Locked view warning message rendering as code

The problem seems to be in formatInterval when there is more than one component (for example "5 days 31 min").

Seems fine after applying latest patch, marking to RTBC.

Test needs after updating code to

+use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\Xss;
 use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\Datetime\DrupalDateTime;
@@ -189,7 +190,7 @@ public function formatInterval($interval, $granularity = 2, $langcode = NULL) {
         break;
       }
     }
-    return $output ? $output : $this->t('0 sec', array(), array('langcode' => $langcode));
+    return $output ? SafeMarkup::set($output) : $this->t('0 sec', array(), array('langcode' => $langcode));
   }
 
   /**

Setting parent meta.

+++ b/core/lib/Drupal/Core/Datetime/DateFormatter.php
@@ -189,7 +190,7 @@ public function formatInterval($interval, $granularity = 2, $langcode = NULL) {
+    return $output ? SafeMarkup::set($output) : $this->t('0 sec', array(), array('langcode' => $langcode));

Can you use SafeMarkup::escape() here? We are avoiding using SafeMarkup::set() as part of this issue #2280965: [meta] Remove every SafeMarkup::set() call. At the very least this needs to be documented why $output is considered safe.

Where is the $output coming from?

Sorry escape isn't a viable solution, I was looking just at the patch. Here's the context for the concatenation build up of output.

  public function formatInterval($interval, $granularity = 2, $langcode = NULL) {
    $output = '';
    foreach ($this->units as $key => $value) {
      $key = explode('|', $key);
      if ($interval >= $value) {
        $output .= ($output ? ' ' : '') . $this->formatPlural(floor($interval / $value), $key[0], $key[1], array(), array('langcode' => $langcode));
        $interval %= $value;
        $granularity--;
      }

      if ($granularity == 0) {
        break;
      }
    }
    return $output ? $output : $this->t('0 sec', array(), array('langcode' => $langcode));
  }

I'm going to add this to the postponed list till we figure out this joining issue:
#2501975: Determine how to update code that currently joins strings in SafeMarkup::set()

No longer blocked, though the discussion in #2501975: Determine how to update code that currently joins strings in SafeMarkup::set() might be valuable to identify the best solution in this case.

Looks like this was fixed in head, as I'm no longer seeing the escaped locked message with current HEAD.

The only thing left might be to write a test, although I assume we are not going to test for double-escaping all over the place. It does seem that there is no test for the locked message itself though, so maybe we can add that (which will then implicitly also test for the double-escaping).

Thanks for finding that mr.baileys! With some research I found this was resolved in #2506479: Replace !placeholder with @placeholder for non URLs in t() in Views, except for t() output that is used as an attribute value. If you'd like to follow up on the test for the revision message, that should be a separate issue.