Problem/Motivation
It is pretty common to want to use a token for a URL when editing text. For instance, you might want something like:
<a href="[my:token:here]">link text here</a>
However, if you try to do this in a body field that is using CKEditor, with a text format that uses the "Limit allowed HTML tags and correct faulty HTML" filter, if you enter a token like that in the field, and then later edit the content that contains that field and either look at the HTML source or save the content, the token is corrupted. This seems to be independent of which CKEditor buttons you have configured, so it isn't a problem (apparently) with a particular button plugin.
Additionally, some (but not all) other attributes in HTML get corrupted in the same way, if your text format allows these attributes. Some examples that were tested:
| Tag | Attribute | Corrupted? |
|---|---|---|
| p | class | Corrupted |
| img | src | Corrupted |
| img | alt | Not corrupted |
| a | href | Corrupted |
Tokens in the text that are outside of HTML attributes do not get corrupted.
Steps to reproduce:
a) In a content item with a field that has a text format that is configured to use CKEditor for editing, and which contains the "Limit allowed HTML tags and correct faulty HTML" filter, and allows the A tag, type some link text in the editor.
b) Highlight to select the link text.
c) Click the Link button (chains) in the editor toolbar, and enter [my:token:here] as the URL in the popup.
d) Click Save in the popup. Verify that the HTML source looks like
<a href="[my:token:here]">link text here</a>
e) Save the content item you are editing.
f) Test -- the link works fine (assuming you are running a token replace so it gets replaced by the right URL).
g) Edit the content item again.
h) When you get back to the editor, look at the HTML source. Instead of seeing what was there before, you will see something like this:
<a href="en:here]">link text here</a>
So that's the bug: if you re-edit some HTML text using CKEditor and the "Limit allowed HTML tags and correct faulty HTML" filter, and there is an A tag with a token in the URL (or tokens in various other attributes, but not all attributes), CKEditor truncates and mangles the token, leading to data loss. According to Priority Levels of Issues, this means it is a Critical bug (or at least Major?) because it leads to data loss.
Note: We are specifically seeing this in the proposed Help Topics module (see related issue #2943974: Work-around for route tokens in Help text format getting truncated after editing a help topic).
Proposed resolution
Fix Drupal so that CKEditor doesn't mangle tokens in URLs in A tags.
The problem was traced down to a bug in \Drupal\Component\Utility\Xss::attributes(). If you pass in an attribute string like href="[something:something:config_basic]" to this function, you get out something that looks like href="config_basic]".
Remaining tasks
Fix the bug in Xss::attributes().
User interface changes
CKEditor will not mangle HTML containing tokens for URLs in A tags, or other HTML tag attributes.
API changes
None.
Data model changes
None.