The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Currently, all arguments and the "tag.source" property bypass all filtering. This is a severe (and for most use cases disproportionate) intervention in the filtering system.
It also means there is no way to use tag.source to ignore contained BBCode tags (the role of a [nocode] tag, so to speak) without simultaneously turning off the remaining filters (which you only want if the content is so alien from HTML that its raw form is required for rendering - eg. to apply syntax-highlighting to source-code).
This could be solved by reverting tag.option and tag.attribute.* and tag.source and tag.outerSource to the old behavior, while adding a special tag.raw.* version for each of these that uses the new behavior.
The documentation would then be updated appropriately, with a warning that tag.raw placeholders should never be used together with the |raw filter for security reasons.
Comments
Comment #2
cburschkaThe latest parser rewrite has removed implicit tag.source armoring - tag plugins now need to do this themselves by overriding TagPlugin::prepare().
However, the entire tag argument string is still armored. This is currently required to ensure the string is parsed correctly, as prior filters may break it by escaping quote characters.
However, this could also be fixed by normalizing the argument string with alternative delimiters that are not subject to HTML filtering.
Comment #3
cburschkaFixed by rewriting the regular expressions to accept HTML entities as quote delimiters.
None of the input is armored by default now. Tag plugins *may* implement ::prepare() to armor their source code, and the [code] tag is now provided by a plugin that does this.