-
Notifications
You must be signed in to change notification settings - Fork 15
feat: html blocks! #875
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: html blocks! #875
Changes from 1 commit
3ca6ecc
e447442
ec7af0d
175589e
88055d7
af85883
433e733
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
- Loading branch information
There are no files selected for viewing
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| import React, { useEffect } from 'react'; | ||
| import { renderToString, renderToStaticMarkup } from 'react-dom/server'; | ||
|
|
||
| const MATCH_SCRIPT_TAGS = /<script\b[^>]*>([\s\S]*?)<\/script *>\n?/gim; | ||
|
|
||
| const extractScripts = (html: string = ''): [string, () => void] => { | ||
| const scripts: string[] = []; | ||
| let match: RegExpExecArray | null; | ||
| while ((match = MATCH_SCRIPT_TAGS.exec(html)) !== null) { | ||
| scripts.push(match[1]); | ||
| } | ||
| const cleaned = html.replace(MATCH_SCRIPT_TAGS, ''); | ||
| return [cleaned, () => scripts.map(js => window.eval(js))]; | ||
| }; | ||
|
|
||
| const HTMLBlock = props => { | ||
| const { children, runScripts, safeMode = false } = props; | ||
| const html = renderToString(<>{children}</>); | ||
| const [cleanedHtml, exec] = extractScripts(html); | ||
|
|
||
| useEffect(() => { | ||
| if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts) exec(); | ||
| }, [runScripts, exec]); | ||
|
|
||
| if (safeMode) { | ||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. that was the usage for us sure, but i'm wondering about the 1000 or downloads a week of
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. okay, we can figure out the final details in another PR since it's a bit out of scope for this one 😅 |
||
| return ( | ||
| <pre className="html-unsafe"> | ||
| <code dangerouslySetInnerHTML={{ __html: renderToStaticMarkup(cleanedHtml) }} /> | ||
| </pre> | ||
| ); | ||
| } | ||
|
|
||
| return <div className="rdmd-html" dangerouslySetInnerHTML={{ __html: html }} />; | ||
| }; | ||
|
|
||
| export default HTMLBlock; | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,7 @@ | ||
|
|
||
| ## Sanitizing `style` tags | ||
|
|
||
| <style> | ||
| * { | ||
| background-color: olive; | ||
| } | ||
| </style> | ||
|
|
||
|
|
||
| ## Sanitizing `style` attributes | ||
|
|
||
| <p style="background-color: salmon">fish content</p> | ||
|
|
||
|
|
||
| ## Sanitizing html blocks | ||
|
|
||
| [block:html] | ||
| { | ||
| "html": "<style>* { border: 3px solid magenta; }</style>" | ||
| } | ||
| [/block] | ||
| <HTMLBlock> | ||
| <h2>Header</h2> | ||
| <p>hello there</p> | ||
| </HTMLBlock> |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,4 +3,5 @@ export enum NodeTypes { | |
| emoji = 'emoji', | ||
| i = 'i', | ||
| image = 'image', | ||
| htmlBlock = 'html-block', | ||
| } | ||
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| import { HTMLBlock } from '../../types'; | ||
|
|
||
| const htmlBlock = (node: HTMLBlock) => { | ||
| const html = node.data.hProperties.html; | ||
| return `<HTMLBlock>${JSON.stringify({ html }, null, 2)}</HTMLBlock>`; | ||
| } | ||
|
|
||
| export default htmlBlock; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Like, there's no reason to strip script tags if the whole thing is getting executed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it only gets executed if you pass
runScripts=true? we should probably leave it to the user to decide whether or not they wanna get h4x0rdThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
HTML blocks were originally a way to say, hey this code is dangerous and we know it. All other 'inlined' html would get tags and attributes sanitized. But I don't see how we could even begin to sanitize MDX.
The only thing I can think of, is if some existing page with an html block has an unknown malicious script in it, and all of sudden we gave it life?