{"action":"opened","issue":{"url":"https://api.github.com/repos/rstudio/shiny/issues/1140","repository_url":"https://api.github.com/repos/rstudio/shiny","labels_url":"https://api.github.com/repos/rstudio/shiny/issues/1140/labels{/name}","comments_url":"https://api.github.com/repos/rstudio/shiny/issues/1140/comments","events_url":"https://api.github.com/repos/rstudio/shiny/issues/1140/events","html_url":"https://github.com/rstudio/shiny/issues/1140","id":142515613,"number":1140,"title":"update*Input functions should sanitize labels","user":{"login":"wch","id":86978,"avatar_url":"https://avatars.githubusercontent.com/u/86978?v=3","gravatar_id":"","url":"https://api.github.com/users/wch","html_url":"https://github.com/wch","followers_url":"https://api.github.com/users/wch/followers","following_url":"https://api.github.com/users/wch/following{/other_user}","gists_url":"https://api.github.com/users/wch/gists{/gist_id}","starred_url":"https://api.github.com/users/wch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wch/subscriptions","organizations_url":"https://api.github.com/users/wch/orgs","repos_url":"https://api.github.com/users/wch/repos","events_url":"https://api.github.com/users/wch/events{/privacy}","received_events_url":"https://api.github.com/users/wch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-22T01:08:18Z","updated_at":"2016-03-22T01:08:18Z","closed_at":null,"body":"The `update*Input` functions currently pass `label` as raw text, and the value is assigned in the client using jQuery's `.text()` function. This means that if a tag object is passed, it doesn't display properly.\r\n\r\nFor example:\r\n\r\n```R\r\n\r\nshinyApp(\r\n  ui = fluidPage(\r\n    textInput(\"text1\", tagList(\"Label 1 - tagList with inline tags\", tags$i(\"italic\"))),\r\n\r\n    textInput(\"text2\", \"Label 2 - raw HTML <i>italic</i>\"),\r\n\r\n    textInput(\"text3\", \"Label 3\"),\r\n    actionButton(\"updateTags\", 'Update Label 3 with tagList(\"Label 3\", tags$i(\"Italic\"))'),\r\n    actionButton(\"updateHTML\", 'Update Label 3 with \"Label 3 <i>italic</i>\"')\r\n  ),\r\n  server = function(input, output, session) {\r\n    observeEvent(input$updateTags, {\r\n      updateTextInput(session, \"text3\", tagList(\"Label 3\", tags$i(\"Italic\")))\r\n    })\r\n\r\n    observeEvent(input$updateHTML, {\r\n      updateTextInput(session, \"text3\", \"Label 3 <i>italic</i>\")\r\n    })\r\n  }\r\n)\r\n```\r\n\r\nFor `textInput`s that have a label when created:\r\n* Label 1 is created with a `tagList()` and `tags$i()` and the text displays with italics.\r\n* Label 2 tries to use raw HTML text, but the `<i>` tag gets escaped, so the text itself is not italic.\r\n\r\nLabel 3 is a `textInput` that has its label updated with `updateTextInput`:\r\n* When updated with `tagList(\"Label 3\", tags$i(\"Italic\"))`, the result is `Label 3,[object Object]`.\r\n* When updated with raw HTML, `\"Label 3 <i>italic</i>\"`, the result is `Label 3 <i>italic</i>`.\r\n\r\nThe behavior should be consistent for `textInput`, and `updateTextInput`, but they treat the `tagList` input differently.\r\n\r\n\r\nAdditionally, for `actionButton`, the behavior is opposite that of `updateActionButton`.\r\n\r\n* `actionButton` respects tag objects, and escapes raw HTML, like `textInput`.\r\n* `updateActionButton` does not properly respect tag objects, and puts raw HTML inline without escaping. For example:\r\n\r\n```R\r\nshinyApp(\r\n  ui = fluidPage(\r\n    actionButton(\"button1\", tagList(\"Button 1 - tagList with inline tags\", tags$i(\"italic\"))),\r\n    br(), br(),\r\n\r\n    actionButton(\"button2\", \"Button 2 - raw HTML <i>italic</i>\"),\r\n    br(), br(),\r\n\r\n    actionButton(\"button3\", \"Button\"),\r\n    br(), br(),\r\n    actionButton(\"updateTags\", 'Update Button 3 with tagList(\"Button 3\", tags$i(\"Italic\"))'),\r\n    actionButton(\"updateHTML\", 'Update Button 3 with \"Button 3 <i>italic</i>\"')\r\n  ),\r\n  server = function(input, output, session) {\r\n    observeEvent(input$updateTags, {\r\n      updateTextInput(session, \"button3\", tagList(\"Button 3\", tags$i(\"Italic\")))\r\n    })\r\n\r\n    observeEvent(input$updateHTML, {\r\n      updateTextInput(session, \"button3\", \"Button 3 <i>italic</i>\")\r\n    })\r\n  }\r\n)\r\n```\r\n\r\n\r\nI believe the proper solution is for the update functions to do this with the `label`:\r\n\r\n```R\r\nlabel <- as.character(htmltools::as.tags(label))\r\n```"}}