Commit 1a37b092 authored by Alex Bronstein's avatar Alex Bronstein
Browse files

Issue #2573657 by catch, Xano, stefan.r: comment_tokens() filters instead of... 

Issue #2573657 by catch, Xano, stefan.r: comment_tokens() filters instead of escapes some plain-text strings
parent 596b69fe

core/modules/comment/comment.tokens.inc

+4 −4
Changes for core/modules/comment/comment.tokens.inc: 4 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -154,7 +154,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM 
          break;



        case 'title':

          $replacements[$original] = $sanitize ? Xss::filter($comment->getSubject()) : $comment->getSubject();

          $replacements[$original] = $sanitize ? Html::escape($comment->getSubject()) : $comment->getSubject();

          break;



        case 'body':
@@ -183,14 +183,14 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM 
          if ($comment->getOwnerId()) {

            $bubbleable_metadata->addCacheableDependency($comment->getOwner());

          }

          $replacements[$original] = $sanitize ? Xss::filter($name) : $name;

          $replacements[$original] = $sanitize ? Html::escape($name) : $name;

          break;



        case 'parent':

          if ($comment->hasParentComment()) {

            $parent = $comment->getParentComment();

            $bubbleable_metadata->addCacheableDependency($parent);

            $replacements[$original] = $sanitize ? Xss::filter($parent->getSubject()) : $parent->getSubject();

            $replacements[$original] = $sanitize ? Html::escape($parent->getSubject()) : $parent->getSubject();

          }

          break;
@@ -210,7 +210,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM 
          $entity = $comment->getCommentedEntity();

          $bubbleable_metadata->addCacheableDependency($entity);

          $title = $entity->label();

          $replacements[$original] = $sanitize ? Xss::filter($title) : $title;

          $replacements[$original] = $sanitize ? Html::escape($title) : $title;

          break;

      }

    }

core/modules/comment/src/Tests/CommentTokenReplaceTest.php

+3 −3
Changes for core/modules/comment/src/Tests/CommentTokenReplaceTest.php: 3 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -54,10 +54,10 @@ function testCommentTokenReplacement() { 
    $tests = array();

    $tests['[comment:cid]'] = $comment->id();

    $tests['[comment:hostname]'] = Html::escape($comment->getHostname());

    $tests['[comment:author]'] = Xss::filter($comment->getAuthorName());

    $tests['[comment:author]'] = Html::escape($comment->getAuthorName());

    $tests['[comment:mail]'] = Html::escape($this->adminUser->getEmail());

    $tests['[comment:homepage]'] = UrlHelper::filterBadProtocol($comment->getHomepage());

    $tests['[comment:title]'] = Xss::filter($comment->getSubject());

    $tests['[comment:title]'] = Html::escape($comment->getSubject());

    $tests['[comment:body]'] = $comment->comment_body->processed;

    $tests['[comment:langcode]'] = Html::escape($comment->language()->getId());

    $tests['[comment:url]'] = $comment->url('canonical', $url_options + array('fragment' => 'comment-' . $comment->id()));
@@ -140,7 +140,7 @@ function testCommentTokenReplacement() { 
    $comment->setOwnerId(0)->setAuthorName($author_name);

    $input = '[comment:author]';

    $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId()));

    $this->assertEqual($output, Xss::filter($author_name), format_string('Sanitized comment author token %token replaced.', array('%token' => $input)));

    $this->assertEqual($output, Html::escape($author_name), format_string('Sanitized comment author token %token replaced.', array('%token' => $input)));

    $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId(), 'sanitize' => FALSE));

    $this->assertEqual($output, $author_name, format_string('Unsanitized comment author token %token replaced.', array('%token' => $input)));