Issue #2454447 by andypost, dawehner, rteijeiro: Split Utility\String class to... (40d6efef) · Commits · project / drupal

core/includes/bootstrap.inc

+5 −6

Changes for core/includes/bootstrap.inc: 5 added lines, 6 removed lines.
Original line number	Diff line number	Diff line
		@@ -8,7 +8,6 @@
		use Drupal\Component\Utility\Crypt;
		use Drupal\Component\Utility\Environment;
		use Drupal\Component\Utility\SafeMarkup;
		use Drupal\Component\Utility\String;
		use Drupal\Component\Utility\Unicode;
		use Drupal\Core\DrupalKernel;
		use Drupal\Core\Extension\ExtensionDiscovery;
		@@ -429,12 +428,12 @@ function t($string, array $args = array(), array $options = array()) {
		/**
		* Formats a string for HTML display by replacing variable placeholders.
		*
		* @see \Drupal\Component\Utility\String::format()
		* @see \Drupal\Component\Utility\SafeMarkup::format()
		* @see t()
		* @ingroup sanitization
		*/
		function format_string($string, array $args = array()) {
		return String::format($string, $args);
		return SafeMarkup::format($string, $args);
		}

		/**
		@@ -495,7 +494,7 @@ function watchdog_exception($type, Exception $exception, $message = NULL, $varia
		// Use a default value if $message is not set.
		if (empty($message)) {
		// The exception message is run through
		// \Drupal\Component\Utility\String::checkPlain() by
		// \Drupal\Component\Utility\SafeMarkup::checkPlain() by
		// \Drupal\Core\Utility\Error:decodeException().
		$message = '%type: !message in %function (line %line of %file).';
		}
		@@ -1022,10 +1021,10 @@ function drupal_static_reset($name = NULL) {
		/**
		* Formats text for emphasized display in a placeholder inside a sentence.
		*
		* @see \Drupal\Component\Utility\String::placeholder()
		* @see \Drupal\Component\Utility\SafeMarkup::placeholder()
		*/
		function drupal_placeholder($text) {
		return String::placeholder($text);
		return SafeMarkup::placeholder($text);
		}

		/**

core/lib/Drupal/Component/Utility/Html.php

+17 −0

Changes for core/lib/Drupal/Component/Utility/Html.php: 17 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -359,4 +359,21 @@ public static function escapeCdataElement(\DOMNode $node, $comment_start = '//',
		}
		}

		/**
		* Decodes all HTML entities including numerical ones to regular UTF-8 bytes.
		*
		* Double-escaped entities will only be decoded once ("&lt;" becomes
		* "<", not "<"). Be careful when using this function, as it will revert
		* previous sanitization efforts (<script> will become <script>).
		*
		* @param string $text
		* The text to decode entities in.
		*
		* @return string
		* The input $text, with all HTML entities decoded once.
		*/
		public static function decodeEntities($text) {
		return html_entity_decode($text, ENT_QUOTES, 'UTF-8');
		}

		}

core/lib/Drupal/Component/Utility/SafeMarkup.php

+119 −2

Changes for core/lib/Drupal/Component/Utility/SafeMarkup.php: 119 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -15,7 +15,7 @@
		* provides a store for known safe strings and methods to manage them
		* throughout the page request.
		*
		* Strings sanitized by String::checkPlain() or Xss::filter() are automatically
		* Strings sanitized by self::checkPlain() or Xss::filter() are automatically
		* marked safe, as are markup strings created from render arrays via
		* drupal_render().
		*
		@@ -133,7 +133,7 @@ public static function setMultiple(array $safe_strings) {
		* self::set(), it won't be escaped again.
		*/
		public static function escape($string) {
		return static::isSafe($string) ? $string : String::checkPlain($string);
		return static::isSafe($string) ? $string : static::checkPlain($string);
		}

		/**
		@@ -165,4 +165,121 @@ public static function getAll() {
		return static::$safeStrings;
		}

		/**
		* Encodes special characters in a plain-text string for display as HTML.
		*
		* Also validates strings as UTF-8. All processed strings are also
		* automatically flagged as safe markup strings for rendering.
		*
		* @param string $text
		* The text to be checked or processed.
		*
		* @return string
		* An HTML safe version of $text, or an empty string if $text is not valid
		* UTF-8.
		*
		* @ingroup sanitization
		*
		* @see drupal_validate_utf8()
		*/
		public static function checkPlain($text) {
		$string = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
		static::$safeStrings[$string]['html'] = TRUE;
		return $string;
		}

		/**
		* Formats a string for HTML display by replacing variable placeholders.
		*
		* This function replaces variable placeholders in a string with the requested
		* values and escapes the values so they can be safely displayed as HTML. It
		* should be used on any unknown text that is intended to be printed to an
		* HTML page (especially text that may have come from untrusted users, since
		* in that case it prevents cross-site scripting and other security problems).
		*
		* In most cases, you should use t() rather than calling this function
		* directly, since it will translate the text (on non-English-only sites) in
		* addition to formatting it.
		*
		* @param string $string
		* A string containing placeholders. The string itself is not escaped, any
		* unsafe content must be in $args and inserted via placeholders.
		* @param array $args
		* An associative array of replacements to make. Occurrences in $string of
		* any key in $args are replaced with the corresponding value, after
		* optional sanitization and formatting. The type of sanitization and
		* formatting depends on the first character of the key:
		* - @variable: Escaped to HTML using self::escape(). Use this as the
		* default choice for anything displayed on a page on the site.
		* - %variable: Escaped to HTML and formatted using self::placeholder(),
		* which makes the following HTML code:
		* @code
		* <em class="placeholder">text output here.</em>
		* @endcode
		* - !variable: Inserted as is, with no sanitization or formatting. Only
		* use this when the resulting string is being generated for one of:
		* - Non-HTML usage, such as a plain-text email.
		* - Non-direct HTML output, such as a plain-text variable that will be
		* printed as an HTML attribute value and therefore formatted with
		* self::checkPlain() as part of that.
		* - Some other special reason for suppressing sanitization.
		*
		* @return string
		* The formatted string, which is marked as safe unless sanitization of an
		* unsafe argument was suppressed (see above).
		*
		* @ingroup sanitization
		*
		* @see t()
		*/
		public static function format($string, array $args = array()) {
		$safe = TRUE;

		// Transform arguments before inserting them.
		foreach ($args as $key => $value) {
		switch ($key[0]) {
		case '@':
		// Escaped only.
		$args[$key] = static::escape($value);
		break;

		case '%':
		default:
		// Escaped and placeholder.
		$args[$key] = static::placeholder($value);
		break;

		case '!':
		// Pass-through.
		if (!static::isSafe($value)) {
		$safe = FALSE;
		}
		}
		}

		$output = strtr($string, $args);
		if ($safe) {
		static::$safeStrings[$output]['html'] = TRUE;
		}

		return $output;
		}

		/**
		* Formats text for emphasized display in a placeholder inside a sentence.
		*
		* Used automatically by self::format().
		*
		* @param string $text
		* The text to format (plain-text).
		*
		* @return string
		* The formatted text (html).
		*/
		public static function placeholder($text) {
		$string = '<em class="placeholder">' . static::escape($text) . '</em>';
		static::$safeStrings[$string]['html'] = TRUE;
		return $string;
		}

		}

core/lib/Drupal/Component/Utility/String.php

+14 −60

Changes for core/lib/Drupal/Component/Utility/String.php: 14 added lines, 60 removed lines.
Original line number	Diff line number	Diff line
		@@ -17,9 +17,6 @@ class String {
		/**
		* Encodes special characters in a plain-text string for display as HTML.
		*
		* Also validates strings as UTF-8. All processed strings are also
		* automatically flagged as safe markup strings for rendering.
		*
		* @param string $text
		* The text to be checked or processed.
		*
		@@ -27,45 +24,32 @@ class String {
		* An HTML safe version of $text, or an empty string if $text is not
		* valid UTF-8.
		*
		* @ingroup sanitization
		*
		* @see drupal_validate_utf8()
		* @see \Drupal\Component\Utility\SafeMarkup
		* @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0.
		* Use \Drupal\Component\Utility\SafeMarkup::checkPlain() instead.
		*/
		public static function checkPlain($text) {
		return SafeMarkup::set(htmlspecialchars($text, ENT_QUOTES, 'UTF-8'));
		return SafeMarkup::checkPlain($text);
		}

		/**
		* Decodes all HTML entities including numerical ones to regular UTF-8 bytes.
		*
		* Double-escaped entities will only be decoded once ("&lt;" becomes
		* "<", not "<"). Be careful when using this function, as it will revert
		* previous sanitization efforts (<script> will become <script>).
		*
		* @param string $text
		* The text to decode entities in.
		*
		* @return string
		* The input $text, with all HTML entities decoded once.
		*
		* @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0.
		* Use \Drupal\Component\Utility\Html::decodeEntities() instead.
		*/
		public static function decodeEntities($text) {
		return html_entity_decode($text, ENT_QUOTES, 'UTF-8');
		return Html::decodeEntities($text);
		}

		/**
		* Formats a string for HTML display by replacing variable placeholders.
		*
		* This function replaces variable placeholders in a string with the requested
		* values and escapes the values so they can be safely displayed as HTML. It
		* should be used on any unknown text that is intended to be printed to an
		* HTML page (especially text that may have come from untrusted users, since
		* in that case it prevents cross-site scripting and other security problems).
		*
		* In most cases, you should use t() rather than calling this function
		* directly, since it will translate the text (on non-English-only sites) in
		* addition to formatting it.
		*
		* @param $string
		* A string containing placeholders. The string itself is not escaped, any
		* unsafe content must be in $args and inserted via placeholders.
		@@ -94,57 +78,27 @@ public static function decodeEntities($text) {
		* The formatted string, which is marked as safe unless sanitization of an
		* unsafe argument was suppressed (see above).
		*
		* @ingroup sanitization
		*
		* @see t()
		* @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0.
		* Use \Drupal\Component\Utility\SafeMarkup::format() instead.
		*/
		public static function format($string, array $args = array()) {
		$safe = TRUE;

		// Transform arguments before inserting them.
		foreach ($args as $key => $value) {
		switch ($key[0]) {
		case '@':
		// Escaped only.
		$args[$key] = SafeMarkup::escape($value);
		break;

		case '%':
		default:
		// Escaped and placeholder.
		$args[$key] = static::placeholder($value);
		break;

		case '!':
		// Pass-through.
		if (!SafeMarkup::isSafe($value)) {
		$safe = FALSE;
		}
		}
		}

		$output = strtr($string, $args);
		if ($safe) {
		SafeMarkup::set($output);
		}

		return $output;
		return SafeMarkup::format($string, $args);
		}

		/**
		* Formats text for emphasized display in a placeholder inside a sentence.
		*
		* Used automatically by self::format().
		*
		* @param string $text
		* The text to format (plain-text).
		*
		* @return string
		* The formatted text (html).
		*
		* @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0.
		* Use \Drupal\Component\Utility\SafeMarkup::placeholder() instead.
		*/
		public static function placeholder($text) {
		return SafeMarkup::set('<em class="placeholder">' . SafeMarkup::escape($text) . '</em>');
		return SafeMarkup::placeholder($text);
		}


		}

core/lib/Drupal/Core/StringTranslation/TranslationManager.php

+1 −2

Changes for core/lib/Drupal/Core/StringTranslation/TranslationManager.php: 1 added line, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -8,7 +8,6 @@
		namespace Drupal\Core\StringTranslation;

		use Drupal\Component\Utility\SafeMarkup;
		use Drupal\Component\Utility\String;
		use Drupal\Core\Language\LanguageManagerInterface;
		use Drupal\Core\StringTranslation\Translator\TranslatorInterface;

		@@ -144,7 +143,7 @@ public function translate($string, array $args = array(), array $options = array
		return SafeMarkup::set($string);
		}
		else {
		return String::format($string, $args);
		return SafeMarkup::format($string, $args);
		}
		}