Bug 39340

Summary: Use of $HtmlTags filter should require another prefilter
Product: Koha Reporter: Phil Ringnalda <phil>
Component: Test SuiteAssignee: Chris Cormack <chris>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: jonathan.druart
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Phil Ringnalda 2025-03-14 20:27:37 UTC
t/lib/QA/TemplateFilters.pm thinks that using $HTMLTags is enough to say you've filtered, but $HTMLTags does no escaping so it isn't enough. You should always either use | html | $HTMLTags or if your string is already escaped use $raw | $HTMLTags to say you've thought about it.

The fix to find them is obvious, just remove line 149 so we don't return if we see $HTMLTags, but I don't know how to fix the part that fixes missing filters.

Since we've already fixed the cases where we were only using $HTMLTags on a TT variable (as security bugs), what's left is a bunch of strings in koha-tmpl/intranet-tmpl/prog/en/modules/about.tt and a mix of values from koha-conf.xml and the string "127.0.0.1" in koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt

The fix for the values from koha-conf.xml is easy, they should be | html filtered. And at first the strings seemed easy to me, just give them | $raw to say we looked at them, but is that right? Is "[% "borrowers" | $HtmlTags tag="strong" %]" done that way to keep that table name from being translatable, so we know it will never need to be escaped?
Comment 1 Phil Ringnalda 2025-03-15 03:18:13 UTC
Nice, the one time I capitalized it correctly was copy-pasted.