Problem/Motivation

The insecure examples shown on FormattableMarkup::placeholderFormat() does not include string delimiters.

$this->placeholderFormat('<@foo>text</@foo>, ['@foo' => $some_variable]);
$this->placeholderFormat('<a @foo>link text</a>, ['@foo' => $some_variable]);
$this->placeholderFormat('<a href="@foo">link text</a>, ['@foo' => $some_variable]);
$this->placeholderFormat('<a title="@foo">link text</a>, ['@foo' => $some_variable]);

Proposed resolution

Change the code to include the final delimiter for those strings. The correct code is the following one.

$this->placeholderFormat('<@foo>text</@foo>', ['@foo' => $some_variable]);
$this->placeholderFormat('<a @foo>link text</a>', ['@foo' => $some_variable]);
$this->placeholderFormat('<a href="@foo">link text</a>', ['@foo' => $some_variable]);
$this->placeholderFormat('<a title="@foo">link text</a>', ['@foo' => $some_variable]);

Issue fork drupal-3521327

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

avpaderno created an issue. See original summary.

avpaderno’s picture

I would rather wait #3518952: Fix grammar in FormattableMarkup::placeholderFormat() comments is fixed, before creating a merge request for this issue.

avpaderno’s picture

avpaderno’s picture

Status: Active » Needs review
smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs issue summary update

Can we use the full issue summary template please.

avpaderno’s picture

Issue summary: View changes
Status: Needs work » Needs review
avpaderno’s picture

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Seems pretty straight forward, LGTM

  • catch committed d4c9cbd2 on 11.2.x
    Issue #3521327 by avpaderno: The insecure examples code does not include...

  • catch committed b4332a51 on 11.x
    Issue #3521327 by avpaderno: The insecure examples code does not include...
catch’s picture

Version: 11.x-dev » 11.2.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to 11.x and cherry-picked to 11.2.x, thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.