Label text isn't HTML-escaped

[craigholm]

When a label is rendered, the contents of the label element aren't escaped either with __str__ or __html__.

>>> from wtforms import IntegerField, Form
>>> class MyForm(Form):
	foo = IntegerField('Number (must be < 10):', default=0)

	
>>> form = MyForm()
>>> for field in form: print(field.label)

<label for="foo">Number (must be < 10):</label>
>>> for field in form: print(field.label.__html__())

<label for="foo">Number (must be < 10):</label>

[andreagrandi]

Snyk vulnerability scanner reports WTForms 2.1 as vulnerable https://snyk.io/vuln/SNYK-PYTHON-WTFORMS-40581

Would it be possible to acknowledge this issue in some way? I know 3.0 is in development but even for this reason it would be nice to know if the new version will be affected as well.

Thank you so much, cheers

[davidism]

There should be very few circumstances where it makes sense to put untrusted input into a label, that's just not what labels are for. Reporting this as an XSS is misleading.

[rfkortekaas]

I'm facing an issue due to the change of this. I try to use HTML special chars in the field label:

Actual Behavior

>>> import wtforms
>>> class F(wtforms.Form):
...     foo = wtforms.IntegerField('ε')
>>> f = F()
>>> for field in f: print(field.label)

<label for="foo">&amp;epsilon;</label>

Expected Behavior

>>> import wtforms
>>> class F(wtforms.Form):
...     foo = wtforms.IntegerField('ε')
>>> f = F()
>>> for field in f: print(field.label)

<label for="foo">&epsilon;</label>

Environment

• Python version: 3.7.4
• wtforms version: 2.3.1

Furthermore I really don't understand why this is a possible source for XSS as there is no user-input affecting the field label. E.g. the source of the label originates from the developer and when he has bad intentions you cannot prevent it like this. Except when you let the user have some control over the forms, but in my opinion this should be solved on another level.

[eliteuser26]

Similar to the previous comment, in version 2.2.1 I was able to use html code in the label text. However in version 2.3.1 it doesn't work anymore. How can I break a text over 2 lines if it is being parsed before rendering. It is for the developer to decide if he should use html code or not. Is there any other option that is not documented in WTForms that would do the same thing.

[rfkortekaas]

I found a solution for this. Maybe it's useful to add it to the documentation.

For escaping WTForms uses escape from MarkupSafe. You can pass an Markup object to the escape function to be able to format HTML.

>>> import wtforms
>>> from markupsafe import Markup
>>> class F(wtforms.Form):
...     foo = wtforms.IntegerField(Markup('ε'))
>>> f = F()
>>> for field in f: print(field.label)

<label for="foo">&epsilon;</label>

[eliteuser26]

Thanks for this solution. I will test it to see if it works in my case. I couldn't understand the examples for Markup at first. It does make things more complicated. I was able to use the label directly into the HTML code directly and it worked fine without escaping. So I don't see why this is a problem. Regards, Claude.

…

On Fri, Jun 5, 2020, 01:56 R.F. Kortekaas ***@***.***> wrote: I found a solution for this. Maybe it's useful to add it to the documentation. For escaping WTForms uses escape from MarkupSafe. You can pass an Markup object to the escape function to be able to format HTML. >>> import wtforms>>> from markupsafe import Markup>>> class F(wtforms.Form): ... foo = wtforms.IntegerField(Markup('&epsilon;'))>>> f = F()>>> for field in f: print(field.label) <label for="foo">&epsilon;</label> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#315 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHUD6MMOBEL2NQYSB6ERGETRVCCIBANCNFSM4C2OL2BA> .

[sovankiry]

I found a solution for this. Maybe it's useful to add it to the documentation.

For escaping WTForms uses escape from MarkupSafe. You can pass an Markup object to the escape function to be able to format HTML.

>>> import wtforms
>>> from markupsafe import Markup
>>> class F(wtforms.Form):
...     foo = wtforms.IntegerField(Markup('ε'))
>>> f = F()
>>> for field in f: print(field.label)

<label for="foo">&epsilon;</label>

@rfkortekaas Thank you so much for your solution and it is working for me. I've problems when upgrade WTForm to version 2.3.x from my old version.