Data hrefs being stripped out of handlebars template in V4

[raytri]

Version used 4.9.3

Describe the bug In the search results webpart, using a custom handlebars template, when attempting to create a download link with an anchor tag, the "href" property of the anchor is removed. This same template works fine in V3.

For instance, if I have the following in the template: <a href="data:text/plain;charset=utf-8,fileContentGoesHere" download="{{slot item @root.slots.Title}}.ics">Download file</a> It removes the href attribute and renders as: <a download="Title.ics">Download file</a> If I remove the data definition: <a href="fileContentGoesHere" download="{{slot item @root.slots.Title}}.ics">Download file</a> It renders just fine (though obviously doesn't work): <a href="fileContentGoesHere" download="Title.ics">Download file</a>

To Reproduce Detailed steps to reproduce the behavior:

1. In the search results webpart, choose "Custom" layout
2. Add an anchor tag with a data href, such as <a href="data:text/plain;charset=utf-8,fileContentGoesHere" download="{{slot item @root.slots.Title}}.ics">Download file</a>
3. Publish the page. the href attribute will be missing.
4. Edit the webpart, and remove "data:text/plain;charset=utf-8," from the href.
5. Publish the page. The href will render as expected.

Expected behavior Data hrefs should render properly in V4 the way they do in V3. In general, hrefs should not be stripped out even if the syntax is bad.

Desktop (please complete the following information):

• Chrome browser

Additional context This is a template that still works fine in the V3 version of the webpart. It only breaks when trying to use it with V4.

[kasperbolarsen]

This works with the default Details List Layout in the Manage columns:

I would expect that it would work in a custom Layout as well :-)

[raytri]

This works with the default Details List Layout in the Manage columns:

I would expect that it would work in a custom Layout as well :-)

The downloaded file is generated dynamically via a helper (it's an ics file for a calendar item), so the path is not a value I can assign to a slot.

[kasperbolarsen]

I see. We would welcome a PR that would enable that :-)

[wobba]

Hi, this is a safety measure to prevent script/css attacks where markup is sanitized. So nothing to do with v3/v4...and may be v3 had security holes tighted in v4.

The workaround is a custom webcomponent solving this case for you.

[raytri]

Hi, this is a safety measure to prevent script/css attacks where markup is sanitized. So nothing to do with v3/v4...and may be v3 had security holes tighted in v4.

The workaround is a custom webcomponent solving this case for you.

Understood. I will give that a try. Thanks!