List Formatting: Disallowed external images appear on list forms

[tecchan1107]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

Declarative list formatting

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

No response

Describe the bug / error

I configured HTML Field Security > Allow external iframes to “Don't allow contributors to insert iframes from external domains.”

Next, I applied column formatting that displays an external image to a list column. As expected, the external image is not displayed in the list view, since external images are not allowed.

However, when opening the list form, the external image is displayed.

Is this expected behavior, or is this a bug?

---

Related Issue

• I have a question about Column Sample Location Weather pnp/List-Formatting#1008

Related Document

• Formatting syntax reference - img src security| Microsoft Learn

  

Steps to reproduce

1. HTML Field Security > Allow external iframes to “Don't allow contributors to insert iframes from external domains”

2. Set the following JSON for formatting any column:

   {
     "$schema": "https://developer.microsoft.com/json-schemas/sp/v2/column-formatting.schema.json",
     "elmType": "img",
     "attributes": {
       "src": "https://github.com/pnp/media/raw/master/parker/pnp/300w/parker.png"
     }
   }

3. Set any value in the formatted column

4. Open the form

Expected behavior

External images are not allowed, so they should not be displayed even on the form.

[Ashlesha-MSFT]

Hello @tecchan1107,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.
If you don’t receive a reply within two working days, please use this escalation form to escalate.

[Ashlesha-MSFT]

@tecchan1107,
We have successfully reproduced the problem you described.
This appears to be a bug rather than expected behavior, as:

• Security settings should be enforced consistently across all SharePoint components
• List views correctly respect the HTML Field Security configuration
• Forms should follow the same security validation rules

We are escalating this to our engineering team as a security inconsistency issue for investigation and resolution.