${section.content.map((item: any) => {
- const value = formatValue(item.value, item.label);
+ const value = item.isHtml ? item.value : formatValue(item.value, item.label);
const valueClass = getValueClass(item.value);
const valueAttributes = getValueAttributes(item.value);
const clickableAttr = item.clickable ? `data-clickable="${item.clickable}"` : '';
diff --git a/tests/unit/Security.test.ts b/tests/unit/Security.test.ts
index ad3f258..c4cb5fe 100644
--- a/tests/unit/Security.test.ts
+++ b/tests/unit/Security.test.ts
@@ -22,4 +22,33 @@ describe('Security', () => {
expect(escaped).toContain(''single quotes'');
});
});
+
+ describe('UIManager Rendering Logic', () => {
+ // Mock logic for UIManager rendering to verify the fix for trusted HTML
+ it('should NOT escape values marked as isHtml', () => {
+ const item = {
+ value: 'Icon Button',
+ isHtml: true,
+ label: 'Test Button'
+ };
+
+ const renderedValue = item.isHtml ? item.value : formatValue(item.value, item.label);
+
+ expect(renderedValue).toContain('');
+ expect(renderedValue).not.toContain('<span class="icon">');
+ });
+
+ it('should escape values NOT marked as isHtml', () => {
+ const item = {
+ value: '',
+ isHtml: false, // or undefined
+ label: 'Malicious Input'
+ };
+
+ const renderedValue = item.isHtml ? item.value : formatValue(item.value, item.label);
+
+ expect(renderedValue).not.toContain('