From #2506195-11: Remove SafeMarkup::set() from Xss::filter().
+++ b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
@@ -173,7 +174,7 @@ public function build() {
- '#markup' => Xss::filterAdmin($site_config->get('slogan')),
+ '#markup' => SafeMarkup::xssFilterAdmin($site_config->get('slogan')),
Filtering here is redundant since by default #markup is admin filtered. This is removed in #2506195: Remove SafeMarkup::set() from Xss::filter() but we should add an explicit test.
| Issue category | Task |
|---|---|
| Issue priority | Normal |
| Unfrozen changes | Unfrozen because it only changes tests. |
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | test_xss_filtering_of-2526458-4.patch | 998 bytes | cilefen |
Comments
Comment #1
alexpottThis is a followup to #2273925: Ensure #markup is XSS escaped in Renderer::doRender()
Comment #2
alexpottComment #3
cilefen commentedComment #4
cilefen commentedComment #5
googletorp commentedLooks good to me.
Comment #6
googletorp commentedComment #7
googletorp commentedComment #8
xjmTest looks great. This issue only changes test code, so per https://www.drupal.org/core/beta-changes, this can be completed any time during the Drupal 8 beta phase. Committed and pushed to 8.0.x. Thanks!