Text trimmed by "Trimmed" or "Summary or trimmed" field formatters will get run through Xss::filter() potentially changing their content

I've extended the patch ( interdiff_9_19 → ) by a safety check to ensure only markup, that is already passed as filtered, is back-casted from string. I'm not sure if the taken approach is sufficient.

As the ensureMarkupIsSafe renderer method the treats MarkupInterface as safe and TextTrimmedFormatter::preRenderSummary is a public static method and therefore may be called within a different context by contrib/custom modules (e.g. a render element that doesn't preserve the #pre_render callback preRenderText) iv'e tried to find a more generic implementation but as MarkupInterface doesn't dictate the `::create` method i couldn't find a practical approach.

As test coverage is needed anyway i hope to have some time in the next days and extend an existing ones or add a new one if necessary.

Minor remarks, looking good :)

As the implemented solution has been approved during review, i belief the proposed solution and remaining task can be updated in the issue summary. Back to review.

Going to find out if this falls under BC policy as this could change the display on existing sites which might not be desired.

smustgrave → credited catch → .

Brought this up in slack #needs-review-queue-initative https://drupal.slack.com/archives/C04CHUX484T/p1708719216555289

I asked if this would be a D11 fix only because of the backwards compatibility impact and @catch replied "It wouldn't make it 11.x only but we might have to put it behind a settings.php switch or feature flag"

So maybe a field formatter setting could cover it? Know smart trim has something like that.

Thanks for taking care of BC.

I think the required change depends on issue classification.
In my eyes this is a bug fix, not a feature request, because as a user (i.e. site builder) i don't expect that my hard-coded markup is filtered out when summarized.

Since the activity (and probably demand) for a fix seems not very high why not make it 11.x only?

Here's a version of the latest patch for Drupal 10.3 without the tests, for folks who want to include this in their composer.json.