Follow-up to #2501639: Remove SafeMarkup::set in drupal_check_module()


FieldPluginBase:advancedRender calls SafeMarkup::set() which is meant to be for internal use only.

Proposed resolution

  • Remove the call by refactoring the code.
  • If refactoring is not possible, thoroughly document where the string is coming from and why it is safe, and why SafeMarkup::set() is required.

Remaining tasks

  1. Evaluate whether the string can be refactored to one of the formats outlined in this change record:
  2. Identify whether there is existing automated test coverage for the sanitization of the string. If there is, list the test in the issue summary. If there isn't, add an automated test for it.
  3. If the string cannot be refactored, the SafeMarkup::set() usage needs to be thoroughly audited and documented.

Manual testing steps (for XSS and double escaping)

Do these steps both with HEAD and with the patch applied:

  1. Clean install of Drupal 8.
  2. Compare the output above in HEAD and with the patch applied. Confirm that there is no double-escaping.
  3. If there is any user or calling code input in the string, submit

    and ensure that it is sanitized.

User interface changes


API changes



kgoel’s picture

Status: Needs work » Active
kgoel’s picture

Issue tags: +VDC
kgoel’s picture

Closed as duplicate, this issue addresses the remaining SafeMarkup::set in FieldPluginBase.php

chx’s picture

Issue summary: View changes
chx’s picture

Title: Remove SafeMarkup::set in buildOptionsForm() and advancedRender() » Remove SafeMarkup::set in FieldPluginBase::advancedRender()
RavindraSingh’s picture

alimac’s picture

Status: Active » Closed (duplicate)
Related issues: +#2505679: Remove SafeMarkup::set in FieldPluginBase::advancedRender()