Problem/Motivation

The 2.0.x branch seems to be horribly broken. Commit b35f7332ad7a8026c7419047afd27b8811f1ff83 literally reverted the whole code rewrite that was done earlier.

Even worse, it adds $text = Xss::filter($text); to Drupal\obfuscate\Plugin\Filter\ObfuscateMail::process(), which removes all HTML tags from formatted text fields.

Issue fork obfuscate-3586753

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mrshowerman created an issue. See original summary.

yepa made their first commit to this issue’s fork.

grumpydev74’s picture

grumpydev74
Primary language French
Location Geneva, CH 🇨🇭
commented

Right, the following statement is correct :

Even worse, it adds $text = Xss::filter($text); to Drupal\obfuscate\Plugin\Filter\ObfuscateMail::process(), which removes all HTML tags from formatted text fields.

I think the Xss::filter($text) added in the version 2.0.2 is irrelevant. Drupal core already sanitize inputs according to text format allowed tags. It's not Obfuscate filter to do so here. It should be removed.

yepa’s picture

yepa
he/him
Primary language French
Location Geneva
commented
Status: Active » Needs review

Patch added following Grumpydev74 comment.

mrshowerman’s picture

mrshowerman
Location Munich
commented
Status: Needs review » Needs work

While this will certainly fix parts of the issue, the main task remains: reset the 2.0.x branch to the state before commit b35f7332ad7a8026c7419047afd27b8811f1ff83.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Priority: Major » Critical

Updating the module to the latest version breaks all texts using obfuscate filter. Downgrading is not possible due to XSS risks, see older releases. So this is critical. I just pinged the maintainer.

nigelcunningham’s picture

nigelcunningham commented

Hi.

Apologies for the breakage. I'll work on reverting the changes while still applying the XSS fix this afternoon.

Regards,

Nij

nigelcunningham’s picture

nigelcunningham commented
Status: Needs work » Needs review