Since PHP 5.4 http://php.net/htmlspecialchars allows to differ between HTML4 and HTML5 entities.

As Drupal 8 supports HTML5 by default, HTML(5) entities should be taken into account in the escaping performed by check_plain().

@see http://stackoverflow.com/questions/7482977/get-hexcode-of-html-entities
@see https://bugs.php.net/bug.php?id=55547

CommentFileSizeAuthor
#17 interdiff.txt21.9 KBbasil_snowman
#17 handle_code_as_html5_in-1365598-17.patch24.38 KBbasil_snowman
#15 interdiff.txt21.6 KBbasil_snowman
#15 handle_code_as_html5_in-1365598-15.patch24.08 KBbasil_snowman
#9 657472-69.patch549 bytesbasil_snowman
drupal8.check-plain-html5.0.patch444 bytessun

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

This seems to be actually as of 5.4.0, so I don't think we can use this for Drupal 8.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Issue summary: View changes

Updated issue summary.

kscheirer’s picture

kscheirer
Primary language English
Location Vallejo
commented
Status: Needs review » Closed (won't fix)

I like the idea, but Dave is right, D8 requires PHP 5.3.3 and that change to htmlspecialchars() went in with PHP 5.4.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Status: Closed (won't fix) » Postponed
Issue tags: +PHP 5.4

The proper status is postponed then. We'll require PHP 5.4 at some point in the future.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Issue summary: View changes

Updated issue summary.

mgifford’s picture

mgifford
he/him
Primary language English
commented
Issue summary: View changes
Status: Postponed » Needs work

Well, PHP 5.4 isn't a barrier now #1498574: [policy, no patch] Require PHP 5.4

However, this is now done with:

function check_plain($text) {
  return String::checkPlain($text);
}

I'm not sure where that is defined or if it is still needed.

damien tournoud’s picture

damien tournoud commented
Issue tags: -Security

Literally the only difference in our use case is that the HTML5 mode will be generating ' instead of '. No security implication.

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented
Version: 8.2.x-dev » 8.3.x-dev
Component: base system » theme system
Issue tags: -PHP 5.4 +Needs re-roll

We do require PHP 5.4, this likely could be done with tests. Needs a bit of a re-roll because check_plain() is now called Html::escape()

basil_snowman’s picture

basil_snowman commented
Status: Needs work » Needs review
Issue tags: -Needs re-roll
StatusFileSize
new 657472-69.patch549 bytes

patch added

basil_snowman’s picture

basil_snowman commented

..somehow my comment was removed

Status: Needs review » Needs work

The last submitted patch, 657472-69.patch, failed testing.

kscheirer’s picture

kscheirer
Primary language English
Location Vallejo
commented

Looks like the tests failed because they're still looking for a ' which will now be '

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

@basil_snowman, because you were unconfirmed and the comment was very light on details of what you did, Mollom apparently thought you were a spammer.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

basil_snowman’s picture

basil_snowman commented
Status: Needs work » Needs review
StatusFileSize
new handle_code_as_html5_in-1365598-15.patch24.08 KB
new interdiff.txt21.6 KB

fixed tests for a new situation.

Status: Needs review » Needs work

The last submitted patch, 15: handle_code_as_html5_in-1365598-15.patch, failed testing. View results

basil_snowman’s picture

basil_snowman commented
Status: Needs work » Needs review
StatusFileSize
new handle_code_as_html5_in-1365598-17.patch24.38 KB
new interdiff.txt21.9 KB

fixed some tests

Status: Needs review » Needs work

The last submitted patch, 17: handle_code_as_html5_in-1365598-17.patch, failed testing. View results

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

smustgrave commented
Status: Needs work » Postponed (maintainer needs more info)
Issue tags: +stale-issue-cleanup

Thank you for creating this issue to improve Drupal.

We are working to decide if this task is still relevant to a currently supported version of Drupal. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or is no longer relevant. Your thoughts on this will allow a decision to be made.

Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Thanks!

andypost’s picture

andypost
he/him
Primary language Russian
commented
Parent issue: » #3463613: Explore PHP 8.4 native HTML 5 parser vs html5-php
Related issues: +#3414933: [PHP 8.4] Use DOMDocument HTML5 support when available, +#2350049: filter_autop() returns <br /> but should return <br> for HTML5

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.