22612034607

Committed 03 Mar 2026 07:00AM UTC coverage: 0.0%. Remained the same

Build # 22612034607

Build Type

push

github

Committed by

eliashaeussler

Commit Message

[BUGFIX] Respect `SafeString` when replacing content placeholder

Coverage Stats

0 of 6 new or added lines in 1 file covered. (0.0%)

1 existing line in 1 file now uncovered.

0 of 507 relevant lines covered (0.0%)

0.0 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Classes/DataProcessing/ProcessFormProcessor.php

<?php

declare(strict_types=1);

/*
 * This file is part of the TYPO3 CMS extension "handlebars_forms".
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */

namespace CPSIT\Typo3HandlebarsForms\DataProcessing;

use CPSIT\Typo3HandlebarsForms\Domain;
use DevTheorem\Handlebars;
use Psr\Http\Message;
use Psr\Log;
use Symfony\Component\DependencyInjection;
use TYPO3\CMS\Fluid;
use TYPO3\CMS\Form;
use TYPO3\CMS\Frontend;
use TYPO3Fluid\Fluid as FluidStandalone;

/**
 * ProcessFormProcessor
 *
 * @author Elias Häußler <e.haeussler@familie-redlich.de>
 * @license GPL-2.0-or-later
 */
#[DependencyInjection\Attribute\AutoconfigureTag('data.processor', ['identifier' => 'process-form'])]
final readonly class ProcessFormProcessor implements Frontend\ContentObject\DataProcessorInterface
{
    private const CONTENT_PLACEHOLDER = '###FORM_CONTENT###';

    /**
     * @param DependencyInjection\ServiceLocator<Value\ValueResolver> $valueResolvers
     */
    public function __construct(
        private Log\LoggerInterface $logger,
        private Fluid\Core\Rendering\RenderingContextFactory $renderingContextFactory,
        private Domain\Renderable\ViewModel\FormViewModelBuilder $formRenderableProcessor,
        #[DependencyInjection\Attribute\AutowireLocator('handlebars_forms.value_resolver', defaultIndexMethod: 'getName')]
        private DependencyInjection\ServiceLocator $valueResolvers,
    ) {}

    /**
     * @param array<string, mixed> $contentObjectConfiguration
     * @param array<string, mixed> $processorConfiguration
     * @param array<string, mixed> $processedData
     * @return array<string, mixed>
     */
    public function process(
        Frontend\ContentObject\ContentObjectRenderer $cObj,
        array $contentObjectConfiguration,
        array $processorConfiguration,
        array $processedData,
    ): array {
        $formRuntime = $contentObjectConfiguration['variables.']['form'] ?? null;

        if (!($formRuntime instanceof Form\Domain\Runtime\FormRuntime)) {
            $this->logger->error(
                'Form runtime is not available when trying to process form with plugin uid "{uid}".',
                ['uid' => $cObj->data['uid'] ?? '(unknown)'],
            );

            return $processedData;
        }

        // Create and prepare Fluid rendering context
        $renderingContext = $this->renderingContextFactory->create();
        $renderingContext->setAttribute(Message\ServerRequestInterface::class, $formRuntime->getRequest());
        $renderingContext->getViewHelperVariableContainer()->addOrUpdate(
            Form\ViewHelpers\RenderRenderableViewHelper::class,
            'formRuntime',
            $formRuntime,
        );

        // Render form and process renderables as part of the form's renderChildrenClosure.
        // Since the final rendered form content (which especially contains all relevant hidden fields)
        // is not yet available when processing renderables, we temporarily pass a content placeholder
        // for all configured CONTENT values and replace them with the real content value later.
        $this->formRenderableProcessor->build(
            $formRuntime,
            $renderingContext,
            function (FluidStandalone\Core\ViewHelper\TagBuilder $tagBuilder) use (
                $cObj,
                $formRuntime,
                &$processedData,
                $processorConfiguration,
                $renderingContext,
                &$tag,
            ) {
                $tag = $tagBuilder;
                $tag->setContent(self::CONTENT_PLACEHOLDER);

                $viewModel = new Domain\Renderable\ViewModel\ViewModel($renderingContext, null, $tag);
                $processedData = $this->processRenderable($formRuntime, $processorConfiguration, $cObj, $viewModel) ?? [];

                return '';
            },
        );

        $formContent = $tag?->getContent();

        // Replace content placeholder with final rendered form content
        if ($formContent !== null) {
            array_walk_recursive($processedData, static function (&$value) use ($formContent) {
                $isSafeString = false;

                if ($value instanceof Handlebars\SafeString) {
                    $isSafeString = true;
                    $value = (string)$value;
                }

                if (is_string($value)) {
                    $value = str_replace(self::CONTENT_PLACEHOLDER, $formContent, $value);
                }

                if ($isSafeString) {
                    $value = new Handlebars\SafeString($value);
                }
            });
        }

        return $processedData;
    }

    /**
     * @param array<string, mixed> $configuration
     * @return array<string, mixed>|null
     */
    private function processRenderable(
        Form\Domain\Model\Renderable\RootRenderableInterface $renderable,
        array $configuration,
        Frontend\ContentObject\ContentObjectRenderer $cObj,
        Domain\Renderable\ViewModel\ViewModel $viewModel,
    ): ?array {
        $processedData = [];

        // Early return on configured "if" condition evaluating to false
        if (!$this->checkIf($configuration, $renderable, $cObj, $viewModel)) {
            return null;
        }

        foreach ($configuration as $key => $value) {
            $keyWithoutDot = rtrim($key, '.');
            $keyWithDot = $keyWithoutDot . '.';

            if (is_array($value) && !array_key_exists($keyWithoutDot, $processedData)) {
                $resolvedValue = $this->processRenderable($renderable, $value, $cObj, $viewModel);

                if (is_array($resolvedValue)) {
                    $processedData[$keyWithoutDot] = $resolvedValue;
                }
            }

            if (!is_string($value)) {
                continue;
            }

            $valueConfiguration = $configuration[$keyWithDot] ?? [];

            // Resolve configured value
            if ($this->valueResolvers->has($value)) {
                $resolvedValue = $this->valueResolvers->get($value)->resolve(
                    $renderable,
                    $viewModel,
                    new Value\ValueResolutionContext(
                        $valueConfiguration,
                        fn(
                            array $contextConfiguration,
                            ?Form\Domain\Model\Renderable\RootRenderableInterface $contextRenderable = null,
                            ?Domain\Renderable\ViewModel\ViewModel $contextViewModel = null,
                        ) => $this->processRenderable(
                            $contextRenderable ?? $renderable,
                            $contextConfiguration,
                            $cObj,
                            $contextViewModel ?? $viewModel,
                        ),
                    ),
                );
            } else {
                $resolvedValue = $value;
            }

            // Skip further processing if processed value is not a string (all COR related methods require a string value)
            if (!is_string($resolvedValue)) {
                $processedData[$keyWithoutDot] = $resolvedValue;
                continue;
            }

            // Process value with stdWrap
            if (is_array($valueConfiguration['stdWrap.'] ?? null)) {
                $resolvedValue = $cObj->stdWrap($resolvedValue, $valueConfiguration['stdWrap.']);
            }

            // Skip value if a configured "if" evaluates to false
            if (is_array($valueConfiguration['if.'] ?? null)) {
                $valueConfiguration['if.']['value'] ??= $resolvedValue;

                if (!$this->checkIf($valueConfiguration, $renderable, $cObj, $viewModel)) {
                    continue;
                }
            }

            // Strings can be considered safe, since the relevant escaping is already performed
            // in the view helpers and/or TagBuilder instances when adding attributes
            if (is_string($resolvedValue)) {
                $resolvedValue = new Handlebars\SafeString($resolvedValue);
            }

            $processedData[$keyWithoutDot] = $resolvedValue;
        }

        return $processedData;
    }

    /**
     * @param array<string, mixed> $configuration
     */
    private function checkIf(
        array &$configuration,
        Form\Domain\Model\Renderable\RootRenderableInterface $renderable,
        Frontend\ContentObject\ContentObjectRenderer $cObj,
        Domain\Renderable\ViewModel\ViewModel $viewModel,
    ): bool {
        if (!is_array($configuration['if.'] ?? null)) {
            return true;
        }

        $cObjTemp = clone $cObj;

        if (is_string($configuration['if.']['currentValue'] ?? null) && is_array($configuration['if.']['currentValue.'] ?? null)) {
            $processedValue = $this->processRenderable(
                $renderable,
                [
                    'currentValue' => $configuration['if.']['currentValue'],
                    'currentValue.' => $configuration['if.']['currentValue.'],
                ],
                $cObj,
                $viewModel,
            );

            $cObjTemp->setCurrentVal($processedValue['currentValue'] ?? null);

            unset($configuration['if.']['currentValue'], $configuration['if.']['currentValue.']);
        }

        if (!$cObjTemp->checkIf($configuration['if.'])) {
            return false;
        }

        unset($configuration['if.']);

        return true;
    }
}

1	<?php
2
3	declare(strict_types=1);
4
5	/*
6	* This file is part of the TYPO3 CMS extension "handlebars_forms".
7	*
8	* It is free software; you can redistribute it and/or modify it under
9	* the terms of the GNU General Public License, either version 2
10	* of the License, or any later version.
11	*
12	* For the full copyright and license information, please read the
13	* LICENSE.txt file that was distributed with this source code.
14	*
15	* The TYPO3 project - inspiring people to share!
16	*/
17
18	namespace CPSIT\Typo3HandlebarsForms\DataProcessing;
19
20	use CPSIT\Typo3HandlebarsForms\Domain;
21	use DevTheorem\Handlebars;
22	use Psr\Http\Message;
23	use Psr\Log;
24	use Symfony\Component\DependencyInjection;
25	use TYPO3\CMS\Fluid;
26	use TYPO3\CMS\Form;
27	use TYPO3\CMS\Frontend;
28	use TYPO3Fluid\Fluid as FluidStandalone;
29
30	/**
31	* ProcessFormProcessor
32	*
33	* @author Elias Häußler <e.haeussler@familie-redlich.de>
34	* @license GPL-2.0-or-later
35	*/
36	#[DependencyInjection\Attribute\AutoconfigureTag('data.processor', ['identifier' => 'process-form'])]
37	final readonly class ProcessFormProcessor implements Frontend\ContentObject\DataProcessorInterface
38	{
39	private const CONTENT_PLACEHOLDER = '###FORM_CONTENT###';
40
41	/**
42	* @param DependencyInjection\ServiceLocator<Value\ValueResolver> $valueResolvers
43	*/
44	public function __construct(	×
45	private Log\LoggerInterface $logger,
46	private Fluid\Core\Rendering\RenderingContextFactory $renderingContextFactory,
47	private Domain\Renderable\ViewModel\FormViewModelBuilder $formRenderableProcessor,
48	#[DependencyInjection\Attribute\AutowireLocator('handlebars_forms.value_resolver', defaultIndexMethod: 'getName')]
49	private DependencyInjection\ServiceLocator $valueResolvers,
50	) {}	×
51
52	/**
53	* @param array<string, mixed> $contentObjectConfiguration
54	* @param array<string, mixed> $processorConfiguration
55	* @param array<string, mixed> $processedData
56	* @return array<string, mixed>
57	*/
58	public function process(	×
59	Frontend\ContentObject\ContentObjectRenderer $cObj,
60	array $contentObjectConfiguration,
61	array $processorConfiguration,
62	array $processedData,
63	): array {
64	$formRuntime = $contentObjectConfiguration['variables.']['form'] ?? null;	×
65
66	if (!($formRuntime instanceof Form\Domain\Runtime\FormRuntime)) {	×
67	$this->logger->error(	×
68	'Form runtime is not available when trying to process form with plugin uid "{uid}".',	×
69	['uid' => $cObj->data['uid'] ?? '(unknown)'],	×
70	);	×
71
72	return $processedData;	×
73	}
74
75	// Create and prepare Fluid rendering context
76	$renderingContext = $this->renderingContextFactory->create();	×
77	$renderingContext->setAttribute(Message\ServerRequestInterface::class, $formRuntime->getRequest());	×
78	$renderingContext->getViewHelperVariableContainer()->addOrUpdate(	×
79	Form\ViewHelpers\RenderRenderableViewHelper::class,	×
80	'formRuntime',	×
81	$formRuntime,	×
82	);	×
83
84	// Render form and process renderables as part of the form's renderChildrenClosure.
85	// Since the final rendered form content (which especially contains all relevant hidden fields)
86	// is not yet available when processing renderables, we temporarily pass a content placeholder
87	// for all configured CONTENT values and replace them with the real content value later.
88	$this->formRenderableProcessor->build(	×
89	$formRuntime,	×
90	$renderingContext,	×
91	function (FluidStandalone\Core\ViewHelper\TagBuilder $tagBuilder) use (	×
92	$cObj,	×
93	$formRuntime,	×
94	&$processedData,	×
95	$processorConfiguration,	×
96	$renderingContext,	×
97	&$tag,	×
98	) {	×
99	$tag = $tagBuilder;	×
100	$tag->setContent(self::CONTENT_PLACEHOLDER);	×
101
102	$viewModel = new Domain\Renderable\ViewModel\ViewModel($renderingContext, null, $tag);	×
103	$processedData = $this->processRenderable($formRuntime, $processorConfiguration, $cObj, $viewModel) ?? [];	×
104
105	return '';	×
106	},	×
107	);	×
108
109	$formContent = $tag?->getContent();	×
110
111	// Replace content placeholder with final rendered form content
112	if ($formContent !== null) {	×
113	array_walk_recursive($processedData, static function (&$value) use ($formContent) {	×
NEW 114	$isSafeString = false;	×
115
NEW 116	if ($value instanceof Handlebars\SafeString) {	×
NEW 117	$isSafeString = true;	×
NEW 118	$value = (string)$value;	×
119	}
120
121	if (is_string($value)) {	×
122	$value = str_replace(self::CONTENT_PLACEHOLDER, $formContent, $value);	×
123	}
124
NEW 125	if ($isSafeString) {	×
NEW 126	$value = new Handlebars\SafeString($value);	×
127	}
UNCOV 128	});	×
129	}
130
131	return $processedData;	×
132	}
133
134	/**
135	* @param array<string, mixed> $configuration
136	* @return array<string, mixed>\|null
137	*/
138	private function processRenderable(	×
139	Form\Domain\Model\Renderable\RootRenderableInterface $renderable,
140	array $configuration,
141	Frontend\ContentObject\ContentObjectRenderer $cObj,
142	Domain\Renderable\ViewModel\ViewModel $viewModel,
143	): ?array {
144	$processedData = [];	×
145
146	// Early return on configured "if" condition evaluating to false
147	if (!$this->checkIf($configuration, $renderable, $cObj, $viewModel)) {	×
148	return null;	×
149	}
150
151	foreach ($configuration as $key => $value) {	×
152	$keyWithoutDot = rtrim($key, '.');	×
153	$keyWithDot = $keyWithoutDot . '.';	×
154
155	if (is_array($value) && !array_key_exists($keyWithoutDot, $processedData)) {	×
156	$resolvedValue = $this->processRenderable($renderable, $value, $cObj, $viewModel);	×
157
158	if (is_array($resolvedValue)) {	×
159	$processedData[$keyWithoutDot] = $resolvedValue;	×
160	}
161	}
162
163	if (!is_string($value)) {	×
164	continue;	×
165	}
166
167	$valueConfiguration = $configuration[$keyWithDot] ?? [];	×
168
169	// Resolve configured value
170	if ($this->valueResolvers->has($value)) {	×
171	$resolvedValue = $this->valueResolvers->get($value)->resolve(	×
172	$renderable,	×
173	$viewModel,	×
174	new Value\ValueResolutionContext(	×
175	$valueConfiguration,	×
176	fn(	×
177	array $contextConfiguration,	×
178	?Form\Domain\Model\Renderable\RootRenderableInterface $contextRenderable = null,	×
179	?Domain\Renderable\ViewModel\ViewModel $contextViewModel = null,	×
180	) => $this->processRenderable(	×
181	$contextRenderable ?? $renderable,	×
182	$contextConfiguration,	×
183	$cObj,	×
184	$contextViewModel ?? $viewModel,	×
185	),	×
186	),	×
187	);	×
188	} else {
189	$resolvedValue = $value;	×
190	}
191
192	// Skip further processing if processed value is not a string (all COR related methods require a string value)
193	if (!is_string($resolvedValue)) {	×
194	$processedData[$keyWithoutDot] = $resolvedValue;	×
195	continue;	×
196	}
197
198	// Process value with stdWrap
199	if (is_array($valueConfiguration['stdWrap.'] ?? null)) {	×
200	$resolvedValue = $cObj->stdWrap($resolvedValue, $valueConfiguration['stdWrap.']);	×
201	}
202
203	// Skip value if a configured "if" evaluates to false
204	if (is_array($valueConfiguration['if.'] ?? null)) {	×
205	$valueConfiguration['if.']['value'] ??= $resolvedValue;	×
206
207	if (!$this->checkIf($valueConfiguration, $renderable, $cObj, $viewModel)) {	×
208	continue;	×
209	}
210	}
211
212	// Strings can be considered safe, since the relevant escaping is already performed
213	// in the view helpers and/or TagBuilder instances when adding attributes
214	if (is_string($resolvedValue)) {	×
215	$resolvedValue = new Handlebars\SafeString($resolvedValue);	×
216	}
217
218	$processedData[$keyWithoutDot] = $resolvedValue;	×
219	}
220
221	return $processedData;	×
222	}
223
224	/**
225	* @param array<string, mixed> $configuration
226	*/
227	private function checkIf(	×
228	array &$configuration,
229	Form\Domain\Model\Renderable\RootRenderableInterface $renderable,
230	Frontend\ContentObject\ContentObjectRenderer $cObj,
231	Domain\Renderable\ViewModel\ViewModel $viewModel,
232	): bool {
233	if (!is_array($configuration['if.'] ?? null)) {	×
234	return true;	×
235	}
236
237	$cObjTemp = clone $cObj;	×
238
239	if (is_string($configuration['if.']['currentValue'] ?? null) && is_array($configuration['if.']['currentValue.'] ?? null)) {	×
240	$processedValue = $this->processRenderable(	×
241	$renderable,	×
242	[	×
243	'currentValue' => $configuration['if.']['currentValue'],	×
244	'currentValue.' => $configuration['if.']['currentValue.'],	×
245	],	×
246	$cObj,	×
247	$viewModel,	×
248	);	×
249
250	$cObjTemp->setCurrentVal($processedValue['currentValue'] ?? null);	×
251
252	unset($configuration['if.']['currentValue'], $configuration['if.']['currentValue.']);	×
253	}
254
255	if (!$cObjTemp->checkIf($configuration['if.'])) {	×
256	return false;	×
257	}
258
259	unset($configuration['if.']);	×
260
261	return true;	×
262	}
263	}

CPS-IT / handlebars-forms / 22612034607

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous