Upon trying to create a model using char “&”, the model name automatically changes this to “&-amp;”. Is this the intended behaviour for the naming of models?
@gergo @iainsproat Any specific reasons we don’t allow special characters in model names?
In the old frontend days, we used to have model names as their identifiers and as such they had to be url safe. I think this might be a remnant of that behavior potentially interacting with other sanitizations stopping sql injection type issues. @iainsproat is already looking at another model name related issue, we’ll try to bunch this in too.
2 Likes
Thanks for raising this question. To elaborate further on @gergo’s earlier message, this is intentional.
Speckle validates and sanitises user input, including model names, to ensure Speckle is secure and safe to use.
For example, Speckle forces all model names to be lower case. Speckle also strips out html tags and replace certain characters to prevent various categories of vulnerabilities. In this case XSS attacks.
We will look in amending the frontend so that & displays correctly in the browser.
Iain
1 Like