When constructing @link theme_render the rendered output of @endlink is passed to Html::escape() as array in key '#markup'. If the '#plain_text' key is not used warnings are produced. Here is a patch that handles that.

CommentFileSizeAuthor
#12 3058517-12.patch848 bytesgauravvvv
#11 html-special-chars-3058517-11.patch639 bytesnikhil_110
#2 html-special-chars-3058517.patch639 bytesplamen.penev

Issue fork drupal-3058517

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Plamen.Penev created an issue. See original summary.

plamen.penev’s picture

plamen.penev commented
Title: Strings that are passed in array as value in the #markup key cannot be handled by Html::escape() » htmlspecialchars() expects parameter 1 to be string, array given
StatusFileSize
new html-special-chars-3058517.patch639 bytes
plamen.penev’s picture

plamen.penev commented
Issue summary: View changes
john cook’s picture

john cook commented
Status: Needs review » Needs work
Issue tags: +Needs security review

Hi @Plamen.Penev.

Thank you for logging and working on this issue.

Before this can be RTBCed a test will need to be created to show that there is a bug, the bug can be reproduced, and that the patch fixes the bug. The tests are usually submitted as a separate patch so it can shown to fail without the patch. So I'm setting back to 'needs work'.

I have concerns about how the solution has been implemented. It appears that the sanitization functions could be bypassed. Because of this I've added the "needs security review" tag. The security team will need to state if the patch can be accepted as is.

Version: 8.7.1 » 8.7.x-dev

Core issues are now filed against the dev versions where changes will be made. Document the specific release you are using in your issue comment. More information about choosing a version.

Version: 8.7.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Branches prior to 8.8.x are not supported, and Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

nikhil_110’s picture

nikhil_110 commented
Issue tags: -
StatusFileSize
new html-special-chars-3058517-11.patch639 bytes

Attached patch against Drupal 9.5.x

gauravvvv’s picture

gauravvvv commented
Status: Needs work » Needs review
StatusFileSize
new 3058517-12.patch848 bytes

Re-rolled patch #2, for 9.5.x. Patch #2 no longer applies to 9.5.x. Not attaching interdiff as no patch is applying to 9.5

ameymudras’s picture

ameymudras commented
Status: Needs review » Needs work

Would be really helpful if we can have testing steps in the description. Couple of suggestions after code review:

1. we can make use of isset instead of array_key_exists since its faster

if (is_array($text) && isset($text['#markup'])) {

2. The following comment needs to be better worded

// Handle strings that are passed in array as value in the #markup key.

rpayanm made their first commit to this issue’s fork.

rpayanm opened merge request !3725

rpayanm’s picture

rpayanm
he/him
Primary language Spanish
commented
Title: htmlspecialchars() expects parameter 1 to be string, array given » 3058517-9.5.x
Status: Needs work » Needs review

I applied the suggestions please review.

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work
Issue tags: +Needs issue summary update, +Needs title update, +Needs Review Queue Initiative

The issue summary should be updated to include the problem, proposed solution, and remaining tasks

Title also should be updated to show the problem not the ticket number.

Also needs test coverage.

rpayanm’s picture

rpayanm
he/him
Primary language Spanish
commented
Title: 3058517-9.5.x » htmlspecialchars() expects parameter 1 to be string, array given
Issue tags: -Needs title update

Ups, sorry.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.