Contrib.social

Collapse text filter runs text through #markup, which can remove tags like SVG, breaking things

Open on Drupal.org →
Created on 6 March 2023, over 1 year ago
Updated 13 February 2024, 9 months ago

Problem/Motivation

The Collapse Text text filter processes all the text it receives and breaks it up into a render array, where the collapsed text stuff is rendered using the appropriate method, and everything surrounding the collapsed stuff is rendered using a #markup render element:

      return [
        '#type'   => 'markup',
        '#markup' => Markup::create($item),
        '#prefix' => '<div class="collapse-text-text">',
        '#suffix' => '</div>',
      ];

Drupal's render system, when encountering a markup element, will run the output thru this:


  protected function ensureMarkupIsSafe(array $elements) {
    if (isset($elements['#plain_text'])) {
      $elements['#markup'] = Markup::create(Html::escape($elements['#plain_text']));
    }
    elseif (!($elements['#markup'] instanceof MarkupInterface)) {
      // The default behavior is to XSS filter using the admin tag list.
      $tags = $elements['#allowed_tags'] ?? Xss::getAdminTagList();
      $elements['#markup'] = Markup::create(Xss::filter($elements['#markup'], $tags));
    }

    return $elements;
  }

HTML tags that are not in the Xss::getAdminTagList() are being stripped. This shouldn't be happening - the collapse text filter should leave the other text alone as much as it can. This is problematic for inline SVGs that may be in the text, like from a rendered media entity. You might think the solution is to have the rendered media entity text filter run AFTER collapse text, but that won't work either, because the custom media embed HTML tag will be stripped for the same reason that SVG is stripped.

Steps to reproduce

Proposed resolution

The render system won't actually run the text thru an XSS filter the text is already encapsulated in a Markup object, so the fix is quite simple.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Fixed

Version

2.0

Component

Code

Created by

🇺🇸United States bkosborne New Jersey, USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024