Forráskód Böngészése

Fix: enable dangerous_inner_html for svgs (#2717)

Jonathan Kelley 11 hónapja
szülő
commit
1a66987245
2 módosított fájl, 12 hozzáadás és 0 törlés
  1. 6 0
      examples/rsx_usage.rs
  2. 6 0
      packages/html/src/attribute_groups.rs

+ 6 - 0
examples/rsx_usage.rs

@@ -95,6 +95,12 @@ fn app() -> Element {
                     }
                 }
             }
+
+            // dangerous_inner_html for both html and svg
+            div { dangerous_inner_html: "<p>hello dangerous inner html</p>" }
+            svg { dangerous_inner_html: "<circle r='50' cx='50' cy='50' />" }
+
+            // Built-in idents can be used
             use {}
             link {
                 as: "asd"

+ 6 - 0
packages/html/src/attribute_groups.rs

@@ -1752,6 +1752,12 @@ mod_methods! {
     /// <https://developer.mozilla.org/en-US/docs/Web/API/Event/preventDefault>
     prevent_default: "dioxus-prevent-default";
 
+    /// dangerous_inner_html is Dioxus's replacement for using innerHTML in the browser DOM. In general, setting
+    /// HTML from code is risky because it’s easy to inadvertently expose your users to a cross-site scripting (XSS)
+    /// attack. So, you can set HTML directly from Dioxus, but you have to type out dangerous_inner_html to remind
+    /// yourself that it’s dangerous
+    dangerous_inner_html;
+
     /// <https://developer.mozilla.org/en-US/docs/Web/SVG/Attribute/accent-height>
     accent_height: "accent-height";