diff --git a/core/lib/Drupal/Core/Render/Renderer.php b/core/lib/Drupal/Core/Render/Renderer.php index 7e63c02..251a130 100644 --- a/core/lib/Drupal/Core/Render/Renderer.php +++ b/core/lib/Drupal/Core/Render/Renderer.php @@ -7,6 +7,8 @@ namespace Drupal\Core\Render; +use Drupal\Component\Utility\EscapedString; +use Drupal\Component\Utility\EscapedStringInterface; use Drupal\Component\Utility\Html; use Drupal\Component\Utility\SafeMarkup; use Drupal\Component\Utility\Xss; @@ -734,7 +736,7 @@ protected function ensureMarkupIsSafe(array $elements) { if (!empty($elements['#plain_text'])) { // Prevent double escaping by calling htmlspecialchars() directly with // $double_encode set to FALSE. - $elements['#markup'] = SafeString::create(htmlspecialchars($elements['#plain_text'], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE)); + $elements['#markup'] = $elements['#plain_text'] instanceof EscapedStringInterface ? $elements['#plain_text'] : new EscapedString($elements['#plain_text']); } elseif (!SafeMarkup::isSafe($elements['#markup'])) { // The default behaviour is to XSS filter using the admin tag list.