Problem/Motivation

src/Render/NameListFormattableMarkup.php escapes each value (unless already MarkupInterface) but uses the delimiter verbatim. Delimiters come from admin-controlled name_list_format config, so it's safe in practice. Document the contract or defensively escape:

$this->delimiter = $delimiter instanceof MarkupInterface ? $delimiter : Html::escape((string) $delimiter);

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork name-3586345

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bluegeek9 created an issue. See original summary.

bluegeek9’s picture

bluegeek9 commented
Assigned: Unassigned » bluegeek9

bluegeek9 opened merge request !87

  • bluegeek9 committed ae5b7917 on 8.x-1.x 
    feat: #3586345 NameListFormattableMarkup treats its delimiter as trusted
bluegeek9’s picture

bluegeek9 commented
Assigned: bluegeek9 » Unassigned
Status: Active » Fixed
//www.flaticon.com/free-icons/thank-you Thank you for your contribution! Your continued support makes this project sustainable.
There are multiple ways to show appreciation for the work contributed to this project including:

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.