Markup is escaped in slots

Created on 2 March 2025, 2 months ago

Problem/Motivation

if you provide markup as variable to a slot to an "included" component the markup is escaped.

{% set content %}
<div>My Markup</div>
{%endset %}

{{ include("my:compnent", {content: content}) }} 

Leads to escaped div markups

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

🇩🇪Germany Christian.wiedemann

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @Christian.wiedemann
  • Merge request !342Fix simple to use markup. → (Open) created by Christian.wiedemann
  • Pipeline finished with Success
    2 months ago
    Total: 528s
    #438061
  • 🇫🇷France pdureau Paris

    I am OK with the MR but I am surprised we let this happens. Maybe it was done in purpose and we forgot, let's be careful and think twcie before merging.

  • 🇩🇪Germany Christian.wiedemann

    Hm I think it is simple a bug. When you use embed or extends it works as expected. Maybe we introduced "include" later and never checked that.

  • 🇫🇷France pdureau Paris

    Ok great

  • 🇫🇷France just_like_good_vibes PARIS

    Hi there, we need more tests to cover that case and the other mentioned.
    let's add tests with the fix and then we can merge :) what do you think?

  • 🇫🇷France just_like_good_vibes PARIS

    Also, i would say "#markup" won't cover all possible html content, but will rather let some tags be accepted and some other not.
    for example, i guess input would be filtered. So why not "#children" if we want any html tag to be accepted?

  • 🇫🇷France pdureau Paris

    So why not "#children" if we want any html tag to be accepted?

    If my understanding is right, #children is an internal render property of the renderer service and we are not expected to use it in our code.

    I will check

  • 🇩🇪Germany Christian.wiedemann

    As I understand we need either #markup => Markup::create($markup) or #children

  • 🇩🇪Germany Christian.wiedemann

    And are there tests for the include function?

  • 🇫🇷France pdureau Paris

    christian,

    What about doing that?

    {% set content %}
    <div>My Markup</div>
    {%endset %}
    
    {{ include("my:component", {
      content: {
        '#markup': content
      }}) }} 
  • 🇩🇪Germany Christian.wiedemann

    Thats wrong. Nobody will understand it:).

  • 🇩🇪Germany Christian.wiedemann

    Why not use #children as 3 lines above.

  • 🇫🇷France just_like_good_vibes PARIS

    i have better.
    we need to introduce a new condition. the string here is injected as an object \Twig\Markup
    and is an instance of \Stringable.
    we should make a new condition in SlotPropType to allow those twig markup to be properly treated as Markup from the render array point of view, while we don't change what we have for the other \Stringable objects.
    i will also add a a test for that.
    let me push something

  • 🇫🇷France pdureau Paris

    Thats wrong. Nobody will understand it:).

    You are talking about presenter templates, right? Nobody understand them already :) and they will disappear soon hopefully. that's why we are extra careful and future-proofing in SDC templates, but we care less in presenter templates.

  • Merge request !345Resolve #3510560 "Twig markup aware" → (Merged) created by just_like_good_vibes
  • 🇫🇷France pdureau Paris

    Why not use #children as 3 lines above.

    I still believe #children is an internal property of the render API and we are not supposed to use it.

    Except 3 messy snippets, it is used by Drupal Core only in the Render API internals:

    • web/core/modules/views_ui/src/ViewEditForm.php
    • web/core/modules/layout_builder/src/Controller/ChooseSectionController.php
    • web/core/modules/system/src/Controller/DbUpdateController.php
    • web/core/lib/Drupal/Core/Render/Renderer.php (many times!)
    • web/core/includes/form.inc (many times!)
    • web/core/includes/theme.inc (a few times)
  • Pipeline finished with Failed
    2 months ago
    Total: 606s
    #440551
  • 🇩🇪Germany Christian.wiedemann

    than #markup = Markup::create() instead of #children?

  • Pipeline finished with Failed
    2 months ago
    Total: 283s
    #440571
  • Pipeline finished with Success
    2 months ago
    Total: 648s
    #440575
  • 🇫🇷France just_like_good_vibes PARIS

    Christian,
    would you review my new MR please :)
    MR !345 (mergeable)

  • miiimooo Europe

    @christian.wiedemann thanks so much for this patch. We use this pattern all over the place, and it breaks when I install ui_patterns.

    This is a similar pattern which was also broken by ui_patterns and is fixed by this patch:

    modal.twig

    <div>
      <div class="modal--body>
        {% block modal_body %}{% endblock %}
      </div>
    </div>
    

    mobile_header.twig

            {% set modal_body %}
              {% block modal_languages %}{% endblock %}
            {% endset %}
            {% embed 'my_components:modal' %}
              {% block modal_body %}{{ modal_body }}{% endblock %}
            {% endembed %}
    
  • 🇫🇷France just_like_good_vibes PARIS

    that one is indeed a nice one to have :)
    can't wait for the new 2.0.1 tag

  • 🇨🇦Canada Liam Morland Ontario, CA 🇨🇦

    A similar issue: 🐛 Property values are converted to Markup Active

  • Automatically closed - issue fixed for 2 weeks with no activity.

  • Pipeline finished with Failed
    11 days ago
    Total: 1260s
    #483940
  • Pipeline finished with Skipped
    11 days ago
    #484281
  • Pipeline finished with Skipped
    11 days ago
    #484290
  • Pipeline finished with Success
    3 days ago
    Total: 153s
    #490752
  • Pipeline finished with Success
    3 days ago
    Total: 150s
    #490755
  • Pipeline finished with Success
    2 days ago
    Total: 274s
    #491492
  • Pipeline finished with Success
    2 days ago
    Total: 154s
    #491573
  • Pipeline finished with Success
    2 days ago
    Total: 159s
    #491590
  • Pipeline finished with Success
    2 days ago
    Total: 142s
    #491591
  • Pipeline finished with Success
    2 days ago
    Total: 218s
    #491594
Production build 0.71.5 2024