Closed (fixed)
Project:
Drupal core
Version:
8.0.x-dev
Component:
base system
Priority:
Critical
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
15 Sep 2015 at 12:07 UTC
Updated:
1 Oct 2015 at 14:04 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
dawehnerComment #4
dawehnerThere we go, this is a bit tricky but some of those are just stupid, like t() around already translated values.
Comment #6
dawehnerAnother missed space.
Comment #8
dawehnerYeah its green.
Comment #10
alexpottMenu labels are escaped when they are displayed in menus so they definitely should be here.
So here we are saved by the current behaviour of
!placeholderas $entity->label() is not marked safe before doing this. If we had the Drupal 7 behaviour this would be exploitable. Therefore I think we need to ensure there is test coverage for this in the aggregator module. I think escaping is the correct behaviour for aggregator titles.Wowzer!?!?! this was using t() as a way to mark safe. And I agree that the definition label should be escaped.
Nice we have some test coverage.
Setting to needs work for adding test coverage of the aggregator entity label in the feed icon.
Comment #11
lauriiiWorking on the test coverage
Comment #12
dawehnerI tried to implement some test helper for that, but yeah xpath is stupid and HTML cannot be properly parsed by HTML
Comment #13
lauriiiComment #14
lauriiiPatch looks good and RTBCing with a help of #10. Btw interdiff has code which is not included in the patch so don't get confused of that :)
Comment #17
dawehnerUps.
Comment #18
alexpottComment #19
stefan.r commentedUnneeded?
where does @label come from here? In https://www.drupal.org/files/issues/interdiff-120-122.txt I thought it was set in ConfigEntityMapper::getTitle?
Otherwise this all looks good to me
Comment #20
stefan.r commentedOops, didn't mean to RTBC yet, just wondering about the @label field bit?
Comment #21
dawehnerThank you for your review @stefan.r
Given that the @title is never used on runtime for this particular class, we could remove the line entirely.
Comment #22
stefan.r commentedComment #23
alexpottCommitted 0f6f909 and pushed to 8.0.x. Thanks!
Comment #25
alexpottThis is part of the critical meta.
Comment #26
alexpottNote we've have issues with respect to entity labels going back years.