LearnNewsExamplesServices
Frontmatter
id7813
titleRefactor: Enhance labelText to support VDOM and remove innerHTML usage
stateClosed
labels
enhancementrefactoring
assigneestobiu
createdAtNov 19, 2025, 5:07 PM
updatedAtNov 19, 2025, 5:35 PM
githubUrlhttps://github.com/neomjs/neo/issues/7813
authortobiu
commentsCount0
parentIssuenull
subIssues[]
subIssuesCompleted0
subIssuesTotal0
blockedBy[]
blocking[]
closedAtNov 19, 2025, 5:35 PM

Refactor: Enhance labelText to support VDOM and remove innerHTML usage

Closed v11.6.1 enhancementrefactoring
tobiu
tobiu commented on Nov 19, 2025, 5:07 PM

Refactor labelText config in CheckBox and TextField (and potentially other fields extending Field) to support Object (single VDOM node) and Object[] (array of VDOM nodes) in addition to String.

Crucially, this refactoring must remove the usage of .html (innerHTML) assignment in afterSetLabelText and replace it with a safer VDOM-based approach (setting .vdom or .cn and .text), similar to the recent valueLabel fix. This mitigates potential XSS vulnerabilities associated with innerHTML.

Scope:

  • Update src/form/field/Base.mjs (if labelText is defined there) or Text.mjs, CheckBox.mjs, etc.
  • Ensure afterSetLabelText handles String (as text), Object, and Object[].
  • Verify backward compatibility for existing string-based labels (rendering as text, not HTML, unless we explicitly decide to keep HTML support for strings - decision needed: strictly text for strings like valueLabel, or keep HTML support for backward compat? -> Prompt implies "custom vdom definition (to close a XSS vulnerability)", suggesting strings should become text-only or we need a clear migration path).

Note: This does NOT involve renaming labelText to label, keeping the scope manageable while improving security and flexibility.

tobiu added the enhancement label on Nov 19, 2025, 5:07 PM
tobiu added the refactoring label on Nov 19, 2025, 5:07 PM
tobiu assigned to @tobiu on Nov 19, 2025, 5:08 PM
tobiu referenced in commit 885fa35 - "Refactor: Enhance labelText to support VDOM and remove innerHTML usage #7813" on Nov 19, 2025, 5:23 PM
tobiu closed this issue on Nov 19, 2025, 5:35 PM