## Summary CCC puts text in `data-ai-tooltip` attributes. The `ai/ai_global.js` behavior from drupal/ai reads the value through `dataset.aiTooltip` and shows it in a tooltip. When the script reads the value, the browser decodes the attribute one time. The way drupal/ai shows this value has changed: * drupal/ai 1.4.10 and older, 1.5.0 and 1.5.1 put the value in `innerHTML`. HTML in the value becomes HTML elements. * drupal/ai 1.4.11 and 1.5.2 (released 2026-10-28) show the tooltip as text (`textContent`). 1.6.0-alpha1 and the 2.0.x branch do the same. #3586712+s changes the `drupal/ai` requirement to `~1.4.11 || ^1.5.2 || ^2`. Then all allowed drupal/ai releases show the tooltip as text. But some CCC tooltips are still escaped two times, for `innerHTML`. With `textContent`, these tooltips show HTML entities. The Automator description shows HTML entities with all drupal/ai versions. The `drupal/ai` requirement change was first part of this issue. It moved to #3586712+s, for 1.0.0. This issue is for 1.0.1. Found in a code scan of 1.0.x. CCC has no stable release yet, so this bug is handled in public, as in #3586615+s. ### Dependency: #3586712+s must be merged first This issue removes the second escape from the pill, `+N` and Automator description tooltips. drupal/ai 1.4.10 and older, 1.5.0 and 1.5.1 put the tooltip value in `innerHTML`. Without the minimum from #3586712+s, a site on these versions would run HTML from tag or term names, entity labels or field labels as script in these tooltips. So this issue must be merged after #3586712+s. Do not merge !388 before the MR of #3586712+s. Until the MR of #3586712+s is merged, !388 keeps the same `composer.json` and AI version docs changes. So !388 cannot add the escape changes without the minimum. Composer does not check the commit of a dev branch. A site on an old drupal/ai dev commit that still uses `innerHTML` has the same risk. #3586712+s documents that such a site must update drupal/ai to the current branch head. ### Problem: some text is escaped two times and shows HTML entities Some tooltips are escaped two times, for `innerHTML`. With `textContent` (drupal/ai 1.4.11, 1.5.2 or later), the tooltip shows the entity text: * Scope pill tooltips and the `+N` overflow tooltip: `AiContextThemeHooks::preprocessAiContextPillList()` calls `Html::escape()`, and then Twig escapes the attribute again. The pills are on the context items list, the Consumers page and the consumer edit page. * The disabled conditional subcontext tooltip on the context items list: `AiContextItemListBuilder::applyHtmlTooltipAttribute()` renders a `#plain_text` array to an escaped string, and the attribute escapes the string again. * The Automator consumer description: `AiContextConsumerTypeAutomator::buildInstanceDescription()` (`src/Plugin/AiContextConsumerType/AiContextConsumerTypeAutomator.php` lines 561-568) returns the result of `t()` with `@` placeholders. So the field, bundle and entity type labels in it are already escaped. `AiContextConsumersForm::getTruncatedDescription()` (`src/Form/AiContextConsumersForm.php` lines 1064-1073) escapes the text again, in the tooltip and in the visible text. The consumer edit page escapes it again too (`src/Form/AiContextConsumerForm.php` line 332). The visible text shows the entities with all drupal/ai versions. The tooltip is used when the description is longer than 60 characters, for example `Automator for the Summary field on the Basic page Content type`. For example, a tag named `Q&A for new customers` shows `Q&amp;A for new customers`. `Price <10` shows `Price &lt;10`. An apostrophe shows `&#039;`, so a field labeled `Author's bio` shows `Author&#039;s bio` in the Automator description. ### Tooltips that keep one escape The context item Description tooltip on the consumer edit page (`AiContextItem::buildDescriptionRenderArray()`) and the AI agent description tooltip on the Consumers page (`AiContextConsumersForm::getTruncatedDescription()`) are escaped one time. With `textContent`, this is correct. #3586712+s describes the security impact of these two tooltips on older drupal/ai versions, and fixes it with the new minimum. ### Tests The current tests check the server HTML for `&lt;img`. They do not check what the tooltip shows after the browser decodes the attribute one time. So they did not find these problems. The functional test `AiContextConsumerSettingsTest::testAgentSettingsEscapesContextDescriptions` uses a short Description, so the page does not use the tooltip. ## Steps to reproduce ### Pill tooltips (drupal/ai 1.5.2, or 1.4.11 or later) 1. Install CCC 1.0.x with drupal/ai 1.5.2. 2. In the **AI Context Tags** vocabulary, add a term named `Q&A for new customers`. 3. Create a context item that is not Global and has no other scopes. Give it this tag, and save it. 4. Open the context items list (`/admin/config/ai/context/items`). Hover over the tag pill. 5. The tooltip shows `Q&amp;A for new customers`. Expected: the tooltip shows `Q&A for new customers`. The code on 1.0.x at fd64e410 does this (`src/Hook/AiContextThemeHooks.php` lines 150 and 164). `AiContextItemListBuilderRowTest::testPillListTooltipsEncodeMarkup` asserts the double-encoded attribute. This was not checked in a browser. ### Automator description (all drupal/ai versions) 1. Install CCC 1.0.x and the AI Automators module. 2. Add a text field labeled `Author's bio` to the Basic page content type, and enable an AI Automator on the field. 3. Open the Consumers page (`/admin/config/ai/context/settings/consumers`). 4. The Automator row shows `Automator for the Author&#039;s bio field on the Basic page…`. The consumer edit page for this Automator shows `Author&#039;s bio` too. Expected: the row shows `Automator for the Author's bio field on the Basic page…`, and the tooltip and the consumer edit page show `Author's bio`. The code on 1.0.x at fd64e410 does this. This was not checked in a browser. ## Proposed resolution 1. **Depend on #3586712+s.** That issue changes the `drupal/ai` requirement in `composer.json`, and the AI version text in `README.md`, `docs/index.md`, `docs/upgrade-policy.md` and `docs/features/consumer_configuration.md`. After the merge of this issue, these files have no changes from this issue. Merge this issue only after #3586712+s. 2. **Keep one escape** for the item description tooltip and the AI agent description tooltip. With `textContent`, one escape is correct. Do not escape these values two times. If you do, an apostrophe shows as `&#039;` and `&` shows as `&amp;` in every long description. 3. **Remove the second escape:** * In `AiContextThemeHooks::preprocessAiContextPillList()`, remove `Html::escape()` from the pill tooltip (`src/Hook/AiContextThemeHooks.php` line 150) and from the `+N` overflow tooltip (line 164). Twig escapes the attribute value. * In `AiContextItemListBuilder` (`src/AiContextItemListBuilder.php` lines 736-786), put the plain text in the attribute. Do not put rendered HTML in it. Only the disabled conditional subcontext tooltip uses `buildSubcontextTypeTooltip()` and `applyHtmlTooltipAttribute()`. Replace them with `buildDisabledConditionalTooltip()`, which returns the translated text as a string. The list builder then does not use the `renderer` service, so remove it from the constructor and from `createInstance()`. The English text does not change, but a translation that has an apostrophe shows `&#039;` today. * In `AiContextConsumerTypeAutomator::buildInstanceDescription()` (`src/Plugin/AiContextConsumerType/AiContextConsumerTypeAutomator.php` lines 561-568), return plain text: call `Html::decodeEntities()` on the `t()` result. All places that print the description escape it one time: `getTruncatedDescription()`, the consumer edit page and the `data-consumer-description` row attribute. In the `AiContextConsumerInstance` constructor and `getDescription()` docblocks, and in `docs/developers/consumer_api.md`, say that the description is plain text and that code that prints it must escape it. 4. **Update the comments** that say the tooltip uses `innerHTML`, or that the value must be encoded two times: * `ai_context.module` lines 1006-1007 * `src/Hook/AiContextThemeHooks.php` lines 102-105 * `templates/ai-context-pill-list.html.twig` lines 8-11 * `src/AiContextItemListBuilder.php` lines 766-768 (removed with `applyHtmlTooltipAttribute()`) and 837-838 * `src/AiContextScopeManager.php` lines 473-475 * `docs/developers/hooks.md` lines 238-241. Also say that a theme that overrides `ai-context-pill-list.html.twig` must print the tooltip values with normal Twig escaping. * `tests/src/Kernel/AiContextItemListBuilderRowTest.php` lines 394-396 Add a short comment at the two tooltips that keep one escape (item 2): `AiContextItem::buildDescriptionRenderArray()` and `AiContextConsumersForm::getTruncatedDescription()`. 5. **Tests.** Add the test trait `AiContextTooltipAssertTrait` (`tests/src/Traits/AiContextTooltipAssertTrait.php`). Its method `assertTooltipsShowPlainText()` decodes each `data-ai-tooltip` value one time, as `dataset` does. It asserts that the result is the plain text, and that the value is escaped exactly one time. Use values that have `<`, `&` and an apostrophe, so that the test fails if a value is escaped one time too many or one time too few: * Kernel `AiContextItemListBuilderRowTest::testPillListTooltipsEncodeMarkup` and `testPillListExplicitTooltipsEncodeMarkup`, including the `+N` tooltip. * Kernel `AiContextScopeEntityTest::testDescriptionSummaryAndRenderArray`. * Unit `AiContextConsumersFormDescriptionTest::testTooltipShowsPlainTextAfterOneDecode` (new, agent description tooltip). * Kernel `AiContextItemListBuilderTest::testDisabledConditionalTooltipIsInformationalPlainText`: also add a translation that has `<`, `&` and an apostrophe, and assert that the tooltip shows it as plain text. * Kernel `AiContextConsumerTypeAutomatorTest::testDescriptionIsHumanReadable`: use a field label that has `<`, `&` and an apostrophe (`Author's Q&A <bio>`), and assert that the description is plain text. * Functional `AiContextConsumerSettingsTest::testAgentSettingsEscapesContextDescriptions`: make the Description longer than 100 characters, so that the page uses the tooltip, and assert the tooltip text. * Functional `AiContextConsumerSettingsTest::testAutomatorListingAndEditor`: change the label of the body field to `Author's Q&A`. Assert the plain text in the Consumers row, its tooltip, the `data-consumer-description` row attribute and the consumer edit page. ## Remaining tasks * [x] Remove the second escape from the pill tooltips, the `+N` tooltip, the disabled subcontext tooltip and the Automator description. * [x] Update the `innerHTML` comments. * [x] Add or change the tests so that they decode the attribute one time. * [ ] After the MR of #3586712+s is merged, update the !388 branch from 1.0.x. Then !388 no longer changes `composer.json`, `README.md`, `docs/index.md`, `docs/upgrade-policy.md` or `docs/features/consumer_configuration.md`. If one of these files has a conflict, keep the 1.0.x version. * [ ] Confirm that `git diff origin/1.0.x...HEAD` on the !388 branch does not change these five files. Then run the tests, `./lint.sh` and `mkdocs build --strict` again. * [ ] Manual check with drupal/ai 1.5.2 or later: the pill, `+N`, item description, agent description and Automator description tooltips show plain text. First run `composer update drupal/ai`, and confirm that `ai/assets/js/ai_global.js` uses `textContent`. An old drupal/ai dev checkout still uses `innerHTML`. * [ ] Review. ## User interface changes With drupal/ai 1.4.11, 1.5.2 or later, the tooltips show plain text. Scope pill tooltips no longer show `&amp;`, `&lt;` or `&#039;`. A translated disabled subcontext tooltip no longer shows `&#039;`. With all drupal/ai versions, Automator descriptions on the Consumers page and the consumer edit page no longer show `&amp;` or `&#039;`. The layout does not change. ## API changes * After preprocess, the `ai_context_pill_list` variables `pills[].tooltip` and `overflow_tooltip` contain plain text, not escaped text. A theme that overrides `ai-context-pill-list.html.twig` and prints these variables with normal Twig escaping does not need a change. * For Automator consumers, `AiContextConsumerInstance::getDescription()` returns plain text, not escaped text. Code that prints it must escape it. All CCC code does this. A custom consumer type must also give `AiContextConsumerInstance` a plain-text description. `docs/developers/consumer_api.md` says this. * `AiContextItemListBuilder` (`@internal`) no longer has the `renderer` constructor argument. The `drupal/ai` requirement change is in #3586712+s. ## Data model changes None. ## Release note Scope pill tooltips and the `+N` overflow tooltip no longer show HTML entities such as `&amp;`, `&lt;` or `&#039;`. Automator descriptions on the Consumers page and the consumer edit page no longer show `&amp;` or `&#039;`. For Automator consumers, `AiContextConsumerInstance::getDescription()` now returns plain text. Code that prints it must escape it. A theme that overrides `ai-context-pill-list.html.twig` must print the tooltip values with normal Twig escaping. This change needs drupal/ai 1.4.11 or later on the 1.4 branch, or 1.5.2 or later. The `drupal/ai` requirement of CCC 1.0.0 already keeps out older versions. If your site uses a drupal/ai dev branch, update it to the current branch head before you update CCC. With an old dev commit, HTML in term names, entity labels or field labels runs as script in these tooltips. > [!note] > Check the one that best describes your usage, or leave all unchecked if AI was not significantly used. > > * [ ] AI **Assisted Issue** \ > _Mainly written by a human; AI used for partial generation under full human supervision._ > > * [x] AI **Generated Issue** \ > _Mainly generated by AI, reviewed and approved by a human before this issue was created._