Contrib.social

Message partials are filtered without text format.

Open on Drupal.org →
Created on 8 July 2025, 2 months ago

Problem/Motivation

All message partials are rendered as "processed text" with text format, here \Drupal\message\Entity\MessageTemplate::getText. The processed text and rendering process already handle removing unallowed tags, attributes, etc. But \Drupal\message\MessageViewBuilder::view wraps partials as plain string markup. Because of that, partials go through another XSS filter, which ignores the configured text format, since it doesn't know about it, potentially removing allowed tags/attributes.

Steps to reproduce

  1. Create text format that allows tag/attribute (e.x. style attribute) that normally is removed by \Drupal\Core\Render\Renderer::ensureMarkupIsSafe
  2. Configure message template with that text format
  3. Tags/Attributes are removed even though they are allowed by text format

Proposed resolution

Wrap the partials in ViewBuilder in the \Drupal\filter\Render\FilteredMarkup class.
The processed text element does the same, so we can consider that the template is safe. Reference: \Drupal\filter\Element\ProcessedText::preRenderText

Remaining tasks

-

User interface changes

-

API changes

-

Data model changes

-

🐛 Bug report
Status

Active

Version

1.0

Component

Code

Created by

reinfate

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024