Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
Follow-up to #2280965: [meta] Remove every SafeMarkup::set() call
Problem/Motivation
\Drupal\Tests\Core\Form\FormCacheTest::testSetCacheWithSafeStrings() calls SafeMarkup::set() which is meant to be for internal use only.
Proposed resolution
- Remove the call by refactoring the code.
- If refactoring is not possible, thoroughly document where the string is coming from and why it is safe, and why SafeMarkup::set() is required.
Remaining tasks
- Evaluate whether the string can be refactored to one of the formats outlined in this change record: https://www.drupal.org/node/2311123
- Identify whether there is existing automated test coverage for the sanitization of the string. If there is, list the test in the issue summary. If there isn't, add an automated test for it.
- If the string cannot be refactored, the SafeMarkup::set() usage needs to be thoroughly audited and documented.
Manual testing steps (for XSS and double escaping)
Do these steps both with HEAD and with the patch applied:
- Clean install of Drupal 8.
- Install the
search_extra_type
module - Go to
/search
, click the "Dummy search type" tab, and enter<test>
- Compare the output above in HEAD and with the patch applied. Confirm that there is no double-escaping.
- If there is any user or calling code input in the string, submit
alert('XSS');and ensure that it is sanitized.
User interface changes
None.
API changes
None.
Comment | File | Size | Author |
---|---|---|---|
#7 | remove_safemarkup_set-2539300-7.patch | 670 bytes | cilefen |
#5 | remove_safemarkup_set-2539300-4.patch | 587 bytes | cilefen |
formtest.patch | 587 bytes | cilefen | |
Comments
Comment #1
cilefen CreditAttribution: cilefen commentedComment #2
pwolanin CreditAttribution: pwolanin as a volunteer and at Acquia commentedjust a test code cleanup, looks good.
Comment #3
tim.plunkettcheckPlain
Comment #4
pwolanin CreditAttribution: pwolanin as a volunteer and at Acquia commentedComment #5
cilefen CreditAttribution: cilefen commentedI blame the reviewer ;-).
Comment #6
tim.plunkettI actually think this is a valid usage of ::set(), since it's just trying to populate the list of safe strings.
But I haven't been as involved with the other issues like this, can we just document it and leave it?
Comment #7
cilefen CreditAttribution: cilefen commentedYes, it probably fine.
Comment #8
tim.plunkettThanks!
Comment #9
alexpottI agree this is valid usage - cause it is what is under test. Committed c4281e4 and pushed to 8.0.x. Thanks!