-
Notifications
You must be signed in to change notification settings - Fork 15
feat: html blocks! #875
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: html blocks! #875
Changes from 1 commit
3ca6ecc
e447442
ec7af0d
175589e
88055d7
af85883
433e733
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
- Loading branch information
There are no files selected for viewing
This file was deleted.
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,12 +13,9 @@ const extractScripts = (html: string = ''): [string, () => void] => { | |
| return [cleaned, () => scripts.map(js => window.eval(js))]; | ||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Like, there's no reason to strip script tags if the whole thing is getting executed?
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. it only gets executed if you pass
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. HTML blocks were originally a way to say, hey this code is dangerous and we know it. All other 'inlined' html would get tags and attributes sanitized. But I don't see how we could even begin to sanitize MDX. The only thing I can think of, is if some existing page with an html block has an unknown malicious script in it, and all of sudden we gave it life? |
||
| }; | ||
|
|
||
| const HTMLBlock = props => { | ||
| const { children, runScripts, safeMode = false } = props; | ||
| const HTMLBlock = ({ children = '', runScripts = false, safeMode = false }) => { | ||
| let html = children; | ||
|
|
||
| if (typeof html !== 'string') html = renderToStaticMarkup(html); | ||
|
|
||
| const [cleanedHtml, exec] = extractScripts(html); | ||
|
|
||
| useEffect(() => { | ||
|
|
@@ -28,12 +25,12 @@ const HTMLBlock = props => { | |
| if (safeMode) { | ||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. that was the usage for us sure, but i'm wondering about the 1000 or downloads a week of
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. okay, we can figure out the final details in another PR since it's a bit out of scope for this one 😅 |
||
| return ( | ||
| <pre className="html-unsafe"> | ||
| <code>{cleanedHtml}</code> | ||
| <code>{html}</code> | ||
| </pre> | ||
| ); | ||
| } | ||
|
|
||
| return <div className="rdmd-html" dangerouslySetInnerHTML={{ __html: html }} />; | ||
| return <div className="rdmd-html" dangerouslySetInnerHTML={{ __html: cleanedHtml }} />; | ||
| }; | ||
|
|
||
| export default HTMLBlock; | ||
Uh oh!
There was an error while loading. Please reload this page.