Closed Option explanation field script tag breaks options page (Save button disappears)

Eris Greyrat

Eris Greyrat

Well-known member
Licensed customer
Affected version
2.3.9
Location: Admin CP > Setup > Options > Create or Edit option > Explanation field

The Explanation field on the option edit page shows the label "You may use HTML". However, if the explanation text contains a <script> tag (for example, when documenting that an option outputs a <script type="application/ld+json"> block in the page head), the tag is rendered raw into the Admin CP options page. This causes the page to stop rendering correctly, and the Save button at the bottom of the options group page disappears entirely.

This is purely a UI issue discovered during add-on development. It is not a security issue, reproducing it requires Admin CP access, and admins are already fully trusted users.

Steps to reproduce:​

Go to Admin CP > Setup > Options
Edit any existing option (or create a new one)
In the Explanation field, enter any text containing a <script> tag, for example:
Code: 
Outputs a <script type="application/ld+json"> block in the page head.
Save the option
Navigate back to the option group page

Expected result:
The explanation text renders with the <script> tag safely escaped (displayed as <script> in plain text) or stripped, and the Save button remains visible.

Actual result: The raw script tag is injected into the page HTML. The options page stops rendering correctly after the affected option, and the Save button disappears.

Workaround:​

Replace the literal tag with plain text in the explanation, write "script tag" or use <script> written as HTML entities to display it safely without breaking the page.

Fix:​

Escape <script> Tags in the explanation field output on the options list template so they render as visible text instead of being injected raw into the page HTML. This is consistent with how XenForo handles untrusted output elsewhere and requires no changes to the save flow or field label.
Before:
Before.webp

After:
After.webp​
 
Last edited:
EDIT: The original post used literal <script> tags that were triggered by Cloudflare WAF on xenforo.com and blocked submission with a 403 error.

I replaced them with post for HTML entities (&lt;script&gt;) to get the post through, which is somewhat ironic given the description of this report.
 
Automated triage: As designed

The explanation field accepts raw HTML on purpose, so a literal opening script tag is treated as real markup. The browser then reads the rest of the page as script, hiding the later options and the Save button. To show the tag as text, write it with HTML entities, as you already found.

This is an automated assessment. A member of staff may review and update it.
 
Confirmed on my side, thanks. The cause is the unclosed <script> tag: the HTML parser treats everything up to the next </script> as script text. A closed tag renders fine. Agreed, this is as designed because the core explanations rely on raw HTML. Using &lt;script&gt; is the correct way to show the tag as text.
 
Back
Top Bottom