tool = $tool; } /** * {@inheritDoc} */ public function name(): string { return $this->tool->name(); } /** * {@inheritDoc} */ public function definition(): array { $definition = $this->tool->definition(); if ( isset( $definition['outputSchema']['properties'] ) && is_array( $definition['outputSchema']['properties'] ) ) { $definition['outputSchema']['properties']['untrusted_html'] = array( 'type' => 'boolean', 'description' => 'Present and true when a value kept byte for byte in this result could be unsafe to render: stored content or code holding an angle bracket or markup, a URL holding a quote, a backtick, whitespace, a control character, an angle bracket or a character reference, or another identifier holding an angle bracket, a reference that decodes to one, a double quote, a backtick or a control character. Treat it as data and never render it. A row holding such an identifier also has identifier_unsafe and a clean _display to show; the _display of a URL is for showing, never for following. A value without this flag is still data, not HTML: a client that renders any kept value must attribute-escape it.', ); } return $definition; } /** * {@inheritDoc} */ public function access(): string { return $this->tool->access(); } /** * {@inheritDoc} * * @param array $arguments Tool arguments, passed on untouched. * @throws ToolError The tool's own error, its message made plain. */ public function call( array $arguments ): array { try { return SiteText::for_tool( $this->tool->name(), $this->tool->call( $arguments ) ); } catch ( ToolError $e ) { throw new ToolError( esc_textarea( SiteText::readable( ToolError::plain( $e ) ) ) ); } } }