Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 300745

HTML entities in Tour tip labels get double-escaped

$
0
0

Problem/Motivation

If a Tour tip label includes HTML tags or characters that will be converted to HTML entities by Html::escape() (e.g. ' to &#039;), those will appear double-escaped in the resulting Tour tip. For example, the label "What''s New with text in <strong>bold</strong>" would get output as this:

What&#039;s New with text in &lt;strong&gt;bold&lt;/strong&gt;

Screenshot showing double-escaped text

Steps to reproduce

1. Create a Tour with a tip with a label with text that will be escaped by Html::escape(). This YAML would work ( tour.tour_.test-admin.yml, attached):

langcode: en
status: true
dependencies:
  module:
    - system
id: test-admin
label: 'Admin page'
module: system
routes:
  -
    route_name: system.admin
tips:
  test-admin-main:
    id: test-admin-main
    plugin: text
    label: 'What''s New with text in <strong>bold</strong>'
    weight: 1
    attributes:
      class: no-nub
    body: 'This is the admin page of the Drupal site.'

2. Start Tour.
3. See tip with double-escaped text.

Proposed resolution

This is a caused by code in core/modules/tour/src/TourViewBuilder.php that calls Html::escape():

$output = [
  'body' => $body,
  'title' => Html::escape($tip->getLabel()),
];

This text does not need to be escaped here because it's already being done somewhere else. If we remove the call to Html::escape(), the resulting label will have the text properly escaped (once):

What's New with text in <strong>bold</strong>

screenshot showing correct text

Remaining tasks

1. Patch code to remove call to Html::escape().
2. Write test (is that needed?).
3. Commit change.


Viewing all articles
Browse latest Browse all 300745

Trending Articles