List Formatting: Disallowed external images appear on list forms

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

Declarative list formatting

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

No response

Describe the bug / error

I configured HTML Field Security > Allow external iframes to “Don't allow contributors to insert iframes from external domains.”

Next, I applied column formatting that displays an external image to a list column. As expected, the external image is not displayed in the list view, since external images are not allowed.

However, when opening the list form, the external image is displayed.

Is this expected behavior, or is this a bug?

---

Related Issue

• https://github.com/pnp/List-Formatting/issues/1008

Related Document

• Formatting syntax reference - img src security| Microsoft Learn

  

Steps to reproduce

1. HTML Field Security > Allow external iframes to “Don't allow contributors to insert iframes from external domains”

2. Set the following JSON for formatting any column:

   {
     "$schema": "https://developer.microsoft.com/json-schemas/sp/v2/column-formatting.schema.json",
     "elmType": "img",
     "attributes": {
       "src": "https://github.com/pnp/media/raw/master/parker/pnp/300w/parker.png"
     }
   }
   

3. Set any value in the formatted column

4. Open the form

Expected behavior

External images are not allowed, so they should not be displayed even on the form.