javascript - Understanding Dart 1.11's new appendHTML sanitizing -


i upgraded dart 1.11 , don't quite unterstand what's happening .appendhtml(). have large project using dart , .appendhtml() used quite often. have been working on app on year , nothing works anymore. :/

my console looks this:

removing disallowed attribute <div style="width: 100%; text-align: right;"> removing disallowed attribute <div style="height: 2em;"> removing disallowed attribute <div style="height: 0.6em;"> removing disallowed attribute <div style="height: 2em;"> removing disallowed attribute <div style="height: 1em;"> removing disallowed attribute <div style="text-align: justify;"> removing disallowed attribute <div style="height: 1em;"> removing disallowed attribute <div style="height: 0.6em;"> removing disallowed attribute <span style="color: #0d4b63; font-size: 1.6em;"> 

most of time create elements using new element() , settings styles using .style.... it's not necessary , appending html string faster , better read.

what reason, inline styles removed while being sanitized? make own nodetreesanitizer mentioned here: appendhtml() doesn't append full html - dart

but not seem solution me because guess there reason happen.

i have used Über simple webapp template , added line of code:

queryselector('#output').appendhtml('<div style="height: 2em; background: red;">test</div>'); 

and style get's removed:

removing disallowed attribute <div style="height: 2em; background: red;"> 

but valid html me. :/

can explain me happens here , why , how can project run again.

thanks lot!

edit:

also svg elements removed:

removing disallowed element <g> removing disallowed element <text> removing disallowed element <image> removing disallowed element <polygon> 

creating custom nodetreesanitizer way go. everywhere text can added dom html sanitation applied. oversight sanitation wasn't done in .appenedhtml(). point declare explicitly elements can added dom , attributes can added these elements. done ensure no malicious html or js can added page mistake.


Comments

Popular posts from this blog

java - Andrioid studio start fail: Fatal error initializing 'null' -

android - Gradle sync Error:Configuration with name 'default' not found -

StringGrid issue in Delphi XE8 firemonkey mobile app -