Problem/Motivation

When multiple filters of the type "FilterInterface::TYPE_HTML_RESTRICTOR" are enabled in CKEditor5, the site crashes with an error.

TypeError: Drupal\ckeditor5\HTMLRestrictions::__construct(): Argument #1 ($elements) must be of type array, Drupal\ckeditor5\HTMLRestrictions given, called in /app/web/core/modules/ckeditor5/src/Plugin/Validation/Constraint/FundamentalCompatibilityConstraintValidator.php on line 157 in Drupal\ckeditor5\HTMLRestrictions->__construct() (line 82 of core/modules/ckeditor5/src/HTMLRestrictions.php).

Steps to reproduce

Enable the FilerHTML plugin for CKEditor5 and another plugin of the type TYPE_HTML_RESTRICTOR. In my case it was a custom filter but you can use another module, like extend_html_filter (I know they are basically the same, but I needed another plugin of this type to reproduce).
When you save the text format, the error above appears.

Proposed resolution

The error is caused by the fact that the "provided" variable is overwritten. It is first an array with allowed HTML tags and attributes, but in the foreach loop that passes through all restrictor filters the variable is overwritten by a HTMLRestrictions instance.

Issue fork drupal-3326778

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Web-Beest created an issue. See original summary.

web-beest’s picture

StatusFileSize
new1.21 KB

Provided patch tested on Drupal core 9.4.9

cilefen’s picture

@Web-Beest Test runs cost the Drupal Association money. It is seldom necessary to test on every platform combination.

web-beest’s picture

I'm sorry, I did not know.

web-beest’s picture

Version: 9.4.x-dev » 9.5.x-dev
catch’s picture

Priority: Normal » Major
Status: Active » Needs review

I don't yet have clear steps to reproduce, but I hit this on a 9.4 site, then updated to 9.5 to see if it was resolved, and got the same error. This was trying to change table to <table class> in the code editing section of the basic HTML format.

Trying to do the same thing on a clean(ish) install of core it works fine.

graber’s picture

StatusFileSize
new1.36 KB

Not sure if it's related to the fix or not (we'll need to update the issue title if so), but after applying this our config failed validation where it shouldn't. Here's a fix for that as well.

graber’s picture

Issue tags: +Needs tests

And ofc this will need tests before the gates open :|
Looking at 10.x code, it's also an issue there.
As for steps to reproduce (EDIT: Just noticed this is in the issue description - embarassed):
- add more than 1 Drupal\filter\Plugin\FilterInterface::TYPE_HTML_RESTRICTOR type filter to an editor instance
- save the form.

There are 3 such filters in core: filter_html, filter_html_escape and filter_null. It doesn't make sense to use the first 2 together and the 3rd one is a fallback filter not to be used directly so there's no situation in pure core where 2 such filters are used at the same time.

As for the second bug I fixed - to reproduce it needs a TYPE_HTML_RESTRICTOR type filter that doesn't restrict anything (yes, doesn't make sense but it's technically possible to create such filter with proper type annotation and getHTMLRestrictions() method returning FALSE or an empty array - enough not to override the base class method). Probably a proper fix would be throwing an exception in filter manager when such a filter is discovered.

graber’s picture

To think of it more.. the second fix is not complete. Imagine 2 restrictors restricting different HTML elements.. Those should be merged first in a foreach and only then checked against provided elements, otherwise we'll get errors for each such plugin. Haven't tested for that though.

catch’s picture

I tried enabling both filter_html and filter_html_escape on a standard install of Drupal 9.5, and wasn't able to reproduce the error that way - even though it doesn't make sense, it would have made test coverage easier (and been enough to promote this to critical).

wim leers’s picture

Issue tags: -Needs tests
StatusFileSize
new2.43 KB

IMHO there is no reason to wait for test coverage for this particular issue. #2 clearly shows the problem.

This only happens in case there are >1 restrictor filters. And indeed you cannot reproduce this with filter_html_escape because that disallows all markup, which means you'll never hit the call to FundamentalCompatibilityConstraintValidator::checkHtmlRestrictionsMatch() in FundamentalCompatibilityConstraintValidator::validate(). I see that's also what @Graber wrote in #9 — he's totally right! 🤓

Wrote test that does just that.

Status: Needs review » Needs work

The last submitted patch, 11: 3326778-11-test-only-FAIL.patch, failed testing. View results

wim leers’s picture

Status: Needs work » Needs review
StatusFileSize
new1.34 KB
new3.72 KB

The interdiff is #2.

graber’s picture

We don't need to call $provided = new HTMLRestrictions($provided_elements); in each loop iteration since we're assigning the same value every time and nothing in the loop changes that value. Let's move this out of the loop.

graber’s picture

StatusFileSize
new1.12 KB
new3.53 KB
new1.12 KB
wim leers’s picture

Hah! Good catch 👍😊

@Graber: you're still able to RTBC. #15 is a trivial change, so doesn't prevent you 😇

graber’s picture

Status: Needs review » Reviewed & tested by the community

Right, test passed locally for me as well so should be fine.

graber’s picture

on 10.1.x though.. too early.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 15: 3326778-15.patch, failed testing. View results

wim leers’s picture

Status: Needs work » Reviewed & tested by the community

That's fine — I'm confident the patch will still be green on 10.1.x and 10.0.x — because it was in #13. This will need to land in the newest branch first anyway. We can worry about a 9.5.x-specific reroll after it lands.

alexpott’s picture

Status: Reviewed & tested by the community » Needs work

Committed and pushed 6e2e2cd055 to 10.1.x and c9118460e5 to 10.0.x. Thanks!

Now we can try and make the test work on Drupal 9.5.

  • alexpott committed 6e2e2cd0 on 10.1.x
    Issue #3326778 by Graber, Wim Leers, Web-Beest, catch: TypeError: Drupal...

  • alexpott committed c9118460 on 10.0.x
    Issue #3326778 by Graber, Wim Leers, Web-Beest, catch: TypeError: Drupal...
diaodiallo’s picture

Hi! anyone have this fixed in 9.5.x I am having this issue on a 9.5.9 Drupal site.

#7 is not working yet.

Thanks.

alpha2zee’s picture

Just noting that this issue occurs with the htmLawed text filter module (TYPE_HTML_RESTRICTOR) in D9 but not D10.

othermachines’s picture

Also trying to upgrade to CKEditor 5 while still on 9.x (which is strongly recommended in the 9.5.x release notes) - Is there a workaround while we wait for a fix?

solideogloria’s picture

Patch #15 seems to work in Drupal 9.5.x for me.

solideogloria’s picture

Actually, while the patch applies correctly, I can't get any of my text formats to save using CKEditor 5.

#3384398: Unclear validation errors when upgrading text formats to CKEditor 5

solideogloria’s picture

solideogloria’s picture

I had to disable the filter provided by Noopener Filter, then I could save the text formats.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

samitk’s picture

Hello,

I am not able to reproduce it with Drupal 11.x, Looks like this issue has been resolved,

As per the comment #21changes has been pushed to 10.0.x and 10.1.x branch.

I guess we can close it.

Thanks
Samit K.

solideogloria’s picture

Version: 11.x-dev » 9.5.x-dev

It is Needs Work for Drupal 9.5.x.

cilefen’s picture

Status: Needs work » Fixed

Drupal 9 is end of life so we can close this. 9 isn’t supported here.

quietone’s picture

Version: 9.5.x-dev » 10.0.x-dev

Since this was committed to D10, so restoring that version.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.