Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Reporter:
Created:
10 Jul 2021 at 11:05 UTC
Updated:
28 Sep 2021 at 12:49 UTC
Jump to comment: Most recent
Comments
Comment #2
avpadernoComment #3
vipin.mittal18Hello Alberto Paderno,
No security or coding standard issues are found in the PAreview. so could you please do some action here on this. I am active contributor and now providing relevant comments on security issues.
Thanks
Vipin Mittal
Comment #4
vipin.mittal18Comment #5
vipin.mittal18Comment #6
avpadernoThe
Drupal\Core\Render\Markupclass is an internal class not thought to be used from contributed modules.hook_page_attachments()implementations aren't expected to return values.Comment #7
vipin.mittal18Thanks Alberto Paderno for your indispensable feedback!
I agree hook_page_attachments() doesn't return anything so will modify the exception code in my module but I believe Markup implementation is correct otherwise operators get escaped automatically due to core Drupal 8 feature.
Refer link: https://www.drupal.org/project/drupal/issues/2752283 and https://www.drupal.org/project/responsive_background_image module which has security coverage.
Comment #8
avpadernoOnly Drupal core can use a class that is marked as internal; that is what comment #27 is saying. That comment is also suggesting a way to avoid using the
Markupclass.For what I can see, since the
Markupclass is usingMarkupTraitand that Drupal 8 and 9 backwards compatibility and internal API policy (backend) doesn't say traits are implicitly internal, a class using that trait (which does all the work) would be sufficient.Comment #9
vipin.mittal18Yes Alberto Paderno it make sense and adding the MarkupInterface in my code and then forward you for further review.
Comment #10
vipin.mittal18Comment #11
vipin.mittal18Hello Alberto Paderno,
I have resolved the Markup and Exception issue from the project and updated the PAReview checklist of this issue. It was great learning addition to my knowledge base. Thanks very much!
Thanks
Vipin Mittal
Comment #12
vipin.mittal18Comment #13
vipin.mittal18Comment #14
vipin.mittal18Comment #15
vipin.mittal18Comment #16
avpadernoI changed the issue priority as described on Review process for security advisory coverage: What to expect / Application Review Timelines.
To reviewers: Please change back the priority to Normal after reviewing the project.
Comment #17
avpadernoThank you for your contribution! I am going to update your account.
These are some recommended readings to help with excellent maintainership:
You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.