How do I stop Form Builder/API from filtering certain HTML tags from #prefix and #suffix on fields?

Question

Summary:

Drupal seems to be stripping certain html tags from the #suffix of Form API created fields and I can't figure out how to stop it.

Environment:

Working in Drupal 8.9.13 with a minimum of modules.

Details:

I don't know Drupal well, and I've been tasked with fixing a custom Form that was imported from Drupal 7. It's being built through the Form API stuff, i.e. https://www.drupal.org/node/268072 The form is using #prefix and #suffix to wrap a div around each field, but it's also adding several labels to the #suffix that are being used for validation notices (shown and hidden via jQuery). Unor

I can embed as many divs as I want in the #suffix, but it's stripping labels. I also tried spans, and those seem to be stripped too. '#suffix' => '<div class="bupkis"><label>vegetable</label>cabbage</div></div>'), is resulting in <div class="bupkis">vegetablecabbage</div></div>

I appreciate that this isn't probably the ideal way to manage validation, but it's what I have and it was working in Drupal 7. I don't have budget to rebuild it all, I just want to get it to work as-is in Drupal 8.

Attempted fixes:

I've tried adding label and span to the 'Filtered HTML' format, in case it was using that as a default, but it didn't help.

I've tried Markup::create, i.e. '#suffix' => Markup::create('<div class="bupkis"><label>vegetable</label>cabbage</div></div>'), which I found in another stack overflow post... but that just causes a crash.

I've tried to find like a content type or something for this form, to see if I can adjust filters there... but there doesn't seem to be one. I think it's just dynamically generated, and there's no underlying pre-set structure?

Answer 1

The filtering doesn't use a text filter format. It is filtered against Xss::$adminTags, which doesn't contain <label>.

If you are sure the string is safe you can put it in a Markup object to avoid XSS filtering:

use Drupal\Core\Render\Markup;

...

  '#suffix' => Markup::create('<div class="bupkis"><label>vegetable</label>cabbage</div></div>'),

For this to work you have to add a use statement before the class or procedural function.