Problem/Motivation
The insecure examples shown on FormattableMarkup::placeholderFormat() does not include string delimiters.
$this->placeholderFormat('<@foo>text</@foo>, ['@foo' => $some_variable]);
$this->placeholderFormat('<a @foo>link text</a>, ['@foo' => $some_variable]);
$this->placeholderFormat('<a href="@foo">link text</a>, ['@foo' => $some_variable]);
$this->placeholderFormat('<a title="@foo">link text</a>, ['@foo' => $some_variable]);
Proposed resolution
Change the code to include the final delimiter for those strings. The correct code is the following one.
$this->placeholderFormat('<@foo>text</@foo>', ['@foo' => $some_variable]);
$this->placeholderFormat('<a @foo>link text</a>', ['@foo' => $some_variable]);
$this->placeholderFormat('<a href="@foo">link text</a>', ['@foo' => $some_variable]);
$this->placeholderFormat('<a title="@foo">link text</a>', ['@foo' => $some_variable]);
Comments
Comment #2
avpadernoI would rather wait #3518952: Fix grammar in FormattableMarkup::placeholderFormat() comments is fixed, before creating a merge request for this issue.
Comment #3
avpadernoComment #5
avpadernoComment #6
smustgrave commentedCan we use the full issue summary template please.
Comment #7
avpadernoComment #8
avpadernoComment #9
smustgrave commentedSeems pretty straight forward, LGTM
Comment #12
catchCommitted/pushed to 11.x and cherry-picked to 11.2.x, thanks!