HTML in element descriptions causing problems?

I typed a <script> tag into the description of one of my TVs - not to try to do something crazy, but just as informative text (I didn’t really think much about it, but I guess I figured the tags would be converted to &lt; etc.).

Instead it caused some sort of weird parsing problem. The result was that on a resource that used a template with that TV, the TV category tabs disappeared... all of the TVs displayed in one long list. Also, the description for that TV truncated where the <script> tag was.

This seems rather prone to disaster; someone could do some pretty wiggy stuff to happen in the Manager interface by typing HTML characters in to description fields.

Should Revolution be escaping html tags in descriptions?

Quote from: jrotering at Jun 08, 2010, 03:29 PM

I typed a <script> tag into the description of one of my TVs - not to try to do something crazy, but just as informative text (I didn’t really think much about it, but I guess I figured the tags would be converted to &lt; etc.).

Instead it caused some sort of weird parsing problem. The result was that on a resource that used a template with that TV, the TV category tabs disappeared... all of the TVs displayed in one long list. Also, the description for that TV truncated where the <script> tag was.

This seems rather prone to disaster; someone could do some pretty wiggy stuff to happen in the Manager interface by typing HTML characters in to description fields.

Should Revolution be escaping html tags in descriptions?

Probably. Obviously, some fields you want to be able to use HTML tags and you’ll have to trust your manager users on that case, but there are certainly some validation rules or input filtering we can add to either not allow such tags or convert them in fields where it does not make sense (i.e. metadata fields such as TV description). Would you mind entering a ticket for this?

Yep. Done.