clean install

web/core/modules/editor/src/Ajax/EditorDialogSave.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace Drupal\editor\Ajax;
+
+use Drupal\Core\Ajax\CommandInterface;
+
+/**
+ * Provides an AJAX command for saving the contents of an editor dialog.
+ *
+ * This command is implemented in editor.dialog.js in
+ * Drupal.AjaxCommands.prototype.editorDialogSave.
+ */
+class EditorDialogSave implements CommandInterface {
+
+  /**
+   * An array of values that will be passed back to the editor by the dialog.
+   *
+   * @var array
+   */
+  protected array $values;
+
+  /**
+   * Constructs an EditorDialogSave object.
+   *
+   * @param array $values
+   *   The values that should be passed to the form constructor in Drupal.
+   */
+  public function __construct(array $values) {
+    $this->values = $values;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function render() {
+    return [
+      'command' => 'editorDialogSave',
+      'values' => $this->values,
+    ];
+  }
+
+}

web/core/modules/editor/src/Annotation/Editor.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Drupal\editor\Annotation;
+
+use Drupal\Component\Annotation\Plugin;
+
+/**
+ * Defines an Editor annotation object.
+ *
+ * Plugin Namespace: Plugin\Editor
+ *
+ * Text editor plugin implementations need to define a plugin definition array
+ * through annotation. These definition arrays may be altered through
+ * hook_editor_info_alter(). The definition includes the following keys:
+ *
+ * - id: The unique, system-wide identifier of the text editor. Typically named
+ *   the same as the editor library.
+ * - label: The human-readable name of the text editor, translated.
+ * - supports_content_filtering: Whether the editor supports "allowed content
+ *   only" filtering.
+ * - supports_inline_editing: Whether the editor supports the inline editing
+ *   provided by the Edit module.
+ * - is_xss_safe: Whether this text editor is not vulnerable to XSS attacks.
+ * - supported_element_types: On which form element #types this text editor is
+ *   capable of working.
+ *
+ * A complete sample plugin definition should be defined as in this example:
+ *
+ * @code
+ * @Editor(
+ *   id = "my_editor",
+ *   label = @Translation("My Editor"),
+ *   supports_content_filtering = FALSE,
+ *   supports_inline_editing = FALSE,
+ *   is_xss_safe = FALSE,
+ *   supported_element_types = {
+ *     "textarea",
+ *     "textfield",
+ *   }
+ * )
+ * @endcode
+ *
+ * For a working example, see \Drupal\ckeditor5\Plugin\Editor\CKEditor5
+ *
+ * @see \Drupal\editor\Plugin\EditorPluginInterface
+ * @see \Drupal\editor\Plugin\EditorBase
+ * @see \Drupal\editor\Plugin\EditorManager
+ * @see hook_editor_info_alter()
+ * @see plugin_api
+ *
+ * @Annotation
+ */
+class Editor extends Plugin {
+
+  /**
+   * The plugin ID.
+   *
+   * @var string
+   */
+  public $id;
+
+  /**
+   * The human-readable name of the editor plugin.
+   *
+   * @ingroup plugin_translatable
+   *
+   * @var \Drupal\Core\Annotation\Translation
+   */
+  public $label;
+
+  /**
+   * Whether the editor supports "allowed content only" filtering.
+   *
+   * @var bool
+   */
+  public $supports_content_filtering;
+
+  /**
+   * Whether the editor supports the inline editing provided by the Edit module.
+   *
+   * @var bool
+   */
+  public $supports_inline_editing;
+
+  /**
+   * Whether this text editor is not vulnerable to XSS attacks.
+   *
+   * @var bool
+   */
+  public $is_xss_safe;
+
+  /**
+   * A list of element types this text editor supports.
+   *
+   * @var string[]
+   */
+  public $supported_element_types;
+
+}

web/core/modules/editor/src/Attribute/Editor.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace Drupal\editor\Attribute;
+
+use Drupal\Component\Plugin\Attribute\Plugin;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+
+/**
+ * Defines an Editor attribute object.
+ *
+ * Plugin Namespace: Plugin\Editor
+ *
+ * For a working example, see \Drupal\ckeditor5\Plugin\Editor\CKEditor5
+ *
+ * @see \Drupal\editor\Plugin\EditorPluginInterface
+ * @see \Drupal\editor\Plugin\EditorBase
+ * @see \Drupal\editor\Plugin\EditorManager
+ * @see hook_editor_info_alter()
+ * @see plugin_api
+ */
+#[\Attribute(\Attribute::TARGET_CLASS)]
+class Editor extends Plugin {
+
+  /**
+   * Constructs an Editor object.
+   *
+   * @param string $id
+   *   The plugin ID.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup $label
+   *   The human-readable name of the text editor, translated
+   * @param bool $supports_content_filtering
+   *   Whether the editor supports "allowed content only" filtering.
+   * @param bool $supports_inline_editing
+   *   Whether the editor supports the inline editing provided by the Edit
+   *   module.
+   * @param bool $is_xss_safe
+   *   Whether this text editor is not vulnerable to XSS attacks.
+   * @param string[] $supported_element_types
+   *   On which form element #types this text editor is capable of working.
+   * @param class-string|null $deriver
+   *   (optional) The deriver class.
+   */
+  public function __construct(
+    public readonly string $id,
+    public readonly TranslatableMarkup $label,
+    public readonly bool $supports_content_filtering,
+    public readonly bool $supports_inline_editing,
+    public readonly bool $is_xss_safe,
+    public readonly array $supported_element_types,
+    public readonly ?string $deriver = NULL,
+  ) {}
+
+}

web/core/modules/editor/src/EditorAccessControlHandler.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Drupal\editor;
+
+use Drupal\Core\Entity\EntityAccessControlHandler;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Defines the access control handler for the text editor entity type.
+ *
+ * @see \Drupal\editor\Entity\Editor
+ */
+class EditorAccessControlHandler extends EntityAccessControlHandler {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkAccess(EntityInterface $editor, $operation, AccountInterface $account) {
+    /** @var \Drupal\editor\EditorInterface $editor */
+    return $editor->getFilterFormat()->access($operation, $account, TRUE);
+  }
+
+}

web/core/modules/editor/src/EditorController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Drupal\editor;
+
+use Drupal\Core\Controller\ControllerBase;
+use Drupal\filter\FilterFormatInterface;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Returns responses for Editor module routes.
+ */
+class EditorController extends ControllerBase {
+
+  /**
+   * Apply the necessary XSS filtering for using a certain text format's editor.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The current request object.
+   * @param \Drupal\filter\FilterFormatInterface $filter_format
+   *   The text format whose text editor (if any) will be used.
+   *
+   * @return \Symfony\Component\HttpFoundation\JsonResponse
+   *   A JSON response containing the XSS-filtered value.
+   *
+   * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
+   *   Thrown if no value to filter is specified.
+   *
+   * @see editor_filter_xss()
+   */
+  public function filterXss(Request $request, FilterFormatInterface $filter_format) {
+    $value = $request->request->get('value');
+    if (!isset($value)) {
+      throw new NotFoundHttpException();
+    }
+
+    // The original_format parameter will only exist when switching text format.
+    $original_format_id = $request->request->get('original_format_id');
+    $original_format = NULL;
+    if (isset($original_format_id)) {
+      $original_format = $this->entityTypeManager()
+        ->getStorage('filter_format')
+        ->load($original_format_id);
+    }
+
+    return new JsonResponse(editor_filter_xss($value, $filter_format, $original_format));
+  }
+
+}

web/core/modules/editor/src/EditorInterface.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace Drupal\editor;
+
+use Drupal\Core\Config\Entity\ConfigEntityInterface;
+
+/**
+ * Provides an interface defining a text editor entity.
+ */
+interface EditorInterface extends ConfigEntityInterface {
+
+  /**
+   * Returns whether this text editor has an associated filter format.
+   *
+   * A text editor may be created at the same time as the filter format it's
+   * going to be associated with; in that case, no filter format object is
+   * available yet.
+   *
+   * @return bool
+   */
+  public function hasAssociatedFilterFormat();
+
+  /**
+   * Returns the filter format this text editor is associated with.
+   *
+   * This could be NULL if the associated filter format is still being created.
+   * @see hasAssociatedFilterFormat()
+   *
+   * @return \Drupal\filter\FilterFormatInterface|null
+   */
+  public function getFilterFormat();
+
+  /**
+   * Returns the associated text editor plugin ID.
+   *
+   * @return string
+   *   The text editor plugin ID.
+   */
+  public function getEditor();
+
+  /**
+   * Set the text editor plugin ID.
+   *
+   * @param string $editor
+   *   The text editor plugin ID to set.
+   */
+  public function setEditor($editor);
+
+  /**
+   * Returns the text editor plugin-specific settings.
+   *
+   * @return array
+   *   A structured array containing all text editor settings.
+   */
+  public function getSettings();
+
+  /**
+   * Sets the text editor plugin-specific settings.
+   *
+   * @param array $settings
+   *   The structured array containing all text editor settings.
+   *
+   * @return $this
+   */
+  public function setSettings(array $settings);
+
+  /**
+   * Returns the image upload settings.
+   *
+   * @return array
+   *   A structured array containing image upload settings.
+   */
+  public function getImageUploadSettings();
+
+  /**
+   * Sets the image upload settings.
+   *
+   * @param array $image_upload
+   *   The structured array containing image upload settings.
+   *
+   * @return $this
+   */
+  public function setImageUploadSettings(array $image_upload);
+
+}

web/core/modules/editor/src/EditorXssFilter/Standard.php

@@ -0,0 +1,138 @@
+<?php
+
+namespace Drupal\editor\EditorXssFilter;
+
+use Drupal\Component\Utility\Html;
+use Drupal\Component\Utility\Xss;
+use Drupal\filter\FilterFormatInterface;
+use Drupal\editor\EditorXssFilterInterface;
+
+/**
+ * Defines the standard text editor XSS filter.
+ */
+class Standard extends Xss implements EditorXssFilterInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function filterXss($html, FilterFormatInterface $format, ?FilterFormatInterface $original_format = NULL) {
+    // Apply XSS filtering, but blacklist the <script>, <style>, <link>, <embed>
+    // and <object> tags.
+    // The <script> and <style> tags are blacklisted because their contents
+    // can be malicious (and therefore they are inherently unsafe), whereas for
+    // all other tags, only their attributes can make them malicious. Since
+    // \Drupal\Component\Utility\Xss::filter() protects against malicious
+    // attributes, we take no blacklisting action.
+    // The exceptions to the above rule are <link>, <embed> and <object>:
+    // - <link> because the href attribute allows the attacker to import CSS
+    //   using the HTTP(S) protocols which Xss::filter() considers safe by
+    //   default. The imported remote CSS is applied to the main document, thus
+    //   allowing for the same XSS attacks as a regular <style> tag.
+    // - <embed> and <object> because these tags allow non-HTML applications or
+    //   content to be embedded using the src or data attributes, respectively.
+    //   This is safe in the case of HTML documents, but not in the case of
+    //   Flash objects for example, that may access/modify the main document
+    //   directly.
+    // <iframe> is considered safe because it only allows HTML content to be
+    // embedded, hence ensuring the same origin policy always applies.
+    $dangerous_tags = ['script', 'style', 'link', 'embed', 'object'];
+
+    // Simply blacklisting these five dangerous tags would bring safety, but
+    // also user frustration: what if a text format is configured to allow
+    // <embed>, for example? Then we would strip that tag, even though it is
+    // allowed, thereby causing data loss!
+    // Therefore, we want to be smarter still. We want to take into account
+    // which HTML tags are allowed by the text format we're filtering for, and
+    // if we're switching from another text format, we want to take that
+    // format's allowed tags into account as well.
+    // In other words: we only expect markup allowed in both the original and
+    // the new format to continue to exist.
+    $format_restrictions = $format->getHtmlRestrictions();
+    if ($original_format !== NULL) {
+      $original_format_restrictions = $original_format->getHtmlRestrictions();
+    }
+
+    // Any tags that are explicitly whitelisted by the text format must be
+    // removed from the list of default dangerous tags: if they're explicitly
+    // allowed, then we must respect that configuration.
+    // When switching from another format, we must use the intersection of
+    // allowed tags: if either format is more restrictive, then the safety
+    // expectations of *both* formats apply.
+    $allowed_tags = self::getAllowedTags($format_restrictions);
+    if ($original_format !== NULL) {
+      $allowed_tags = array_intersect($allowed_tags, self::getAllowedTags($original_format_restrictions));
+    }
+
+    // Don't blacklist dangerous tags that are explicitly allowed in both text
+    // formats.
+    $blacklisted_tags = array_diff($dangerous_tags, $allowed_tags);
+
+    $output = static::filter($html, $blacklisted_tags);
+
+    // Since data-attributes can contain encoded HTML markup that could be
+    // decoded and interpreted by editors, we need to apply XSS filtering to
+    // their contents.
+    return static::filterXssDataAttributes($output);
+  }
+
+  /**
+   * Applies a very permissive XSS/HTML filter to data-attributes.
+   *
+   * @param string $html
+   *   The string to apply the data-attributes filtering to.
+   *
+   * @return string
+   *   The filtered string.
+   */
+  protected static function filterXssDataAttributes($html) {
+    if (stristr($html, 'data-') !== FALSE) {
+      $dom = Html::load($html);
+      $xpath = new \DOMXPath($dom);
+      foreach ($xpath->query('//@*[starts-with(name(.), "data-")]') as $node) {
+        // The data-attributes contain an HTML-encoded value, so we need to
+        // decode the value, apply XSS filtering and then re-save as encoded
+        // value. There is no need to explicitly decode $node->value, since the
+        // DOMAttr::value getter returns the decoded value.
+        $value = Xss::filterAdmin($node->value);
+        $node->value = Html::escape($value);
+      }
+      $html = Html::serialize($dom);
+    }
+
+    return $html;
+  }
+
+  /**
+   * Get all allowed tags from a restrictions data structure.
+   *
+   * @param array|false $restrictions
+   *   Restrictions as returned by FilterInterface::getHTMLRestrictions().
+   *
+   * @return array
+   *   An array of allowed HTML tags.
+   *
+   * @see \Drupal\filter\Plugin\Filter\FilterInterface::getHTMLRestrictions()
+   */
+  protected static function getAllowedTags($restrictions) {
+    if ($restrictions === FALSE || !isset($restrictions['allowed'])) {
+      return [];
+    }
+
+    $allowed_tags = array_keys($restrictions['allowed']);
+    // Exclude the wildcard tag, which is used to set attribute restrictions on
+    // all tags simultaneously.
+    $allowed_tags = array_diff($allowed_tags, ['*']);
+
+    return $allowed_tags;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static function needsRemoval(array $html_tags, $elem) {
+    // See static::filterXss() about how this class uses blacklisting instead
+    // of the normal whitelisting.
+    return !parent::needsRemoval($html_tags, $elem);
+  }
+
+}

web/core/modules/editor/src/EditorXssFilterInterface.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace Drupal\editor;
+
+use Drupal\filter\FilterFormatInterface;
+
+/**
+ * Defines an interface for text editor XSS (Cross-site scripting) filters.
+ */
+interface EditorXssFilterInterface {
+
+  /**
+   * Filters HTML to prevent XSS attacks when a user edits it in a text editor.
+   *
+   * Should filter as minimally as possible, only to remove XSS attack vectors.
+   *
+   * Is only called when:
+   * - loading a non-XSS-safe text editor for a $format that contains a filter
+   *   preventing XSS attacks (a FilterInterface::TYPE_HTML_RESTRICTOR filter):
+   *   if the output is safe, it should also be safe to edit.
+   * - loading a non-XSS-safe text editor for a $format that doesn't contain a
+   *   filter preventing XSS attacks, but we're switching from a previous text
+   *   format ($original_format is not NULL) that did prevent XSS attacks: if
+   *   the output was previously safe, it should be safe to switch to another
+   *   text format and edit.
+   *
+   * @param string $html
+   *   The HTML to be filtered.
+   * @param \Drupal\filter\FilterFormatInterface $format
+   *   The text format configuration entity. Provides context based upon which
+   *   one may want to adjust the filtering.
+   * @param \Drupal\filter\FilterFormatInterface|null $original_format
+   *   (optional) The original text format configuration entity (when switching
+   *   text formats/editors). Also provides context based upon which one may
+   *   want to adjust the filtering.
+   *
+   * @return string
+   *   The filtered HTML that cannot cause any XSS anymore.
+   */
+  public static function filterXss($html, FilterFormatInterface $format, ?FilterFormatInterface $original_format = NULL);
+
+}

web/core/modules/editor/src/Element.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace Drupal\editor;
+
+use Drupal\Core\Security\TrustedCallbackInterface;
+use Drupal\editor\Entity\Editor;
+use Drupal\filter\Entity\FilterFormat;
+use Drupal\Component\Plugin\PluginManagerInterface;
+use Drupal\Core\Render\BubbleableMetadata;
+
+/**
+ * Defines a service for Text Editor's render elements.
+ */
+class Element implements TrustedCallbackInterface {
+
+  /**
+   * The Text Editor plugin manager service.
+   *
+   * @var \Drupal\Component\Plugin\PluginManagerInterface
+   */
+  protected $pluginManager;
+
+  /**
+   * Constructs a new Element object.
+   *
+   * @param \Drupal\Component\Plugin\PluginManagerInterface $plugin_manager
+   *   The Text Editor plugin manager service.
+   */
+  public function __construct(PluginManagerInterface $plugin_manager) {
+    $this->pluginManager = $plugin_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function trustedCallbacks() {
+    return ['preRenderTextFormat'];
+  }
+
+  /**
+   * Additional #pre_render callback for 'text_format' elements.
+   */
+  public function preRenderTextFormat(array $element) {
+    // Allow modules to programmatically enforce no client-side editor by
+    // setting the #editor property to FALSE.
+    if (isset($element['#editor']) && !$element['#editor']) {
+      return $element;
+    }
+
+    // \Drupal\filter\Element\TextFormat::processFormat() copies properties to
+    // the expanded 'value' to the child element, including the #pre_render
+    // property. Skip this text format widget, if it contains no 'format'.
+    if (!isset($element['format'])) {
+      return $element;
+    }
+    $format_ids = array_keys($element['format']['format']['#options']);
+
+    // Early-return if no text editor is associated with any of the text formats.
+    $editors = Editor::loadMultiple($format_ids);
+    foreach ($editors as $key => $editor) {
+      $definition = $this->pluginManager->getDefinition($editor->getEditor());
+      if (!in_array($element['#base_type'], $definition['supported_element_types'])) {
+        unset($editors[$key]);
+      }
+    }
+    if (count($editors) === 0) {
+      return $element;
+    }
+
+    // Use a hidden element for a single text format.
+    $field_id = $element['value']['#id'];
+    if (!$element['format']['format']['#access']) {
+      // Use the first (and only) available text format.
+      $format_id = $format_ids[0];
+      $element['format']['editor'] = [
+        '#type' => 'hidden',
+        '#name' => $element['format']['format']['#name'],
+        '#value' => $format_id,
+        '#attributes' => [
+          'data-editor-for' => $field_id,
+        ],
+      ];
+    }
+    // Otherwise, attach to text format selector.
+    else {
+      $element['format']['format']['#attributes']['class'][] = 'editor';
+      $element['format']['format']['#attributes']['data-editor-for'] = $field_id;
+    }
+
+    // Hide the text format's filters' guidelines of those text formats that have
+    // a text editor associated: they're rather useless when using a text editor.
+    foreach ($editors as $format_id => $editor) {
+      $element['format']['guidelines'][$format_id]['#access'] = FALSE;
+    }
+
+    // Attach Text Editor module's (this module) library.
+    $element['#attached']['library'][] = 'editor/drupal.editor';
+
+    // Attach attachments for all available editors.
+    $element['#attached'] = BubbleableMetadata::mergeAttachments($element['#attached'], $this->pluginManager->getAttachments($format_ids));
+
+    // Apply XSS filters when editing content if necessary. Some types of text
+    // editors cannot guarantee that the end user won't become a victim of XSS.
+    if (!empty($element['value']['#value'])) {
+      $original = $element['value']['#value'];
+      $format = FilterFormat::load($element['format']['format']['#value']);
+
+      // Ensure XSS-safety for the current text format/editor.
+      $filtered = editor_filter_xss($original, $format);
+      if ($filtered !== FALSE) {
+        $element['value']['#value'] = $filtered;
+      }
+
+      // Only when the user has access to multiple text formats, we must add data-
+      // attributes for the original value and change tracking, because they are
+      // only necessary when the end user can switch between text formats/editors.
+      if ($element['format']['format']['#access']) {
+        $element['value']['#attributes']['data-editor-value-is-changed'] = 'false';
+        $element['value']['#attributes']['data-editor-value-original'] = $original;
+      }
+    }
+
+    return $element;
+  }
+
+}

web/core/modules/editor/src/Entity/Editor.php

@@ -0,0 +1,225 @@
+<?php
+
+namespace Drupal\editor\Entity;
+
+use Drupal\Component\Plugin\Exception\PluginNotFoundException;
+use Drupal\Core\Config\Entity\ConfigEntityBase;
+use Drupal\Core\StreamWrapper\StreamWrapperInterface;
+use Drupal\editor\EditorInterface;
+
+/**
+ * Defines the configured text editor entity.
+ *
+ * An Editor entity is created when a filter format entity (Text format) is
+ * saved after selecting an editor plugin (eg: CKEditor). The ID of the
+ * Editor entity will be same as the ID of the filter format entity in which
+ * the editor plugin was selected.
+ *
+ * @ConfigEntityType(
+ *   id = "editor",
+ *   label = @Translation("Text editor"),
+ *   label_collection = @Translation("Text editors"),
+ *   label_singular = @Translation("text editor"),
+ *   label_plural = @Translation("text editors"),
+ *   label_count = @PluralTranslation(
+ *     singular = "@count text editor",
+ *     plural = "@count text editors",
+ *   ),
+ *   handlers = {
+ *     "access" = "Drupal\editor\EditorAccessControlHandler",
+ *   },
+ *   entity_keys = {
+ *     "id" = "format"
+ *   },
+ *   config_export = {
+ *     "format",
+ *     "editor",
+ *     "settings",
+ *     "image_upload",
+ *   },
+ *   constraints = {
+ *     "RequiredConfigDependencies" = {
+ *       "filter_format"
+ *     }
+ *   }
+ * )
+ */
+class Editor extends ConfigEntityBase implements EditorInterface {
+
+  /**
+   * Machine name of the text format for this configured text editor.
+   *
+   * @var string
+   *
+   * @see getFilterFormat()
+   */
+  protected $format;
+
+  /**
+   * The name (plugin ID) of the text editor.
+   *
+   * @var string
+   */
+  protected $editor;
+
+  /**
+   * The structured array of text editor plugin-specific settings.
+   *
+   * @var array
+   */
+  protected $settings = [];
+
+  /**
+   * The structured array of image upload settings.
+   *
+   * @var array
+   */
+  protected $image_upload = [];
+
+  /**
+   * The filter format this text editor is associated with.
+   *
+   * @var \Drupal\filter\FilterFormatInterface
+   */
+  protected $filterFormat;
+
+  /**
+   * @var \Drupal\Component\Plugin\PluginManagerInterface
+   */
+  protected $editorPluginManager;
+
+  /**
+   * {@inheritdoc}
+   */
+  public function id() {
+    return $this->format;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function __construct(array $values, $entity_type) {
+    parent::__construct($values, $entity_type);
+
+    try {
+      $plugin = $this->editorPluginManager()->createInstance($this->editor);
+      $this->settings += $plugin->getDefaultSettings();
+    }
+    catch (PluginNotFoundException $e) {
+      // When a Text Editor plugin has gone missing, still allow the Editor
+      // config entity to be constructed. The only difference is that default
+      // settings are not added.
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function label() {
+    return $this->getFilterFormat()->label();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function calculateDependencies() {
+    parent::calculateDependencies();
+    // Create a dependency on the associated FilterFormat.
+    $this->addDependency('config', $this->getFilterFormat()->getConfigDependencyName());
+    // @todo use EntityWithPluginCollectionInterface so configuration between
+    //   config entity and dependency on provider is managed automatically.
+    $definition = $this->editorPluginManager()->createInstance($this->editor)->getPluginDefinition();
+    $this->addDependency('module', $definition['provider']);
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function hasAssociatedFilterFormat() {
+    return $this->format !== NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFilterFormat() {
+    if (!$this->filterFormat) {
+      $this->filterFormat = \Drupal::entityTypeManager()->getStorage('filter_format')->load($this->format);
+    }
+    return $this->filterFormat;
+  }
+
+  /**
+   * Returns the editor plugin manager.
+   *
+   * @return \Drupal\Component\Plugin\PluginManagerInterface
+   */
+  protected function editorPluginManager() {
+    if (!$this->editorPluginManager) {
+      $this->editorPluginManager = \Drupal::service('plugin.manager.editor');
+    }
+
+    return $this->editorPluginManager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getEditor() {
+    return $this->editor;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setEditor($editor) {
+    $this->editor = $editor;
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getSettings() {
+    return $this->settings;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setSettings(array $settings) {
+    $this->settings = $settings;
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getImageUploadSettings() {
+    return $this->image_upload;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setImageUploadSettings(array $image_upload_settings) {
+    $this->image_upload = $image_upload_settings;
+    return $this;
+  }
+
+  /**
+   * Computes all valid choices for the "image_upload.scheme" setting.
+   *
+   * @see editor.schema.yml
+   *
+   * @return string[]
+   *   All valid choices.
+   *
+   * @internal
+   */
+  public static function getValidStreamWrappers(): array {
+    return array_keys(\Drupal::service('stream_wrapper_manager')->getNames(StreamWrapperInterface::WRITE_VISIBLE));
+  }
+
+}

web/core/modules/editor/src/EventSubscriber/EditorConfigTranslationSubscriber.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace Drupal\editor\EventSubscriber;
+
+use Drupal\config_translation\ConfigEntityMapperInterface;
+use Drupal\config_translation\Event\ConfigMapperPopulateEvent;
+use Drupal\config_translation\Event\ConfigTranslationEvents;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Drupal\Core\Config\ConfigFactoryInterface;
+
+/**
+ * Adds configuration names to configuration mapper on POPULATE_MAPPER event.
+ */
+class EditorConfigTranslationSubscriber implements EventSubscriberInterface {
+
+  /**
+   * The config factory.
+   *
+   * @var \Drupal\Core\Config\ConfigFactoryInterface
+   */
+  protected $configFactory;
+
+  /**
+   * EditorConfigTranslationSubscriber constructor.
+   *
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The factory for configuration objects.
+   */
+  public function __construct(ConfigFactoryInterface $config_factory) {
+    $this->configFactory = $config_factory;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events = [];
+    if (class_exists('Drupal\config_translation\Event\ConfigTranslationEvents')) {
+      $events[ConfigTranslationEvents::POPULATE_MAPPER][] = ['addConfigNames'];
+    }
+    return $events;
+  }
+
+  /**
+   * Reacts to the populating of a configuration mapper.
+   *
+   * @param \Drupal\config_translation\Event\ConfigMapperPopulateEvent $event
+   *   The configuration mapper event.
+   */
+  public function addConfigNames(ConfigMapperPopulateEvent $event) {
+    $mapper = $event->getMapper();
+    if ($mapper instanceof ConfigEntityMapperInterface && $mapper->getType() == 'filter_format') {
+      $editor_config_name = 'editor.editor.' . $mapper->getEntity()->id();
+      // Only add the text editor config if it exists, otherwise we assume no
+      // editor has been set for this text format.
+      if (!$this->configFactory->get($editor_config_name)->isNew()) {
+        $mapper->addConfigName($editor_config_name);
+      }
+    }
+  }
+
+}

web/core/modules/editor/src/Form/EditorImageDialog.php

@@ -0,0 +1,250 @@
+<?php
+
+namespace Drupal\editor\Form;
+
+use Drupal\Component\Utility\Bytes;
+use Drupal\Component\Utility\Environment;
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\editor\Entity\Editor;
+use Drupal\Core\Ajax\AjaxResponse;
+use Drupal\Core\Ajax\HtmlCommand;
+use Drupal\editor\Ajax\EditorDialogSave;
+use Drupal\Core\Ajax\CloseModalDialogCommand;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Drupal\Core\Entity\EntityStorageInterface;
+
+/**
+ * Provides an image dialog for text editors.
+ *
+ * @deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. There is no
+ * replacement.
+ *
+ * @see https://www.drupal.org/node/3291493
+ *
+ * @internal
+ */
+class EditorImageDialog extends FormBase {
+
+  /**
+   * The file storage service.
+   *
+   * @var \Drupal\Core\Entity\EntityStorageInterface
+   */
+  protected $fileStorage;
+
+  /**
+   * Constructs a form object for image dialog.
+   *
+   * @param \Drupal\Core\Entity\EntityStorageInterface $file_storage
+   *   The file storage service.
+   */
+  public function __construct(EntityStorageInterface $file_storage) {
+    @trigger_error(__NAMESPACE__ . '\EditorImageDialog is deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. There is no replacement. See https://www.drupal.org/node/3291493', E_USER_DEPRECATED);
+    $this->fileStorage = $file_storage;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('entity_type.manager')->getStorage('file')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'editor_image_dialog';
+  }
+
+  /**
+   * {@inheritdoc}
+   *
+   * @param array $form
+   *   An associative array containing the structure of the form.
+   * @param \Drupal\Core\Form\FormStateInterface $form_state
+   *   The current state of the form.
+   * @param \Drupal\editor\Entity\Editor $editor
+   *   The text editor to which this dialog corresponds.
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, ?Editor $editor = NULL) {
+    // This form is special, in that the default values do not come from the
+    // server side, but from the client side, from a text editor. We must cache
+    // this data in form state, because when the form is rebuilt, we will be
+    // receiving values from the form, instead of the values from the text
+    // editor. If we don't cache it, this data will be lost.
+    if (isset($form_state->getUserInput()['editor_object'])) {
+      // By convention, the data that the text editor sends to any dialog is in
+      // the 'editor_object' key. And the image dialog for text editors expects
+      // that data to be the attributes for an <img> element.
+      $image_element = $form_state->getUserInput()['editor_object'];
+      $form_state->set('image_element', $image_element);
+      $form_state->setCached(TRUE);
+    }
+    else {
+      // Retrieve the image element's attributes from form state.
+      $image_element = $form_state->get('image_element') ?: [];
+    }
+
+    $form['#tree'] = TRUE;
+    $form['#attached']['library'][] = 'editor/drupal.editor.dialog';
+    $form['#prefix'] = '<div id="editor-image-dialog-form">';
+    $form['#suffix'] = '</div>';
+
+    // Construct strings to use in the upload validators.
+    $image_upload = $editor->getImageUploadSettings();
+    $existing_file = isset($image_element['data-entity-uuid']) ? \Drupal::service('entity.repository')->loadEntityByUuid('file', $image_element['data-entity-uuid']) : NULL;
+    $fid = $existing_file ? $existing_file->id() : NULL;
+
+    $form['fid'] = [
+      '#title' => $this->t('Image'),
+      '#type' => 'managed_file',
+      '#default_value' => $fid ? [$fid] : NULL,
+      '#upload_validators' => [
+        'FileExtension' => ['extensions' => 'gif png jpg jpeg'],
+      ],
+      '#required' => TRUE,
+    ];
+
+    $form['attributes']['src'] = [
+      '#title' => $this->t('URL'),
+      '#type' => 'textfield',
+      '#default_value' => $image_element['src'] ?? '',
+      '#maxlength' => 2048,
+      '#required' => TRUE,
+    ];
+
+    // If the editor has image uploads enabled, show a managed_file form item,
+    // otherwise show a (file URL) text form item.
+    if ($image_upload['status']) {
+      $form['attributes']['src']['#access'] = FALSE;
+      $form['attributes']['src']['#required'] = FALSE;
+
+      if (!empty($image_upload['max_dimensions']['width']) || !empty($image_upload['max_dimensions']['height'])) {
+        $max_dimensions = $image_upload['max_dimensions']['width'] . 'x' . $image_upload['max_dimensions']['height'];
+      }
+      else {
+        $max_dimensions = 0;
+      }
+      $max_filesize = min(Bytes::toNumber($image_upload['max_size'] ?? 0), Environment::getUploadMaxSize());
+      $form['fid']['#upload_location'] = $image_upload['scheme'] . '://' . ($image_upload['directory'] ?? '');
+      $form['fid']['#upload_validators']['FileSizeLimit'] = ['fileLimit' => $max_filesize];
+      $form['fid']['#upload_validators']['FileImageDimensions'] = ['maxDimensions' => $max_dimensions];
+    }
+    else {
+      $form['fid']['#access'] = FALSE;
+      $form['fid']['#required'] = FALSE;
+    }
+
+    // The alt attribute is *required*, but we allow users to opt-in to empty
+    // alt attributes for the very rare edge cases where that is valid by
+    // specifying two double quotes as the alternative text in the dialog.
+    // However, that *is* stored as an empty alt attribute, so if we're editing
+    // an existing image (which means the src attribute is set) and its alt
+    // attribute is empty, then we show that as two double quotes in the dialog.
+    // @see https://www.drupal.org/node/2307647
+    $alt = $image_element['alt'] ?? '';
+    if ($alt === '' && !empty($image_element['src'])) {
+      $alt = '""';
+    }
+    $form['attributes']['alt'] = [
+      '#title' => $this->t('Alternative text'),
+      '#description' => $this->t('Short description of the image used by screen readers and displayed when the image is not loaded. This is important for accessibility.'),
+      '#type' => 'textfield',
+      '#required' => TRUE,
+      '#required_error' => $this->t('Alternative text is required.<br />(Only in rare cases should this be left empty. To create empty alternative text, enter <code>""</code> — two double quotes without any content).'),
+      '#default_value' => $alt,
+      '#maxlength' => 2048,
+    ];
+
+    // When Drupal core's filter_align is being used, the text editor may
+    // offer the ability to change the alignment.
+    if (isset($image_element['data-align']) && $editor->getFilterFormat()->filters('filter_align')->status) {
+      $form['align'] = [
+        '#title' => $this->t('Align'),
+        '#type' => 'radios',
+        '#options' => [
+          'none' => $this->t('None'),
+          'left' => $this->t('Left'),
+          'center' => $this->t('Center'),
+          'right' => $this->t('Right'),
+        ],
+        '#default_value' => $image_element['data-align'] === '' ? 'none' : $image_element['data-align'],
+        '#wrapper_attributes' => ['class' => ['container-inline']],
+        '#attributes' => ['class' => ['container-inline']],
+        '#parents' => ['attributes', 'data-align'],
+      ];
+    }
+
+    // When Drupal core's filter_caption is being used, the text editor may
+    // offer the ability to in-place edit the image's caption: show a toggle.
+    if (isset($image_element['hasCaption']) && $editor->getFilterFormat()->filters('filter_caption')->status) {
+      $form['caption'] = [
+        '#title' => $this->t('Caption'),
+        '#type' => 'checkbox',
+        '#default_value' => $image_element['hasCaption'] === 'true',
+        '#parents' => ['attributes', 'hasCaption'],
+      ];
+    }
+
+    $form['actions'] = [
+      '#type' => 'actions',
+    ];
+    $form['actions']['save_modal'] = [
+      '#type' => 'submit',
+      '#value' => $this->t('Save'),
+      // No regular submit-handler. This form only works via JavaScript.
+      '#submit' => [],
+      '#ajax' => [
+        'callback' => '::submitForm',
+        'event' => 'click',
+      ],
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $response = new AjaxResponse();
+
+    // Convert any uploaded files from the FID values to data-entity-uuid
+    // attributes and set data-entity-type to 'file'.
+    $fid = $form_state->getValue(['fid', 0]);
+    if (!empty($fid)) {
+      /** @var \Drupal\file\FileInterface $file */
+      $file = $this->fileStorage->load($fid);
+      $file_url = $file->createFileUrl();
+      $form_state->setValue(['attributes', 'src'], $file_url);
+      $form_state->setValue(['attributes', 'data-entity-uuid'], $file->uuid());
+      $form_state->setValue(['attributes', 'data-entity-type'], 'file');
+    }
+
+    // When the alt attribute is set to two double quotes, transform it to the
+    // empty string: two double quotes signify "empty alt attribute". See above.
+    if (trim($form_state->getValue(['attributes', 'alt'])) === '""') {
+      $form_state->setValue(['attributes', 'alt'], '');
+    }
+
+    if ($form_state->getErrors()) {
+      unset($form['#prefix'], $form['#suffix']);
+      $form['status_messages'] = [
+        '#type' => 'status_messages',
+        '#weight' => -10,
+      ];
+      $response->addCommand(new HtmlCommand('#editor-image-dialog-form', $form));
+    }
+    else {
+      $response->addCommand(new EditorDialogSave($form_state->getValues()));
+      $response->addCommand(new CloseModalDialogCommand());
+    }
+
+    return $response;
+  }
+
+}

web/core/modules/editor/src/Form/EditorLinkDialog.php

@@ -0,0 +1,110 @@
+<?php
+
+namespace Drupal\editor\Form;
+
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\editor\Entity\Editor;
+use Drupal\Core\Ajax\AjaxResponse;
+use Drupal\Core\Ajax\HtmlCommand;
+use Drupal\editor\Ajax\EditorDialogSave;
+use Drupal\Core\Ajax\CloseModalDialogCommand;
+
+/**
+ * Provides a link dialog for text editors.
+ *
+ * @deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. There is no
+ * replacement.
+ *
+ * @see https://www.drupal.org/node/3291493
+ *
+ * @internal
+ */
+class EditorLinkDialog extends FormBase {
+
+  /**
+   * Constructs a form object for link dialog.
+   */
+  public function __construct() {
+    @trigger_error(__NAMESPACE__ . '\EditorLinkDialog is deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. There is no replacement. See https://www.drupal.org/node/3291493', E_USER_DEPRECATED);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'editor_link_dialog';
+  }
+
+  /**
+   * {@inheritdoc}
+   *
+   * @param array $form
+   *   An associative array containing the structure of the form.
+   * @param \Drupal\Core\Form\FormStateInterface $form_state
+   *   The current state of the form.
+   * @param \Drupal\editor\Entity\Editor $editor
+   *   The text editor to which this dialog corresponds.
+   *
+   * @return array
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, ?Editor $editor = NULL) {
+    // The default values are set directly from \Drupal::request()->request,
+    // provided by the editor plugin opening the dialog.
+    $user_input = $form_state->getUserInput();
+    $input = $user_input['editor_object'] ?? [];
+
+    $form['#tree'] = TRUE;
+    $form['#attached']['library'][] = 'editor/drupal.editor.dialog';
+    $form['#prefix'] = '<div id="editor-link-dialog-form">';
+    $form['#suffix'] = '</div>';
+
+    // Everything under the "attributes" key is merged directly into the
+    // generated link tag's attributes.
+    $form['attributes']['href'] = [
+      '#title' => $this->t('URL'),
+      '#type' => 'textfield',
+      '#default_value' => $input['href'] ?? '',
+      '#maxlength' => 2048,
+    ];
+
+    $form['actions'] = [
+      '#type' => 'actions',
+    ];
+    $form['actions']['save_modal'] = [
+      '#type' => 'submit',
+      '#value' => $this->t('Save'),
+      // No regular submit-handler. This form only works via JavaScript.
+      '#submit' => [],
+      '#ajax' => [
+        'callback' => '::submitForm',
+        'event' => 'click',
+      ],
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $response = new AjaxResponse();
+
+    if ($form_state->getErrors()) {
+      unset($form['#prefix'], $form['#suffix']);
+      $form['status_messages'] = [
+        '#type' => 'status_messages',
+        '#weight' => -10,
+      ];
+      $response->addCommand(new HtmlCommand('#editor-link-dialog-form', $form));
+    }
+    else {
+      $response->addCommand(new EditorDialogSave($form_state->getValues()));
+      $response->addCommand(new CloseModalDialogCommand());
+    }
+
+    return $response;
+  }
+
+}

web/core/modules/editor/src/Plugin/EditorBase.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Drupal\editor\Plugin;
+
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Plugin\PluginBase;
+
+/**
+ * Defines a base class from which other modules providing editors may extend.
+ *
+ * This class provides default implementations of the EditorPluginInterface so
+ * that classes extending this one do not need to implement every method.
+ *
+ * Plugins extending this class need to specify an annotation containing the
+ * plugin definition so the plugin can be discovered.
+ *
+ * @see \Drupal\editor\Annotation\Editor
+ * @see \Drupal\editor\Plugin\EditorPluginInterface
+ * @see \Drupal\editor\Plugin\EditorManager
+ * @see plugin_api
+ */
+abstract class EditorBase extends PluginBase implements EditorPluginInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getDefaultSettings() {
+    return [];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateConfigurationForm(array &$form, FormStateInterface $form_state) {
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitConfigurationForm(array &$form, FormStateInterface $form_state) {
+  }
+
+}

web/core/modules/editor/src/Plugin/EditorManager.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace Drupal\editor\Plugin;
+
+use Drupal\Core\Plugin\DefaultPluginManager;
+use Drupal\Core\Cache\CacheBackendInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\editor\Attribute\Editor;
+
+/**
+ * Configurable text editor manager.
+ *
+ * @see \Drupal\editor\Annotation\Editor
+ * @see \Drupal\editor\Plugin\EditorPluginInterface
+ * @see \Drupal\editor\Plugin\EditorBase
+ * @see plugin_api
+ */
+class EditorManager extends DefaultPluginManager {
+
+  /**
+   * Constructs an EditorManager object.
+   *
+   * @param \Traversable $namespaces
+   *   An object that implements \Traversable which contains the root paths
+   *   keyed by the corresponding namespace to look for plugin implementations.
+   * @param \Drupal\Core\Cache\CacheBackendInterface $cache_backend
+   *   Cache backend instance to use.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The module handler to invoke the alter hook with.
+   */
+  public function __construct(\Traversable $namespaces, CacheBackendInterface $cache_backend, ModuleHandlerInterface $module_handler) {
+    parent::__construct('Plugin/Editor', $namespaces, $module_handler, 'Drupal\editor\Plugin\EditorPluginInterface', Editor::class, 'Drupal\editor\Annotation\Editor');
+    $this->alterInfo('editor_info');
+    $this->setCacheBackend($cache_backend, 'editor_plugins');
+  }
+
+  /**
+   * Populates a key-value pair of available text editors.
+   *
+   * @return array
+   *   An array of translated text editor labels, keyed by ID.
+   */
+  public function listOptions() {
+    $options = [];
+    foreach ($this->getDefinitions() as $key => $definition) {
+      $options[$key] = $definition['label'];
+    }
+    return $options;
+  }
+
+  /**
+   * Retrieves text editor libraries and JavaScript settings.
+   *
+   * @param array $format_ids
+   *   An array of format IDs as returned by array_keys(filter_formats()).
+   *
+   * @return array
+   *   An array of attachments, for use with #attached.
+   *
+   * @see \Drupal\Core\Render\AttachmentsResponseProcessorInterface::processAttachments()
+   */
+  public function getAttachments(array $format_ids) {
+    $attachments = ['library' => []];
+
+    $settings = [];
+    foreach ($format_ids as $format_id) {
+      $editor = editor_load($format_id);
+      if (!$editor) {
+        continue;
+      }
+
+      $plugin = $this->createInstance($editor->getEditor());
+      $plugin_definition = $plugin->getPluginDefinition();
+
+      // Libraries.
+      $attachments['library'] = array_merge($attachments['library'], $plugin->getLibraries($editor));
+
+      // Format-specific JavaScript settings.
+      $settings['editor']['formats'][$format_id] = [
+        'format' => $format_id,
+        'editor' => $editor->getEditor(),
+        'editorSettings' => $plugin->getJSSettings($editor),
+        'editorSupportsContentFiltering' => $plugin_definition['supports_content_filtering'],
+        'isXssSafe' => $plugin_definition['is_xss_safe'],
+      ];
+    }
+
+    // Allow other modules to alter all JavaScript settings.
+    $this->moduleHandler->alter('editor_js_settings', $settings);
+
+    if (empty($attachments['library']) && empty($settings)) {
+      return [];
+    }
+
+    $attachments['drupalSettings'] = $settings;
+
+    return $attachments;
+  }
+
+}

web/core/modules/editor/src/Plugin/EditorPluginInterface.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace Drupal\editor\Plugin;
+
+use Drupal\Component\Plugin\PluginInspectionInterface;
+use Drupal\Core\Plugin\PluginFormInterface;
+use Drupal\editor\Entity\Editor;
+
+/**
+ * Defines an interface for configurable text editors.
+ *
+ * Modules implementing this interface may want to extend the EditorBase class,
+ * which provides default implementations of each method where appropriate.
+ *
+ * If the editor's behavior depends on extensive options and/or external data,
+ * then the implementing module can choose to provide a separate, global
+ * configuration page rather than per-text-format settings. In that case, this
+ * form should provide a link to the separate settings page.
+ *
+ * @see \Drupal\editor\Annotation\Editor
+ * @see \Drupal\editor\Plugin\EditorBase
+ * @see \Drupal\editor\Plugin\EditorManager
+ * @see plugin_api
+ */
+interface EditorPluginInterface extends PluginInspectionInterface, PluginFormInterface {
+
+  /**
+   * Returns the default settings for this configurable text editor.
+   *
+   * @return array
+   *   An array of settings as they would be stored by a configured text editor
+   *   entity (\Drupal\editor\Entity\Editor).
+   */
+  public function getDefaultSettings();
+
+  /**
+   * Returns JavaScript settings to be attached.
+   *
+   * Most text editors use JavaScript to provide a WYSIWYG or toolbar on the
+   * client-side interface. This method can be used to convert internal settings
+   * of the text editor into JavaScript variables that will be accessible when
+   * the text editor is loaded.
+   *
+   * @param \Drupal\editor\Entity\Editor $editor
+   *   A configured text editor object.
+   *
+   * @return array
+   *   An array of settings that will be added to the page for use by this text
+   *   editor's JavaScript integration.
+   *
+   * @see \Drupal\Core\Render\AttachmentsResponseProcessorInterface::processAttachments()
+   * @see EditorManager::getAttachments()
+   */
+  public function getJSSettings(Editor $editor);
+
+  /**
+   * Returns libraries to be attached.
+   *
+   * Because this is a method, plugins can dynamically choose to attach a
+   * different library for different configurations, instead of being forced to
+   * always use the same method.
+   *
+   * @param \Drupal\editor\Entity\Editor $editor
+   *   A configured text editor object.
+   *
+   * @return array
+   *   An array of libraries that will be added to the page for use by this text
+   *   editor.
+   *
+   * @see \Drupal\Core\Render\AttachmentsResponseProcessorInterface::processAttachments()
+   * @see EditorManager::getAttachments()
+   */
+  public function getLibraries(Editor $editor);
+
+}

web/core/modules/editor/src/Plugin/Filter/EditorFileReference.php

@@ -0,0 +1,128 @@
+<?php
+
+namespace Drupal\editor\Plugin\Filter;
+
+use Drupal\Component\Utility\Html;
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Image\ImageFactory;
+use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\file\FileInterface;
+use Drupal\filter\Attribute\Filter;
+use Drupal\filter\FilterProcessResult;
+use Drupal\filter\Plugin\FilterBase;
+use Drupal\filter\Plugin\FilterInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides a filter to track images uploaded via a Text Editor.
+ *
+ * Generates file URLs and associates the cache tags of referenced files.
+ */
+#[Filter(
+  id: "editor_file_reference",
+  title: new TranslatableMarkup("Track images uploaded via a Text Editor"),
+  description: new TranslatableMarkup("Ensures that the latest versions of images uploaded via a Text Editor are displayed, along with their dimensions."),
+  type: FilterInterface::TYPE_TRANSFORM_REVERSIBLE
+)]
+class EditorFileReference extends FilterBase implements ContainerFactoryPluginInterface {
+
+  /**
+   * The entity repository.
+   *
+   * @var \Drupal\Core\Entity\EntityRepositoryInterface
+   */
+  protected $entityRepository;
+
+  /**
+   * The image factory.
+   *
+   * @var \Drupal\Core\Image\ImageFactory
+   */
+  protected $imageFactory;
+
+  /**
+   * Constructs a \Drupal\editor\Plugin\Filter\EditorFileReference object.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin ID for the plugin instance.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Entity\EntityRepositoryInterface $entity_repository
+   *   The entity repository.
+   * @param \Drupal\Core\Image\ImageFactory $image_factory
+   *   The image factory.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, EntityRepositoryInterface $entity_repository, ImageFactory $image_factory) {
+    $this->entityRepository = $entity_repository;
+    $this->imageFactory = $image_factory;
+    parent::__construct($configuration, $plugin_id, $plugin_definition);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('entity.repository'),
+      $container->get('image.factory')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function process($text, $langcode) {
+    $result = new FilterProcessResult($text);
+
+    if (stristr($text, 'data-entity-type="file"') !== FALSE) {
+      $dom = Html::load($text);
+      $xpath = new \DOMXPath($dom);
+      $processed_uuids = [];
+      foreach ($xpath->query('//*[@data-entity-type="file" and @data-entity-uuid]') as $node) {
+        $uuid = $node->getAttribute('data-entity-uuid');
+
+        // If there is a 'src' attribute, set it to the file entity's current
+        // URL. This ensures the URL works even after the file location changes.
+        if ($node->hasAttribute('src')) {
+          $file = $this->entityRepository->loadEntityByUuid('file', $uuid);
+          if ($file instanceof FileInterface) {
+            $node->setAttribute('src', $file->createFileUrl());
+            if ($node->nodeName == 'img') {
+              $image = $this->imageFactory->get($file->getFileUri());
+              $width = $image->getWidth();
+              $height = $image->getHeight();
+              // Set dimensions to avoid content layout shift (CLS).
+              // @see https://web.dev/cls/
+              if ($width !== NULL && !$node->hasAttribute('width')) {
+                $node->setAttribute('width', (string) $width);
+              }
+              if ($height !== NULL && !$node->hasAttribute('height')) {
+                $node->setAttribute('height', (string) $height);
+              }
+            }
+          }
+        }
+
+        // Only process the first occurrence of each file UUID.
+        if (!isset($processed_uuids[$uuid])) {
+          $processed_uuids[$uuid] = TRUE;
+
+          $file = $this->entityRepository->loadEntityByUuid('file', $uuid);
+          if ($file instanceof FileInterface) {
+            $result->addCacheTags($file->getCacheTags());
+          }
+        }
+      }
+      $result->setProcessedText(Html::serialize($dom));
+    }
+
+    return $result;
+  }
+
+}