@@ -422,53 +422,10 @@ def _script(
422
422
key is given, the key is inferred to be the content of the script or, lastly its
423
423
'src' attribute if that is given.
424
424
425
- If no attributes are given, the content of the script may evaluate to a function.
426
- This function will be called when the script is initially created or when the
427
- content of the script changes. The function may itself optionally return a teardown
428
- function that is called when the script element is removed from the tree, or when
429
- the script content changes.
430
-
431
425
Notes:
432
426
Do not use unsanitized data from untrusted sources anywhere in your script.
433
- Doing so may allow for malicious code injection. Consider this **insecure**
434
- code:
435
-
436
- .. code-block::
437
-
438
- my_script = html.script(f"console.log('{user_bio}');")
439
-
440
- A clever attacker could construct ``user_bio`` such that they could escape the
441
- string and execute arbitrary code to perform cross-site scripting
442
- (`XSS <https://en.wikipedia.org/wiki/Cross-site_scripting>`__`). For example,
443
- what if ``user_bio`` were of the form:
444
-
445
- .. code-block:: text
446
-
447
- '); attackerCodeHere(); ('
448
-
449
- This would allow the following Javascript code to be executed client-side:
450
-
451
- .. code-block:: js
452
-
453
- console.log(''); attackerCodeHere(); ('');
454
-
455
- One way to avoid this could be to escape ``user_bio`` so as to prevent the
456
- injection of Javascript code. For example:
457
-
458
- .. code-block:: python
459
-
460
- import json
461
- my_script = html.script(f"console.log({json.dumps(user_bio)});")
462
-
463
- This would prevent the injection of Javascript code by escaping the ``user_bio``
464
- string. In this case, the following client-side code would be executed instead:
465
-
466
- .. code-block:: js
467
-
468
- console.log("'); attackerCodeHere(); ('");
469
-
470
- This is a very simple example, but it illustrates the point that you should
471
- always be careful when using unsanitized data from untrusted sources.
427
+ Doing so may allow for malicious code injection
428
+ (`XSS <https://en.wikipedia.org/wiki/Cross-site_scripting>`__`).
472
429
"""
473
430
model : VdomDict = {"tagName" : "script" }
474
431
0 commit comments