ClientValidation broken with script tag in attribute label

[luke-]

What steps will reproduce the problem?

• Create a form and model with attribute label e.g. Test Label<script>alert("1")</script>
• Without enableClientValidation the attribute label is properly encoded
• With enableClientValidation a script alert is shown and broken HTML appears

Additional info

Q	A
Yii version	2.0.latest
PHP version	any
Operating system	any

[bizley]

Please provide the code used to place the label in the view.

[luke-]

Here a example:

Model:

class Example extends ActiveRecord
{
    public function attributeLabels()
    {
        return [
            'newPassword' => Yii::t('base', 'New password').'<script>alert("1")</script>',
        ];
    }
   // ...
}

View:

    <?php $form = ActiveForm::begin(['enableClientValidation' => true]); ?>
    ...
    <?php echo $form->field($model, 'newPassword')->passwordInput(['maxlength' => 45]); ?>

[bizley]

Hmm, I can see that label is not encoded by default. It was long time ago last time I checked this but isn't it by design? enableClientValidation has nothing to do with it.

[luke-]

Hmm, here attribute lables seems to by encoded by default. Screenshot of the example code:

[bizley]

Oh, I see, so the label is placed as is as a part of client validation JS code.

[bizley]

I can confirm labels are indeed encoded but apparently not when used inside the JS.

[samdark]

We should encode them for JS as well.