Issue #2501481 by Cottser, davidhernandez, kfriend, alimac, YesCT, lauriii,...

Issue #2501481 by Cottser, davidhernandez, kfriend, alimac, YesCT, lauriii, tim.plunkett, cilefen, lbainbridge, porchlight: form_select_options() is a theme function in disguise and should not use SafeMarkup::set

core/includes/form.inc

@@ -43,7 +43,7 @@ function template_preprocess_select(&$variables) {
 }
 
 /**
- * Converts an array of options into HTML, for use in select list form elements.
+ * Converts an options form element into a structured array for output.
  *
  * This function calls itself recursively to obtain the values for each optgroup
  * within the list of options and when the function encounters an object with
@@ -78,13 +78,22 @@ function template_preprocess_select(&$variables) {
  *   $element['#options'] above, or NULL. This parameter is only used internally
  *   and is not intended to be passed in to the initial function call.
  *
- * @return string
- *   An HTML string of options and optgroups for use in a select form element.
+ * @return mixed[]
+ *   A structured, possibly nested, array of options and optgroups for use in a
+ *   select form element.
+ *   - label: A translated string whose value is the text of a single HTML
+ *     option element, or the label attribute for an optgroup.
+ *   - options: Optional, array of options for an optgroup.
+ *   - selected: A boolean that indicates whether the option is selected when
+ *     rendered.
+ *   - type: A string that defines the element type. The value can be 'option'
+ *     or 'optgroup'.
+ *   - value: A string that contains the value attribute for the option.
  */
 function form_select_options($element, $choices = NULL) {
   if (!isset($choices)) {
     if (empty($element['#options'])) {
-      return '';
+      return [];
     }
     $choices = $element['#options'];
   }
@@ -94,29 +103,35 @@ function form_select_options($element, $choices = NULL) {
   $value_is_array = $value_valid && is_array($element['#value']);
   // Check if the element is multiple select and no value has been selected.
   $empty_value = (empty($element['#value']) && !empty($element['#multiple']));
-  $options = '';
+  $options = [];
   foreach ($choices as $key => $choice) {
     if (is_array($choice)) {
-      $options .= '<optgroup label="' . SafeMarkup::checkPlain($key) . '">';
-      $options .= form_select_options($element, $choice);
-      $options .= '</optgroup>';
+      $options[] = [
+        'type' => 'optgroup',
+        'label' => $key,
+        'options' => form_select_options($element, $choice),
+      ];
     }
     elseif (is_object($choice) && isset($choice->option)) {
-      $options .= form_select_options($element, $choice->option);
+      $options = array_merge($options, form_select_options($element, $choice->option));
     }
     else {
+      $option = [];
       $key = (string) $key;
       $empty_choice = $empty_value && $key == '_none';
       if ($value_valid && ((!$value_is_array && (string) $element['#value'] === $key || ($value_is_array && in_array($key, $element['#value']))) || $empty_choice)) {
-        $selected = ' selected="selected"';
+        $option['selected'] = TRUE;
       }
       else {
-        $selected = '';
+        $option['selected'] = FALSE;
       }
-      $options .= '<option value="' . SafeMarkup::checkPlain($key) . '"' . $selected . '>' . SafeMarkup::checkPlain($choice) . '</option>';
+      $option['type'] = 'option';
+      $option['value'] = $key;
+      $option['label'] = $choice;
+      $options[] = $option;
     }
   }
-  return SafeMarkup::set($options);
+  return $options;
 }
 
 /**

core/modules/system/templates/select.html.twig

@@ -12,4 +12,18 @@
  * @ingroup themeable
  */
 #}
-<select{{ attributes }}>{{ options }}</select>
+{% spaceless %}
+  <select{{ attributes }}>
+    {% for option in options %}
+      {% if option.type == 'optgroup' %}
+        <optgroup label="{{ option.label }}">
+          {% for sub_option in option.options %}
+            <option value="{{ sub_option.value }}"{{ sub_option.selected ? ' selected="selected"' }}>{{ sub_option.label }}</option>
+          {% endfor %}
+        </optgroup>
+      {% elseif option.type == 'option' %}
+        <option value="{{ option.value }}"{{ option.selected ? ' selected="selected"' }}>{{ option.label }}</option>
+      {% endif %}
+    {% endfor %}
+  </select>
+{% endspaceless %}

core/themes/classy/templates/form/select.html.twig

@@ -10,4 +10,18 @@
  * @see template_preprocess_select()
  */
 #}
-<select{{ attributes }}>{{ options }}</select>
+{% spaceless %}
+  <select{{ attributes }}>
+    {% for option in options %}
+      {% if option.type == 'optgroup' %}
+        <optgroup label="{{ option.label }}">
+          {% for sub_option in option.options %}
+            <option value="{{ sub_option.value }}"{{ sub_option.selected ? ' selected="selected"' }}>{{ sub_option.label }}</option>
+          {% endfor %}
+        </optgroup>
+      {% elseif option.type == 'option' %}
+        <option value="{{ option.value }}"{{ option.selected ? ' selected="selected"' }}>{{ option.label }}</option>
+      {% endif %}
+    {% endfor %}
+  </select>
+{% endspaceless %}