Allow HTML in label of field

[edwardmp]

Currently, embedding HTML in the label does not work as expected (trivial example):

Code example:
<%= f.text_field :name, label: "<b>Name</b>" %>

[edwardmp]

Proposed fix in PR #314

[mattbrictson]

Does this work?

<%= f.text_field :name, label: "<b>Name</b>".html_safe %>

[edwardmp]

@mattbrictson
Yup, it seems so. Still, personally I'd rather have this kind of logic in 1 place.
I also display the form errors in the label, and any HTML in the error message is still escaped.

[mattbrictson]

I understand the need to sometimes display HTML inside error messages, but we have to be careful. Blindly calling html_safe inside bootstrap_form is a security issue, and as such I would prefer not to go down that path.

I think perhaps Rails already has adequate tools to address this problem.

For example, for labels I think the example I gave above (using html_safe explicitly) is the right way to go.

For error messages, it may not be as straightforward. But using the Rails i18n system to generate the error messages, there is a way to specify HTML in interpolated messages, as explained in the Rails Guide here: http://guides.rubyonrails.org/i18n.html#using-safe-html-translations

Error messages can be specified as follows: http://guides.rubyonrails.org/i18n.html#error-message-scopes

[edwardmp]

@mattbrictson the i18n way (appending _html to the translation key) doesn't work for me in error messages.

In addition, the existing codebase already calls html_safe (e.g. at https://github.com/bootstrap-ruby/rails-bootstrap-forms/blob/master/lib/bootstrap_form/form_builder.rb#L423) so wouldn't it be inconsequent to disallow it here but allow it there?

[mattbrictson]

In addition, the existing codebase already calls html_safe

That usage is slightly different: in that case the string is a concatenation of already-safe components, so there is no security issue. Whereas calling html_safe on a arbitrary label value is not a good idea, IMHO.

the i18n way (appending _html to the translation key) doesn't work for me in error messages.

Thanks for looking into that. If vanilla Rails allows it (as the docs indicate), but bootstrap_form does not, then we must have a bug somewhere. Could you open a new issue specifically for using i18n _html strings in error messages? I would like to get to the bottom of it when I have time to investigate further.

[unikitty37]

Thanks for looking into that. If vanilla Rails allows it (as the docs indicate), but bootstrap_form does not, then we must have a bug somewhere. Could you open a new issue specifically for using i18n _html strings in error messages? I would like to get to the bottom of it when I have time to investigate further.

I noticed that before I found this issue — it looks like you need to explicitly check for the existence of the '_html' version of the string. I've added a fix as #344.

[edwardmp]

@unikitty37 , thanks! If that works then it's all I need. I'll close this issue.