2

Summary:

Drupal seems to be stripping certain html tags from the #suffix of Form API created fields and I can't figure out how to stop it.

Environment:

Working in Drupal 8.9.13 with a minimum of modules.

Details:

I don't know Drupal well, and I've been tasked with fixing a custom Form that was imported from Drupal 7. It's being built through the Form API stuff, i.e. https://www.drupal.org/node/268072 The form is using #prefix and #suffix to wrap a div around each field, but it's also adding several labels to the #suffix that are being used for validation notices (shown and hidden via jQuery). Unor

I can embed as many divs as I want in the #suffix, but it's stripping labels. I also tried spans, and those seem to be stripped too. '#suffix' => '<div class="bupkis"><label>vegetable</label>cabbage</div></div>'), is resulting in <div class="bupkis">vegetablecabbage</div></div>

I appreciate that this isn't probably the ideal way to manage validation, but it's what I have and it was working in Drupal 7. I don't have budget to rebuild it all, I just want to get it to work as-is in Drupal 8.

Attempted fixes:

I've tried adding label and span to the 'Filtered HTML' format, in case it was using that as a default, but it didn't help.

I've tried Markup::create, i.e. '#suffix' => Markup::create('<div class="bupkis"><label>vegetable</label>cabbage</div></div>'), which I found in another stack overflow post... but that just causes a crash.

I've tried to find like a content type or something for this form, to see if I can adjust filters there... but there doesn't seem to be one. I think it's just dynamically generated, and there's no underlying pre-set structure?

3
  • drupal.org/docs/drupal-apis/form-api/form-render-elements says it will be filtered for XSS safety... not sure if that includes <label>
    – Mir
    Jun 4, 2021 at 22:17
  • 2
    Just causes a crash ... probably a missing use Drupal\Core\Render\Markup;
    – 4uk4
    Jun 4, 2021 at 22:47
  • @4k4 Can you throw that as a full answer? You were absolutely right, and having the right Use statement and then using Markup::create, it works! I'd love to give you credit for your help.
    – Mir
    Jun 4, 2021 at 22:57

1 Answer 1

7

The filtering doesn't use a text filter format. It is filtered against Xss::$adminTags, which doesn't contain <label>.

If you are sure the string is safe you can put it in a Markup object to avoid XSS filtering:

use Drupal\Core\Render\Markup;

...

  '#suffix' => Markup::create('<div class="bupkis"><label>vegetable</label>cabbage</div></div>'),

For this to work you have to add a use statement before the class or procedural function.

1
  • Thank you so much once again!
    – Mir
    Jun 6, 2021 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.