Replace use of whitelist/blacklist in \Drupal\Component\Utility\Xss and its test and core/lib/Drupal/Core/Render/theme.api.php

1. +++ b/core/lib/Drupal/Component/Utility/Xss.php
   @@ -70,7 +70,7 @@ public static function filter($string, array $html_tags = NULL) {
   -    // Change back only well-formed entities in our whitelist:
   +    // Change back only well-formed entities in our allowed_extensions:
   

   Change back only well-formed entities in our list of allowed html tags:

2. +++ b/core/lib/Drupal/Component/Utility/Xss.php
   @@ -83,7 +83,7 @@ public static function filter($string, array $html_tags = NULL) {
   -    // Strip any tags that are not in the whitelist.
   +    // Strip any tags that are not in the allowed_list.
   

   Strip any tags that are not in the list of allowed html tags.

3. +++ b/core/lib/Drupal/Component/Utility/Xss.php
   @@ -161,7 +161,7 @@ protected static function split($string, $html_tags, $class) {
   -    // When in whitelist mode, an element is disallowed when not listed.
   +    // When in allowed_extensions mode, an element is disallowed when not listed.
   

   This whitelist mode does not exist. This code exists so that \Drupal\Component\Utility\Xss and \Drupal\editor\EditorXssFilter\Standard can behave different. I.e. treat the list of html tags as list of allowed tags or a list of tags to remove. So something like Defer to the ::needsRemoval() method to decide if the element is to be removed. This allows the list of tags to be treated as either a list of allowed tags or a list of denied tags.

4. +++ b/core/lib/Drupal/Core/Render/theme.api.php
   @@ -274,7 +274,7 @@
   - *   your markup needs any of the tags not in this whitelist, then you can
   + *   your markup needs any of the tags not in this allowed_extensions, then you can
   

   This comment needs fixing an should be re-flowed to be

    *   \Drupal\Component\Utility\Xss::$adminTags for the list of allowed tags. If
    *   your markup needs any of the tags not in this list, then you can implement
    *   a theme hook and/or an asset library. Alternatively, you can use the key
    *   #allowed_tags to alter which tags are filtered.
   

Committed and pushed 7430b47266 to 9.1.x and 49bdb09e7a to 9.0.x and d448b54d86 to 8.9.x. Thanks!

Backported to 8.9.x as this change is only comments.