Bring SafeMarkup::format()/t() docs up to date with the final state of the sanitization API

Created on 29 September 2015, over 9 years ago
Updated 17 February 2025, about 2 months ago

Problem/Motivation

#2570431: Document that certain (non-"href") attribute values in t() and SafeMarkup::format() are not supported and may be insecure was just committed after multiple rounds of iteration.

There is still some work to do though.

YesCT and pwolanin worked on a further improvement to the documentation posted at https://www.drupal.org/node/2570431#comment-10385927

Also #2576533: Rename SafeStringInterface to MarkupInterface and move related classes may rename SafeStringInterface/SafeString to 'Markup' et al. If we do that, then conceptually it will be easier to explain what the various inputs and outputs are.

Postponing not on #2576533: Rename SafeStringInterface to MarkupInterface and move related classes since that issue isn't critical yet, but just for 24-48 hours to let things settle a bit, possibly including that issue getting committed.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

📌 Task
Status

Closed: outdated

Version

11.0 🔥

Component

base system

Created by

🇬🇧United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024