Basic vs Composite Elements: Differences in HTML Rendering

Problem/Motivation

Basic and composite elements are not rendered in the same way. If HTML markup is submitted to a Text Field, it's displayed as plain text. If HTML markup is submitted to a composite element, like Name, the HTML is rendered (<script> tags are still stripped, so this is not a XSS vulnerability). I noticed it specifically when a user a submitted an image in an image tag to a name field.

Steps to reproduce

1. Start from a fresh Drupal 9.5 install
2. Install the webform module (version 6.1.5)
3. Create a webform
4. Add a Text Field to the webform
5. Add a Name Field to the webform (simplest case: only have first name visible, but it doesn't matter)
6. Create a submission to the webform with the value <img src="https://dummyimage.com/100x100/000/fff"> entered for both the Text Field and the Name Field
7. View the new submission and see that the image is rendered in the Name Field but displayed as plain text in the Text Field.

Proposed resolution

Attached is a patch file with my proposed solution. I replaced #markup with #plain_text to match how values are rendered for Basic Elements (line 1652 in WebformElementBase.php). This makes their behavior consistent and prevents users submitting images when they aren't expected to.

Remaining tasks

There may be functionality in compositive elements that rely on using #markup that I'm not aware of. For myself, none of the composite elements: Address, Contact, Custom, Link, Location, Name, Telephone advanced were used with the expectation of HTML, so it works well enough.