Sanitize blog post featured image alt text to automatically escape quotation marks

HubSpot Ideas
1

Original post here. Copying and pasting post content below:

----

I noticed that quotation marks in the alt text of blog post featured images are not automatically escaped.

For example, here is how the alt text This is some alt text “with quotation marks.” is rendered as HTML:

<img src="https://{OBSCURED}.fs1.hubspotusercontent-na1.net/hubfs/{OBSCURED}/sample-image.jpeg" loading="lazy" alt="This is some alt text " with="" quotation="" marks.""="">

This seems like an input sanitization issue on Hubspot’s end and a potential security concern.

Steps to reproduce:

1. Create a blog post

2. Enter some text in the alt text of the featured image that contains quotations marks, e.g.This is some alt text “with quotation marks.”

3. Ensure image in the template code renders alt text via the content.featured_image_alt_text Hubl variable

4. Publish post and inspect image element via dev tools

2

+1

This is needed for situations where the user (marketers) are adding double quotes to the Alt Text when the image itself contains written text and they are quoting the text as part of the description. Single quotes work in this case, but there’s nothing to flag the user to avoid double quotes.