By chx on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
8.0.x
Introduced in version: 
8.0.0-beta4
Issue links: 
https://www.drupal.org/node/2364647
Description: 

A blacklist mode was accidentally added to the Xss filter. This is now fixed and the optional $mode argument is gone and Filter::Xss (same as Drupal 7 filter_xss) takes only two arguments.

If you have used the blacklist feature then a) you likely have a security hole b) in the very very unlikely case you don't, you can study Drupal\editor\EditorXssFilter\Standard on how to re-create the same functionality. Doing this is deliberately not documented as it is almost always a very bad idea.

Impacts: 
Module developers