Merge branch '7.4' into 8.0

* 7.4:
  [ObjectMapper] do not require mapping a target's required promoted property when not on source (#2)
  run tests with PHPUnit 12.3
  [GitHub] Update .github/PULL_REQUEST_TEMPLATE.md to remove SF 7.2 as it's not supported anymore
  [CI] fixed the Intl data tests actions Tests fails due to unknown option -v which is shorthand of the --verbose as per the phpunit its removed without any replacement sebastianbergmann/phpunit#5647 (comment)
  [Mailer] Fix expected exception message to include quotes around "http(s)://"
  [WebProfilerBundle] Fix toolbar not rendering after replacing it
  [Validator] (60455) Validate translations for Arabic (ar)
  (60474) Remove translation state attribute for Twig template validator in Ukrainian translation
  [VarDumper] Fix dumping objects from the DOM extension
  [Mailer] Add MicrosoftGraph API Transport
  [Yaml] Fix code style
  [Tests] Adapt testAddHtmlContentWithErrors to be HTML5 compliant
  Add friendly name in the `to` field
  [ObjectMapper] read source metadata before transform
  [HtmlSanitizer] Fix force_attributes not replacing existing attribute in initial data

Author: nicolas-grekas

Tests/HtmlSanitizerCustomTest.php

@@ -232,10 +232,17 @@ public function testForceAttribute()
     {
         $config = (new HtmlSanitizerConfig())
             ->allowElement('div')
+            ->allowElement('img', '*')
             ->allowElement('a', ['href'])
             ->forceAttribute('a', 'rel', 'noopener noreferrer')
+            ->forceAttribute('img', 'loading', 'lazy')
         ;
 
+        $this->assertSame(
+            '<img title="My image" src="https://example.com/image.png" loading="lazy" />',
+            $this->sanitize($config, '<img title="My image" src="https://example.com/image.png" loading="eager" onerror="alert(\'1234\')" />')
+        );
+
         $this->assertSame(
             '<a rel="noopener noreferrer">Hello</a> world',
             $this->sanitize($config, '<a>Hello</a> world')
@@ -250,6 +257,11 @@ public function testForceAttribute()
             '<div>Hello</div> world',
             $this->sanitize($config, '<div style="width: 100px">Hello</div> world')
         );
+
+        $this->assertSame(
+            '<a href="https://symfony.com" rel="noopener noreferrer">Hello</a> world',
+            $this->sanitize($config, '<a href="https://symfony.com" rel="noopener">Hello</a> world')
+        );
     }
 
     public function testForceHttps()

Visitor/DomVisitor.php

@@ -129,7 +129,7 @@ private function enterNode(string $domNodeName, \DOMNode $domNode, Cursor $curso
 
         // Force configured attributes
         foreach ($this->forcedAttributes[$domNodeName] ?? [] as $attribute => $value) {
-            $node->setAttribute($attribute, $value);
+            $node->setAttribute($attribute, $value, true);
         }
 
         $cursor->node->addChild($node);

Visitor/Node/Node.php

@@ -56,10 +56,10 @@ public function getAttribute(string $name): ?string
         return $this->attributes[$name] ?? null;
     }
 
-    public function setAttribute(string $name, ?string $value): void
+    public function setAttribute(string $name, ?string $value, bool $override = false): void
     {
         // Always use only the first declaration (ease sanitization)
-        if (!\array_key_exists($name, $this->attributes)) {
+        if ($override || !\array_key_exists($name, $this->attributes)) {
             $this->attributes[$name] = $value;
         }
     }