The callback arguments are unsafe (form values) and the return value must be safe for HTML. See also T395622.
Description
Description
Related Objects
Related Objects
Event Timeline
Comment Actions
This is currently not easy to do because we don't have a general-purpose way to check function-likes: handleMethodCall does a million things and is very reliant on having argument nodes. Some places (like for getQueryInfo handling) use it anyway but it's messy.
Test case I prepared:
$unsafeValidationCallback_noArgs = [ 'type' => 'text', 'validation-callback' => static function() { return $_GET['a']; } ]; $unsafeValidationCallback_oneArg = [ 'type' => 'text', 'validation-callback' => static function ( $value ) { echo $value; return $value; } ]; $unsafeValidationCallback_twoArgs = [ 'type' => 'text', 'validation-callback' => static function ( $value, $allData ) { echo $allData['foo']; return $allData['bar']; } ]; $safeValidationCallback = [ 'type' => 'text', 'validation-callback' => static function ( $value, $allData ) { return htmlspecialchars( $value ) . htmlspecialchars( $allData['x'] ); } ]; $unsafeCallback = static function ( $value ) { echo $value; return $value; }; $indirectUnsafeValidationCallback = [ 'type' => 'text', 'validation-callback' => $unsafeCallback, ];