Fix template directive injection handling - #41244

Description (*)

This PR fixes an issue in the template directive filtering that can cause directive content originating from template data to be processed again when deferred directives are resolved.

The issue can be reproduced through a guest cart by storing a template directive in an address field and subsequently triggering the Payflow Pro response handling flow.

The proposed changes introduce two mechanisms to prevent this behavior:

• Signature markers to identify directives that were intentionally deferred by a template.
• Placeholders to prevent the output of one directive from being re-scanned and interpreted as another directive during the same filtering operation.

Unresolved signature markers are also removed when the root template finishes processing, preventing internal marker values from reaching the rendered output.

Related Pull Requests

Fixed Issues (if relevant)

1. Fixes magento/magento2#<issue_number>

Manual testing scenarios (*)

1. Create a guest cart using the createGuestCart GraphQL mutation and save the returned cart ID.

2. Set the billing address of the guest cart using the following setBillingAddressOnCart GraphQL mutation. Replace <CART_ID> with the guest cart ID returned in the previous step.

mutation SetBillingAddressOnCart {
  setBillingAddressOnCart(
    input: {
      cart_id: "<CART_ID>"
      billing_address: {
        address: {
          firstname: "Injected Code Example"
          lastname: "lastname"
          country_code: "GB"
          city: "city"
          street: "street"
          region: "{{if postcode}}{{var postcode}}{{/if}}{{/var}}{{if postcode}}{{var postcode}}{{/if}}{{if city}}{{var firstname}}{{/if}}"
          postcode: "{{var postcode}}"
          telephone: "1"
        }
      }
    }
  ) {
    cart {
      billing_address {
        firstname
        lastname
        street
        city
        postcode
        country {
          code
        }
      }
    }
  }
}

The important part of this payload is that the firstname is set to Injected Code Example, while the region field contains the template directive: {{if city}}{{var firstname}}{{/if}}

3. Execute the handlePayflowProResponse GraphQL mutation for the same guest cart:

mutation  {
  handlePayflowProResponse(
    input: {
      cart_id: "<CART_ID>"
      paypal_payload: "RESULT=12&RESPMSG=Declined"
    }
  ) {
    cart {
      id
    }
  }
}

4. After the request, check the email in MailCatcher (or an equivalent tool). Before the fix, Injected Code Example appears twice in the payment transaction failure information: once as the firstname value and once where the template directive is injected.

If you do the same steps with this PR applied, you can see that this unintended replacement doesn't happen.

Questions or comments

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
• All automated tests passed successfully (all builds are green)