Backoffice: Add localize.htmlString() helper to prevent XSS in HTML-rendered translations#22731

Merged

AndyButland merged 10 commits into

mainfrom

v17/bugfix/escaped-delete-names

May 6, 2026

Commits on May 6, 2026

docs(claude): document how unsafeHTML should be used together with escapeHTML()
iOvergaard
committed
fix: adds escapeHTML where appropriate in order not to render html directly
iOvergaard
committed
chore: removes small nitpick fallback
iOvergaard
committed
docs(claude): fixes incorrect using of unsafeHTML
iOvergaard
committed
feat(localization): add localize.htmlString() and convert call sites

iOvergaard
and
claude
committed
chore(eslint): add no-unsafe-localize rule to flag unsafeHTML(localize.string|term(...))

iOvergaard
and
claude
committed
fix(localization): stringify htmlString args before escaping

iOvergaard
and
claude
committed
fix(installer-consent-element): sanitise content before rendering it

liamlaverty
authored and
iOvergaard
committed
fix(dashboard-telem-element): sanitise html before rendering

liamlaverty
authored and
iOvergaard
committed
Merge remote-tracking branch 'origin/main' into v17/bugfix/escaped-delete-names
iOvergaard
committed