Problem/Motivation

Proposed resolution

Fix that if statement to also include a check for the 'filter_html' filter.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Issue fork drupal-3067116

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

effulgentsia created an issue. See original summary.

oknate’s picture

I'm having trouble recreating the issue where it breaks the markup. For me, if I set the display of a processed text render element with a Remote Video (using a YouTube url) to 'trimmed', it just disappears. If you get a chance, could you add a little more detailed steps to reproduce.

effulgentsia’s picture

If I add https://www.youtube.com/watch?v=BNoCn6T9Xf8 as my video.

Then, create an Article with just that media entity in it, which after saving that Article, I confirm by clicking the "Source" button in the CKE toolbar and see that all it says is:

<drupal-media data-align="center" data-entity-type="media" data-entity-uuid="16747bf7-da20-413e-9dcc-f5dc68be6ae7"></drupal-media>

Now, when I view the Article on it own page, I see the video, and when I view the page's source, the corresponding article tag that this media got rendered as is:

<article class="align-center media media--type-remote-video media--view-mode-default"><div data-quickedit-field-id="media/3/field_media_oembed_video/en/default" class="field field--name-field-media-oembed-video field--type-string field--label-hidden field__item"><iframe src="/d8/media/oembed?url=https%3A//www.youtube.com/watch%3Fv%3DBNoCn6T9Xf8&amp;max_width=0&amp;max_height=0&amp;hash=g7tTfPlxtopJBgsN7cuXgS_mIJDTjdRN_00VmxumQ3Q" frameborder="0" allowtransparency="" width="480" height="270" class="media-oembed-content" title="DrupalCon Seattle 2019: Driesnote"></iframe>
</div>
      
  </article>

This is just slightly over 600 characters. When I view this article on the frontpage as a teaser, then text_summary() trims it to 600, it cuts off the last 3 characters and just returns:

<article class="align-center media media--type-remote-video media--view-mode-default"><div data-quickedit-field-id="media/3/field_media_oembed_video/en/default" class="field field--name-field-media-oembed-video field--type-string field--label-hidden field__item"><iframe src="/d8/media/oembed?url=https%3A//www.youtube.com/watch%3Fv%3DBNoCn6T9Xf8&amp;max_width=0&amp;max_height=0&amp;hash=g7tTfPlxtopJBgsN7cuXgS_mIJDTjdRN_00VmxumQ3Q" frameborder="0" allowtransparency="" width="480" height="270" class="media-oembed-content" title="DrupalCon Seattle 2019: Driesnote"></iframe>
</div>
      
  </artic

Then, Xss::filter() runs on it, and does two things:
1) Removes the iframe.
2) Removes the final </artic since that's an incomplete closing tag.

The result is:

<article class="align-center media media--type-remote-video media--view-mode-default"><div data-quickedit-field-id="media/3/field_media_oembed_video/en/default" class="field field--name-field-media-oembed-video field--type-string field--label-hidden field__item">
</div>

That's what appears in my frontpage source. Which means there's an <article> tag that's opened and never closed.

oknate’s picture

Status: Active » Needs review
StatusFileSize
new3.83 KB
new2.53 KB
new3.82 KB

Here's a patch and test coverage. I originally created the test using the example in #3, but I think it's better to simplify it. I'm including the original for reference (3067116-4--oembed-example.patch).

The last submitted patch, 4: 3067116-4--FAIL.patch, failed testing. View results

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

naresh_bavaskar’s picture

Assigned: Unassigned » naresh_bavaskar
naresh_bavaskar’s picture

Assigned: naresh_bavaskar » Unassigned
StatusFileSize
new3.64 KB

Rerolling patch for latest branch 9.3.x

Status: Needs review » Needs work

The last submitted patch, 11: 3067116-11.patch, failed testing. View results

nishantghetiya made their first commit to this issue’s fork.

nishantghetiya’s picture

Status: Needs work » Needs review

Changes make on above patch remove deprecated functions assertContains() and assertNotContains() replace with assertStringContainsString() and assertStringNotContainsString

phenaproxima’s picture

Status: Needs review » Needs work

This looks good to me. I only have one nitpicky piece of feedback. We have a fail patch in #4, so that box is checked. I think, once my one tiny bit of feedback is addressed, I'd be very happy to mark this RTBC.

phenaproxima’s picture

Issue tags: +Bug Smash Initiative

Adding to the Bug Smash Initiative.

dww made their first commit to this issue’s fork.

dww’s picture

Status: Needs work » Needs review

Made @phenaproxima's suggested changes. Back to NR.

phenaproxima’s picture

Status: Needs review » Reviewed & tested by the community

Thanks, @dww! RTBC on the assumption that tests will pass.

larowlan’s picture

Priority: Normal » Major

Crediting @effulgentsia who did a lot of the original legwork here in #3
I think given this generates broken markup it qualifies as Major

larowlan’s picture

Title: text_summary() returns malformed (not normalized) HTML for basic_html and other formats that use filter_html instead of filter_htmlcorrector » [backport] text_summary() returns malformed (not normalized) HTML for basic_html and other formats that use filter_html instead of filter_htmlcorrector
Version: 9.3.x-dev » 9.2.x-dev

Merged this to 9.3.x

Going to get a second opinion on backporting to 9.2.x, which I'm in favour of, but because this will change markup on sites (albeit to correct it), going to err on the side of caution.

larowlan’s picture

Title: [backport] text_summary() returns malformed (not normalized) HTML for basic_html and other formats that use filter_html instead of filter_htmlcorrector » text_summary() returns malformed (not normalized) HTML for basic_html and other formats that use filter_html instead of filter_htmlcorrector
Version: 9.2.x-dev » 9.3.x-dev
Status: Reviewed & tested by the community » Fixed

Discussed with @xjm who agreed with the risk of disruption here

since it could change the appearance of sites -- the thing where sites might be relying on the broken behavior

Leaving as fixed and adding a change record

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.