{"record":{"id":"bc8cf3ed6e3602a7","repo":"docusealco/docuseal","slug":"html-content-is-not-allowed-value-first-200","errorCode":null,"errorMessage":"HTML content is not allowed: #{value.first(200)}...","messagePattern":"HTML content is not allowed: #(.+?)\\.\\.\\.","errorType":"validation","errorClass":"Submitters::NormalizeValues::InvalidDefaultValue","httpStatus":422,"severity":"error","filePath":"lib/submitters/normalize_values.rb","lineNumber":236,"sourceCode":" raise InvalidDefaultValue, \"Invalid #{type} value\" unless purpose == :api\n\n find_or_create_blob_from_html(account, value, field)\n else\n raise InvalidDefaultValue, \"Invalid value, url, base64 or text < 60 chars is expected: #{value.first(200)}...\"\n end\n\n attachment = for_submitter.attachments.find_by(blob_id: blob.id) if for_submitter\n\n attachment ||= ActiveStorage::Attachment.new(\n blob:,\n name: 'attachments'\n )\n\n attachment\n end\n\n def find_or_create_blob_from_html(_account, value, _field)\n raise InvalidDefaultValue, \"HTML content is not allowed: #{value.first(200)}...\"\n end\n\n def find_or_create_blob_from_base64(account, data, type, mime_type: nil)\n checksum = Digest::MD5.base64digest(data)\n\n blob = find_blob_by_checksum(checksum, account)\n\n return blob if blob\n\n mime_type ||= Marcel::MimeType.for(data)\n\n detected_extensions = Marcel::TYPE_EXTS[mime_type].to_a.map(&:downcase)\n\n if detected_extensions.any? { |e| Submitters::DANGEROUS_EXTENSIONS.include?(e) }\n raise InvalidDefaultValue, \"File type '.#{detected_extensions.first}' is not allowed.\"\n end\n\n extension = detected_extensions.first","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/docusealco/docuseal/blob/004a22c1c88109c7ba0b567df011a8cb13894001/lib/submitters/normalize_values.rb#L218-L254","documentation":"Submitters::NormalizeValues#find_or_create_blob_from_html (lib/submitters/normalize_values.rb:236) raises InvalidDefaultValue 'HTML content is not allowed' unconditionally — the method body is just the raise. HTML-to-image rendering for image field defaults has been removed from the product; the API-only gate one level up (line 218) lets purpose :api through to here, so even API callers now get this error. It is a hard feature retirement, not a data problem.","triggerScenarios":"POST /api/v1 submissions or template field updates passing an '...' or '

Approved

'\n\n# after\ndefault_value = \"data:image/png;base64,#{Base64.strict_encode64(rendered_png_bytes)}\"","handlingStrategy":"validation","validationCode":"# Reject/transform HTML before it reaches the server\nraise ArgumentError, 'render HTML to an image client-side' if value.match?(/\\A\\s*<(html|!doctype)/i)","typeGuard":null,"tryCatchPattern":"begin\n Submitters::NormalizeValues.normalize_attachment_value(value, field, account, attachments, purpose: :api)\nrescue Submitters::NormalizeValues::InvalidDefaultValue => e\n render json: { error: 'HTML image defaults are no longer supported; send base64 or a URL' }, status: :unprocessable_entity\nend","preventionTips":["Treat HTML-to-image defaults as removed: pre-render to PNG/JPEG in your stack.","Audit stored payloads for ''/'