Problem/Motivation

While using a "list" field type and adding items to the "Allowed values", there is a list of "Allowed HTML tags in labels".
Any HTML in a label is being stripped out of the label.
This concerns only when the label is displayed, in a form no HTML is allowed inside an <option> tag.

Steps to reproduce

Configure a list field with HTML in the allowed values label and display it.

Proposed resolution

Remaining tasks

  • Verify the bug still exists
  • Add/modify tests to assert the HTML is being stripped when is displayed inside an <option> tag and displayed when the label is rendered
  • Write code that allows HTML when displaying the label

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3089983

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

greatmatter created an issue. See original summary.

greatmatter’s picture

Issue summary: View changes
valthebald’s picture

Version: 8.7.8 » 8.9.x-dev
Issue tags: +Needs issue summary update, +Novice, +Amsterdam2019

Bumping target issue, adding tags

fazni’s picture

Assigned: Unassigned » fazni
fazni’s picture

@greatmatter Description is not clear for me, could you please attach the screenshot.

valthebald’s picture

Assigned: fazni » Unassigned

@fazni please avoid assigning Novice issues (see https://www.drupal.org/node/1319140 for details).
Trying to reproduce the issue (and provide screenshots) could be one possible way to move this issue forward.
Thank you!

fazni’s picture

@valthebald, thank you your feedback is important, I don't know too much about the policy.

I add somthing like that drupal.org|<b>drupal.org</b> in field allowed HTML
At level of HTML ( I inspect elements) of select it will be stripped "<select><option value="drupal.org">drupal.org</option></select>"

At level of page (front-end/display) the style(css) of the <b> tag will be applied.

simon peacock’s picture

StatusFileSize
new112.34 KB

I would say this works as intended.
The html is not displayed in the label on the node form (I believe this is correct), but is respected on the front-end.
List field "allowed values list" strips HTML from label

simon peacock’s picture

Status: Active » Needs review
.tom’s picture

Working on this from Drupalcon Amsterdam

mikkmiggur’s picture

StatusFileSize
new27.23 KB

It might be still a issue in the node edit form because it might be difficult to separate values when you have multiple values there with different tags. A simple example where is difficult to separate values without HTML in the admin form:
Allowed values list

simon peacock’s picture

StatusFileSize
new37.06 KB

I can see this being beneficial. But I have concerns for tags such as the anchor.
This could potentially render the list unusable.
Only local images are allowed.
Image tags would also be a problem.

Only local images are allowed.
As suggested, we could strip the href from the anchor but with the image we could have a really horrible looking drop down.
I appreciate these are edge cases but I'm concerned we will be introducing the potential for more issues later on.

simon peacock’s picture

So it looks like adding html to the `option` tag is invalid mark-up.
As discussed on SO:
can I use html tags in the options for select elements
This make me even more nervous for going against standards outside of Drupal.

I would consider this issue as 'works as expected'.

mikkmiggur’s picture

StatusFileSize
new46.73 KB

When HTML tags are showed in the edit view it's much more useful.
An example where tags are displayed and attributes are removed.
Tags are allowed.

sutharsan’s picture

Status: Needs review » Active

I fail to see what is there for review. It looks to me that there is a discussion going on and there is neither consensus on the problem nor on the solution.

Please do update the issue summary with the problem and proposed solution.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

mohrerao’s picture

I feel people will rarely use allowed HTML tags for listbox. However since we explicitly mention allowed tags this issue needs to be addressed. I tried adding only image tags and it came up with blank values in the form making it difficult to choose.
We should decide on how we display this in the form. can some UI person help on this

mohrerao’s picture

Issue tags: +ui

Adding UI tag so that some UI expert can suggest alternatives.

darrindeal’s picture

StatusFileSize
new22.14 KB

As stated in #13, the option tag cannot contain markup.

So it looks like adding HTML to the `option` tag is invalid mark-up.
As discussed on SO:
Can I use HTML tags in the options for select elements?
can I use HTML tags in the options for select elements
This make me even more nervous for going against standards outside of Drupal.

The issue I see is that the list field type is working as intended but the description is confusing in saying that the label can contain markup. This is the same for the float list and integer list. I suggest that this line in the description is removed.

desc

darrindeal’s picture

Status: Active » Needs review
StatusFileSize
new2.67 KB

I created the patch to change that I proposed.

tanubansal’s picture

Assigned: Unassigned » tanubansal
tanubansal’s picture

Assigned: tanubansal » Unassigned
StatusFileSize
new326.54 KB
new265.83 KB

@greatmatter, @darrindeal : After adding the latest patch provided by @darrindeal, I still can't see the HTML tags are applied.
Is it possible to add the steps to replicate the issue?

mayurjadhav’s picture

As mention in the #13 we can not add html tags to options in list field.
@tanubansal #20 patch is to remove the description which was invalid and confusing.
Patch works perfect for me, +1 for RTBC.

greatmatter’s picture

@tanubansal : Yes - the steps are as follows:

  1. Add a field of any type, but choose "list"
  2. In the "Field Settings" tab, there is a line of text in the description that says "Allowed HTML tags in labels: <a> <b> <big> <code> <del> <em> <i> <ins> <pre> <q> <small> <span> <strong> <sub> <sup> <tt> <ol> <ul> <li> <p> <br> <img>"
  3. Add any of the aforementioned HTML tags as a label
  4. Go to the Edit form for the content type
  5. Observe that the list item has the HTML stripped out.

Unfortunately, as mentioned in #13, it looks like it's not valid HTML to have tags in an <option> tag, so...yeah, we should probably remove the description.

tanubansal’s picture

After adding patch #20, tested via below mentioned steps :

Add a field of any type, but choose "list"
In the "Field Settings" tab, there is a line of text in the description that says "Allowed HTML tags in labels
Add any of the aforementioned HTML tags as a label
Go to the Edit form for the content type
Observe that the list item has the HTML stripped out.

Description text has been removed and updated
This can be moved to RTBC

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

abhijith s’s picture

StatusFileSize
new55.77 KB
new62.88 KB

Applied patch #20 and it works fine.The misleading description is removed after this patch.
Screenshots

before patch:
before

after patch:
after

abhijith s’s picture

Status: Needs review » Reviewed & tested by the community
lauriii’s picture

Status: Reviewed & tested by the community » Needs work
Issue tags: +Needs subsystem maintainer review

Would be useful if someone could update the issue summary since it took a while for me to figure out what this issue was trying to change.

Tagging for subsystem maintainer review in case they want to provide feedback on the solution.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

larowlan’s picture

I think we should retain the text but clarify that it is only used in display mode, not form mode

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

alucinogenado’s picture

StatusFileSize
new5.92 KB

I agree that the allowed tags list should be kept, but that a warning should be added to clarify that any tags are stripped from select options as per HTML specification.

However, one clarification: HTML tags are allowed in labels, not only in Display mode but also in Form mode, if the field widget is set to Check boxes/radio buttons.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

sahil.goyal’s picture

StatusFileSize
new2.71 KB
new4.52 KB

Rerolling the patch #20 as it does not getting compatible with the current version 10.1.x, so i made it updating the patch and now its applied perfectly. updating the reroll_diff along, And hold it to the NW as #29 suggest.

gauravvvv’s picture

StatusFileSize
new3.52 KB
new1.75 KB

Removed unused statements, Attached interdiff for same. please review.

gauravvvv’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 37: 3089983-37.patch, failed testing. View results

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

rodrigoaguilera’s picture

Issue summary: View changes
Issue tags: -Needs issue summary update +Vienna2025

Updated the IS without verifying if the bug still exist.

I think it is still a good novice issue so I will keep it on the list for the mentoring team for Vienna.

The Drupal Contribution Mentoring team is triaging issues for Drupalcon Vienna 2025 and we are reserving this issue for Mentored Contribution during the event.

After 17th of October, this issue returns to being open to all. Thanks!

sanket.tale made their first commit to this issue’s fork.

mradcliffe’s picture

Issue tags: -Novice

I am removing the Novice tag from this issue because I am a little confused about what I would be verifying based on the steps to reproduce after trying to follow the issue comments. It is possible that this is Novice, but I think it would need a bit more clarity in the steps to reproduce section of the issue summary based on some of the comments with screenshots.

I’m using this documentation as a source: https://www.drupal.org/community/contributor-guide/task/triage-novice-is...

mayurgajar’s picture

Assigned: Unassigned » mayurgajar

mayurgajar’s picture

Assigned: mayurgajar » Unassigned

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.