Render callbacks must be a closure or implement TrustedCallbackInterface or RenderCallbackInterface

Recent security releases have shown that the render system needs to be stricter about what it allow to be called by a callback. See:

• https://www.drupal.org/sa-core-2018-002
• https://www.drupal.org/sa-core-2018-004
• #2860607: Code execution via Twig templates (including inline)

If you have code that adds a render callback - #access_callback, #lazy_builder, #pre_render or #post_render it might need to be updated. This will initially result in deprecation errors, but will eventually result in code throwing an exception.

Procedural function callbacks

If the callback is to a procedural function, for example, color_block_view_pre_render() you will need to move it to an object that implements \Drupal\Core\Security\TrustedCallbackInterface. For example:

class ColorBlock implements TrustedCallbackInterface {

  /**
   * {@inheritdoc}
   */
  public static function trustedCallbacks() {
    return ['preRender'];
  }

  /**
   * #pre_render callback: Sets color preset logo.
   */
  public static function preRender($build) {
    // Do what the color_block_view_pre_render() function did. For the minimal change you can call the procedural function.
  }

}

In core:

• drupal_pre_render_links() replaced with \Drupal\Core\Render\Element\Link::preRenderLinks()
• color_block_view_pre_render() replaced with \Drupal\color\ColorBlock::preRender()
• filter_form_access_denied() replaced with \Drupal\filter\Element\TextFormat::accessDeniedCallback()
• history_attach_timestamp() replaced with \Drupal\history\HistoryRenderCallback::lazyBuilder()
• _toolbar_do_get_rendered_subtrees() replaced with \Drupal\toolbar\Controller\ToolbarController::preRenderGetRenderedSubtrees()
• toolbar_prerender_toolbar_administration_tray() replaced with \Drupal\toolbar\Controller\ToolbarController::preRenderAdministrationTray()
• views_pre_render_views_form_views_form() replaced with \Drupal\views\Form\ViewsFormMainForm::preRenderViewsForm()

Object method callbacks

If the callback is a RenderCallbackInterface object no update is necessary. Otherwise the object needs to implement \Drupal\Core\Security\TrustedCallbackInterface. For example, \Drupal\node\Plugin\Search\NodeSearch has #pre_render callback to ::removeSubmittedInfo(). You need to add TrustedCallbackInterface to NodeSearch and implement TrustedCallbackInterface::trustedCallbacks() like so:

  /**
   * {@inheritdoc}
   */
  public static function trustedCallbacks() {
    return ['removeSubmittedInfo'];
  }

Anonymous function callbacks

These are not recommended because they cannot be serialized. But they do not require updating as they are trusted.