Skip to main content
Jahia Store
EN

HTML5 Elements

community
Download 1.0.3

Information

Module ID
html5-elements
Group ID
org.jahiacommunity.modules
Status
community
Category
Pre-built templates and components
Author
pvollenweider
Developer website
http://www.jahia.com
Requires Jahia
8.0.0.0
Updated
2026-08-12
Source
scm:git:git@github.com:Jahia/html5-elements.git
Tags
  • html5
  • layout

This module allows you to add HTML 5 elements to your page.

Versions

Security

Editor-supplied values are now escaped at the point of output in both views. All three paths below were
already constrained by the node type definitions, so none was exploitable through Content Editor; the
change removes the module's dependence on a value constraint holding on every JCR write path (document
import, provisioning, external providers, a future definition edit) rather than on the sink itself.

  • elementId is escaped before rendering into id="…" (element.jsp). It was the last custom
    attribute rendered unescaped — class, role, style and aria-label were already handled.
  • data-* attributes are no longer composed into pre-built markup. The three elementData* blocks
    assembled data-<name>="<value>" strings that then had to be written out unescaped, which hid the
    escaping decision from the sink and left the attribute name unescaped. Names and values are now
    emitted separately in the start tag, and both are escaped.
  • jcr:mimeType is escaped before rendering into <source type="…"> (video.jsp). The video
    picker's mime='video/*' restriction is a UI filter, not server-side validation, so the referenced
    file's mime type must be treated as untrusted.

This release also ships two stored-XSS fixes that were merged after 1.0.2 but never released:

  • elementStyle is escaped before rendering into style="…", closing attribute-breakout injection
    from the element's Style field.
  • fallbackContent is escaped before rendering inside <video>, closing stored XSS from the video
    fallback text.

Attribute names (elementId, dataName/dataName2/dataName3) still rely on the
[a-zA-Z0-9-_]+ value constraint in definitions.cnd to exclude whitespace, which XML escaping cannot
do. That pairing is now documented next to the sink and asserted by tests, so relaxing the constraint
fails the build rather than silently opening a hole.

SECURITY.md documents the module's trust model and, deliberately, what escaping does not cover.

Fixed

  • The localized <video> fallback text was never rendered. The view resolved the default from the
    resource bundle and then immediately overwrote it with the (empty) node property — that branch is only
    entered because the property is empty. Any video without the html5mix:videoAdvancedSettings mixin
    therefore rendered no fallback content at all.
  • <source type=""> was always empty. jcr:mimeType was read from the jnt:file node, but the
    property lives on that file's jcr:content child (jnt:resource). The content type is now read via
    getFileContent().getContentType(). See the upgrade note below.
  • A deleted video source or poster file no longer breaks page rendering. Both properties are
    weakreferences and carry no referential integrity: mandatory guards the save, not the read, and
    resolving a dangling reference throws ItemNotFoundException. Pages containing a video whose file had
    been deleted previously failed to render. They now degrade — live mode renders nothing, and edit mode
    shows the editor which component needs fixing.
  • Edit mode no longer references an unloaded stylesheet class in the new video notice.

Added

  • First automated test suite for this module (tests/), using the standard Docker-based
    @jahia/cypress harness: 32 tests covering the rendered markup of all twelve html5nt:* elements,
    the customize and data-attribute mixins, every escaping fix above, and the <video> fallback, content
    type and dangling-reference behaviour. Run it with bash ci.build.sh && bash ci.startup.sh, or see
    tests/README.md for the faster local-node workflow.

    The suite paid for itself immediately: the empty <source type> defect above was found by it, not by
    review.

Upgrade notes

<source type> is now populated (please check your video files)

Before 1.0.3 the rendered markup was always <source src="…" type="">. An empty type makes browsers
fetch the file and sniff its format. Now the real stored content type is emitted.

Per the HTML specification, when type is present and the browser cannot play that type, it skips
the source without fetching it. So if any video file in your repository carries an incorrect
jcr:mimeType, a video that previously played (via sniffing) can stop playing after this upgrade.

This is expected to be rare — Jahia normally derives jcr:mimeType from the uploaded file — but it is
worth a check on sites with videos uploaded through WebDAV or the GraphQL API, where the mime type can
come from a client-supplied header. Inspect <your-video>/jcr:content/jcr:mimeType and correct any
value that does not match the actual file.

Other visible changes

  • Videos without the Advanced settings mixin now render the fallback text
    ("Your browser does not support the video tag", or its localized value) instead of nothing. It is
    only shown by browsers that cannot play the video.
  • Pages containing a video whose source file was deleted will now render instead of failing. Editors see
    a notice on the affected component in edit mode; visitors see nothing where the video was.
  • One new resource bundle key, html5nt_video.missingSource, used only in edit mode.

Known limitations

Not addressed in this release, and worth tracking separately:

  • <video> has no captions support. There is no way to attach a <track> element, so any video
    published through this module fails WCAG 2.2 success criterion 1.2.2 (Captions) outright.
  • elementRole is unvalidated free text. A misspelled ARIA role is silently ignored by browsers.
  • aria-label on a <div> has no effect — the attribute is ignored on elements with the generic
    role unless a role is also set — yet the Aria field is offered for all element types.
  • Multiple <main> elements per page are permitted, which breaks the one-main-landmark rule.
  • elementStyle permits arbitrary inline CSS. Escaping prevents breaking out of the attribute; it
    does not constrain the CSS itself. Any site using the Style field also requires
    style-src 'unsafe-inline' in its Content Security Policy. See SECURITY.md for the residual risks
    and the two site-level ways to avoid them.
  • src/main/import/repository.xml is stale, pinning a 1.0.0-SNAPSHOT mount point and referencing
    a view file that no longer exists.

Full changelog: html5-elements-1.0.2...1_0_3

Requires Jahia 8.0.0.0Updated 2026-09-14

Add video component

Requires Jahia 8.0.0.0Updated 2026-08-12
Requires Jahia 8.0.0.0Updated 2021-02-24
Requires Jahia 8.0.0.0Updated 2026-08-12