v3.27.0 release breaks functionality for returning html from formatters

[tonyalaribe]

Bug report

• What is the behavior you expect?
  Before v3.27.0 release, I was returning HTML from the formatters, to print more interesting legends
  

• What is happening instead?
  Now the HTML string is printed.
  

• What error message are you getting?
  There are no related error messages in the console
  

[justineKlimato]

I'm facing the same problem using formatter for the legend :

[alekbless]

Same, formatter is not rendering html entities

[juliorosseti]

!up - Same, formatter is not rendering html entities

[idoshr]

Same, formatter is not rendering html entities
Please help!!!

[brianlagunas]

@junedchhipa What changed with v3.27.0 that cause this? Was is a design decision or a regression bug?

[brianlagunas]

@tonyalaribe @justineKlimato @alekbless @juliorosseti @idoshr

Can anyone provide a reproduction app via a codepen? Preferably one that works using the older version and one that's broken using the newest version.

Thanks

[junedchhipa]

@brianlagunas This was a decision taken in response to a vulnerability https://snyk.io/vuln/SNYK-JS-APEXCHARTS-1062708

[EchopixUser]

I understand the XSS vulnerability but my input is not coming from the user... How do I get the formatter to stop escaping the html now? Besides downgrading the lib? Honestly I do not understand why input sanitization should be a concern of the lib and not the programmer using it. And in the very least, if you for some reason decide to take on the responsibility, provide an option that won't sanitize the input...

[brianlagunas]

@EchopixUser there are many ways to use XSS that don't include input from a user. ApexCharts is a client side library and is easily manipulated by anyone that's not the original programmer. XSS does not need user input in order to be taken advantage of.

[idoshr]

So what is the solution for custom rendering in tooltip???