Harden string-based rendering - #21
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 51fd5a97c3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (typeof content === 'string') { | ||
| target.textContent = content; | ||
| } else if (content && content.unsafeHtml) { | ||
| target.innerHTML = content.unsafeHtml; |
There was a problem hiding this comment.
unsafeBody as raw HTML in modal helper
The new modal API advertises unsafeBody as the opt-in HTML hook, but this helper only switches to innerHTML when content.unsafeHtml exists. If a consumer follows the new API and passes unsafeBody: '<strong>...</strong>', the markup is still written through textContent, so both the initial modal body and any later setBody() updates render the literal tags instead of HTML.
Useful? React with 👍 / 👎.
|
|
||
| chartContainer.innerHTML = '<svg id="' + svgId + '"></svg>'; | ||
| chartContainer.textContent = ''; | ||
| chartContainer.appendChild(sf.el('svg', { id: svgId })); |
There was a problem hiding this comment.
Replacing the parser-created '<svg ...>' with sf.el('svg', ...) changes the chart root to document.createElement('svg'). Frappe Gantt's vendored setup_wrapper() reuses any existing child svg instead of creating its own root (static/sf/vendor/frappe-gantt/frappe-gantt.min.js), so on browsers that require createElementNS for SVG nodes the library will append rect/g children under a non-SVG element and the chart can render blank.
Useful? React with 👍 / 👎.
1 participant
Summary
SF.eltext-safe by default and add explicitunsafeHtmlkey.unsafeBody,tabs[].content.unsafeHtml,cells[].unsafeHtml,unsafePopupHtml,columns[].render(task).unsafeHtml).static/sf/sf.js.