BUG-000141008 for Portal for ArcGIS

Bug ID Number	BUG-000141008
Submitted	June 25, 2021
Last Modified	February 14, 2025
Applies to	Portal for ArcGIS
Version found	10.8.1
Operating System	Windows OS
Operating System Version	N/A
Status	As Designed

Additional Information

This is as-designed. Both ArcGIS Enterprise and ArcGIS Online have HTML sanitization logic in place to clean untrusted elements and strings of HTML. This is to prevent cross-site scripting and protect the system and user. In this case, the HTML href element does not contain a trusted protocol and the resulting link is intentionally sanitized (resulting in a link that does not work). The HTML sanitization logic trusts the "arcgis-survey123" protocol, but in this example, it is not defined explicitly via the HTML string, it is constructed via the underlying arcade expression. Refer to the workaround to revise the arcade expression and href HTML string.

Workaround

The workflow works with the following updates: 1. Update the return statement within the arcade expression to... return UrlEncode(params)+coordinates+callback; 2. Update the pop-up HTML string href to... href="arcgis-survey123://{expression/expr0}&field:esa={esa}"