Angle brackets (chevrons) dropped from plain text fields

[jackmaninov]

Is there an existing issue for this?

• I have searched the existing issues

Version of Corteza

2024.9.0

Current Behavior

I have an application that requires a user be able to enter an email configuration value into a record, e.g.
Application No-Reply <noreply@example.com>

However after saving the record the opening angle bracket and everything afterwards is truncated. I assume this is being stripped because of something to do with the Rich Text Editor (which I do not have enabled for this field).

The only success I have had in escaping these characters is using \u003c and \u003e and then relying on downstream systems to parse this back into angle brackets, but ideally my users would not have to be subjected to this.

Expected Behavior

Users can enter text with angle brackets and they are stored in the record. Corteza should handle any escaping necessary to handle angle brackets internally.

Steps To Reproduce

1. Create a module with a text record field.
2. Create a record with something similar to Application No-Reply <noreply@example.com> in the text field
3. Corteza truncates the field.

Environment and versions

Brave Version 1.78.97 Chromium: 136.0.7103.93 (Official Build) (64-bit)
Pop!_OS 22.04 LTS

Anything else?

No response

[Fajfa]

Interesting, thanks for reporting it.

[github-actions]

Stale issue message

[Fajfa]

Will allow for "safe" html elements to be allowed. Things like script and iframe tags will still be removed for sanitization.
If you want to use such unsafe HTML in Corteza i suggest you use it in the template system or workflows themselves, which are not sanitized.