- Issue created by @Luke.Leber
- 🇺🇸United States cilefen
This seems similar in nature to 🐛 Support displaying a message that correctly validates file uploads for the Gin theme. Active . Do they have a common cause?
- 🇺🇸United States Luke.Leber Pennsylvania
I believe that the root cause is that Drupal's XSS utility is somewhat dated. There are a pile of "safe" HTML5 tags that are stripped out -- a subset of SVG's elements among them.
This is a somewhat heavy-handed approach that immediately comes to mind to resolve this in the mean-time:
$status_messages = ['#type' => 'status_messages']; // Rather than concatenating things in `#prefix`, extract the // existing prefix and only run XSS filter on that. $prefix = $form['#prefix'] ?? ''; if (!($prefix instanceof MarkupInterface)) { $prefix = Xss::filterAdmin($prefix); } // Then render a build array noting that... // 1. $prefix has been sanitized. // 2. $status_messages has been sanitized (via Twig) $build = [ ['#markup' => Markup::create($prefix)], $status_messages, array_filter($form, static fn($key) => $key !== '#prefix', ARRAY_FILTER_USE_KEY), ]; $output = $renderer->renderRoot($build);