- Issue created by @codebymikey
- Merge request !9Issue #3348521: Summaries should not be decoded with Html::decodeEntities → (Open) created by codebymikey
- Status changed to Needs review
over 1 year ago 3:52pm 16 March 2023 Added issue fork, the current approach also allows it to work if the third party module happens to return a simple string rather than markup.
- First commit to issue fork.
- 🇩🇪Germany Anybody Porta Westfalica
The module's implementation changed in the meantime:
$data['conditions'][$condition_id] = is_string($summary) ? Html::decodeEntities($summary) : Html::decodeEntities($summary->render());Could the maintainer eventually explain why
Html::decodeEntities()is used here at all?I also can't really see a benefit, theoretically it's even more a risk:
https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Component%21Utility%21Html.php/function/Html%3A%3AdecodeEntities/8.9.x So I think it should be removed for good reasons, if it's not needed.Be careful when using this function, as it will revert previous sanitization efforts (<script> will become
).