diff --git a/docs/source/tags/hypertext.md b/docs/source/tags/hypertext.md index e69db4aff911..1619b78acfa4 100644 --- a/docs/source/tags/hypertext.md +++ b/docs/source/tags/hypertext.md @@ -18,6 +18,7 @@ Use with the following data types: HTML. | value | string | | Value of the element | | [valueType] | url \| text | text | Whether the text is stored directly in uploaded data or needs to be loaded from a URL | | [inline] | boolean | false | Whether to embed HTML directly in Label Studio or use an iframe | +| [sanitizeHtml] | boolean | true | Whether to sanitize the provided html (remove scripts etc) | | [saveTextResult] | yes \| no | | Whether to store labeled text along with the results. By default, doesn't store text for `valueType=url` | | [encoding] | none \| base64 \| base64unicode | | How to decode values from encoded strings | | [selectionEnabled] | boolean | true | Enable or disable selection | diff --git a/web/libs/editor/src/tags/object/RichText/model.js b/web/libs/editor/src/tags/object/RichText/model.js index 77a7330f0090..c7cf36827753 100644 --- a/web/libs/editor/src/tags/object/RichText/model.js +++ b/web/libs/editor/src/tags/object/RichText/model.js @@ -41,6 +41,7 @@ const WARNING_MESSAGES = { * @param {string} value - value of the element * @param {url|text} [valueType=url|text] – source of the data, check (Data retrieval)[https://labelstud.io/guide/tasks.html] page for more inforamtion * @param {boolean} [inline=false] - whether to embed html directly to LS or use iframe (only HyperText) + * @param {boolean} [sanitizeHtml=true] - whether to sanitize the provided html (only HyperText) * @param {boolean} [saveTextResult=true] – whether or not to save selected text to the serialized data * @param {boolean} [selectionEnabled=true] - enable or disable selection * @param {boolean} [clickableLinks=false] – allow annotator to open resources from links @@ -57,6 +58,8 @@ const TagAttrs = types.model("RichTextModel", { inline: false, + sanitizehtml: types.optional(types.boolean, true), + /** Whether or not to save selected text to the serialized data */ savetextresult: types.optional(types.enumeration(["none", "no", "yes"]), () => window.LS_SECURE_MODE ? "no" : "none", @@ -235,7 +238,7 @@ const Model = types // clean up the html — remove scripts and iframes // nodes count better be the same, so replace them with stubs // we should not sanitize text tasks because we already have htmlEscape in view.js - if (isFF(FF_SAFE_TEXT) && self.type === "text") { + if (!self.sanitizehtml || (isFF(FF_SAFE_TEXT) && self.type === "text")) { self._value = String(val); } else { self._value = sanitizeHtml(String(val));