outerSource is a special property, and its only purpose is to revert a tag to its previous, unparsed state after being parsed, as if it had not been recognized.
Thus, technically, the "source" applies only to the opening and closing elements. The content is still filtered and rendered.
Unfortunately, now that the tag options and attributes bypass all filters, this means the outerSource is a concatenation of unprocessed text (the opening tag) and processed text (the content). This is bad, because if a tag plugin ever disappears, then the fallback plugin will happily print out [missing_tag=<script>console.log("Ha ha! Mine is an evil laugh!");</script>]...[/missing_tag].
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | 0001-Issue-2634224-safe-content-and-outerSource.patch | 2.24 KB | cburschka |
Comments
Comment #2
cburschka(Actually, the whole thing is much more broken than that right now - content() itself is no longer marked as safe by the Element class, which means nested tags are broken.)
Comment #3
cburschkaw.r.t the above, for some reason this bug doesn't have symptoms. Even when $tag->content() and $tag->option() are both strings, the markup in $tag->content() is passed through and the markup in $tag->option() is escaped.
Despite this, it's clearly incorrect not to mark content() as safe.
Comment #5
cburschka