core/lib/Drupal/Component/Utility/Xss.php

@@ -224,6 +224,8 @@ protected static function attributes($attributes) {
             $skip_protocol_filtering = substr($attribute_name, 0, 5) === 'data-' || in_array($attribute_name, array(
               'title',
               'alt',
+              'rel',
+              'property',
             ));
 
             $working = $mode = 1;

core/lib/Drupal/Core/Access/CsrfTokenGenerator.php

@@ -87,7 +87,7 @@ public function validate($token, $value = '') {
       return FALSE;
     }
 
-    return $token === $this->computeToken($seed, $value);
+    return Crypt::hashEquals($this->computeToken($seed, $value), $token);
   }
 
   /**

core/lib/Drupal/Core/Asset/CssCollectionRenderer.php

@@ -63,7 +63,7 @@ class CssCollectionRenderer implements AssetCollectionRendererInterface {
   /**
    * Constructs a CssCollectionRenderer.
    *
-   * @param \Drupal\Core\State\StateInterface
+   * @param \Drupal\Core\State\StateInterface $state
    *   The state key/value store.
    */
   public function __construct(StateInterface $state) {

core/lib/Drupal/Core/Asset/JsCollectionRenderer.php

@@ -20,7 +20,7 @@ class JsCollectionRenderer implements AssetCollectionRendererInterface {
   /**
    * Constructs a JsCollectionRenderer.
    *
-   * @param \Drupal\Core\State\StateInterface
+   * @param \Drupal\Core\State\StateInterface $state
    *   The state key/value store.
    */
   public function __construct(StateInterface $state) {

core/lib/Drupal/Core/Authentication/AuthenticationProviderChallengeInterface.php

@@ -21,7 +21,7 @@ interface AuthenticationProviderChallengeInterface {
    * @param \Exception $previous
    *   The previous exception.
    *
-   * @return \Symfony\Component\HttpKernel\Exception\HttpExceptionInterface|NULL
+   * @return \Symfony\Component\HttpKernel\Exception\HttpExceptionInterface|null
    *   An exception to be used in order to generate an authentication challenge.
    */
   public function challengeException(Request $request, \Exception $previous);