diff --git a/core/lib/Drupal/Core/Form/FormErrorHandler.php b/core/lib/Drupal/Core/Form/FormErrorHandler.php index df736b0..fee0023 100644 --- a/core/lib/Drupal/Core/Form/FormErrorHandler.php +++ b/core/lib/Drupal/Core/Form/FormErrorHandler.php @@ -83,8 +83,9 @@ protected function displayErrorMessages(array $form, FormStateInterface $form_st } elseif ($is_visible_element && $has_title && $has_id) { // We need to pass this through SafeMarkup::escape() so - // drupal_set_message() does not encode the links. - $error_links[] = SafeMarkup::escape($this->l($title, Url::fromRoute('', [], ['fragment' => $form_element['#id'], 'external' => TRUE]))); + // drupal_set_message() does not encode the links. The element title, + // however, can contain HTML so we need to mark it as safe. + $error_links[] = SafeMarkup::escape($this->l(SafeMarkup::set($title), Url::fromRoute('', [], ['fragment' => $form_element['#id'], 'external' => TRUE]))); unset($errors[$name]); } }