Problem/Motivation
While this may be considered a security issue. From a developer UX standpoint, I would like to create a simple changelog.json file for my site that I render with Views onto my project where the JSON contains an HTML entry that contains project changelog details with H2 and some UL elements for project changes.
renderField() in views json source calls HTML::escape() from the Drupal API that makes rendering raw HTML impossible from json source data. Doesn't Drupal8 have autoescaping On by default [https://www.drupal.org/project/search_api/issues/2742027#comment-11284971]. Shouldn't I be able to render at least {{ value|raw }} and see any raw HTML from my json source key?
Given my json source file called changelog.json has the content:
[
{
"log": "<h2>12-17-2020<\/h2>\n<ul>\n <li>added Host deployment scripts and workflow through Gitlab CI for project.<\/li>\n<\/ul>\n"
}
]
I would like to see this raw HTML rendered in Views. If I remove HTML::escape($value); to just return $value, and then {{ value|raw }} the field it works as expected. Additionally if renderField() simply returns value and the View does not override the output, the HTML content is auto-escaped by Drupal. Why the double escaping from the module?
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | views_json_source-render-as-markup-3188991-5.patch | 1.38 KB | glottus |
| #4 | 3188991-1.patch | 427 bytes | tenken |
Comments
Comment #2
tenken commentedComment #3
tenken commentedComment #4
tenken commentedI have supplied a patch that removes the extraneous html escaping.
Comment #5
glottus commentedI came up with a similar solution, but added the ability to toggle rendering the source as markup within the Views field configurations. See attached patch.
Comment #6
sebaz commented#5 works great and can be added to next release.
Comment #8
venugopp commentedComment #9
venugopp commented