[BUGFIX] Render class info modal from plain-text data attributes

[CybotTM]

Proposal for option a in #1344 — something concrete to compare against the sanitizer route. Merge only if that is the option you want.

What it does

PhpTextRole::getClassCodeNode() no longer assembles HTML. Signature, flags and summary travel as separate plain-text data-* values, and the modal writes the markup around them:

if (item.dataset.signature) {
  detailParts.push(`<code>${htmlEscape(item.dataset.signature)}</code>`);
}

Every value is escaped exactly once, and no markup crosses the attribute boundary — nothing to sanitize, no allowlist to maintain.

The API summary is decoded on read, so plain text is what travels internally:

$apiInfo['summary'] = html_entity_decode($apiInfo['summary'], ENT_QUOTES | ENT_HTML5, 'UTF-8');

Rendered result for the example from the issue:

data-signature="final class ModifyPageLinkConfigurationEvent"
data-summary="A generic PSR 14 Event … when building a "page link"."

The " there is Twig escaping one real " for the attribute; element.dataset hands the modal a plain quote.

Two deliberate behaviour changes

• The details block for :php-short: loses its second FQN line. data-fqn already carries the FQN and the modal renders it in its own section.
• The zero-width-space entity that str_replace('\\', '​\\', …) inserted around backslashes goes with the HTML blob. It only ever applied to the details string.

Both are visible in the diff and are why this is a proposal rather than something I would merge on my own.

Verification

npm test                          6 files, 27 tests passed
make test-integration ENV=local   Tests: 115, Assertions: 1150, Skipped: 2   OK
make test-unit ENV=local          OK (83 tests, 183 assertions)
make phpstan ENV=local            No errors
make code-style ENV=local         0 of 147 files

PHP 8.5.8. One integration fixture changes, the changelog one; the typo3-file fixture is a non-API role and keeps the escaped plain text from #1343.

ModalDetails.test.js covers what the modal renders, which is the gap #1344 describes: signature and summary become <code> / <em> elements, a quote in the summary stays a quote, plain data-details still works for roles without API info, and markup arriving in either field stays inert. The XSS regression tests from ab24ff7 pass unchanged.

[linawolf]

I think transporting the plain text values is much cleaner. Does this work for all kind of supported languages or only for PHP?

[CybotTM]

Hi @linawolf ,

Does this work for all kind of supported languages or only for PHP?

works for all.
nothing in the template or the modal JS is PHP-specific. The other roles just have no metadata to put in signature / flags / summary yet, only a static sentence.