As designed Markup in phrases converted to HTML entities

[tomdav]

Affected version

2.1

For example I tried changing the phrase "Star" to <i class="fal fa-star"></i>. It displays fine initially but when I toggle star/unstar when viewing a conversatoin it converts the font awesome markup to html entities rather than displaying the font awesome icon.

Edit: this is due to function XF.handleSwitchResponse using the jquery .text() method. I modified it to use the .html() method and it works fine now (although I do need to wrap the font awesome markup in span tags which borders on another bug). Is there a reason why it is currently limited to text only?

 

[Chris D]

Unfortunately the general case is whenever we've used .text() specifically or otherwise are escaping HTML output, it is deliberate and done for security.

In some cases it may be slightly over-zealous, but we're not necessarily going to implement changes that will potentially introduce XSS vectors unintentionally.