Problem/Motivation
Symfony released a number of security fixes including one to spaceless; https://github.com/twigphp/Twig/commit/3190b9ae12614dfd58cc5d8f394bac470...
This module duplicated spaceless as is (so including Symfony's bug) when support for spaceless in core did not exist per #3477375: Provide non-deprecated replacement for Twig "spaceless" filter.
Drupal Core security team agreed to make this public to apply the same: https://git.drupalcode.org/security/185020-footnotes-security/-/work_ite... (link to private original issue)
Note that the default setup of this module does not have this issue:
- Ensure you have not manually disabled the Limit allowed HTML filter in footnotes
- Ensure you are not using footnotes_spaceless beyond the footnotes module provided twig templates (cloning them to your theme is fine)
Steps to reproduce
- View footnotes_spaceless
- See same as previous code
Proposed resolution
- Apply same fix
- Apply test coverage
- Add warnings
Remaining tasks
MR
User interface changes
Warnings to use limit allowed html when using footnotes_spaceless
API changes
N/A
Data model changes
N/A
Issue fork footnotes-3591772
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
scott_euser commentedComment #5
scott_euser commentedComment #7
scott_euser commented