itsscb/htmx
1
0
Fork 0
mirror of https://github.com/bigskysoftware/htmx.git synced 2025-09-27 13:01:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Change innerText note to reflect that we used textContent

Browse Source
This commit is contained in:
Alexander Petros 2024-02-29 11:14:59 -05:00
parent d1fc7895f6
commit 8ba9e7b05d
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/htmx.js
View File

@ -1805,9 +1805,10 @@ var htmx = (function() {
}
const settleInfo = makeSettleInfo(target)
// For text content swaps, don't parse the response as HTML, just insert it
if (swapSpec.swapStyle === 'textContent') {
// parse only as text; don't process OOB swaps
target.textContent = content
// Otherwise, make the fragment and process it
} else {
let fragment = makeFragment(content)

4
www/content/essays/web-security-basics-with-htmx.md
View File

@ -241,9 +241,9 @@ Keep in mind that the JSON you parse might have a *property* that is formatted a
{ "name": "<script>alert('Hahaha I am a script')</script>" }
```
Therefore, don't insert JSON values as HTML either—use `innerText` if you're doing something like that. This is well outside the realm of htmx-controlled UI though.
Therefore, don't insert JSON values as HTML either—use `textContent` if you're doing something like that. This is well outside the realm of htmx-controlled UI though.
The 2.0 version of htmx will include an `innerText` swap, if you want to call someone else's API directly from the client and just put that text into the page.
The 2.0 version of htmx will include a `textContent` swap, if you want to call someone else's API directly from the client and just put that text into the page.
### Custom HTML controls