Contrib.social

Stop escaping CDATA elements in Html::serialize()

Open on Drupal.org →
Created on 20 February 2024, about 1 year ago
Updated 22 February 2024, about 1 year ago

Problem/Motivation

Since 🐛 Upgrade filter system to HTML5 Fixed Drupal now inputs and outputs HTML5 correctly in the \Drupal\Component\Utility\Html class.

However, Html::serialize() still contains the following code to escape script and style tags with CDATA:

      foreach ($body_node->getElementsByTagName('script') as $node) {
        static::escapeCdataElement($node);
      }
      foreach ($body_node->getElementsByTagName('style') as $node) {
        static::escapeCdataElement($node, '/*', '*/');
      }

As per the comment on ::escapeCdataElement():

   * \DOMDocument::loadHTML() in \Drupal\Component\Utility\Html::load() makes
   * CDATA sections from the contents of inline script and style tags. This can
   * cause HTML4 browsers to throw exceptions.

We no longer use DOMDocument in Html::load() and HTML4 browsers are dead, so we should be able to drop this.

Steps to reproduce

Proposed resolution

Remove the code from Html::serialize()
Deprecate Html::escapeCdataElement().

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

📌 Task
Status

Needs work

Version

11.0 🔥

Component
Filter  →

Last updated 5 days ago

No maintainer
Created by

🇬🇧United Kingdom longwave UK

Live updates comments and jobs are added and updated live.
  • Novice

    It would make a good project for someone who is new to the Drupal contribution process. It's preferred over Newbie.

  • Needs change record

    A change record needs to be drafted before an issue is committed. Note: Change records used to be called change notifications.

Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024