Update to Drupal 8.0.0 beta 14. For more information, see https://drupal.org/node/2544542

core/lib/Drupal/Core/Routing/LocalAwareRedirectResponseTrait.php

@@ -0,0 +1,57 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Core\Routing\LocalAwareRedirectResponseTrait.
+ */
+
+namespace Drupal\Core\Routing;
+
+use Drupal\Component\Utility\UrlHelper;
+
+/**
+ * Provides a trait which ensures that a URL is safe to redirect to.
+ */
+trait LocalAwareRedirectResponseTrait {
+
+  /**
+   * The request context.
+   *
+   * @var \Drupal\Core\Routing\RequestContext
+   */
+  protected $requestContext;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function isLocal($url) {
+    return !UrlHelper::isExternal($url) || UrlHelper::externalIsLocal($url, $this->getRequestContext()->getCompleteBaseUrl());
+  }
+
+  /**
+   * Returns the request context.
+   *
+   * @return \Drupal\Core\Routing\RequestContext
+   */
+  protected function getRequestContext() {
+    if (!isset($this->requestContext)) {
+      $this->requestContext = \Drupal::service('router.request_context');
+    }
+    return $this->requestContext;
+  }
+
+  /**
+   * Sets the request context.
+   *
+   * @param \Drupal\Core\Routing\RequestContext $request_context
+   *   The request context.
+   *
+   * @return $this
+   */
+  public function setRequestContext(RequestContext $request_context) {
+    $this->requestContext = $request_context;
+
+    return $this;
+  }
+
+}

core/lib/Drupal/Core/Routing/LocalRedirectResponse.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Core\Routing\LocalRedirectResponse.
+ */
+
+namespace Drupal\Core\Routing;
+
+use Drupal\Component\HttpFoundation\SecuredRedirectResponse;
+
+/**
+ * Provides a redirect response which cannot redirect to an external URL.
+ */
+class LocalRedirectResponse extends SecuredRedirectResponse {
+
+  use LocalAwareRedirectResponseTrait {
+    LocalAwareRedirectResponseTrait::isLocal as isSafe;
+  }
+
+}

core/lib/Drupal/Core/Routing/NullGenerator.php

@@ -7,7 +7,7 @@
 
 namespace Drupal\Core\Routing;
 
-use Drupal\Core\Cache\CacheableMetadata;
+use Drupal\Core\Render\BubbleableMetadata;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Routing\RequestContext as SymfonyRequestContext;
 use Symfony\Component\Routing\Exception\RouteNotFoundException;
@@ -51,7 +51,7 @@ class NullGenerator extends UrlGenerator {
   /**
    * {@inheritdoc}
    */
-  protected function processRoute($name, Route $route, array &$parameters, CacheableMetadata $cacheable_metadata = NULL) {
+  protected function processRoute($name, Route $route, array &$parameters, BubbleableMetadata $bubbleable_metadata = NULL) {
   }
 
   /**
@@ -76,7 +76,7 @@ class NullGenerator extends UrlGenerator {
   /**
    * Overrides Drupal\Core\Routing\UrlGenerator::processPath().
    */
-  protected function processPath($path, &$options = array(), CacheableMetadata $cacheable_metadata = NULL) {
+  protected function processPath($path, &$options = array(), BubbleableMetadata $bubbleable_metadata = NULL) {
     return $path;
   }
 }

core/lib/Drupal/Core/Routing/RequestFormatRouteFilter.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\Core\Routing;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Exception\NotAcceptableHttpException;
 use Symfony\Component\Routing\Route;
@@ -51,7 +50,7 @@ class RequestFormatRouteFilter implements RouteFilterInterface {
     // We do not throw a
     // \Symfony\Component\Routing\Exception\ResourceNotFoundException here
     // because we don't want to return a 404 status code, but rather a 406.
-    throw new NotAcceptableHttpException(SafeMarkup::format('No route found for the specified format @format.', ['@format' => $format]));
+    throw new NotAcceptableHttpException("No route found for the specified format $format.");
   }
 
 }

core/lib/Drupal/Core/Routing/TrustedRedirectResponse.php

@@ -0,0 +1,56 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Core\Routing\TrustedRedirectResponse.
+ */
+
+namespace Drupal\Core\Routing;
+
+use Drupal\Component\HttpFoundation\SecuredRedirectResponse;
+
+/**
+ * Provides a redirect response which contains trusted URLs.
+ *
+ * Use this class in case you know that you want to redirect to an external URL.
+ */
+class TrustedRedirectResponse extends SecuredRedirectResponse {
+
+  use LocalAwareRedirectResponseTrait;
+
+  /**
+   * A list of trusted URLs, which are safe to redirect to.
+   *
+   * @var string[]
+   */
+  protected $trustedUrls = array();
+
+  /**
+   * {@inheritdoc}
+   */
+  public function __construct($url, $status = 302, $headers = array()) {
+    $this->trustedUrls[$url] = TRUE;
+    parent::__construct($url, $status, $headers);
+  }
+
+  /**
+   * Sets the target URL to a trusted URL.
+   *
+   * @param string $url
+   *   A trusted URL.
+   *
+   * @return $this
+   */
+  public function setTrustedTargetUrl($url) {
+    $this->trustedUrls[$url] = TRUE;
+    return $this->setTargetUrl($url);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function isSafe($url) {
+    return !empty($this->trustedUrls[$url]) || $this->isLocal($url);
+  }
+
+}

core/lib/Drupal/Core/Routing/UrlGenerator.php

@@ -7,8 +7,8 @@
 
 namespace Drupal\Core\Routing;
 
-use Drupal\Core\Cache\CacheableMetadata;
 use Drupal\Core\GeneratedUrl;
+use Drupal\Core\Render\BubbleableMetadata;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Routing\RequestContext as SymfonyRequestContext;
 use Symfony\Component\Routing\Route as SymfonyRoute;
@@ -54,14 +54,19 @@ class UrlGenerator implements UrlGeneratorInterface {
   /**
    * Overrides characters that will not be percent-encoded in the path segment.
    *
+   * The first two elements are the first two parameters of str_replace(), so
+   * if you override this variable you can also use arrays for the encoded
+   * and decoded characters.
+   *
    * @see \Symfony\Component\Routing\Generator\UrlGenerator
    */
-  protected $decodedChars = array(
+  protected $decodedChars = [
     // the slash can be used to designate a hierarchical structure and we want allow using it with this meaning
     // some webservers don't allow the slash in encoded form in the path for security reasons anyway
     // see http://stackoverflow.com/questions/4069002/http-400-if-2f-part-of-get-url-in-jboss
-    '%2F' => '/',
-  );
+    '%2F', // Map from these encoded characters.
+    '/', // Map to these decoded characters.
+  ];
 
   /**
    *  Constructs a new generator object.
@@ -72,19 +77,18 @@ class UrlGenerator implements UrlGeneratorInterface {
    *   The path processor to convert the system path to one suitable for urls.
    * @param \Drupal\Core\RouteProcessor\OutboundRouteProcessorInterface $route_processor
    *   The route processor.
-   * @param \Drupal\Core\Config\ConfigFactoryInterface $config
-   *    The config factory.
    * @param \Symfony\Component\HttpFoundation\RequestStack $request_stack
    *   A request stack object.
+   * @param string[] $filter_protocols
+   *   (optional) An array of protocols allowed for URL generation.
    */
-  public function __construct(RouteProviderInterface $provider, OutboundPathProcessorInterface $path_processor, OutboundRouteProcessorInterface $route_processor, ConfigFactoryInterface $config, RequestStack $request_stack) {
+  public function __construct(RouteProviderInterface $provider, OutboundPathProcessorInterface $path_processor, OutboundRouteProcessorInterface $route_processor, RequestStack $request_stack, array $filter_protocols = ['http', 'https']) {
     $this->provider = $provider;
     $this->context = new RequestContext();
 
     $this->pathProcessor = $path_processor;
     $this->routeProcessor = $route_processor;
-    $allowed_protocols = $config->get('system.filter')->get('protocols') ?: array('http', 'https');
-    UrlHelper::setAllowedProtocols($allowed_protocols);
+    UrlHelper::setAllowedProtocols($filter_protocols);
     $this->requestStack = $request_stack;
   }
 
@@ -212,7 +216,7 @@ class UrlGenerator implements UrlGeneratorInterface {
     }
 
     // The contexts base URL is already encoded (see Symfony\Component\HttpFoundation\Request)
-    $url = strtr(rawurlencode($url), $this->decodedChars);
+    $url = str_replace($this->decodedChars[0], $this->decodedChars[1], rawurlencode($url));
 
     // Drupal paths rarely include dots, so skip this processing if possible.
     if (strpos($url, '/.') !== FALSE) {
@@ -277,13 +281,10 @@ class UrlGenerator implements UrlGeneratorInterface {
   /**
    * {@inheritdoc}
    */
-  public function generateFromRoute($name, $parameters = array(), $options = array(), $collect_cacheability_metadata = FALSE) {
-    $generated_url = $collect_cacheability_metadata ? new GeneratedUrl() : NULL;
-
+  public function generateFromRoute($name, $parameters = array(), $options = array(), $collect_bubbleable_metadata = FALSE) {
     $options += array('prefix' => '');
     $route = $this->getRoute($name);
-    $name = $this->getRouteDebugMessage($name);
-    $this->processRoute($name, $route, $parameters, $generated_url);
+    $generated_url = $collect_bubbleable_metadata ? new GeneratedUrl() : NULL;
 
     $query_params = [];
     // Symfony adds any parameters that are not path slugs as query strings.
@@ -291,6 +292,23 @@ class UrlGenerator implements UrlGeneratorInterface {
       $query_params = $options['query'];
     }
 
+    $fragment = '';
+    if (isset($options['fragment'])) {
+      if (($fragment = trim($options['fragment'])) != '') {
+        $fragment = '#' . $fragment;
+      }
+    }
+
+    // Generate a relative URL having no path, just query string and fragment.
+    if ($route->getOption('_no_path')) {
+      $query = $query_params ? '?' . http_build_query($query_params, '', '&') : '';
+      $url = $query . $fragment;
+      return $collect_bubbleable_metadata ? $generated_url->setGeneratedUrl($url) : $url;
+    }
+
+    $options += array('prefix' => '');
+    $name = $this->getRouteDebugMessage($name);
+    $this->processRoute($name, $route, $parameters, $generated_url);
     $path = $this->getInternalPathFromRoute($name, $route, $parameters, $query_params);
     $path = $this->processPath($path, $options, $generated_url);
 
@@ -300,13 +318,6 @@ class UrlGenerator implements UrlGeneratorInterface {
       $path = '/' . str_replace('%2F', '/', rawurlencode($prefix)) . $path;
     }
 
-    $fragment = '';
-    if (isset($options['fragment'])) {
-      if (($fragment = trim($options['fragment'])) != '') {
-        $fragment = '#' . $fragment;
-      }
-    }
-
     // The base_url might be rewritten from the language rewrite in domain mode.
     if (isset($options['base_url'])) {
       $base_url = $options['base_url'];
@@ -321,20 +332,15 @@ class UrlGenerator implements UrlGeneratorInterface {
       }
 
       $url = $base_url . $path . $fragment;
-      return $collect_cacheability_metadata ? $generated_url->setGeneratedUrl($url) : $url;
+      return $collect_bubbleable_metadata ? $generated_url->setGeneratedUrl($url) : $url;
     }
 
     $base_url = $this->context->getBaseUrl();
 
     $absolute = !empty($options['absolute']);
     if (!$absolute || !$host = $this->context->getHost()) {
-
-      if ($route->getOption('_only_fragment')) {
-        return $collect_cacheability_metadata ? $generated_url->setGeneratedUrl($fragment) : $fragment;
-      }
-
       $url = $base_url . $path . $fragment;
-      return $collect_cacheability_metadata ? $generated_url->setGeneratedUrl($url) : $url;
+      return $collect_bubbleable_metadata ? $generated_url->setGeneratedUrl($url) : $url;
     }
 
     // Prepare an absolute URL by getting the correct scheme, host and port from
@@ -355,19 +361,19 @@ class UrlGenerator implements UrlGeneratorInterface {
     } elseif ('https' === $scheme && 443 != $this->context->getHttpsPort()) {
       $port = ':' . $this->context->getHttpsPort();
     }
-    if ($collect_cacheability_metadata) {
+    if ($collect_bubbleable_metadata) {
       $generated_url->addCacheContexts(['url.site']);
     }
     $url = $scheme . '://' . $host . $port . $base_url . $path . $fragment;
-    return $collect_cacheability_metadata ? $generated_url->setGeneratedUrl($url) : $url;
+    return $collect_bubbleable_metadata ? $generated_url->setGeneratedUrl($url) : $url;
 
   }
 
   /**
    * {@inheritdoc}
    */
-  public function generateFromPath($path = NULL, $options = array(), $collect_cacheability_metadata = FALSE) {
-    $generated_url = $collect_cacheability_metadata ? new GeneratedUrl() : NULL;
+  public function generateFromPath($path = NULL, $options = array(), $collect_bubbleable_metadata = FALSE) {
+    $generated_url = $collect_bubbleable_metadata ? new GeneratedUrl() : NULL;
 
     $request = $this->requestStack->getCurrentRequest();
     $current_base_path = $request->getBasePath() . '/';
@@ -432,7 +438,7 @@ class UrlGenerator implements UrlGeneratorInterface {
       }
       // Reassemble.
       $url = $path . $options['fragment'];
-      return $collect_cacheability_metadata ? $generated_url->setGeneratedUrl($url) : $url;
+      return $collect_bubbleable_metadata ? $generated_url->setGeneratedUrl($url) : $url;
     }
     else {
       $path = ltrim($this->processPath('/' . $path, $options, $generated_url), '/');
@@ -463,20 +469,20 @@ class UrlGenerator implements UrlGeneratorInterface {
     $base = $options['absolute'] ? $options['base_url'] : $current_base_path;
     $prefix = empty($path) ? rtrim($options['prefix'], '/') : $options['prefix'];
 
-    if ($options['absolute'] && $collect_cacheability_metadata) {
+    if ($options['absolute'] && $collect_bubbleable_metadata) {
       $generated_url->addCacheContexts(['url.site']);
     }
 
     $path = str_replace('%2F', '/', rawurlencode($prefix . $path));
     $query = $options['query'] ? ('?' . UrlHelper::buildQuery($options['query'])) : '';
     $url = $base . $options['script'] . $path . $query . $options['fragment'];
-    return $collect_cacheability_metadata ? $generated_url->setGeneratedUrl($url) : $url;
+    return $collect_bubbleable_metadata ? $generated_url->setGeneratedUrl($url) : $url;
   }
 
   /**
    * Passes the path to a processor manager to allow alterations.
    */
-  protected function processPath($path, &$options = array(), CacheableMetadata $cacheable_metadata = NULL) {
+  protected function processPath($path, &$options = array(), BubbleableMetadata $bubbleable_metadata = NULL) {
     // Router-based paths may have a querystring on them.
     if ($query_pos = strpos($path, '?')) {
       // We don't need to do a strict check here because position 0 would mean we
@@ -488,7 +494,7 @@ class UrlGenerator implements UrlGeneratorInterface {
       $actual_path = $path;
       $query_string = '';
     }
-    $path = $this->pathProcessor->processOutbound($actual_path === '/' ? $actual_path : rtrim($actual_path, '/'), $options, $this->requestStack->getCurrentRequest(), $cacheable_metadata);
+    $path = $this->pathProcessor->processOutbound($actual_path === '/' ? $actual_path : rtrim($actual_path, '/'), $options, $this->requestStack->getCurrentRequest(), $bubbleable_metadata);
     $path .= $query_string;
     return $path;
   }
@@ -502,11 +508,11 @@ class UrlGenerator implements UrlGeneratorInterface {
    *   The route object to process.
    * @param array $parameters
    *   An array of parameters to be passed to the route compiler.
-   * @param \Drupal\Core\Cache\CacheableMetadata $cacheable_metadata
-   *   (optional) Object to collect route processors' cacheability.
+   * @param \Drupal\Core\Render\BubbleableMetadata $bubbleable_metadata
+   *   (optional) Object to collect route processors' bubbleable metadata.
    */
-  protected function processRoute($name, SymfonyRoute $route, array &$parameters, CacheableMetadata $cacheable_metadata = NULL) {
-    $this->routeProcessor->processOutbound($name, $route, $parameters, $cacheable_metadata);
+  protected function processRoute($name, SymfonyRoute $route, array &$parameters, BubbleableMetadata $bubbleable_metadata = NULL) {
+    $this->routeProcessor->processOutbound($name, $route, $parameters, $bubbleable_metadata);
   }
 
   /**

core/lib/Drupal/Core/Routing/UrlGeneratorInterface.php

@@ -70,14 +70,14 @@ interface UrlGeneratorInterface extends VersatileGeneratorInterface {
    *     set if _url() is invoked by Drupal\Core\Entity\Entity::uri().
    *   - 'entity': The entity object (such as a node) for which the URL is being
    *     generated. Only set if _url() is invoked by Drupal\Core\Entity\Entity::uri().
-   * @param bool $collect_cacheability_metadata
+   * @param bool $collect_bubbleable_metadata
    *   (optional) Defaults to FALSE. When TRUE, both the generated URL and its
-   *   associated cacheability metadata are returned.
+   *   associated bubbleable metadata are returned.
    *
    * @return string|\Drupal\Core\GeneratedUrl
    *   A string containing a URL to the given path.
-   *   When $collect_cacheability_metadata is TRUE, a GeneratedUrl object is
-   *   returned, containing the generated URL plus cacheability metadata.
+   *   When $collect_bubbleable_metadata is TRUE, a GeneratedUrl object is
+   *   returned, containing the generated URL plus bubbleable metadata.
    *
    * @throws \Drupal\Core\Routing\GeneratorNotInitializedException.
    *
@@ -92,7 +92,7 @@ interface UrlGeneratorInterface extends VersatileGeneratorInterface {
    * @see \Drupal\Core\Url
    * @see \Drupal\Core\GeneratedUrl
    */
-  public function generateFromPath($path = NULL, $options = array(), $collect_cacheability_metadata = FALSE);
+  public function generateFromPath($path = NULL, $options = array(), $collect_bubbleable_metadata = FALSE);
 
   /**
    * Gets the internal path (system path) of a route.
@@ -142,14 +142,14 @@ interface UrlGeneratorInterface extends VersatileGeneratorInterface {
    *     modify the base URL when a language dependent URL requires so.
    *   - 'prefix': Only used internally, to modify the path when a language
    *     dependent URL requires so.
-   * @param bool $collect_cacheability_metadata
+   * @param bool $collect_bubbleable_metadata
    *   (optional) Defaults to FALSE. When TRUE, both the generated URL and its
-   *   associated cacheability metadata are returned.
+   *   associated bubbleable metadata are returned.
    *
    * @return string|\Drupal\Core\GeneratedUrl
    *   The generated URL for the given route.
-   *   When $collect_cacheability_metadata is TRUE, a GeneratedUrl object is
-   *   returned, containing the generated URL plus cacheability metadata.
+   *   When $collect_bubbleable_metadata is TRUE, a GeneratedUrl object is
+   *   returned, containing the generated URL plus bubbleable metadata.
    *
    * @throws \Symfony\Component\Routing\Exception\RouteNotFoundException
    *   Thrown when the named route does not exist.
@@ -159,6 +159,6 @@ interface UrlGeneratorInterface extends VersatileGeneratorInterface {
    *   Thrown when a parameter value for a placeholder is not correct because it
    *   does not match the requirement.
    */
-  public function generateFromRoute($name, $parameters = array(), $options = array(), $collect_cacheability_metadata = FALSE);
+  public function generateFromRoute($name, $parameters = array(), $options = array(), $collect_bubbleable_metadata = FALSE);
 
 }