Skip to content

Conversation

basvanpoppel
Copy link
Contributor

Description (*)

This PR adds a fix to prevent html tags to be rendered in a wrong way. If a tag doesn't have content it's always self-closing, adding a script tag without content will therefor not work.

Tags like hr, br, input, img, etc. are forbidden to be closed - they must be self-closing and are not allowed to have content.

This change checks if the element type is void to determine if the tag should be self-closing.

Related Pull Requests

Fixed Issues (if relevant)

  1. Fixes SecureHtmlRenderer renderTag method renders incorrectly when provided 'null' content #32822

Manual testing scenarios (*)

There's currently no steps you can take inside Magento to test this, as all present script tags have content. Adding a script tag without content (like <script/>, or what happens in many scenarios, <script src="script.js"/>) will trigger the issue.

Questions or comments

I have written a unit test to verify behaviour, please let me know if anything else is needed.
Related to this issue there might be the question wether it's a good practice to add external scripts this way - but this is not the function to validate this - this function should just take care of rendering the html tag.

Contribution checklist (*)

  • Pull request has a meaningful description of its purpose
  • All commits are accompanied by meaningful commit messages
  • All new or changed code is covered with unit/integration tests (if applicable)
  • README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
  • All automated tests passed successfully (all builds are green)

@m2-assistant
Copy link

m2-assistant bot commented Jun 9, 2021

Hi @basvanpoppel. Thank you for your contribution
Here are some useful tips how you can test your changes using Magento test environment.
Add the comment under your pull request to deploy test or vanilla Magento instance:

  • @magento give me test instance - deploy test instance based on PR changes
  • @magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

  • @magento run all tests - run or re-run all required tests against the PR changes
  • @magento run <test-build(s)> - run or re-run specific test build(s)
    For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names. Allowed build names are:

  1. Database Compare
  2. Functional Tests CE
  3. Functional Tests EE,
  4. Functional Tests B2B
  5. Integration Tests
  6. Magento Health Index
  7. Sample Data Tests CE
  8. Sample Data Tests EE
  9. Sample Data Tests B2B
  10. Static Tests
  11. Unit Tests
  12. WebAPI Tests
  13. Semantic Version Checker

You can find more information about the builds here

ℹ️ Please run only needed test builds instead of all when developing. Please run all test builds before sending your PR for review.

For more details, please, review the Magento Contributor Guide documentation.

⚠️ According to the Magento Contribution requirements, all Pull Requests must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.

🕙 You can find the schedule on the Magento Community Calendar page.

📞 The triage of Pull Requests happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket.

🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel

✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

@m2-community-project m2-community-project bot added Priority: P3 May be fixed according to the position in the backlog. Severity: S3 Affects non-critical data or functionality and does not force users to employ a workaround. labels Jun 9, 2021
@mrtuvn mrtuvn self-assigned this Jun 10, 2021
@mrtuvn
Copy link
Contributor

mrtuvn commented Jun 10, 2021

@magento run all tests

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@mrtuvn
Copy link
Contributor

mrtuvn commented Jun 10, 2021

@magento run WebAPI Tests, Functional Tests EE, Functional Tests CE, Functional Tests B2B

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@mrtuvn
Copy link
Contributor

mrtuvn commented Jun 10, 2021

Can you check fail tests related integrations cases

@mrtuvn
Copy link
Contributor

mrtuvn commented Jun 10, 2021

@magento run Integration Tests, Unit Tests

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@basvanpoppel
Copy link
Contributor Author

@magento run Integration Tests

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@basvanpoppel
Copy link
Contributor Author

Integration tests are fine now. I saw a functional test failing earlier but it seems I can't access it. (also it doesn't seem related to this PR)

@mrtuvn
Copy link
Contributor

mrtuvn commented Jun 10, 2021

@magento run WebAPI Tests, Static Tests, Semantic Version Checker, Sample Data Tests EE, Sample Data Tests CE, Sample Data Tests B2B, Magento Health Index, Functional Tests EE, Functional Tests CE, Functional Tests B2B, Database Compare

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@mrtuvn
Copy link
Contributor

mrtuvn commented Jun 11, 2021

Thanks you for your contribution
Seem everything look good for me! Fail tests seem not related with this pull request changes

@mrtuvn mrtuvn added Auto-Tests: Covered All changes in Pull Request is covered by auto-tests Award: bug fix labels Jun 11, 2021
@mrtuvn mrtuvn requested review from AlexMaxHorkun and Den4ik June 11, 2021 03:43
@Den4ik
Copy link
Contributor

Den4ik commented Jun 17, 2021

@magento run Functional Tests CE

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@sivaschenko
Copy link
Member

sivaschenko commented Jun 22, 2021

The base branch was changed to platform-health to deliver in the scope of the Platform health project.

@ihor-sviziev @Den4ik do you think the proposed optimization is important? Did you include array_flip execution time in the benchmark for isset (or exclude it for in_array)?

@ihor-sviziev
Copy link
Contributor

ihor-sviziev commented Jun 22, 2021 via email

@Den4ik
Copy link
Contributor

Den4ik commented Jun 22, 2021

The base branch was changed to platform-health to deliver in the scope of the Platform health project.

@ihor-sviziev @Den4ik do you think the proposed optimization is important? Did you include array_flip execution time in the benchmark for isset (or exclude it for in_array)?

In my opinion it's not super important because array is not so long. But I agree with @ihor-sviziev that we can prepare array with keys and use isset for check

@sivaschenko
Copy link
Member

@basvanpoppel would you be able to apply the proposed improvements?

basvanpoppel and others added 2 commits June 28, 2021 14:16
Co-authored-by: Ihor Sviziev <ihor-sviziev@users.noreply.github.com>
Co-authored-by: Ihor Sviziev <ihor-sviziev@users.noreply.github.com>
@basvanpoppel
Copy link
Contributor Author

basvanpoppel commented Jun 28, 2021

@basvanpoppel would you be able to apply the proposed improvements?

@sivaschenko They have been applied. I've learned something, thanks. :)

@ihor-sviziev
Copy link
Contributor

@magento run all tests

@magento-automated-testing
Copy link

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

@m2-assistant
Copy link

m2-assistant bot commented Jul 2, 2021

Hi @basvanpoppel, thank you for your contribution!
Please, complete Contribution Survey, it will take less than a minute.
Your feedback will help us to improve contribution process.

@basvanpoppel basvanpoppel deleted the set-self-closing-tags-for-void-elements branch January 28, 2024 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Auto-Tests: Covered All changes in Pull Request is covered by auto-tests Award: bug fix Component: View Priority: P3 May be fixed according to the position in the backlog. Progress: ready for testing Project: Platform Health Release Line: 2.4 Severity: S3 Affects non-critical data or functionality and does not force users to employ a workaround.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

SecureHtmlRenderer renderTag method renders incorrectly when provided 'null' content
6 participants