Comments (1)
While this is indeed a problem, it is not traditionally the expected behavior that all HTML should be escaped in data property values. Traditionally there has been an expectation that certain tags like p, ul, ol, li and the heading levels can be used in properties like overview statement, teaching statement, etc. Labels are used for publication titles, and here it is often the case that ā¤iā„ is used for scientific names and sub/sup are used for subscript and superscript.
In the GUI editor, AntiSamy is used to strip unwanted tags and scripts, and the client-side validation in TinyMCE is used as well. It sounds like something needs to be changed here for the label form. And of course none of guards against ingested values.
Before making a sweeping change, it probably is worth discussing whether the current anti-XSS library or something similar can also be used at display time without an objectionable performance penalty. In addition, it would be good to have specific annotations for properties where HTML (or different HTML subsets) is or isn't allowed.
from vivo.
Related Issues (20)
- Add new object property button shouldn't be available if neither of 'select from existing' nor 'provide selection' options set HOT 2
- Form to create new faux object property should have 'select from existing' and 'provide selection' options predefined as set in base property
- UILabelsVocabulary.ttl namespace and PropertyKey class name should be modified to avoid confusion with core ontology
- Data property edit form doesn't return valid values with " character
- Faux property participant doesn't work
- Having a classgroup with a missing label causes index page not to render HOT 1
- Properties do not have the correct settings to suggest creating a new value or selecting an existing value HOT 2
- Upload RDF data with blank nodes results in shredded ontology data in TBOX HOT 1
- Extend Dynamic API ontology with UI elements
- vivo_home/api/rest/{version}/persons
- vivo_home/api/rest/{version}/organizationUnits
- vivo_home/api/rest/{version}/events
- vivo_home/api/rest/{version}/projects
- vivo_home/api/rest/{version}/publications
- SPARQL Operation - Pageable and sortable flag HOT 1
- Add documentation for DOI claiming tool HOT 1
- Some inferred TBox axioms are not removed when assertions are deleted HOT 3
- Long delay when logging in to populated instance HOT 6
- Some i18n labels are missing
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
š Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ššš
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ā¤ļø Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vivo.