core/lib/Drupal/Component/Utility/DiffArray.php

@@ -21,8 +21,8 @@ class DiffArray {
    *   The array to compare to.
    *
    * @return array
-   *   Returns an array containing all the values from array1 that are not present
-   *   in array2.
+   *   Returns an array containing all the values from array1 that are not
+   *   present in array2.
    */
   public static function diffAssocRecursive(array $array1, array $array2) {
     $difference = [];

core/lib/Drupal/Component/Utility/Environment.php

@@ -11,9 +11,9 @@ class Environment {
    * Compares the memory required for an operation to the available memory.
    *
    * @param string $required
-   *   The memory required for the operation, expressed as a number of bytes with
-   *   optional SI or IEC binary unit prefix (e.g. 2, 3K, 5MB, 10G, 6GiB, 8bytes,
-   *   9mbytes).
+   *   The memory required for the operation, expressed as a number of bytes
+   *   with optional SI or IEC binary unit prefix (e.g. 2, 3K, 5MB, 10G, 6GiB,
+   *   8bytes, 9mbytes).
    * @param string|null $memory_limit
    *   (optional) The memory limit for the operation, expressed as a number of
    *   bytes with optional SI or IEC binary unit prefix (e.g. 2, 3K, 5MB, 10G,

core/lib/Drupal/Component/Utility/Html.php

@@ -86,8 +86,6 @@ public static function getClass($class) {
    * Link below shows the syntax for valid CSS identifiers (including element
    * names, classes, and IDs in selectors).
    *
-   * @see https://www.w3.org/TR/CSS21/syndata.html#characters
-   *
    * @param string $identifier
    *   The identifier to clean.
    * @param array $filter
@@ -95,6 +93,8 @@ public static function getClass($class) {
    *
    * @return string
    *   The cleaned identifier.
+   *
+   * @see https://www.w3.org/TR/CSS21/syndata.html#characters
    */
   public static function cleanCssIdentifier(
     $identifier,
@@ -129,7 +129,8 @@ public static function cleanCssIdentifier(
     // - ISO 10646 characters U+00A1 and higher
     // We strip out any character not in the above list.
     $identifier = preg_replace('/[^\x{002D}\x{0030}-\x{0039}\x{0041}-\x{005A}\x{005F}\x{0061}-\x{007A}\x{00A1}-\x{FFFF}]/u', '', $identifier);
-    // Identifiers cannot start with a digit, two hyphens, or a hyphen followed by a digit.
+    // Identifiers cannot start with a digit, two hyphens, or a hyphen followed
+    // by a digit.
     $identifier = preg_replace([
       '/^[0-9]/',
       '/^(-[0-9])|^(--)/',
@@ -225,12 +226,12 @@ public static function getUniqueId($id) {
   public static function getId($id) {
     $id = str_replace([' ', '_', '[', ']'], ['-', '-', '-', ''], mb_strtolower($id));
 
-    // As defined in https://www.w3.org/TR/html4/types.html#type-name, HTML IDs can
-    // only contain letters, digits ([0-9]), hyphens ("-"), underscores ("_"),
-    // colons (":"), and periods ("."). We strip out any character not in that
-    // list. Note that the CSS spec doesn't allow colons or periods in identifiers
-    // (https://www.w3.org/TR/CSS21/syndata.html#characters), so we strip those two
-    // characters as well.
+    // As defined in https://www.w3.org/TR/html4/types.html#type-name, HTML IDs
+    // can only contain letters, digits ([0-9]), hyphens ("-"), underscores
+    // ("_"), colons (":"), and periods ("."). We strip out any character not in
+    // that list. Note that the CSS spec doesn't allow colons or periods in
+    // identifiers (https://www.w3.org/TR/CSS21/syndata.html#characters), so we
+    // strip those two characters as well.
     $id = preg_replace('/[^A-Za-z0-9\-_]/', '', $id);
 
     // Removing multiple consecutive hyphens.
@@ -414,9 +415,9 @@ public static function decodeEntities(string $text): string {
    * Html::decodeEntities() will convert all HTML entities to UTF-8 bytes,
    * including "&eacute;" and "&lt;" to "é" and "<".
    *
-   * When constructing @link theme_render render arrays @endlink passing the output of Html::escape() to
-   * '#markup' is not recommended. Use the '#plain_text' key instead and the
-   * renderer will autoescape the text.
+   * When constructing @link theme_render render arrays @endlink passing the
+   * output of Html::escape() to '#markup' is not recommended. Use the
+   * '#plain_text' key instead and the renderer will autoescape the text.
    *
    * @param string $text
    *   The input text.
@@ -440,11 +441,11 @@ public static function escape(string $text): string {
    * change other relative URLs because they would result in different absolute
    * URLs depending on the current path. For example: when the same content
    * containing such a relative URL (for example 'image.png'), is served from
-   * its canonical URL (for example 'http://example.com/some-article') or from
-   * a listing or feed (for example 'http://example.com/all-articles') their
+   * its canonical URL (for example 'https://example.com/some-article') or from
+   * a listing or feed (for example 'https://example.com/all-articles') their
    * "current path" differs, resulting in different absolute URLs:
-   * 'http://example.com/some-article/image.png' versus
-   * 'http://example.com/all-articles/image.png'. Only one can be correct.
+   * 'https://example.com/some-article/image.png' versus
+   * 'https://example.com/all-articles/image.png'. Only one can be correct.
    * Therefore relative URLs that are not root-relative cannot be safely
    * transformed and should generally be avoided.
    *

core/lib/Drupal/Component/Utility/NestedArray.php

@@ -3,7 +3,7 @@
 namespace Drupal\Component\Utility;
 
 /**
- * Provides helpers to perform operations on nested arrays and array keys of variable depth.
+ * Provides methods for working with nested arrays of variable depth.
  *
  * @ingroup utility
  */
@@ -147,8 +147,8 @@ public static function &getValue(array &$array, array $parents, &$key_exists = N
   public static function setValue(array &$array, array $parents, $value, $force = FALSE) {
     $ref = &$array;
     foreach ($parents as $parent) {
-      // PHP auto-creates container arrays and NULL entries without error if $ref
-      // is NULL, but throws an error if $ref is set, but not an array.
+      // PHP auto-creates container arrays and NULL entries without error if
+      // $ref is NULL, but throws an error if $ref is set, but not an array.
       if (isset($ref) && !is_array($ref)) {
         if (!$force) {
           throw new \LogicException('Cannot create key "' . $parent . '" on non-array value.');

core/lib/Drupal/Component/Utility/Number.php

@@ -48,8 +48,8 @@ public static function validStep($value, $step, $offset = 0.0) {
 
     // $remainder is a double precision floating point number. Remainders that
     // can't be represented with single precision floats are acceptable. The
-    // fractional part of a float has 24 bits. That means remainders smaller than
-    // $step * 2^-24 are acceptable.
+    // fractional part of a float has 24 bits. That means remainders smaller
+    // than $step * 2^-24 are acceptable.
     $computed_acceptable_error = (double) ($step / pow(2.0, 24));
 
     return $computed_acceptable_error >= $remainder || $remainder >= ($step - $computed_acceptable_error);
@@ -87,15 +87,29 @@ public static function intToAlphadecimal($i = 0) {
    * Decodes a sorting code back to an integer.
    *
    * @param string $string
-   *   The alpha decimal value to convert
+   *   The alpha decimal value to convert.
    *
    * @return int
    *   The integer value.
    *
+   * @throws \InvalidArgumentException
+   *   If $string contains invalid characters, throw an exception.
+   *
    * @see \Drupal\Component\Utility\Number::intToAlphadecimal
    */
   public static function alphadecimalToInt($string = '00') {
-    return (int) base_convert(substr($string, 1), 36, 10);
+    // For backwards compatibility, we must accept NULL
+    // and the empty string, returning 0,
+    // like (int) base_convert(substr($string, 1), 36, 10) always did.
+    if ('' === $string || NULL === $string) {
+      @trigger_error('Passing NULL or an empty string to ' . __METHOD__ . '() is deprecated in drupal:11.2.0 and will be removed in drupal:12.0.0. See https://www.drupal.org/node/3494472', E_USER_DEPRECATED);
+      return 0;
+    }
+    $alpha_decimal_substring = substr($string, 1);
+    if (!ctype_alnum($alpha_decimal_substring)) {
+      throw new \InvalidArgumentException("Invalid characters passed for attempted conversion: $string");
+    }
+    return (int) base_convert($alpha_decimal_substring, 36, 10);
   }
 
 }

core/lib/Drupal/Component/Utility/SortArray.php

@@ -55,8 +55,8 @@ public static function sortByWeightProperty($a, $b) {
    * Callback for uasort().
    *
    * @param array $a
-   *   First item for comparison. The compared items should be associative arrays
-   *   that optionally include a 'title' key.
+   *   First item for comparison. The compared items should be associative
+   *   arrays that optionally include a 'title' key.
    * @param array $b
    *   Second item for comparison.
    *
@@ -73,8 +73,8 @@ public static function sortByTitleElement($a, $b) {
    * Callback for uasort().
    *
    * @param array $a
-   *   First item for comparison. The compared items should be associative arrays
-   *   that optionally include a '#title' key.
+   *   First item for comparison. The compared items should be associative
+   *   arrays that optionally include a '#title' key.
    * @param array $b
    *   Second item for comparison.
    *

core/lib/Drupal/Component/Utility/Unicode.php

@@ -12,17 +12,18 @@ class Unicode {
   /**
    * Matches Unicode characters that are word boundaries.
    *
-   * Characters with the following General_category (gc) property values are used
-   * as word boundaries. While this does not fully conform to the Word Boundaries
-   * algorithm described in http://unicode.org/reports/tr29, as PCRE does not
-   * contain the Word_Break property table, this simpler algorithm has to do.
+   * Characters with the following General_category (gc) property values are
+   * used as word boundaries. While this does not fully conform to the Word
+   * Boundaries algorithm described in http://unicode.org/reports/tr29, as PCRE
+   * does not contain the Word_Break property table, this simpler algorithm has
+   * to do.
    * - Cc, Cf, Cn, Co, Cs: Other.
    * - Pc, Pd, Pe, Pf, Pi, Po, Ps: Punctuation.
    * - Sc, Sk, Sm, So: Symbols.
    * - Zl, Zp, Zs: Separators.
    *
-   * Non-boundary characters include the following General_category (gc) property
-   * values:
+   * Non-boundary characters include the following General_category (gc)
+   * property values:
    * - Ll, Lm, Lo, Lt, Lu: Letters.
    * - Mc, Me, Mn: Combining Marks.
    * - Nd, Nl, No: Numbers.
@@ -190,8 +191,8 @@ public static function convertToUtf8($data, $encoding) {
   /**
    * Truncates a UTF-8-encoded string safely to a number of bytes.
    *
-   * If the end position is in the middle of a UTF-8 sequence, it scans backwards
-   * until the beginning of the byte sequence.
+   * If the end position is in the middle of a UTF-8 sequence, it scans
+   * backwards until the beginning of the byte sequence.
    *
    * Use this function whenever you want to chop off a string at an unsure
    * location. On the other hand, if you're sure that you're splitting on a
@@ -280,24 +281,25 @@ public static function ucwords($text) {
    *   If TRUE, attempt to truncate on a word boundary. Word boundaries are
    *   spaces, punctuation, and Unicode characters used as word boundaries in
    *   non-Latin languages; see Unicode::PREG_CLASS_WORD_BOUNDARY for more
-   *   information. If a word boundary cannot be found that would make the length
-   *   of the returned string fall within length guidelines (see parameters
-   *   $max_length and $min_wordsafe_length), word boundaries are ignored.
+   *   information. If a word boundary cannot be found that would make the
+   *   length of the returned string fall within length guidelines (see
+   *   parameters $max_length and $min_wordsafe_length), word boundaries are
+   *   ignored.
    * @param bool $add_ellipsis
    *   If TRUE, add '...' to the end of the truncated string (defaults to
    *   FALSE). The string length will still fall within $max_length.
    * @param int $min_wordsafe_length
-   *   If $wordsafe is TRUE, the minimum acceptable length for truncation (before
-   *   adding an ellipsis, if $add_ellipsis is TRUE). Has no effect if $wordsafe
-   *   is FALSE. This can be used to prevent having a very short resulting string
-   *   that will not be understandable. For instance, if you are truncating the
-   *   string "See MyVeryLongURLExample.com for more information" to a word-safe
-   *   return length of 20, the only available word boundary within 20 characters
-   *   is after the word "See", which wouldn't leave a very informative string. If
-   *   you had set $min_wordsafe_length to 10, though, the function would realize
-   *   that "See" alone is too short, and would then just truncate ignoring word
-   *   boundaries, giving you "See MyVeryLongURL..." (assuming you had set
-   *   $add_ellipsis to TRUE).
+   *   If $wordsafe is TRUE, the minimum acceptable length for truncation
+   *   (before adding an ellipsis, if $add_ellipsis is TRUE). Has no effect if
+   *   $wordsafe is FALSE. This can be used to prevent having a very short
+   *   resulting string that will not be understandable. For instance, if you
+   *   are truncating the string "See MyVeryLongURLExample.com for more
+   *   information" to a word-safe return length of 20, the only available word
+   *   boundary within 20 characters is after the word "See", which wouldn't
+   *   leave a very informative string. If you had set $min_wordsafe_length to
+   *   10, though, the function would realize that "See" alone is too short, and
+   *   would then just truncate ignoring word boundaries, giving you "See
+   *   MyVeryLongURL..." (assuming you had set $add_ellipsis to TRUE).
    *
    * @return string
    *   The truncated string.
@@ -326,9 +328,9 @@ public static function truncate($string, $max_length, $wordsafe = FALSE, $add_el
 
     if ($wordsafe) {
       $matches = [];
-      // Find the last word boundary, if there is one within $min_wordsafe_length
-      // to $max_length characters. preg_match() is always greedy, so it will
-      // find the longest string possible.
+      // Find the last word boundary, if there is one within
+      // $min_wordsafe_length to $max_length characters. preg_match() is always
+      // greedy, so it will find the longest string possible.
       $found = preg_match('/^(.{' . $min_wordsafe_length . ',' . $max_length . '})[' . Unicode::PREG_CLASS_WORD_BOUNDARY . ']/us', $string, $matches);
       if ($found) {
         $string = $matches[1];
@@ -377,10 +379,10 @@ public static function strcasecmp($str1, $str2) {
    * When text containing an invalid UTF-8 lead byte (0xC0 - 0xFF) is presented
    * as UTF-8 to Internet Explorer 6, the program may misinterpret subsequent
    * bytes. When these subsequent bytes are HTML control characters such as
-   * quotes or angle brackets, parts of the text that were deemed safe by filters
-   * end up in locations that are potentially unsafe; An onerror attribute that
-   * is outside of a tag, and thus deemed safe by a filter, can be interpreted
-   * by the browser as if it were inside the tag.
+   * quotes or angle brackets, parts of the text that were deemed safe by
+   * filters end up in locations that are potentially unsafe; An onerror
+   * attribute that is outside of a tag, and thus deemed safe by a filter, can
+   * be interpreted by the browser as if it were inside the tag.
    *
    * The function does not return FALSE for strings containing character codes
    * above U+10FFFF, even though these are prohibited by RFC 3629.

core/lib/Drupal/Component/Utility/UrlHelper.php

@@ -71,13 +71,13 @@ public static function buildQuery(array $query, $parent = '') {
    * compress a string into a URL-safe query parameter which will be shorter
    * than if it was used directly.
    *
-   * @see \Drupal\Component\Utility\UrlHelper::uncompressQueryParameter()
-   *
    * @param string $data
    *   The data to compress.
    *
    * @return string
    *   The data compressed into a URL-safe string.
+   *
+   * @see \Drupal\Component\Utility\UrlHelper::uncompressQueryParameter()
    */
   public static function compressQueryParameter(string $data): string {
     // Use 'base64url' encoding. Note that the '=' sign is only used for padding
@@ -90,8 +90,6 @@ public static function compressQueryParameter(string $data): string {
   /**
    * Takes a compressed parameter and converts it back to the original.
    *
-   * @see \Drupal\Component\Utility\UrlHelper::compressQueryParameter()
-   *
    * @param string $compressed
    *   A string as compressed by
    *   \Drupal\Component\Utility\UrlHelper::compressQueryParameter().
@@ -99,6 +97,8 @@ public static function compressQueryParameter(string $data): string {
    * @return string
    *   The uncompressed data, or the original string if it cannot be
    *   uncompressed.
+   *
+   * @see \Drupal\Component\Utility\UrlHelper::compressQueryParameter()
    */
   public static function uncompressQueryParameter(string $compressed): string {
     // Because this comes from user data, suppress the PHP warning that
@@ -156,9 +156,8 @@ public static function filterQueryParameters(array $query, array $exclude = [],
   /**
    * Parses a URL string into its path, query, and fragment components.
    *
-   * This function splits both internal paths like @code node?b=c#d @endcode and
-   * external URLs like @code https://example.com/a?b=c#d @endcode into their
-   * component parts. See
+   * This function splits both internal paths like "node?b=c#d" and external
+   * URLs like "https://example.com/a?b=c#d" into their component parts. See
    * @link http://tools.ietf.org/html/rfc3986#section-3 RFC 3986 @endlink for an
    * explanation of what the component parts are.
    *
@@ -217,7 +216,7 @@ public static function parse($url) {
     else {
       // parse_url() does not support relative URLs, so make it absolute. For
       // instance, the relative URL "foo/bar:1" isn't properly parsed.
-      $parts = parse_url('http://example.com/' . $url);
+      $parts = parse_url('https://example.com/' . $url);
       // Strip the leading slash that was just added.
       $options['path'] = substr($parts['path'], 1);
       if (isset($parts['query'])) {
@@ -249,13 +248,13 @@ public static function encodePath($path) {
   /**
    * Determines whether a path is external to Drupal.
    *
-   * An example of an external path is http://example.com. If a path cannot be
+   * An example of an external path is https://example.com. If a path cannot be
    * assessed by Drupal's menu handler, then we must treat it as potentially
    * insecure.
    *
    * @param string $path
    *   The internal path or external URL being linked to, such as "node/34" or
-   *   "http://example.com/foo".
+   *   "https://example.com/foo".
    *
    * @return bool
    *   TRUE or FALSE, where TRUE indicates an external path.
@@ -284,9 +283,9 @@ public static function isExternal($path) {
    * Determines if an external URL points to this installation.
    *
    * @param string $url
-   *   A string containing an external URL, such as "http://example.com/foo".
+   *   A string containing an external URL, such as "https://example.com/foo".
    * @param string $base_url
-   *   The base URL string to check against, such as "http://example.com/"
+   *   The base URL string to check against, such as "https://example.com/".
    *
    * @return bool
    *   TRUE if the URL has the same domain and base path.
@@ -410,8 +409,8 @@ public static function stripDangerousProtocols($uri) {
         // We found a colon, possibly a protocol. Verify.
         $protocol = substr($uri, 0, $colon_position);
         // If a colon is preceded by a slash, question mark or hash, it cannot
-        // possibly be part of the URL scheme. This must be a relative URL, which
-        // inherits the (safe) protocol of the base document.
+        // possibly be part of the URL scheme. This must be a relative URL,
+        // which inherits the (safe) protocol of the base document.
         if (preg_match('![/?#]!', $protocol)) {
           break;
         }

core/lib/Drupal/Component/Utility/Variable.php

@@ -42,7 +42,8 @@ public static function callableToString($callable): string {
    * @param mixed $var
    *   The variable to export.
    * @param string $prefix
-   *   A prefix that will be added at the beginning of every lines of the output.
+   *   A prefix that will be added at the beginning of every lines of the
+   *   output.
    *
    * @return string
    *   The variable exported in a way compatible to Drupal's coding standards.

core/lib/Drupal/Component/Utility/Xss.php

@@ -18,7 +18,86 @@ class Xss {
    *
    * @see \Drupal\Component\Utility\Xss::filterAdmin()
    */
-  protected static $adminTags = ['a', 'abbr', 'acronym', 'address', 'article', 'aside', 'b', 'bdi', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'command', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'mark', 'menu', 'meter', 'nav', 'ol', 'output', 'p', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'small', 'span', 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'tr', 'tt', 'u', 'ul', 'var', 'wbr'];
+  protected static $adminTags = [
+    'a',
+    'abbr',
+    'acronym',
+    'address',
+    'article',
+    'aside',
+    'b',
+    'bdi',
+    'bdo',
+    'big',
+    'blockquote',
+    'br',
+    'caption',
+    'cite',
+    'code',
+    'col',
+    'colgroup',
+    'command',
+    'dd',
+    'del',
+    'details',
+    'dfn',
+    'div',
+    'dl',
+    'dt',
+    'em',
+    'figcaption',
+    'figure',
+    'footer',
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+    'header',
+    'hgroup',
+    'hr',
+    'i',
+    'img',
+    'ins',
+    'kbd',
+    'li',
+    'mark',
+    'menu',
+    'meter',
+    'nav',
+    'ol',
+    'output',
+    'p',
+    'pre',
+    'progress',
+    'q',
+    'rp',
+    'rt',
+    'ruby',
+    's',
+    'samp',
+    'section',
+    'small',
+    'span',
+    'strong',
+    'sub',
+    'summary',
+    'sup',
+    'table',
+    'tbody',
+    'td',
+    'tfoot',
+    'th',
+    'thead',
+    'time',
+    'tr',
+    'tt',
+    'u',
+    'ul',
+    'var',
+    'wbr',
+  ];
 
   /**
    * The default list of HTML tags allowed by filter().

core/lib/Drupal/Core/Access/AccessManagerInterface.php

@@ -12,7 +12,7 @@
 interface AccessManagerInterface {
 
   /**
-   * Checks a named route with parameters against applicable access check services.
+   * Checks a named route with parameters against access check services.
    *
    * Determines whether the route is accessible or not.
    *

core/lib/Drupal/Core/Access/AccessResult.php

@@ -87,7 +87,7 @@ public static function allowedIf($condition) {
    *   The condition to evaluate.
    * @param string|null $reason
    *   (optional) The reason why access is forbidden. Intended for developers,
-   *   hence not translatable
+   *   hence not translatable.
    *
    * @return \Drupal\Core\Access\AccessResult
    *   If $condition is TRUE, isForbidden() will be TRUE, otherwise isNeutral()
@@ -98,7 +98,7 @@ public static function forbiddenIf($condition, $reason = NULL) {
   }
 
   /**
-   * Creates an allowed access result if the permission is present, neutral otherwise.
+   * Creates an access result if the permission is present, neutral otherwise.
    *
    * Checks the permission and adds a 'user.permissions' cache context.
    *
@@ -121,7 +121,7 @@ public static function allowedIfHasPermission(AccountInterface $account, $permis
   }
 
   /**
-   * Creates an allowed access result if the permissions are present, neutral otherwise.
+   * Creates an access result if the permissions are present, neutral otherwise.
    *
    * Checks the permission and adds a 'user.permissions' cache contexts.
    *
@@ -131,7 +131,7 @@ public static function allowedIfHasPermission(AccountInterface $account, $permis
    *   The permissions to check.
    * @param string $conjunction
    *   (optional) 'AND' if all permissions are required, 'OR' in case just one.
-   *   Defaults to 'AND'
+   *   Defaults to 'AND'.
    *
    * @return \Drupal\Core\Access\AccessResult
    *   If the account has the permissions, isAllowed() will be TRUE, otherwise
@@ -406,8 +406,8 @@ public function andIf(AccessResultInterface $other) {
    * @return $this
    */
   public function inheritCacheability(AccessResultInterface $other) {
-    $this->addCacheableDependency($other);
     if ($other instanceof CacheableDependencyInterface) {
+      $this->addCacheableDependency($other);
       if ($this->getCacheMaxAge() !== 0 && $other->getCacheMaxAge() !== 0) {
         $this->setCacheMaxAge(Cache::mergeMaxAges($this->getCacheMaxAge(), $other->getCacheMaxAge()));
       }
@@ -415,6 +415,9 @@ public function inheritCacheability(AccessResultInterface $other) {
         $this->setCacheMaxAge($other->getCacheMaxAge());
       }
     }
+    else {
+      $this->setCacheMaxAge(0);
+    }
     return $this;
   }
 

core/lib/Drupal/Core/Access/AccessResultForbidden.php

@@ -3,7 +3,7 @@
 namespace Drupal\Core\Access;
 
 /**
- * Value object indicating a forbidden access result, with cacheability metadata.
+ * Value object for a forbidden access result, with cacheability metadata.
  */
 class AccessResultForbidden extends AccessResult implements AccessResultReasonInterface {
 

core/lib/Drupal/Core/Access/AccessResultNeutral.php

@@ -18,7 +18,7 @@ class AccessResultNeutral extends AccessResult implements AccessResultReasonInte
    * Constructs a new AccessResultNeutral instance.
    *
    * @param null|string $reason
-   *   (optional) A message to provide details about this access result
+   *   (optional) A message to provide details about this access result.
    */
   public function __construct($reason = NULL) {
     $this->reason = $reason;

core/lib/Drupal/Core/Access/CsrfAccessCheck.php

@@ -24,12 +24,12 @@
  */
 class CsrfAccessCheck implements RoutingAccessInterface {
 
+  use RoutePathGenerationTrait;
+
   /**
    * The CSRF token generator.
-   *
-   * @var \Drupal\Core\Access\CsrfTokenGenerator
    */
-  protected $csrfToken;
+  protected CsrfTokenGenerator $csrfToken;
 
   /**
    * Constructs a CsrfAccessCheck object.
@@ -55,13 +55,7 @@ public function __construct(CsrfTokenGenerator $csrf_token) {
    *   The access result.
    */
   public function access(Route $route, Request $request, RouteMatchInterface $route_match) {
-    $parameters = $route_match->getRawParameters();
-    $path = ltrim($route->getPath(), '/');
-    // Replace the path parameters with values from the parameters array.
-    foreach ($parameters as $param => $value) {
-      $path = str_replace("{{$param}}", $value, $path);
-    }
-
+    $path = $this->generateRoutePath($route, $route_match->getRawParameters()->all());
     if ($this->csrfToken->validate($request->query->get('token', ''), $path)) {
       $result = AccessResult::allowed();
     }

core/lib/Drupal/Core/Access/RoutePathGenerationTrait.php

+<?php
+
+namespace Drupal\Core\Access;
+
+use Symfony\Component\Routing\Route;
+
+/**
+ * Provides a method for generating route paths.
+ */
+trait RoutePathGenerationTrait {
+
+  /**
+   * Generates a route path by replacing placeholders with their values.
+   *
+   * Placeholders without corresponding values in the parameters array
+   * are removed from the resulting path.
+   *
+   * @param \Symfony\Component\Routing\Route $route
+   *   The route object containing the path with placeholders.
+   * @param array $parameters
+   *   An associative array of parameters to replace in the route path,
+   *   where the keys are placeholders and the values are the replacement
+   *   values.
+   *   @code
+   *   Example:
+   *   [
+   *     'parameter1' => 'value1',
+   *   ]
+   *   @endcode
+   *   This will transform a route path such as
+   *   '/route/path/{parameter1}{parameter2}' into '/route/path/value1'.
+   *
+   * @return string
+   *   The generated path with all placeholders either replaced by their
+   *   corresponding values or removed if no matching parameter exists.
+   */
+  public function generateRoutePath(Route $route, array $parameters): string {
+    $path = ltrim($route->getPath(), '/');
+
+    // Replace path parameters with their corresponding values from the
+    // parameters array.
+    foreach ($parameters as $param => $value) {
+      if (NULL !== $value) {
+        $path = str_replace("{{$param}}", $value, $path);
+      }
+    }
+
+    // Remove placeholders that were not replaced.
+    $path = preg_replace('/\/{[^}]+}/', '', $path);
+
+    // Remove trailing slashes (multiple slashes may result from the removal of
+    // unreplaced placeholders).
+    $path = rtrim($path, '/');
+
+    return $path;
+  }
+
+}

core/lib/Drupal/Core/Access/RouteProcessorCsrf.php

@@ -6,6 +6,7 @@
 use Drupal\Core\Render\BubbleableMetadata;
 use Drupal\Core\Security\TrustedCallbackInterface;
 use Drupal\Core\RouteProcessor\OutboundRouteProcessorInterface;
+use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Routing\Route;
 
 /**
@@ -13,21 +14,24 @@
  */
 class RouteProcessorCsrf implements OutboundRouteProcessorInterface, TrustedCallbackInterface {
 
-  /**
-   * The CSRF token generator.
-   *
-   * @var \Drupal\Core\Access\CsrfTokenGenerator
-   */
-  protected $csrfToken;
+  use RoutePathGenerationTrait;
 
   /**
    * Constructs a RouteProcessorCsrf object.
    *
-   * @param \Drupal\Core\Access\CsrfTokenGenerator $csrf_token
+   * @param \Drupal\Core\Access\CsrfTokenGenerator $csrfToken
    *   The CSRF token generator.
+   * @param \Symfony\Component\HttpFoundation\RequestStack|null $requestStack
+   *   The request stack.
    */
-  public function __construct(CsrfTokenGenerator $csrf_token) {
-    $this->csrfToken = $csrf_token;
+  public function __construct(
+    protected CsrfTokenGenerator $csrfToken,
+    protected ?RequestStack $requestStack = NULL,
+  ) {
+    if ($requestStack === NULL) {
+      @trigger_error('Calling ' . __CLASS__ . ' constructor without the $requestStack argument is deprecated in drupal:11.2.0 and it will be required in drupal:12.0.0. See https://www.drupal.org/project/drupal/issues/3485174', E_USER_DEPRECATED);
+      $this->requestStack = \Drupal::service('request_stack');
+    }
   }
 
   /**
@@ -35,14 +39,10 @@ public function __construct(CsrfTokenGenerator $csrf_token) {
    */
   public function processOutbound($route_name, Route $route, array &$parameters, ?BubbleableMetadata $bubbleable_metadata = NULL) {
     if ($route->hasRequirement('_csrf_token')) {
-      $path = ltrim($route->getPath(), '/');
-      // Replace the path parameters with values from the parameters array.
-      foreach ($parameters as $param => $value) {
-        $path = str_replace("{{$param}}", $value, $path);
-      }
+      $path = $this->generateRoutePath($route, $parameters);
       // Adding this to the parameters means it will get merged into the query
       // string when the route is compiled.
-      if (!$bubbleable_metadata) {
+      if (!$bubbleable_metadata || $this->requestStack->getCurrentRequest()->getRequestFormat() !== 'html') {
         $parameters['token'] = $this->csrfToken->get($path);
       }
       else {
@@ -51,7 +51,6 @@ public function processOutbound($route_name, Route $route, array &$parameters, ?
         $placeholder_render_array = [
           '#lazy_builder' => ['route_processor_csrf:renderPlaceholderCsrfToken', [$path]],
         ];
-
         // Instead of setting an actual CSRF token as the query string, we set
         // the placeholder, which will be replaced at the very last moment. This
         // ensures links with CSRF tokens don't break cacheability.
@@ -62,7 +61,9 @@ public function processOutbound($route_name, Route $route, array &$parameters, ?
   }
 
   /**
-   * #lazy_builder callback; gets a CSRF token for the given path.
+   * Render API callback: Adds a CSRF token for the given path to the markup.
+   *
+   * This function is assigned as a #lazy_builder callback.
    *
    * @param string $path
    *   The path to get a CSRF token for.

core/lib/Drupal/Core/Action/ActionManager.php

@@ -33,7 +33,7 @@ class ActionManager extends DefaultPluginManager implements CategorizingPluginMa
    *   The module handler to invoke the alter hook with.
    */
   public function __construct(\Traversable $namespaces, CacheBackendInterface $cache_backend, ModuleHandlerInterface $module_handler) {
-    parent::__construct('Plugin/Action', $namespaces, $module_handler, 'Drupal\Core\Action\ActionInterface', Action::class, 'Drupal\Core\Annotation\Action');
+    parent::__construct('Plugin/Action', $namespaces, $module_handler, ActionInterface::class, Action::class, 'Drupal\Core\Annotation\Action');
     $this->alterInfo('action_info');
     $this->setCacheBackend($cache_backend, 'action_info');
   }

core/lib/Drupal/Core/Action/Plugin/Action/EmailAction.php

@@ -192,7 +192,8 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta
    */
   public function validateConfigurationForm(array &$form, FormStateInterface $form_state) {
     if (!$this->emailValidator->isValid($form_state->getValue('recipient')) && !str_contains($form_state->getValue('recipient'), ':mail')) {
-      // We want the literal %author placeholder to be emphasized in the error message.
+      // We want the literal %author placeholder to be emphasized in the error
+      // message.
       $form_state->setErrorByName('recipient', $this->t('Enter a valid email address or use a token email address such as %author.', ['%author' => '[node:author:mail]']));
     }
   }

core/lib/Drupal/Core/Action/Plugin/Action/GotoAction.php

@@ -116,7 +116,7 @@ public function buildConfigurationForm(array $form, FormStateInterface $form_sta
     $form['url'] = [
       '#type' => 'textfield',
       '#title' => $this->t('URL'),
-      '#description' => $this->t('The URL to which the user should be redirected. This can be an internal URL like /node/1234 or an external URL like @url.', ['@url' => 'http://example.com']),
+      '#description' => $this->t('The URL to which the user should be redirected. This can be an internal URL like /node/1234 or an external URL like @url.', ['@url' => 'https://example.com']),
       '#default_value' => $this->configuration['url'],
       '#required' => TRUE,
     ];