Skip to content

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[Form] Over-sanitization of form's id attributes #53976

Copy link
Copy link
Open
@ThomasLandauer

Description

@ThomasLandauer
Issue body actions

Symfony version(s) affected

7.0.3

Description

For HTML4 compliance, numbers are stripped from a form's block prefix when creating the id attribute of the HTML elements.
However, in HTML5 those restrictions don't apply anymore, see https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute

When specified on HTML elements, the id attribute value must be unique amongst all the IDs in the element's tree and must contain at least one character. The value must not contain any ASCII whitespace.

There are no other restrictions on what form an ID can take; in particular, IDs can consist of just digits, start with a digit, start with an underscore, consist of just punctuation, etc.

So I suggest to adjust the sanitizing, or (probably easier) drop it completely and leave it in the responsibility of the user to set a valid block prefix.

How to reproduce

Setup a form with:

public function getBlockPrefix(): string
{
    return '1-foo';
}

The resulting field looks like this:

<input type="email" id="-foo_email" name="1-foo[email]">

(Side note: Starting an id with - was also not valid in HTML4)

Possible Solution

The sanitizing is happening in BaseType::buildView()

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      Morty Proxy This is a proxified and sanitized view of the page, visit original site.