A demonstration of work accomplished on Drupal 8 critical issues the week of August 21.

1. GET DRUPAL B DONE

2. Earlier this week…

3. 11 release blockers!

4. Now…

5. 5
8
10
13
15
Monday Tuesday Wednesday Thursday Friday
11 release blockers!

7. OUR DEMO: HOW WE ARE SAVING THE
DRUPAL WORLD FROM THE ZOMBIE
APOCALYPSE OF CRITICAL ISSUES

8. Lots of things were fixed
during the hackathon…
• 4 critical security issues (in
D6/7 *and* 8!)
• 8 blockers to Safe Markup
criticals
• 2 upgrade path criticals
• 1 Entity API critical

10. …so how did we go from 11
to 11?

11. Security

12. SHIPPED!

13. Thanks, Peter! :D

14. Before SA…

15. 5
8
10
13
15
Monday Tuesday Wednesday Thursday Friday
<— Previously hidden
criticals!
After SA…

16. Would love to
demo, but…
Customs confiscated my
Neuralyzer. ;)

17. Safe Markup
CLOSE!

18. Markup in Drupal 7
<script>alert('Mwahahaha!')</script>
&lt;script&gt;alert(&quot;Mwahahaha!&quot;)&lt;/
script&gt;
https://www.drupal.org/writing-secure-code
check_plain()/check_markup()
filter_xss()/filter_xss_admin()
t() + @ or %

19. If you forget…

20. Markup in Drupal 8
<script>alert('Mwahahaha!')</script>
&lt;script&gt;alert(&quot;Mwahahaha!&quot;)&lt;/
script&gt;
"Twig autoescape enabled" change record

21. If you forget…

22. Instances of
SafeMarkup::set()
[meta] Remove every SafeMarkup::set() call
This week! =>

23. Upgrade Path
CLOSE!

24. Sordid tale…
• Beta 12 (June 29) we started requiring
upgrade paths in core patches.
• Beta 13 (July 29) we attempted to
provide an upgrade path to site
builders from Beta 12
• People tested it, found out stuff broke
(silent fails on content updates)
• Now fixing those issues, and adding
better automated tests to mitigate
future regressions.

25. Watch for beta-15 for upgrade
path provided by core, take 2
15

26. …and please, please, stop
testing D8 so we can ship! ;)

27. Scalability
SHIPPED!

28. files/php

29. files/php

30. Replace Symfony container with a Drupal one, stored in cache

32. • Drupal 6/7: more secure for our
customers today
• Drupal 8: more secure for our
customers tomorrow (including
plugging #1 security hole)
• Drupal 8 beta-to-beta upgrade
path two issues away from being
unblocked
• Major milestone for customers
waiting to make the leap into
Drupal 8
• Less Cloud Team angst!
Hackathon
Accomplishments, in short…

33. Thanks!