HTML inside an vertical-tabs tab label is being removed and escaped

Created on 31 May 2023, over 2 years ago

Problem/Motivation

This issue appeared in combination with the "Field Group" module, through issue 🐛 HTML inside the "Vertical Tabs" "Tab" label is being removed and escaped Postponed and Add option to allow HTML in labels Fixed .

The core "vertical-tabs.js" uses "textContent" in line 89 of "core/misc/vertical-tabs.js" to render the tab labels instead of "innerHTML".

Element.innerHTML returns HTML, as its name indicates. Sometimes people use innerHTML to retrieve or write text inside an element, but textContent has better performance because its value is not parsed as HTML.

See: https://developer.mozilla.org/en-US/docs/Web/API/Node/textContent

When this is changed, the HTML is used, but still gets escaped.

Here is a screenshot, where the tabs are rendered as details elements with the correct title for a split second:

And here the final rendered vertical tabs with the "broken" tab titles:

Steps to reproduce

Proposed resolution

Use innerHTML instead and "lower" the amount of escaped HTML (e.g. using Xss::filterAdmin).

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component
Render 

Last updated 8 days ago

Created by

🇩🇪Germany Grevil

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024