Skip to content

Instantly share code, notes, and snippets.

@zoechi
Last active March 10, 2023 18:03
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save zoechi/68b6fb1921410c5948bb to your computer and use it in GitHub Desktop.
Save zoechi/68b6fb1921410c5948bb to your computer and use it in GitHub Desktop.
appendHtml doesn't validate HTML
<div id="div1"></div>
<br/>
<div id="div2"></div>
<br/>
<div id="div3"></div>
<br/>
<div id="div4"></div>
<br/>
<div id="div5"></div>
<br/>
<div id="div6"></div>
import 'dart:html';
String dangerousHtml(String name) {
return '''
<div>
<span>Some text</span>
<script type="text/javascript">
window.alert("bla");
</script>
<input type="button" text="xxx" onclick="window.alert('bla');" value="$name"></button>
</div>''';
}
void main() {
window.onClick.listen((e) => print("click"));
print('setInnerHtml'); // removes
querySelector('#div1').setInnerHtml(dangerousHtml('setInnerHtml'));
print('innerHtml'); // removes
querySelector('#div2').innerHtml = dangerousHtml('innerHtml');;
print('new Element.html'); // removes
querySelector('#div3').append(new Element.html(dangerousHtml('new Element.html')));
print('new DocumentFragment.html'); // removes
var df = new DocumentFragment.html(dangerousHtml('new DocumentFragment.html'));
querySelector('#div4').append(df);
print('appendHtml'); //
querySelector('#div5').appendHtml(dangerousHtml('appendHtml'));
print('appendText');
querySelector('#div6').appendText(dangerousHtml('appendText'));
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment