Samin061 opened a new pull request, #71700: URL: https://github.com/apache/airflow/pull/71700
renderField and renderConnectionForm build the connection form HTML by concatenating the connection type and each widget field name into the id, for and data-field attributes without escaping, while the surrounding label, placeholder and description already pass through escapeHTML/escapeAttr. A connection form widget whose field name or connection type carries a double quote and angle brackets breaks out of the attribute and injects markup into the registry page when its chip is opened. Both values now go through escapeAttr, matching the escaping applied to the neighbouring fields and to the search results in #71618. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
