Closed (fixed)
Project:
Name Field
Version:
8.x-1.x-dev
Component:
Code
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
22 Apr 2026 at 17:37 UTC
Updated:
10 May 2026 at 01:10 UTC
Jump to comment: Most recent
Lines 38–115 of src/Traits/NameFormSettingsHelperTrait.php build table structure by concatenating raw HTML strings with $form[$child]['#title']. It's safe today because titles derive from NameComponentMetadataService::getTranslations() (hardcoded labels), but the pattern is fragile — any future contributor passing dynamic data into #title would land it in an unescaped prefix.
Recommendation: migrate to #type => 'table'.
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
bluegeek9 commentedComment #5
bluegeek9 commented