Skip to content

Code demo is not escaping strings before colourizing them #1002

@NeilFraser

Description

@NeilFraser

May be a security issue, load link then click JS (or another language tab):
https://blockly-demo.appspot.com/static/demos/code/index.html#naf7fr

Originally my fault. Basically this is what happens every time one uses innerHTML no matter how careful one is. The solution is to stop using prettyPrintOne and use prettyPrint instead.

Old code:

    if (typeof prettyPrintOne == 'function') {
      code = content.textContent;
      code = prettyPrintOne(code, 'js');
      content.innerHTML = code;
  }

Suggested code:

    if (typeof prettyPrint == 'function') {
      prettyPrint();
  }

Old HTML:

  <pre id="content_javascript" class="content"></pre>

Suggested HTML:

  <pre id="content_javascript" class="content prettyprint lang-js"></pre>

Likewise for the other languages. And of course test that it can not only pretty print the code, but change the pretty printed code when the blocks are changed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    help wantedExternal contributions actively solicitedissue: bugDescribes why the code or behaviour is wronglow priority

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions