## Summary CCC puts text in `data-ai-tooltip` attributes. The `ai/ai_global.js` behavior from drupal/ai reads the value through `dataset.aiTooltip` and shows it in a tooltip. When the script reads the value, the browser decodes the attribute one time. The way drupal/ai shows this value has changed: * drupal/ai 1.4.10 and older, 1.5.0 and 1.5.1 put the value in `innerHTML`. HTML in the value becomes HTML elements. * drupal/ai 1.4.11 and 1.5.2 (released 2026-10-28) show the tooltip as text (`textContent`). 1.6.0-alpha1 and the 2.0.x branch do the same. `composer.json` on 1.0.x allows `drupal/ai: ^1.4 || ^2`. So a site can use a drupal/ai version that puts the tooltip value in `innerHTML`. With these older drupal/ai versions, this bug has a security impact (see below). The fix is to require the drupal/ai versions that show the tooltip as text. This issue was split from #3586705+s. That issue removes a second escape from other CCC tooltips. It must be merged after this issue (see "Related issues"). Found in a code scan of 1.0.x. CCC has no stable release yet, so this bug is handled in public, as in #3586615+s. ### Security impact with older drupal/ai versions Two CCC tooltips are escaped one time. This is correct when drupal/ai shows the tooltip as text. With `innerHTML`, the decoded value is parsed as HTML, so stored HTML runs as script. The script runs when the page loads. A hover is not necessary. * **Context item Description** on the consumer edit page: `AiContextItem::buildDescriptionRenderArray()` (`src/Entity/AiContextItem.php` lines 977-984). `getDescriptionSummary()` removes tags and then decodes entities. So a Description that contains `&lt;img src=x onerror=...&gt;` becomes `<img src=x onerror=...>`, and Twig escapes it only one time. The tooltip is used when the Description is longer than 100 characters. The consumer edit page shows all items, drafts included. * Who can add the HTML: a user with **Create AI Context Item**, **Edit own AI Context Item** or **Edit any AI Context Item**. All three permissions have `restrict access: true`. No default role has them. * Where it runs: in the session of a user with **Administer AI Context** who opens `/admin/config/ai/context/settings/consumers/{consumer_id}/edit`. The script can do all that this user can do. * **AI agent description** on the Consumers page: `AiContextConsumersForm::getTruncatedDescription()` (`src/Form/AiContextConsumersForm.php` lines 1064-1070). The tooltip is used when the description is longer than 60 characters. * Who can add the HTML: a user with **Administer AI Agent** (AI Agents module). In AI Agents 1.3.0, this permission does not have `restrict access`. * Where it runs: in the session of a user with **Administer AI Context** who opens `/admin/config/ai/context/settings/consumers`. The script can do all that this user can do. Anonymous users, and users without these permissions, cannot do this. Versions: CCC 1.0.0-beta1 to 1.0.0-rc1 and 1.0.x, with drupal/ai 1.4.10 or older, 1.5.0 or 1.5.1. With drupal/ai 1.4.11, 1.5.2 or later, the same values show as text and no script runs. This issue does not change the CCC code of these two tooltips. ### Dev branches The Composer requirement does not check the commit of a dev branch. A drupal/ai dev branch, for example `1.4.x-dev`, `1.5.x-dev`, `1.6.x-dev`, `1.x-dev`, `2.0.x-dev` or `2.x-dev`, satisfies it, also at an old commit that still uses `innerHTML`. drupal/ai 2.x has no release yet, so every site on drupal/ai 2 uses a dev branch. So a site that uses a drupal/ai dev branch must update drupal/ai to the current branch head. `docs/upgrade-policy.md` and the release note say this. ### Related issues * #3586705+s (milestone 1.0.1) removes the second escape from the scope pill tooltips, the `+N` tooltip, the disabled subcontext tooltip and the Automator description. Without the minimum from this issue, a site on drupal/ai 1.4.10 or older, 1.5.0 or 1.5.1 would then run HTML from tag or term names, entity labels or field labels as script in the pill, `+N` and Automator description tooltips. So #3586705+s must be merged after this issue. Until #3586705+s is merged, some tooltips show HTML entities with the drupal/ai versions that this issue requires (see "User interface changes"). * AI 1.4.12 has no release date yet. 1.0.0-rc2 does not wait for it and uses `~1.4.11` from this issue. After AI 1.4.12 is released, #3586709+s changes `~1.4.11` to `~1.4.12`. * #3586463+s gave `^1.4.12` as an example minimum. Do not use `^1.4.11` or `^1.4.12`, because they also allow 1.5.0 and 1.5.1. A later change to the minimum must also keep 1.5.0 and 1.5.1 out. ## Steps to reproduce ### Context item Description (drupal/ai 1.5.1, 1.5.0, or 1.4.10 or older) 1. Install CCC 1.0.x with drupal/ai 1.5.1. 2. As a user with **Create AI Context Item**, create a context item. Set **Description** to `&lt;img src=x onerror=alert(document.domain)&gt;`, followed by more than 100 characters of text. Save it as a draft. 3. As a user with **Administer AI Context**, open **Configure context** for an agent: `/admin/config/ai/context/settings/consumers/agent:{id}/edit`. 4. The alert opens when the page loads. Expected: no script runs. After the fix, Composer does not allow drupal/ai 1.5.1 with CCC. With drupal/ai 1.5.2 or later, the tooltip shows `<img src=x onerror=alert(document.domain)>` as text. The code on 1.0.x at fd64e410 still has this bug. It was checked in a browser on 1.0.x at 9932f4ab with a drupal/ai 1.5.x-dev checkout from 2026-10-23, which is older than 1.5.2. The tooltip code did not change between these two commits. ### AI agent description (drupal/ai 1.5.1, 1.5.0, or 1.4.10 or older) 1. Install CCC 1.0.x with drupal/ai 1.5.1. 2. As a user with **Administer AI Agent**, edit an AI agent. Set its description to `<img src=x onerror=alert(document.domain)>`, followed by more than 60 characters of text. Save it. 3. As a user with **Administer AI Context**, open the Consumers page: `/admin/config/ai/context/settings/consumers`. 4. The alert opens when the page loads. Expected: no script runs. After the fix, Composer does not allow drupal/ai 1.5.1 with CCC. With drupal/ai 1.5.2 or later, the tooltip shows the description as text. This was found by reading the code on 1.0.x at fd64e410. It was not checked in a browser. ## Proposed resolution 1. **Composer.** In `composer.json`, change `"drupal/ai": "^1.4 || ^2"` to `"drupal/ai": "~1.4.11 || ^1.5.2 || ^2"`. This keeps out 1.4.10 and older, 1.5.0 and 1.5.1. 2. **AI version text.** Change the AI version text to match in `README.md` (line 99), `docs/index.md` (lines 62-64) and `docs/upgrade-policy.md` (line 17). In `docs/upgrade-policy.md`, also say that AI 1.5.0 and 1.5.1 are not supported, and that older AI versions show admin tooltips as HTML. 3. **Automator notes.** Because 1.5.0 and 1.5.1 are no longer allowed, the Automator notes from #3586679+s name 1.5.2: `README.md` (line 100), `docs/index.md` (line 63), `docs/upgrade-policy.md` (line 17) and `docs/features/consumer_configuration.md` (line 25). 4. **Dev branches.** In `docs/upgrade-policy.md`, say that Composer does not check the commit of a dev branch, and that a site on a drupal/ai dev branch must update it to the current branch head. The release note says this too. This issue does not change PHP code, Twig templates or tests. The tooltip changes stay in #3586705+s. ## Remaining tasks The change is in !395 (head `a0dda4ee`: `a7eedcfa` merged with 1.0.x at `5403b879`). * [x] Change the `drupal/ai` requirement in `composer.json`. * [x] Change the AI version text and the Automator notes in `README.md`, `docs/index.md`, `docs/upgrade-policy.md` and `docs/features/consumer_configuration.md`. * [x] Add the dev branch note to `docs/upgrade-policy.md`. * [x] Open the MR: !395. * [x] Check with Composer that the new requirement keeps out drupal/ai 1.4.10, 1.5.0 and 1.5.1, and allows 1.4.11 and 1.5.2. `composer why-not` shows the `drupal/ai_context` requirement for 1.5.1, 1.5.0 and 1.4.10, and not for 1.4.11 and 1.5.2. * [ ] Review. * [ ] After the merge, update the !388 branch (#3586705+s) from 1.0.x. Confirm that `git diff origin/1.0.x...HEAD` on that branch does not change `composer.json`, `README.md`, `docs/index.md`, `docs/upgrade-policy.md` or `docs/features/consumer_configuration.md`. ## User interface changes This issue does not change CCC code. With the drupal/ai versions that CCC then requires: * The context item Description tooltip and the AI agent description tooltip show HTML as text. * Scope pill tooltips, the `+N` overflow tooltip and the Automator description tooltip show HTML entities such as `&amp;` or `&#039;`. Sites that already use drupal/ai 1.4.11, 1.5.2 or later see this today. #3586705+s (milestone 1.0.1) fixes this. ## API changes * The `drupal/ai` Composer requirement changes from `^1.4 || ^2` to `~1.4.11 || ^1.5.2 || ^2`. Sites on drupal/ai 1.4.10 or older, 1.5.0 or 1.5.1 must update drupal/ai together with CCC. No PHP API changes. ## Data model changes None. ## Release note CCC now requires drupal/ai 1.4.11 or later on the 1.4 branch, or 1.5.2 or later (`~1.4.11 || ^1.5.2 || ^2`). These drupal/ai versions show admin tooltips as text. With older drupal/ai versions, HTML in a long context item description or AI agent description runs as script when an administrator opens the CCC consumer pages. Update drupal/ai together with CCC, for example with `composer update drupal/ai_context drupal/ai -W`, and then run `drush updatedb`. To stay on AI 1.4, use `composer update drupal/ai_context drupal/ai -W --with drupal/ai:~1.4.11`. Composer does not check the commit of a dev branch. If your site uses a drupal/ai dev branch, for example `1.4.x-dev`, `1.5.x-dev`, `1.6.x-dev`, `1.x-dev`, `2.0.x-dev` or `2.x-dev`, update it to the current branch head. drupal/ai 2.x has no release yet, so every site on drupal/ai 2 uses a dev branch. With these drupal/ai versions, scope pill tooltips, the `+N` overflow tooltip and the Automator description tooltip show HTML entities such as `&amp;` or `&#039;`. #3586705+s (milestone 1.0.1) fixes this. > [!note] > Check the one that best describes your usage, or leave all unchecked if AI was not significantly used. > > * [ ] AI **Assisted Issue** \ > _Mainly written by a human; AI used for partial generation under full human supervision._ > > * [x] AI **Generated Issue** \ > _Mainly generated by AI, reviewed and approved by a human before this issue was created._