#date_time_callbacks and #date_date_callbacks bypass the TrustedCallbackInterface protections

Fixes the phpcs issues.

Patch looks great.

Just some nits.

1. +++ b/core/lib/Drupal/Core/Security/StaticTrustedCallbackHelper.php
   @@ -0,0 +1,47 @@
   +namespace Drupal\Core\Security;
   

   Formidable namespace!

2. +++ b/core/lib/Drupal/Core/Security/StaticTrustedCallbackHelper.php
   @@ -0,0 +1,47 @@
   +   * @param $message
   

   Missing data type. It's presumably a string?

3. +++ b/core/lib/Drupal/Core/Security/StaticTrustedCallbackHelper.php
   @@ -0,0 +1,47 @@
   +   * @see \Drupal\Core\Security\DoTrustedCallbackTrait::doTrustedCallback
   
   +++ b/core/tests/Drupal/KernelTests/Core/Datetime/DatetimeElementFormTest.php
   @@ -105,7 +136,46 @@ public function testDatetimeElement() {
   +   * Data provider for ::testDatetimeElementUntrustedCallbacks.
   

   Missing parens on the method name.

4. +++ b/core/tests/Drupal/KernelTests/Core/Datetime/DatetimeElementFormTest.php
   @@ -12,14 +14,21 @@
   +   * Date flag.
   ...
   +   * Time flag.
   

   These docs are a little weak; can we spell out what these flags are used for?

5. +++ b/core/tests/Drupal/KernelTests/Core/Datetime/DatetimeElementFormTest.php
   @@ -105,7 +136,46 @@ public function testDatetimeElement() {
   +   * @return array
   +   *   Test cases.
   

   Looks like it's a string[][] so we can be specific about that.

Thanks!

Should be 9.3.x I think since it's raising new deprecations for arbitrary untrusted callbacks.

Fixed spelling error.

1. +++ b/core/lib/Drupal/Core/Datetime/Element/Datetime.php
   @@ -267,9 +273,8 @@ public static function processDatetime(&$element, FormStateInterface $form_state
   +          $message = sprintf('DateTime element #date_date_callbacks callbacks must be methods of a class that implements \Drupal\Core\Security\TrustedCallbackInterface or be an anonymous function. The callback was %s. Support for this callback implementation is deprecated in 9.3.0 and will be removed in Drupal 10.0.0. See https://www.drupal.org/node/3217966', Variable::callableToString($callback));
   
   @@ -299,9 +304,8 @@ public static function processDatetime(&$element, FormStateInterface $form_state
   +          $message = sprintf('DateTime element #date_time_callbacks callbacks must be methods of a class that implements \Drupal\Core\Security\TrustedCallbackInterface or be an anonymous function. The callback was %s. Support for this callback implementation is deprecated in 9.3.0 and will be removed in Drupal 10.0.0. See https://www.drupal.org/node/3217966', Variable::callableToString($callback));
   

   Nitpick, message should have drupal:9.3.0 and drupal:10.0.0

2. +++ b/core/lib/Drupal/Core/Security/StaticTrustedCallbackHelper.php
   @@ -0,0 +1,47 @@
   +class StaticTrustedCallbackHelper {
   

   Are there any other places this should be used in the future? If so, any follow-ups worth opening?

Nice catch @tim.plunkett. Fixed the deprecation message.

Thanks, looks good! Other than #20.2, which shouldn't block commit, all feedback has been addressed.

Whoops, had botched the previous patch (forgot to add the new file). Fixed in this patch, and restoring RTBC.

Uggghhhh

Fixed 1-4, I don't agree on 5, dataProviders can return anything - so leaving it generic in case of future refactoring

FWIW I disagree with this; we can almost always be more specific than array and the array depth and content is useful information for using the data provider. The test method that it's a data provider for is also now (correctly) typehinted, so if we did expand the provider the contract would be broken and we wouldn't miss fixing the docs and typehint.

Leaving RTBC to discuss.

Committed to 9.3.x only since it includes a new, dynamic deprecation; and published the CR. Thanks!

This issue has caused a serious regression - see #3250335: #date_date_callbacks is broken in Drupal 9.3 - the feature no longer works.

Another potentially tricky issue is that we missed a bit of date_date_callback because the same mechanism is used by \Drupal\Core\Datetime\Element\Datelist - see #3250349: \Drupal\Core\Datetime\Element\Datelist::processDatelist() does not use trusted callbacks - #date_date_callbacks only partially converted to TrustedCallbackInterface in 9.3.x