Embedded form allows <script> to be saved

Develop, Build & Integrate APIs & Integrations
1

We have noticed that <script></script> can be saved into HubSpot via an embedded form. When we use Hubl to display the values saved into a webpage, the script is now embedded in the page.

The Hubspot API disallows <script>, can forms submission disallow this also? Or atleast can we have a safe way to display the values via Hubl?

I’ve used a temporary solution

|striptags

But we’d need to apply this site wide. Can we globally set this?

We can sanitize the string on the front end but would need to hijack the submit button which isn’t ideal

2

Hi, @RBoyd9 :waving_hand: Thank you very much for the question. I’d like to invite some of our community champions to the conversation — hey @Anton @Teun @Phil_Vallender, do you have any experience here?

Thank you for taking a look! — Jaycee