javascript - Understanding Dart 1.11's new appendHTML sanitizing -
i upgraded dart 1.11 , don't quite unterstand what's happening .appendhtml()
. have large project using dart , .appendhtml()
used quite often. have been working on app on year , nothing works anymore. :/
my console looks this:
removing disallowed attribute <div style="width: 100%; text-align: right;"> removing disallowed attribute <div style="height: 2em;"> removing disallowed attribute <div style="height: 0.6em;"> removing disallowed attribute <div style="height: 2em;"> removing disallowed attribute <div style="height: 1em;"> removing disallowed attribute <div style="text-align: justify;"> removing disallowed attribute <div style="height: 1em;"> removing disallowed attribute <div style="height: 0.6em;"> removing disallowed attribute <span style="color: #0d4b63; font-size: 1.6em;">
most of time create elements using new element()
, settings styles using .style.
... it's not necessary , appending html string faster , better read.
what reason, inline styles removed while being sanitized? make own nodetreesanitizer
mentioned here: appendhtml() doesn't append full html - dart
but not seem solution me because guess there reason happen.
i have used Über simple webapp template , added line of code:
queryselector('#output').appendhtml('<div style="height: 2em; background: red;">test</div>');
and style get's removed:
removing disallowed attribute <div style="height: 2em; background: red;">
but valid html me. :/
can explain me happens here , why , how can project run again.
thanks lot!
edit:
also svg elements removed:
removing disallowed element <g> removing disallowed element <text> removing disallowed element <image> removing disallowed element <polygon>
creating custom nodetreesanitizer
way go. everywhere text can added dom html sanitation applied. oversight sanitation wasn't done in .appenedhtml()
. point declare explicitly elements can added dom , attributes can added these elements. done ensure no malicious html or js can added page mistake.
Comments
Post a Comment