- Issue created by @bmunslow
Special characters such as " ' < > & are escaped in Drupal\advanced_datalayer\Plugin\AdvancedDatalayer\Tag::tidy method;
and thus display as html entities.
Enable advanced_datalayer for a content type and enter special characters in the title.
For example, this test string:
Drupal's test string: This & That
Is output as:
Drupal's test string: This & That
The way I see it, it's not needed to run all values through Html::escape, since they are already safely encoded in advanced_datalayer.module by means of Json::encode.
I run a few tests and you can find in the example below, how attempts to inject malicious code fail even after removing Html::escape from the tidy method.
Test string:
Article with special chars: & " ' < > and malicious code: <script>alert('Hacked!');</script>
DataLayer output:
Article with special chars: & " ' < > and malicious code: alert('Hacked!');
Active
2.1
Code