Umbraco.CMS.Backoffice icon indicating copy to clipboard operation
Umbraco.CMS.Backoffice copied to clipboard

Published 20 hours ago • verified publisher icon umbraco

Label property editor UI value sanitize

Open iOvergaard opened this issue 1 year ago • 0 comments

The value field on the label property editor UI could contain anything such as custom HTML and scripts. We should probably test it to see if it prints out HTML correctly or if it is escaped. I know that some extensions save HTML directly in a label. We should probably also figure out if we can scrape it a bit to remove dangerous characters by running it through an HTML parser such as sanitize-html

Originally posted by @iOvergaard in https://github.com/umbraco/Umbraco.CMS.Backoffice/pull/691#discussion_r1187146953

iOvergaard avatar May 08 '23 14:05 iOvergaard