[BUGFIX] Do not render empty eval and is_in instructions

This commit checks whether `eval` and `is_in` are not empty before they
are used as "input params" for the JavaScript part of the FormEngine.

Also, a plausibility check is added to ensure `eval=is_in` and a
non-falsy `is_in` configuration are given.

Resolves: #103184
Releases: main, 12.4
Change-Id: I23da4483f1b35b0720ce59d07847fe01ead9a461
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83085
Reviewed-by: Andreas Kienast <[email protected]>
Tested-by: core-ci <[email protected]>
Reviewed-by: Markus Klein <[email protected]>
Tested-by: Oliver Bartsch <[email protected]>
Tested-by: Andreas Kienast <[email protected]>
Reviewed-by: Oliver Bartsch <[email protected]>
Tested-by: Markus Klein <[email protected]>

Author: andreaskienast

Build/Sources/TypeScript/backend/form-engine-validation.ts

@@ -29,6 +29,7 @@ import { selector } from '@typo3/core/literals';
 
 type FormEngineFieldElement = HTMLInputElement|HTMLTextAreaElement|HTMLSelectElement;
 type CustomEvaluationCallback = (value: string) => string;
+type FormEngineInputParams = { field: string, evalList?: string, is_in?: string };
 
 export default (function() {
 
@@ -106,12 +107,7 @@ export default (function() {
 
     if (field.dataset.config !== undefined) {
       const config = JSON.parse(field.dataset.config);
-      const evalList = Utility.trimExplode(',', config.evalList);
-      let value = field.value;
-
-      for (let i = 0; i < evalList.length; i++) {
-        value = FormEngineValidation.formatValue(evalList[i], value, config);
-      }
+      const value = FormEngineValidation.formatByEvals(config, field.value);
       if (value.length) {
         humanReadableField.value = value;
       }
@@ -131,6 +127,16 @@ export default (function() {
     }
   };
 
+  FormEngineValidation.formatByEvals = function(config: FormEngineInputParams, value: string): string {
+    if (config.evalList !== undefined) {
+      const evalList = Utility.trimExplode(',', config.evalList);
+      for (const evalInstruction of evalList) {
+        value = FormEngineValidation.formatValue(evalInstruction, value, config);
+      }
+    }
+    return value;
+  };
+
   /**
    * Format field value
    */
@@ -206,17 +212,8 @@ export default (function() {
 
     if (field.dataset.config !== undefined) {
       const config = JSON.parse(field.dataset.config);
-      const evalList = Utility.trimExplode(',', config.evalList);
-      let newValue = humanReadableField.value;
-
-      for (let i = 0; i < evalList.length; i++) {
-        newValue = FormEngineValidation.processValue(evalList[i], newValue, config);
-      }
-
-      let formattedValue = newValue;
-      for (let i = 0; i < evalList.length; i++) {
-        formattedValue = FormEngineValidation.formatValue(evalList[i], formattedValue, config);
-      }
+      const newValue = FormEngineValidation.processByEvals(config, humanReadableField.value);
+      const formattedValue = FormEngineValidation.formatByEvals(config, newValue);
 
       // Only update fields if value actually changed
       if (field.value !== newValue) {
@@ -402,10 +399,20 @@ export default (function() {
     return returnValue;
   };
 
+  FormEngineValidation.processByEvals = function(config: FormEngineInputParams, value: string): string {
+    if (config.evalList !== undefined) {
+      const evalList = Utility.trimExplode(',', config.evalList);
+      for (const evalInstruction of evalList) {
+        value = FormEngineValidation.processValue(evalInstruction, value, config);
+      }
+    }
+    return value;
+  };
+
   /**
    * Process a value by given command and config
    */
-  FormEngineValidation.processValue = function(command: string, value: string, config: {is_in: string}): string {
+  FormEngineValidation.processValue = function(command: string, value: string, config: FormEngineInputParams): string {
     let newString = '';
     let theValue = '';
     let a = 0;

typo3/sysext/backend/Classes/Form/Element/InputTextElement.php

@@ -131,6 +131,24 @@ public function render(): array
             $evalList[] = 'null';
         }
 
+        $formEngineInputParams = [
+            'field' => $itemName,
+        ];
+        // The `is_in` constraint requires two parameters to work: the "eval" setting and a configuration of the
+        // actually allowed characters
+        if (in_array('is_in', $evalList, true)) {
+            if (($config['is_in'] ?? '') !== '') {
+                $formEngineInputParams['is_in'] = $config['is_in'];
+            } else {
+                $evalList = array_diff($evalList, ['is_in']);
+            }
+        } else {
+            unset($config['is_in']);
+        }
+        if ($evalList !== []) {
+            $formEngineInputParams['evalList'] = implode(',', $evalList);
+        }
+
         $attributes = [
             'value' => '',
             'id' => $fieldId,
@@ -141,11 +159,7 @@ public function render(): array
                 'hasDefaultValue',
             ]),
             'data-formengine-validation-rules' => $this->getValidationDataAsJsonString($config),
-            'data-formengine-input-params' => (string)json_encode([
-                'field' => $itemName,
-                'evalList' => implode(',', $evalList),
-                'is_in' => trim($config['is_in'] ?? ''),
-            ], JSON_THROW_ON_ERROR),
+            'data-formengine-input-params' => (string)json_encode($formEngineInputParams, JSON_THROW_ON_ERROR),
             'data-formengine-input-name' => $itemName,
         ];