Issue #3534154 by fjgarlin: Allow html rendering of trusted projects in markdown files

api.install

@@ -148,5 +148,23 @@ function api_update_10001() {
   foreach ($fields as $field_name => $field) {
     $update_manager->installFieldStorageDefinition($field_name, 'project', 'project', $field);
   }
+}
+
+function api_update_10002() {
+  $fields['trusted'] = BaseFieldDefinition::create('boolean')
+    ->setLabel(t('Trusted'))
+    ->setDescription(t('The code in this project is trusted and can be rendered safely as-is. <b>Do not use with projects you do not trust!</b>'))
+    ->setDefaultValue(FALSE)
+    ->setDisplayOptions('form', [
+      'type' => 'boolean_checkbox',
+      'settings' => [
+        'display_label' => TRUE,
+      ],
+    ])
+    ->setDisplayConfigurable('form', TRUE);
 
+  $update_manager = \Drupal::entityDefinitionUpdateManager();
+  foreach ($fields as $field_name => $field) {
+    $update_manager->installFieldStorageDefinition($field_name, 'project', 'project', $field);
+  }
 }

src/Entity/Project.php

@@ -133,6 +133,18 @@ class Project extends ContentEntityBase implements ProjectInterface {
       ])
       ->setDisplayConfigurable('view', TRUE);
 
+    $fields['trusted'] = BaseFieldDefinition::create('boolean')
+      ->setLabel(t('Trusted'))
+      ->setDescription(t('The code in this project is trusted and can be rendered safely as-is. <b>Do not use with projects you do not trust!</b>'))
+      ->setDefaultValue(FALSE)
+      ->setDisplayOptions('form', [
+        'type' => 'boolean_checkbox',
+        'settings' => [
+          'display_label' => TRUE,
+        ],
+      ])
+      ->setDisplayConfigurable('form', TRUE);
+
     $fields['created'] = BaseFieldDefinition::create('created')
       ->setLabel(t('Created'))
       ->setDescription(t('The time that the project was created.'));
@@ -159,6 +171,28 @@ class Project extends ContentEntityBase implements ProjectInterface {
     return $this;
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public function getTrusted() {
+    return $this->get('trusted')->value;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function isTrusted() {
+    return (bool) $this->getTrusted();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setTrusted($trusted) {
+    $this->set('trusted', $trusted);
+    return $this;
+  }
+
   /**
    * {@inheritdoc}
    */

src/Interfaces/ProjectInterface.php

@@ -29,6 +29,33 @@ interface ProjectInterface extends ContentEntityInterface, EntityChangedInterfac
    */
   public function setTitle($title);
 
+  /**
+   * Gets the project trusted value.
+   *
+   * @return bool
+   *   Project trusted value.
+   */
+  public function getTrusted();
+
+  /**
+   * Checks if the project is trusted.
+   *
+   * @return bool
+   *   Whether the project is trusted or not.
+   */
+  public function isTrusted();
+
+  /**
+   * Sets the project trusted value.
+   *
+   * @param bool $trusted
+   *   Project trusted value.
+   *
+   * @return \Drupal\api\Interfaces\ProjectInterface
+   *   The called project entity.
+   */
+  public function setTrusted($trusted);
+
   /**
    * Gets the project creation timestamp.
    *

src/Parser.php

@@ -303,7 +303,7 @@ class Parser {
             $parseFunction = $parse_functions[$extension];
             $baseFileDocblock = $this->parseFile($file);
             if (!empty($baseFileDocblock)) {
-              return DocBlock::createOrUpdate($this->$parseFunction($baseFileDocblock) ?? [], $branch);
+              return DocBlock::createOrUpdate($this->$parseFunction($baseFileDocblock, $branch) ?? [], $branch);
             }
           }
         }
@@ -352,7 +352,7 @@ class Parser {
                   'branch_id' => $branch->id(),
                   'branch_type' => $branch->getEntityTypeId(),
                   'action' => 'parse',
-                  'data' => $this->$parseFunction($baseFileDocblock) ?? [],
+                  'data' => $this->$parseFunction($baseFileDocblock, $branch) ?? [],
                 ];
                 $docblock_counter++;
                 $this->parseQueue->createItem($docblock_info);
@@ -693,11 +693,13 @@ class Parser {
    *
    * @param array $docblock
    *   Information about the file to parse.
+   * @param \Drupal\api\Interfaces\BranchInterface
+   *   (Optional) Branch where this docblock is.
    *
    * @return array
    *   Docblock array containing the different elements within the file.
    */
-  public function parsePhp(array $docblock) {
+  public function parsePhp(array $docblock, ?BranchInterface $branch = NULL) {
     $error_logged = FALSE;
     $statements = FALSE;
     try {
@@ -800,11 +802,13 @@ class Parser {
    *
    * @param array $docblock
    *   Information about the file to parse.
+   * @param \Drupal\api\Interfaces\BranchInterface
+   *   (Optional) Branch where this docblock is.
    *
    * @return array
    *   Docblock array containing the different elements within the file.
    */
-  public function parseYaml(array $docblock) {
+  public function parseYaml(array $docblock, ?BranchInterface $branch = NULL) {
     // Just use the file name as the documentation, since the file contents
     // are not good documentation.
     $bare_docblock = $docblock;
@@ -980,13 +984,15 @@ class Parser {
    *
    * @param array $docblock
    *   Information about the file to parse.
+   * @param \Drupal\api\Interfaces\BranchInterface
+   *   (Optional) Branch where this docblock is.
    * @param bool $escape_html
    *   If TRUE, escpae HTML characters in the source code listing.
    *
    * @return array
    *   Docblock array containing the different elements within the file.
    */
-  public function parseText(array $docblock, $escape_html = FALSE) {
+  public function parseText(array $docblock, ?BranchInterface $branch = NULL, $escape_html = FALSE) {
     // See if the file contains an @file block, and use that for the
     // documentation if so; otherwise, just use the file as a whole. This is
     // probably only present for Twig files.
@@ -1019,13 +1025,15 @@ class Parser {
    *
    * @param array $docblock
    *   Information about the file to parse.
+   * @param \Drupal\api\Interfaces\BranchInterface
+   *  (Optional) Branch where this docblock is.
    *
    * @return array
    *   Docblock array containing the different elements within the file.
    */
-  public function parseTwig(array $docblock) {
+  public function parseTwig(array $docblock, ?BranchInterface $branch = NULL) {
     // Use the text file function, but escape HTML characters.
-    return $this->parseText($docblock, TRUE);
+    return $this->parseText($docblock, $branch, TRUE);
   }
 
   /**
@@ -1033,16 +1041,22 @@ class Parser {
    *
    * @param array $docblock
    *   Information about the file to parse.
+   * @param \Drupal\api\Interfaces\BranchInterface
+   *   (Optional) Branch where this docblock is.
    *
    * @return array
    *   Docblock array containing the different elements within the file.
    */
-  public function parseMarkdown(array $docblock) {
+  public function parseMarkdown(array $docblock, ?BranchInterface $branch = NULL) {
+    $html_input = 'strip';
+    if ($branch instanceof BranchInterface) {
+      $html_input = $branch->getProject()->isTrusted() ? 'allow' : 'strip';
+    }
     $code = $docblock['source'];
     $code = Formatter::validateEncoding($code);
     $docblock['code'] = '<pre>' . htmlspecialchars($code, ENT_NOQUOTES, 'UTF-8') . '</pre>';
     $markdown_parser = new CommonMarkConverter([
-      'html_input' => 'escape',
+      'html_input' => $html_input,
       'allow_unsafe_links' => FALSE,
     ]);
     $docblock['documentation'] = $markdown_parser->convert($code);
@@ -1063,11 +1077,13 @@ class Parser {
    *
    * @param array $docblock
    *   Information about the file to parse.
+   * @param \Drupal\api\Interfaces\BranchInterface
+   *   (Optional) Branch where this docblock is.
    *
    * @return array
    *   Docblock array containing the different elements within the file.
    */
-  public function parseHtml(array $docblock) {
+  public function parseHtml(array $docblock, ?BranchInterface $branch = NULL) {
     $code = $docblock['source'];
     $code = Formatter::validateEncoding($code);
     $docblock['code'] = '<pre>' . htmlspecialchars($code, ENT_NOQUOTES, 'UTF-8') . '</pre>';