Alert banner `govukButton` display with raw HTML contents about notifications-admin HOT 1 CLOSED

Hi @toomore,

Thanks for raising! I'm not entirely sure what's happening with your setup - it's perfectly valid to have a span inside a button within the HTML spec, and modern browsers should appropriately render that. Indeed, testing this locally and on our production system, this code works fine as intended and the span is correctly rendered. We don't want the template name to be visible since the template name's already mentioned at the top of the banner, however, we want screen readers to give full context when reading out the button text, so we add the template name within a govuk-visually-hidden css class.

I'd suggest ensuring you have an up to date browser, have updated your govuk-frontend-jinja python repo and govuk-frontend repo to the latest version (and rebuilt css/js with npm run build),

While I was investigating this I did notice and fix an XSS vulnerability with this component, so if you've forked notifications-admin I'd encourage you to ensure you've got the most recent version.

As a final note, this repository was not designed with outside use in mind, rather, this is a codebase we've written for our own platform (https://www.notifications.service.gov.uk/) and is public since we're committed to coding in the open where possible. As such, we won't always be able to prioritise investigating issues raised if they do not impact our production system. If you do find other issues or concerns feel free to raise them, but I cannot promise we'll be able to work with you to solve every single one.

Many thanks,

Leo

from notifications-admin.