Repository: hydroshare/hydroshare

Issue:
Problems with label validation and presentation
- Long project tags which have no spaces or hyphens create nonideal formatting in sidebar
- Single space possible as label (this breaks styling on filter sidebar)
- Label processing eats all "<" and ">" symbols (related to next item).  Labels with these characters cannot be deleted by the user.
- HTML and JavaScript injection is possible for labels.  
- It is possible to create duplicate labels (e.g. two labels with exact same name "1").  This is the only bullet not detailed in the attached video, but hopefully is rather intuitive.

On a personal note, if someone could please clear my undeletable labels from the beta backend (those with "<" or ">" characters in them), that would be appreciated. 

[Video](https://drive.google.com/file/d/14XvkPdDbWpclye_UF3sCviCOZhzMEQGj/view?usp=sharing)
[Test Environment](https://github.com/hydroshare/hydroshare/files/2146098/180628_CUAHSI-QA_test-env.txt)



Discussion:
Interaction with beta moved to https://github.com/hydroshare/hydroshare/issues/3336
Apparently this didn't pass the negative testing cases. In the report, it contains multiple issues all of which are related to the labeling. To address issue, it's better to start from functional requirement. What we support and what we don't support. For the cases we don't support, we should not allow them to add the label, for example the "<" tag. 
 During testing, I found a long tag name that is constituted with multiple words is presented well. Freedom to let user enter HTML formatted texts got gobbled.

#### Actions to take:

- HTML injection should not be allowed
- Tag name should have a length limit 
- A tip showing the chopped off tag name is needed when presenting a long single word tag like ABCDEFGHIJKLMNOP
- A tag with only space(s) should not be allowed
@Castronova I believe this falls under Pages and General HS Components. Please review and relabel if needed. 
Some constraints are made to prevent html injection.  #3684
@ndebuhr could you please retest this? Scott mentioned that the injection issue is fixed and assess if this is still a bug? 
My simple injection attempts were prevented:
![image](https://user-images.githubusercontent.com/17934193/157067414-e267e974-5558-400b-ac2a-4232cea819ed.png)
However LONG labels still create formatting issues and whitespace gives an error that doesn't make sense.
I will fix those...


Resolving patch:
diff --git a/hs_labels/migrations/0006_auto_20220311_1827.py b/hs_labels/migrations/0006_auto_20220311_1827.py
new file mode 100644
--- /dev/null
+++ b/hs_labels/migrations/0006_auto_20220311_1827.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.29 on 2022-03-11 18:27
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('hs_labels', '0005_auto_20171127_1952'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='userresourcelabels',
+            name='label',
+            field=models.TextField(max_length=75),
+        ),
+    ]
diff --git a/hs_labels/models.py b/hs_labels/models.py
--- a/hs_labels/models.py
+++ b/hs_labels/models.py
@@ -89,7 +89,7 @@ class UserResourceLabels(models.Model):
                                  help_text='resource to which a label applies',
                                  on_delete=models.CASCADE)
 
-    label = models.TextField(null=False)
+    label = models.TextField(null=False, max_length=75)
 
     class Meta:
         unique_together = ('user', 'resource', 'label')
diff --git a/hs_labels/views/__init__.py b/hs_labels/views/__init__.py
--- a/hs_labels/views/__init__.py
+++ b/hs_labels/views/__init__.py
@@ -43,6 +43,8 @@ def resource_labeling_action(request, shortkey=None, *args, **kwargs):
     elif label_type == LABEL or label_type == SAVEDLABEL:
         if label is None:
             err_msg = "A value for label is missing"
+        elif len(label) >= 75:
+            err_msg = "The label is too long (> 75 characters)"
     elif label_type != SAVEDLABEL and shortkey is None:
             err_msg = "Resource ID is missing"
 


Test patch: