Refactor labelText config in CheckBox and TextField (and potentially other fields extending Field) to support Object (single VDOM node) and Object[] (array of VDOM nodes) in addition to String.
Crucially, this refactoring must remove the usage of .html (innerHTML) assignment in afterSetLabelText and replace it with a safer VDOM-based approach (setting .vdom or .cn and .text), similar to the recent valueLabel fix. This mitigates potential XSS vulnerabilities associated with innerHTML.
Scope:
- Update
src/form/field/Base.mjs (if labelText is defined there) or Text.mjs, CheckBox.mjs, etc.
- Ensure
afterSetLabelText handles String (as text), Object, and Object[].
- Verify backward compatibility for existing string-based labels (rendering as text, not HTML, unless we explicitly decide to keep HTML support for strings - decision needed: strictly text for strings like
valueLabel, or keep HTML support for backward compat? -> Prompt implies "custom vdom definition (to close a XSS vulnerability)", suggesting strings should become text-only or we need a clear migration path).
Note: This does NOT involve renaming labelText to label, keeping the scope manageable while improving security and flexibility.
Refactor
labelTextconfig inCheckBoxandTextField(and potentially other fields extendingField) to supportObject(single VDOM node) andObject[](array of VDOM nodes) in addition toString.Crucially, this refactoring must remove the usage of
.html(innerHTML) assignment inafterSetLabelTextand replace it with a safer VDOM-based approach (setting.vdomor.cnand.text), similar to the recentvalueLabelfix. This mitigates potential XSS vulnerabilities associated withinnerHTML.Scope:
src/form/field/Base.mjs(iflabelTextis defined there) orText.mjs,CheckBox.mjs, etc.afterSetLabelTexthandles String (as text), Object, and Object[].valueLabel, or keep HTML support for backward compat? -> Prompt implies "custom vdom definition (to close a XSS vulnerability)", suggesting strings should become text-only or we need a clear migration path).Note: This does NOT involve renaming
labelTexttolabel, keeping the scope manageable while improving security and flexibility.