Skip to content

mvc: deprecate htmlspecialchars() use#10041

Open
Greelan wants to merge 3 commits into
opnsense:masterfrom
Greelan:htmlspecialchars
Open

mvc: deprecate htmlspecialchars() use#10041
Greelan wants to merge 3 commits into
opnsense:masterfrom
Greelan:htmlspecialchars

Conversation

@Greelan
Copy link
Copy Markdown
Contributor

@Greelan Greelan commented Mar 26, 2026

Attempt at addressing #7337

@Greelan Greelan mentioned this pull request Mar 26, 2026
2 tasks
const aliasMetadataList = row["alias_meta_" + column.id] || [];

const renderedItems = aliasMetadataList.map(aliasInfo => {
const safeText = $('<span>').text(aliasInfo.value || '').html();
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In volt we have {{ var | safe }} btw...

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(it doesn't account for API data returns, I know but I wanted to mention it)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, that's why I was happy to rely on {{ var }} where relevant

Copy link
Copy Markdown
Contributor Author

@Greelan Greelan Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, my bad, I'd understood that volt auto-escaped. I've now added explicit |safe attributes

@fichtner fichtner self-assigned this Mar 26, 2026
@fichtner
Copy link
Copy Markdown
Member

Thanks, I'll look at this in two weeks. Busy schedule at the moment. If I don't please ping me again.

@Greelan
Copy link
Copy Markdown
Contributor Author

Greelan commented May 1, 2026

@fichtner ping as requested

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants