HTML for tooltip is rendering as string

[bibekrimal]

Bug report

HTML for tooltip is rendering as string.

Codepen

https://codepen.io/bibekr/pen/xxRwGYp

Explanation

After the last update, the tooltip html as shown in the codepen coming from x-axis categories is returned as string.
with the use of previous version it looks like this https://tppr.me/CRBk3 and that is the behavior required. This bug came from version 3.23.1

[RomRider]

Same for legend also with 3.24.0. Used to work with 3.23.1

[junedchhipa]

Re-opening this due to Cross-site Scripting (XSS) - DOM vulnerability

[j-muiruri]

Facing this issue with 3.27.1

[tale]

Hey, could an alternative solution be introducing an optional flag that allows you to bypass the DOM sanitization?
That way the default behaviour is still safe, but the option to supply direct HTML is possible if necessary.

Snyk Disclosure: https://snyk.io/vuln/SNYK-JS-APEXCHARTS-1300579

[j-muiruri]

Sure, will try this

[junedchhipa]

HTML tooltip will not be supported due to XSS vulnerability.

[RomRider]

Can you at least make this an opt-in feature with explicit warning?

[pvictor]

Yes please, add an argument to allow HTML in tooltip/legends, with a security notice if needed but it's an important feature.