Webform Content Creator currently uses the build in Drupal token manager for processing tokens. This mostly works fine, but it means some extra webform tokens (such as the suffixes to, e.g., strip HTML tags) do not work. This suffix would be very useful for a situation where the "Custom" field is populated with HTML content (provided by the person configuring the mapping) and webform tokens which should not allow HTML input.
You need:
1. a webform with a long text field
2. a node type with a long text field
3. a corresponding webform content creator configuration set up with a mapping to the node long text field populated with custom text including a token for the webform long text field suffixed with :htmldecode:striptags, e.g. [webform_submission:values:description:htmldecode:striptags]
With this configuration, try submitting your form with content like
alert('test');. Since the :striptags suffix is not supported, this will work. This means that some tokens cannot be used safely if mapping to a field that renders HTML.
Use the webform token manager instead so the token suffixes will be processed correctly.
I will open an MR with the change shortly.
Active
4.0
Code
I've opened an MR and attached a corresponding patch.