Roles are not displayed in the admin form

Hi hosterholz,

I guess you are talking about XSS injection more than CSRF.

It is not needed to escape your labels in the #options of a render element. Drupal's philosophy is "safe by default", and the render API (twig included) should render your labels without any potential HTML or javascript injections just fine.

Except if you voluntarily would append change the twig template to add {{ checkbox|raw }} or use a Markup::create() in the #option, you should be safe.

So the escape is not needed here and redundant.

Reopening. The maintainer will decide which fix is better for him.

So you have it.

It's Drupal default behavior: when HTML is inserted, it's rendered as plain text. There is no XSS injection possible.

Double escaping seems to render you a broken image, it's weird, and surely not the expected behavior.

That's why I included that in my patch, it's out of scope, but jumped out at me when I was fixing the Roles not being displayed.

If you have some time, you can:

- Close this ticket and keep the other one active.
- Open a new ticket to fix this double escaping, which produces an issue (as per your screenshot).
- And link things altogether to keep track record.

Ok, so I've been giving it a bit more time now that I'm home (was only reviewing, not testing).

I think you're absolutely right, and I've been wasting your time, sorry about that.

By default, (without HTML::escape) Drupal is safe regarding XSS injection, and I wasn't completely crazy to think that (a role with the name <script>alert('Alert');</script>, won't work).

Though, as you mentioned, it is subject to potential CSRF attack as is. The HTML::escape does the trick and prevent that. Of course, it is mitigated by the fact that you need a lot of permissions, but still. It is a security issue.

We can actually see it in : core/modules/filter/src/FilterFormatFormBase.php

$form['roles'] = [
  '#type' => 'checkboxes',
  '#title' => $this->t('Roles'),
  '#options' => array_map(fn(RoleInterface $role) => Html::escape($role->label()), Role::loadMultiple()),
  '#disabled' => $is_fallback,
  '#weight' => -10,
];

And regarding #3554029: CSRF in Matomo Settings Form, it also looks to me a way to prevent CSRF and is a security issue.

I'm closing this ticket then.

MR introduces a potential CSRF vulnerability.