Skip to content

Commit ca33704

Browse files
committed
Remove unneeded docstring
1 parent 4cfec27 commit ca33704

File tree

1 file changed

+2
-45
lines changed

1 file changed

+2
-45
lines changed

src/py/reactpy/reactpy/html.py

Lines changed: 2 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -422,53 +422,10 @@ def _script(
422422
key is given, the key is inferred to be the content of the script or, lastly its
423423
'src' attribute if that is given.
424424
425-
If no attributes are given, the content of the script may evaluate to a function.
426-
This function will be called when the script is initially created or when the
427-
content of the script changes. The function may itself optionally return a teardown
428-
function that is called when the script element is removed from the tree, or when
429-
the script content changes.
430-
431425
Notes:
432426
Do not use unsanitized data from untrusted sources anywhere in your script.
433-
Doing so may allow for malicious code injection. Consider this **insecure**
434-
code:
435-
436-
.. code-block::
437-
438-
my_script = html.script(f"console.log('{user_bio}');")
439-
440-
A clever attacker could construct ``user_bio`` such that they could escape the
441-
string and execute arbitrary code to perform cross-site scripting
442-
(`XSS <https://en.wikipedia.org/wiki/Cross-site_scripting>`__`). For example,
443-
what if ``user_bio`` were of the form:
444-
445-
.. code-block:: text
446-
447-
'); attackerCodeHere(); ('
448-
449-
This would allow the following Javascript code to be executed client-side:
450-
451-
.. code-block:: js
452-
453-
console.log(''); attackerCodeHere(); ('');
454-
455-
One way to avoid this could be to escape ``user_bio`` so as to prevent the
456-
injection of Javascript code. For example:
457-
458-
.. code-block:: python
459-
460-
import json
461-
my_script = html.script(f"console.log({json.dumps(user_bio)});")
462-
463-
This would prevent the injection of Javascript code by escaping the ``user_bio``
464-
string. In this case, the following client-side code would be executed instead:
465-
466-
.. code-block:: js
467-
468-
console.log("'); attackerCodeHere(); ('");
469-
470-
This is a very simple example, but it illustrates the point that you should
471-
always be careful when using unsanitized data from untrusted sources.
427+
Doing so may allow for malicious code injection
428+
(`XSS <https://en.wikipedia.org/wiki/Cross-site_scripting>`__`).
472429
"""
473430
model: VdomDict = {"tagName": "script"}
474431

0 commit comments

Comments
 (0)