Bug 39340 - Use of $HtmlTags filter should require another prefilter
Summary: Use of $HtmlTags filter should require another prefilter
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Test Suite (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Chris Cormack
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-14 20:27 UTC by Phil Ringnalda
Modified: 2025-03-15 03:18 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2025-03-14 20:27:37 UTC
t/lib/QA/TemplateFilters.pm thinks that using $HTMLTags is enough to say you've filtered, but $HTMLTags does no escaping so it isn't enough. You should always either use | html | $HTMLTags or if your string is already escaped use $raw | $HTMLTags to say you've thought about it.

The fix to find them is obvious, just remove line 149 so we don't return if we see $HTMLTags, but I don't know how to fix the part that fixes missing filters.

Since we've already fixed the cases where we were only using $HTMLTags on a TT variable (as security bugs), what's left is a bunch of strings in koha-tmpl/intranet-tmpl/prog/en/modules/about.tt and a mix of values from koha-conf.xml and the string "127.0.0.1" in koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt

The fix for the values from koha-conf.xml is easy, they should be | html filtered. And at first the strings seemed easy to me, just give them | $raw to say we looked at them, but is that right? Is "[% "borrowers" | $HtmlTags tag="strong" %]" done that way to keep that table name from being translatable, so we know it will never need to be escaped?
Comment 1 Phil Ringnalda 2025-03-15 03:18:13 UTC
Nice, the one time I capitalized it correctly was copy-pasted.