Checkbox/Radio // no escaping for choice labels. It can be possible that those labels actually have HTML in text.

Author: Christian Leucht

src/View/Checkbox.php

@@ -57,7 +57,7 @@ public function render(ElementInterface $element): string
             $label = sprintf(
                 '<label for="%s">%s</label>',
                 $this->escapeAttribute($elementAttr['id']),
-                $this->escapeHtml($choice['label'])
+                $choice['label']
             );
 
             $html[] = sprintf(

src/View/Radio.php

@@ -44,7 +44,7 @@ public function render(ElementInterface $element): string
             $label = sprintf(
                 '<label for="%s">%s</label>',
                 $this->escapeAttribute($elementAttr['id']),
-                $this->escapeHtml($choice['label'])
+                $choice['label']
             );
 
             $html[] = sprintf(