Problem/Motivation

While this may be considered a security issue. From a developer UX standpoint, I would like to create a simple changelog.json file for my site that I render with Views onto my project where the JSON contains an HTML entry that contains project changelog details with H2 and some UL elements for project changes.

renderField() in views json source calls HTML::escape() from the Drupal API that makes rendering raw HTML impossible from json source data. Doesn't Drupal8 have autoescaping On by default [https://www.drupal.org/project/search_api/issues/2742027#comment-11284971]. Shouldn't I be able to render at least {{ value|raw }} and see any raw HTML from my json source key?

Given my json source file called changelog.json has the content:

[
    {
        "log": "<h2>12-17-2020<\/h2>\n<ul>\n  <li>added Host deployment scripts and workflow through Gitlab CI for project.<\/li>\n<\/ul>\n"
    }
]

I would like to see this raw HTML rendered in Views. If I remove HTML::escape($value); to just return $value, and then {{ value|raw }} the field it works as expected. Additionally if renderField() simply returns value and the View does not override the output, the HTML content is auto-escaped by Drupal. Why the double escaping from the module?

Comments

tenken created an issue. See original summary.

tenken’s picture

Issue summary: View changes
tenken’s picture

Issue summary: View changes
tenken’s picture

StatusFileSize
new427 bytes

I have supplied a patch that removes the extraneous html escaping.

glottus’s picture

I came up with a similar solution, but added the ability to toggle rendering the source as markup within the Views field configurations. See attached patch.

sebaz’s picture

#5 works great and can be added to next release.

  • venugopp committed 05321e9 on 8.x-1.x authored by Glottus
    Issue #3188991 by tenken, venugopp, Glottus: cannot render html...
venugopp’s picture

Assigned: Unassigned » venugopp
Status: Active » Fixed
venugopp’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.