[BUGFIX] Do not render empty eval and is_in instructions

This commit checks whether `eval` and `is_in` are not empty before they
are used as "input params" for the JavaScript part of the FormEngine.

Also, a plausibility check is added to ensure `eval=is_in` and a
non-falsy `is_in` configuration are given.

Resolves: #103184
Releases: main, 12.4
Change-Id: I23da4483f1b35b0720ce59d07847fe01ead9a461
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83561
Tested-by: core-ci <typo3@b13.com>
Tested-by: Andreas Kienast <a.fernandez@scripting-base.de>
Reviewed-by: Andreas Kienast <a.fernandez@scripting-base.de>

Build/Sources/TypeScript/backend/form-engine-validation.ts

@@ -25,6 +25,7 @@ import Severity from '@typo3/backend/severity';
 import { selector } from '@typo3/core/literals';
 
 type CustomEvaluationCallback = (value: string) => string;
+type FormEngineInputParams = { field: string, evalList?: string, is_in?: string };
 
 export default (function() {
 
@@ -111,12 +112,7 @@ export default (function() {
 
     const config = $mainField.data('config');
     if (typeof config !== 'undefined') {
-      const evalList = FormEngineValidation.trimExplode(',', config.evalList);
-      let value = $field.val();
-
-      for (let i = 0; i < evalList.length; i++) {
-        value = FormEngineValidation.formatValue(evalList[i], value, config);
-      }
+      const value = FormEngineValidation.formatByEvals(config, $field.val());
       if (value.length) {
         $humanReadableField.val(value);
       }
@@ -141,6 +137,16 @@ export default (function() {
     }
   };
 
+  FormEngineValidation.formatByEvals = function(config: FormEngineInputParams, value: string): string {
+    if (config.evalList !== undefined) {
+      const evalList = FormEngineValidation.trimExplode(',', config.evalList);
+      for (const evalInstruction of evalList) {
+        value = FormEngineValidation.formatValue(evalInstruction, value, config);
+      }
+    }
+    return value;
+  };
+
   /**
    * Format field value
    */
@@ -223,17 +229,9 @@ export default (function() {
 
     const config = $mainField.data('config');
     if (typeof config !== 'undefined') {
-      const evalList = FormEngineValidation.trimExplode(',', config.evalList);
-      let newValue = $humanReadableField.val();
+      const newValue = FormEngineValidation.processByEvals(config, $humanReadableField.val());
+      const formattedValue = FormEngineValidation.formatByEvals(config, newValue);
 
-      for (let i = 0; i < evalList.length; i++) {
-        newValue = FormEngineValidation.processValue(evalList[i], newValue, config);
-      }
-
-      let formattedValue = newValue;
-      for (let i = 0; i < evalList.length; i++) {
-        formattedValue = FormEngineValidation.formatValue(evalList[i], formattedValue, config);
-      }
       if ($mainField.prop('disabled') && $mainField.data('enableOnModification')) {
         $mainField.prop('disabled', false);
       }
@@ -413,6 +411,16 @@ export default (function() {
     return returnValue;
   };
 
+  FormEngineValidation.processByEvals = function(config: FormEngineInputParams, value: string): string {
+    if (config.evalList !== undefined) {
+      const evalList = FormEngineValidation.trimExplode(',', config.evalList);
+      for (const evalInstruction of evalList) {
+        value = FormEngineValidation.processValue(evalInstruction, value, config);
+      }
+    }
+    return value;
+  };
+
   /**
    * Process a value by given command and config
    *
@@ -421,7 +429,7 @@ export default (function() {
    * @param {Array} config
    * @returns {String}
    */
-  FormEngineValidation.processValue = function(command: string, value: string, config: {is_in: string}): string {
+  FormEngineValidation.processValue = function(command: string, value: string, config: FormEngineInputParams): string {
     let newString = '';
     let theValue = '';
     let a = 0;

typo3/sysext/backend/Classes/Form/Element/InputTextElement.php

@@ -133,6 +133,24 @@ public function render(): array
             $evalList[] = 'null';
         }
 
+        $formEngineInputParams = [
+            'field' => $itemName,
+        ];
+        // The `is_in` constraint requires two parameters to work: the "eval" setting and a configuration of the
+        // actually allowed characters
+        if (in_array('is_in', $evalList, true)) {
+            if (($config['is_in'] ?? '') !== '') {
+                $formEngineInputParams['is_in'] = $config['is_in'];
+            } else {
+                $evalList = array_diff($evalList, ['is_in']);
+            }
+        } else {
+            unset($config['is_in']);
+        }
+        if ($evalList !== []) {
+            $formEngineInputParams['evalList'] = implode(',', $evalList);
+        }
+
         $attributes = [
             'value' => '',
             'id' => $fieldId,
@@ -143,11 +161,7 @@ public function render(): array
                 'hasDefaultValue',
             ]),
             'data-formengine-validation-rules' => $this->getValidationDataAsJsonString($config),
-            'data-formengine-input-params' => (string)json_encode([
-                'field' => $itemName,
-                'evalList' => implode(',', $evalList),
-                'is_in' => trim($config['is_in'] ?? ''),
-            ], JSON_THROW_ON_ERROR),
+            'data-formengine-input-params' => (string)json_encode($formEngineInputParams, JSON_THROW_ON_ERROR),
             'data-formengine-input-name' => $itemName,
         ];