Custom-namespaced elements using colons is supposed to be allowed specifically via the HTML spec. We should make sure this doesn't break.

CommentFileSizeAuthor
#22 2321061-22.patch1.37 KBmstrelan
#22 2321061-22-testonly.patch798 bytesmstrelan
#9 xss_split_fails_on-2321061-9.patch1.31 KBstar-szr
#5 2321061-xss-split-custom-element-colon-tag-name.patch1.31 KBdave reid
#5 2321061-xss-split-custom-element-colon-tag-name-TEST-ONLY.patch744 bytesdave reid
#1 2321061-xss-split-custom-element-colon-tag-name-TEST-ONLY.patch714 bytesdave reid
#1 2321061-xss-split-custom-element-colon-tag-name.patch1.29 KBdave reid

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Active » Needs review
StatusFileSize
new 2321061-xss-split-custom-element-colon-tag-name.patch1.29 KB
new 2321061-xss-split-custom-element-colon-tag-name-TEST-ONLY.patch714 bytes
dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Related issues: +#2315255: Xss::split() fails on custom HTML elements with dashes in the name

The last submitted patch, 1: 2321061-xss-split-custom-element-colon-tag-name.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 1: 2321061-xss-split-custom-element-colon-tag-name-TEST-ONLY.patch, failed testing.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs work » Needs review
StatusFileSize
new 2321061-xss-split-custom-element-colon-tag-name-TEST-ONLY.patch744 bytes
new 2321061-xss-split-custom-element-colon-tag-name.patch1.31 KB

Ok let's try with a closing tag.

The last submitted patch, 5: 2321061-xss-split-custom-element-colon-tag-name-TEST-ONLY.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 5: 2321061-xss-split-custom-element-colon-tag-name.patch, failed testing.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Issue tags: +Media Initiative, +Contributed project blocker
star-szr’s picture

star-szr
he/him
Primary language English
commented
Status: Needs work » Needs review
StatusFileSize
new xss_split_fails_on-2321061-9.patch1.31 KB

Here's a rerolled (actually recreated because it's so small) patch that applies against 8.0.x, 8.1.x, and 8.2.x. I didn't run any tests against it.

Status: Needs review » Needs work

The last submitted patch, 9: xss_split_fails_on-2321061-9.patch, failed testing.

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mstrelan’s picture

mstrelan commented
Version: 9.4.x-dev » 10.1.x-dev
Status: Needs work » Needs review
Issue tags: +Needs issue summary update, +DrupalSouth, +Bug Smash Initiative
StatusFileSize
new 2321061-22-testonly.patch798 bytes
new 2321061-22.patch1.37 KB

Updated patch for 10.1.x. Also fixed the failing tests because they weren't passing test:element as an allowed tag to Xss::filter.

darvanen’s picture

darvanen
he/him
Primary language English
Location Sydney, Australia
commented

It would seem in the 8 years since this issue was created that the HTML spec has changed or moved on.

The current spec does not include ':' or '#x3A' (colon character) in the list of allowed characters for custom elements.

I think this should be Closed (works as designed).

The last submitted patch, 22: 2321061-22-testonly.patch, failed testing. View results

Status: Needs review » Needs work

The last submitted patch, 22: 2321061-22.patch, failed testing. View results

darvanen’s picture

darvanen
he/him
Primary language English
Location Sydney, Australia
commented
Status: Needs work » Closed (works as designed)

Closing per #23 after discussion with @mstrelan and @DanielVeza at #DrupalSouth.