Problem/Motivation

We would like to display an icon next to certain Webform element titles, using a simple <i> tag (e.g. from an icon library).

Currently, Webform element titles strip or escape the <i> tag, so it cannot be used for basic icon markup. This limits the ability to add small visual indicators in element titles (for example an info icon, or a custom status icon), without having to add separate custom markup wrappers.

In our project, we have several forms where design requires an icon directly in the element title, e.g.:
<i class="icon-info"></i> Some question text

Steps to reproduce

  1. Create or edit a Webform.
  2. Add an element (for example a textfield).
  3. Set the Title field to something like: Your question title
  4. Save and view the Webform.

Actual result:
The tag is not rendered as HTML; it is stripped/escaped and appears as plain text, or is removed, depending on the context.

Expected result
Allow the tag to be preserved in Webform element titles so that icons can be added via markup, while still keeping other HTML filtering/sanitization in place.

Proposed resolution

The attached patch:

  • Adjusts the markup sanitization / allowed tags so that is permitted in Webform element titles.
  • Keeps all existing XSS/markup protections in place.
  • Does not change behaviour for any other tags; only is added to the allowed list in this context.

The intent is to keep this change minimal and focused:

  • Only the tag is allowed.
  • No attributes beyond what is already handled by the existing markup filtering are added.

Remaining tasks

  • Review the patch and the exact location where is allowed.
  • Confirm that allowing in element titles is acceptable from a UX and security perspective.
  • If needed, restrict this behaviour to specific contexts (e.g. title rendered as label only).
  • Add/adjust tests if maintainers consider it necessary (I can help if pointed towards the appropriate test class).

Comments

ionut.stan created an issue. See original summary.

ionut.stan’s picture

Issue summary: View changes
ionut.stan’s picture

Issue summary: View changes
liam morland’s picture

Version: 6.2.x-dev » 6.3.x-dev