Problem/Motivation

#2575615: Introduce HtmlEscapedText and remove SafeMarkup::setMultiple() and SafeMarkup::getAll() and remove the static safeStrings list marked SafeMarkup::isSafe() deprecated.

Proposed resolution

remove usages of SafeMarkup::isSafe()

Remaining tasks

Contributor tasks needed
Task Novice task? Contributor instructions Complete?
Create a patch Instructions
Review patch to ensure that it fixes the issue, stays within scope, is properly documented, and follows coding standards Instructions

User interface changes

No

API changes

No

Data model changes

No

Comments

YesCT created an issue. See original summary.

lauriii’s picture

Status: Active » Needs review
StatusFileSize
new17.2 KB

Status: Needs review » Needs work

The last submitted patch, 2: remove_usages_of-2579691-2.patch, failed testing.

The last submitted patch, 2: remove_usages_of-2579691-2.patch, failed testing.

The last submitted patch, 2: remove_usages_of-2579691-2.patch, failed testing.

lauriii’s picture

Status: Needs work » Needs review
StatusFileSize
new19.63 KB

Status: Needs review » Needs work

The last submitted patch, 7: remove_usages_of-2579691-7.patch, failed testing.

lauriii’s picture

Status: Needs work » Needs review
StatusFileSize
new19.63 KB
new540 bytes

Status: Needs review » Needs work

The last submitted patch, 9: remove_usages_of-2579691-8.patch, failed testing.

alexpott’s picture

  1. +++ b/core/includes/bootstrap.inc
    @@ -441,7 +441,7 @@ function drupal_set_message($message = NULL, $type = 'status', $repeat = FALSE)
    -    if (!($message instanceof Markup) && SafeMarkup::isSafe($message)) {
    +    if (!($message instanceof Markup)) {
    

    This is a logic change and not quite right - the point of this is to change complex MarkupInterface objects like TranslatableString into Markup objects.

  2. +++ b/core/modules/views_ui/tests/src/Unit/ViewListBuilderTest.php
    @@ -168,6 +168,7 @@ public function testBuildRowEntityList() {
    +    // @todo what should we do for these SafeMarkup::isSafe calls?
         $this->assertFalse(SafeMarkup::isSafe('/<object>malformed_path</object>'), '/<script>alert("/<object>malformed_path</object> is not marked safe.');
         $this->assertFalse(SafeMarkup::isSafe('/<script>alert("placeholder_page/%")'), '/<script>alert("/<script>alert("placeholder_page/%") is not marked safe.');
    

    Imo remove them this is just no longer relevant. Autoescape no longer uses a list of safe strings.

  3. +++ b/core/tests/Drupal/Tests/Core/Render/RendererTest.php
    @@ -47,13 +48,13 @@ public function testRenderBasic($build, $expected, callable $setup_code = NULL)
    +      $this->assertFalse(($build['#markup'] instanceof MarkupInterface), 'The #markup value is not marked safe before rendering.');
    ...
    +      $this->assertTrue(($render_output instanceof MarkupInterface), 'Output of render is marked safe.');
    +      $this->assertTrue(($build['#markup'] instanceof MarkupInterface), 'The #markup value is marked safe after rendering.');
    
    @@ -751,7 +752,7 @@ public function testRenderCacheProperties(array $expected_results) {
    +      $this->assertTrue(($data[$cache_property] instanceof MarkupInterface), "$cache_property is marked as a safe string");
    

    No need for additional brackets.

lauriii’s picture

Version: 8.0.x-dev » 8.1.x-dev
lauriii’s picture

Status: Needs work » Needs review
StatusFileSize
new19.88 KB
new1.62 KB

Thanks for the review @alexpott!

dawehner’s picture

  1. +++ b/core/lib/Drupal/Core/Render/RenderCache.php
    @@ -341,12 +341,6 @@ public function getCacheableRenderArray(array $elements) {
    -      // Ensure that any safe strings are a Markup object.
    -      foreach (Element::properties(array_flip($elements['#cache_properties'])) as $cache_property) {
    -        if (isset($elements[$cache_property]) && is_scalar($elements[$cache_property]) && SafeMarkup::isSafe($elements[$cache_property])) {
    -          $elements[$cache_property] = Markup::create($elements[$cache_property]);
    -        }
    -      }
    

    Are you 100% sure that this change is fine? It feels like we are relying on a detail of the renderer inside the RenderCache

  2. +++ b/core/modules/menu_link_content/src/Tests/MenuLinkContentDeriverTest.php
    @@ -72,7 +73,7 @@ public function testRediscover() {
         $this->assertFalse($title instanceof TranslatableMarkup);
         $this->assertIdentical('<script>alert("Welcome to the discovered jungle!")</script>', $title);
    -    $this->assertFalse(SafeMarkup::isSafe($title));
    +    $this->assertFalse($title instanceof MarkupInterface);
    

    Given the previous check, we can remove that one. assertIdentical already ensures that we are dealing with a pure string

  3. +++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
    @@ -138,7 +138,7 @@ public function testFormat($string, array $args, $expected, $message, $expected_
         $this->assertEquals($expected, $result, $message);
    -    $this->assertEquals($expected_is_safe, SafeMarkup::isSafe($result), 'SafeMarkup::format correctly sets the result as safe or not safe.');
    +    $this->assertEquals($expected_is_safe, $result instanceof MarkupInterface, 'SafeMarkup::format correctly sets the result as safe or not safe.');
     
    
    +++ b/core/tests/Drupal/Tests/Core/Render/RendererTest.php
    @@ -47,13 +48,13 @@ public function testRenderBasic($build, $expected, callable $setup_code = NULL)
     
         if (isset($build['#markup'])) {
    -      $this->assertFalse(SafeMarkup::isSafe($build['#markup']), 'The #markup value is not marked safe before rendering.');
    +      $this->assertFalse(($build['#markup'] instanceof MarkupInterface), 'The #markup value is not marked safe before rendering.');
         }
         $render_output = $this->renderer->renderRoot($build);
         $this->assertSame($expected, (string) $render_output);
         if ($render_output !== '') {
    -      $this->assertTrue(SafeMarkup::isSafe($render_output), 'Output of render is marked safe.');
    -      $this->assertTrue(SafeMarkup::isSafe($build['#markup']), 'The #markup value is marked safe after rendering.');
    +      $this->assertTrue(($render_output instanceof MarkupInterface), 'Output of render is marked safe.');
    +      $this->assertTrue(($build['#markup'] instanceof MarkupInterface), 'The #markup value is marked safe after rendering.');
         }
       }
     
    @@ -751,7 +752,7 @@ public function testRenderCacheProperties(array $expected_results) {
    
    @@ -751,7 +752,7 @@ public function testRenderCacheProperties(array $expected_results) {
         // #custom_property_array can not be a safe_cache_property.
         $safe_cache_properties = array_diff(Element::properties(array_filter($expected_results)), ['#custom_property_array']);
         foreach ($safe_cache_properties as $cache_property) {
    -      $this->assertTrue(SafeMarkup::isSafe($data[$cache_property]), "$cache_property is marked as a safe string");
    +      $this->assertTrue(($data[$cache_property] instanceof MarkupInterface), "$cache_property is marked as a safe string");
         }
       }
     
    diff --git a/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php b/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
    
    +++ b/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
    @@ -64,7 +64,7 @@ public function testFormatPlural($count, $singular, $plural, array $args = array
    -    $this->assertTrue(SafeMarkup::isSafe($result));
    +    $this->assertTrue($result instanceof MarkupInterface);
    

    Let's use assertInstanceOf here

Status: Needs review » Needs work

The last submitted patch, 13: remove_usages_of-2579691-13.patch, failed testing.

lauriii’s picture

Status: Needs work » Needs review
StatusFileSize
new19.97 KB
new4.17 KB

Thanks for the review @dawehner! Fixed comments from #14

dawehner’s picture

Status: Needs review » Reviewed & tested by the community

Thank you @lauriii

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 16: remove_usages_of-2579691-16.patch, failed testing.

alexpott’s picture

Re #14.1 @lauriii is right...

if (isset($elements[$cache_property]) && is_scalar($elements[$cache_property]) && $elements[$cache_property] instanceof MarkupInterface) {

Doing is_scalar() and then checking is the thing is an instanceof MarkupInterface makes no sense.

lauriii’s picture

Status: Needs work » Needs review
StatusFileSize
new20.04 KB
new1.59 KB

Stupid mistake from me.. This should be green! :)

Status: Needs review » Needs work

The last submitted patch, 20: remove_usages_of-2579691-20.patch, failed testing.

lauriii’s picture

Status: Needs work » Needs review
StatusFileSize
new20.4 KB
new3.04 KB

One more stupid mistake from me

aleksip’s picture

Hello from #2664570: Move Attribute classes under Drupal\Component!

\Drupal\Core\Template\Attribute has redundant use Drupal\Component\Utility\SafeMarkup;

stefan.r’s picture

StatusFileSize
new5.17 KB
new24.3 KB

#22 looks great, just updating those last few comments here!

alexpott’s picture

Status: Needs review » Reviewed & tested by the community

The only usages of SafeMarkup::isSafe() are in Drupal\Tests\Component\Utility\SafeMarkupTest which is testing the deprecated method so this is good to go.

alexpott’s picture

Status: Reviewed & tested by the community » Needs review

Hang on...

alexpott’s picture

Status: Needs review » Reviewed & tested by the community
StatusFileSize
new26.25 KB
new5.59 KB

We can get rid of quite a few use statements which show the SafeMarkup class getting out of the way :)

  • Cottser committed f7c02df on 8.1.x
    Issue #2579691 by lauriii, alexpott, stefan.r, YesCT, dawehner: Remove...
star-szr’s picture

Title: remove usages of SafeMarkup::isSafe() » Remove usages of SafeMarkup::isSafe()
Status: Reviewed & tested by the community » Fixed

Good stuff. The only remaining usages are in core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php.

Since it's not a bug fix and is only removing usages of a deprecated method this only makes sense to commit to 8.1.x.

Committed f7c02df and pushed to 8.1.x. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.