string list with partial strings if the whole result will @@ -126,7 +126,7 @@ public static function filter($string, $html_tags = array('a', 'em', 'strong', ' * * @ingroup sanitization * - * @see \Drupal\Component\Utility\SafeMarkup::xssFilter() + * @see \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() * @see \Drupal\Component\Utility\Xss::getAdminTagList() * */ diff --git a/core/modules/views/src/Plugin/Block/ViewsBlock.php b/core/modules/views/src/Plugin/Block/ViewsBlock.php index 97db7c9..2bb9768 100644 --- a/core/modules/views/src/Plugin/Block/ViewsBlock.php +++ b/core/modules/views/src/Plugin/Block/ViewsBlock.php @@ -34,7 +34,7 @@ public function build() { // Override the label to the dynamic title configured in the view. if (empty($this->configuration['views_label']) && $this->view->getTitle()) { // @todo https://www.drupal.org/node/2527360 remove call to SafeMarkup. - $output['#title'] = SafeMarkup::xssFilter($this->view->getTitle(), Xss::getAdminTagList()); + $output['#title'] = SafeMarkup::xssFilterAdmin($this->view->getTitle()); } // Before returning the block output, convert it to a renderable array diff --git a/core/modules/views/src/Plugin/views/display/Page.php b/core/modules/views/src/Plugin/views/display/Page.php index 7ec3560..b73f8b0 100644 --- a/core/modules/views/src/Plugin/views/display/Page.php +++ b/core/modules/views/src/Plugin/views/display/Page.php @@ -183,7 +183,7 @@ public function execute() { if (is_array($render)) { $render += array( // @todo https://www.drupal.org/node/2527360 remove call to SafeMarkup. - '#title' => SafeMarkup::xssFilter($this->view->getTitle(), Xss::getAdminTagList()), + '#title' => SafeMarkup::xssFilterAdmin($this->view->getTitle()), ); } return $render; diff --git a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php index 90a475f..7dac910 100644 --- a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php +++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php @@ -217,11 +217,12 @@ public function testReplace($search, $replace, $subject, $expected, $is_safe) { * Tests the interaction between the safe list and XSS filtering. * * @covers ::xssFilter + * @covers ::xssFilterAdmin * @covers ::escape */ public function testAdminXss() { - // Use the predefined XSS admin tag list. This strips the tags. - $this->assertEquals('text', SafeMarkup::xssFilter('text', Xss::getAdminTagList())); + // This will strip the tags. + $this->assertEquals('text', SafeMarkup::xssFilterAdmin('text')); $this->assertTrue(SafeMarkup::isSafe('text'), 'The string \'text\' is marked as safe.'); // This won't strip the tags and the string with HTML will be