+++ b/core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php
@@ -37,7 +37,7 @@ public function viewElements(FieldItemListInterface $items) {
- $elements[$delta] = array('#markup' => nl2br(SafeMarkup::checkPlain($item->value)));
+ $elements[$delta] = array('#markup' => nl2br(Html::escape($item->value)));
It's a pre-existing problem, but this will cause Markup's filtering safe strategy to still be applied. Even though that's absolutely unnecessary.
The only tag that is going to be in there is <br>, by definition. And that is allowed by \Drupal\Component\Utility\Xss::getAdminTagList().
However, using SafeString::create() here or creating another SafeStringInterface implementation for this also feels kinda overkill.
Not sure what's best.
None.
None.
None.
Comments
Comment #2
joelpittetMany ways to skin a escaped string.
http://twig.sensiolabs.org/doc/filters/nl2br.html
The value will be escaped normally by twig and the new lines will be converted to br tags. BOOM!
Comment #3
wim leersPerfect!
Comment #4
andypost+1 rtbc, just clean-up "use" and inified array syntax
Comment #5
alexpottIs there a test for this?
Comment #6
andypostYep, there's
\Drupal\field\Tests\String\RawStringFormatterTest::testStringFormatter\Drupal\field\Tests\String\StringFormatterTest::testStringFormatteralso
\Drupal\Core\Field\Plugin\Field\FieldFormatter\StringFormatter::viewValue()does the same, so maybe override that too?Comment #7
andypostI'm sure better re-title
Comment #10
andypostFix broken tests, also filed new bug and add todo for #2567745: \Drupal\taxonomy\Plugin\views\field\TermName::getItems should work with links
Comment #11
joelpittetCan we just render the array and get the value so we don't have to keep changing this test if the way we build the data changes later?
Thanks @andypost, that makes all the other things consistent. I think it's good to go here too, it's a bit scope creepy but tolerable I think.
Comment #12
lauriiiFixed #11
Comment #13
joelpittetThanks setting back to RTBC.
Comment #16
joelpittetLooks like unrelated failure.
Comment #17
andypostI'm sure we need to extend formatters tests
-
UuidFormatterTesttests build ofStringFormatter-
RawStringFormatterTesttests build ofBasicStringFormatterNow tests are the same
Comment #18
joelpittet@andypost the reason I asked @lauriii to change is it is because this is testing how we built something and not what we built. Though I appreciate more tests I think this the wrong kind of test. It should test the output is as expected not the "how we built the output".
Comment #19
andypost@joelpittet as you see I extend tests same way as they are. Mean testing how formatter returns build, also checking how that rendered.
for me that exactly a test of the formatter build
Comment #20
joelpittetYes, that's what I'm saying we shouldn't be testing "how it's built" but rather we should test "what is the end result of the render of the array". Does that make sense?
Put in other words: Right now it's testing the input is there instead of testing the output we get from that input.
Comment #21
dawehnerDoes someone mind trying to profile how much this makes for example /admin/content slower, with let's say 50 nodes?
Comment #22
joelpittetScenario
xdebug off, twig C extension off. xhprof on.
http://www.lionsad.de/xhprof-kit/xhprof/xhprof_html/?run1=55fa31db35b03&...
http://www.lionsad.de/xhprof-kit/xhprof/xhprof_html/?run1=55fa31db35b03&...
Comment #23
dawehnerOh this is really nice. As we no longer use #markup, we no longer have to
Xss::filter()the result, which saves us quite some time, see http://www.lionsad.de/xhprof-kit/xhprof/xhprof_html/?symbol=Drupal%5CCom...Comment #24
joelpittetOh I forgot to mention but I'm only showing 10 nodes at a time, should have changed it to 50 but I'm sure the % would be similar.
Comment #25
joelpittet@andypost re #20 is there any reason why we should be testing the input?
Comment #26
andypostreverted #17 changes and added more render tests, should be ready now
Comment #27
joelpittetThank you @andypost. Still not sure why some of this needs to test the input but part of that was there before this patch so as long as it's testing the output I'm happy:)
Comment #28
alexpottTwig making things quicker... now there is a turn up for the books! Nice work all. Committed 3137a14 and pushed to 8.0.x. Thanks!