diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php index d20ad6b..3020bbe 100644 --- a/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -35,58 +35,29 @@ class SafeMarkup { /** * The list of safe strings. * + * Strings in this list are marked as secure for the entire page render, not + * just the code or element that set it. Therefore, only valid HTML should be + * marked as safe (never partial markup). For example, you should never mark + * string such as '<' or '