Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
I'm currently considering using a free theme for my a Website, they use bootstraps Carousel to render a slideshow/banner, and their advice on how to make that slideshow work is to embed HTML in a block an set it to Full HTML. Tutorial here
My question is if there are security risks attached to having a Full HTML block?
Or does Drupal (more specifically 8) inherently protects blocks with code/snippets in?
If so, to which extent should one utilize it, instead of e.g. building a custom block?
In general, you should probably only give Full HTML access to only your most trusted users (which may only be the site administrator).
Now the example you linked to was intended to be used in a block. Block administration is also something that will likely only be done by your site administrators. Every site needs an administration plan, so it's fair to ask, can the people entrusted with block creation also be entrusted with the use of Full HTML? If so, no need to create a custom block.
Alternatively, the example code is fairly benign, so you could add a Text Format that allowed for the use of those tags & attributes (admin -> configuration -> content authoring -> text formats and editors). I often create a Text Format called Advanced HTML that allows for most tags but I don't include any of the potentially problematic tags like script, object, style, etc.
To produce that carousel, looks like you would minimally need the following:
<div id class role data-*><ol class><li class data-*><img src alt><h3><p>
