-
Notifications
You must be signed in to change notification settings - Fork 174
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Confirmation modal enhancements #1900
Confirmation modal enhancements #1900
Conversation
@@ -14,7 +14,7 @@ <h3 class="fd-title fd-title--h5">{settings.header}</h3> | |||
</div> | |||
</div> | |||
</header> | |||
<div class="fd-message-box__body">{settings.body}</div> | |||
<div class="fd-message-box__body">{@html settings.body}</div> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i can't find any sanity check for settings.body, so this allows to inject anything into core app
@@ -14,7 +14,7 @@ <h3 class="fd-title fd-title--h5">{settings.header}</h3> | |||
</div> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@hardl , I have pushed an improvement which will sanitize HTML body and also restore those formatting tags. Please review it again. Thanks |
core/src/ConfirmationModal.html
Outdated
const sanitizedHtml = EscapingHelpers.sanitizeHtml(settings.body); | ||
settings = { | ||
...settings, | ||
body: EscapingHelpers.restoreSanitizedTags( | ||
sanitizedHtml, | ||
restoreSanitizedTags | ||
) | ||
}; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should not be better to just create a new method in EscapingHelpers.sanatizeHtmlWithSpecialChar (or a better name) where you can inject the whole logic, instead of putting it in ConfirmationModal.html?
I guess that also the restoreSanitizedTags Array should be moved to EscapingHelpers.js (I think we could reuse it in other element, like Alert or whatever... )
Thanks @legteodav . I have introduced a new sanatizeHtmlExceptTextFormatting function to handle those logics. |
We should document which elements are allowed. Fine as a follow-up task as well |
Co-authored-by: Aleksandra Simeonova <[email protected]>
Co-authored-by: Aleksandra Simeonova <[email protected]>
…uigi into update-fiddle-to-v1.10 * 'update-fiddle-to-v1.10' of github.com:JohannesDoberer/luigi: Confirmation modal enhancements (SAP#1900) Blog post with Luigi updates (SAP#1880) Fix error in navigation docs 1824 Silent Renew for OIDC documentation theming.nodeViewURLDecorator should also be applied to settings micro frontends viewUrl General/User settings docu review
Related issue(s)
Fixes #1896