Follow up of this conversation: #684 (comment)
This is best explained by a simple example:
<script type="text/javascript">
console.log("js: a & b");
</script>
<py-script>
import js
js.console.log("py: a & b");
</py-script>This produces the following:
This is even worse if we use " or ', because currently they are interpreted as quotes and thus they can easily trigger Python syntax errors; e.g. the following trigger a SyntaxError:
<py-script>
import js
js.console.log("py: a " b");
</py-script>By reading the code, it seems that the interpretation of HTML entities happens here:
|
function escape(str: string): string { |
|
return str.replace(/</g, "<").replace(/>/g, ">") |
|
} |
|
|
|
function htmlDecode(input: string): string { |
|
const doc = new DOMParser().parseFromString(ltrim(escape(input)), 'text/html'); |
|
return doc.documentElement.textContent; |
|
} |
I don't really understand what's going on: inside htmlDecode input seems to be the raw string of text that we want; then we put it inside DOMParser(), only to extract the text back.
PR #684 mitigates the issue by escaping angle brackets, but why do we need to call DOMParser in the first place?
/cc @philippjfr who worked on this recently and @fpliger who might remember what was the original idea
Follow up of this conversation: #684 (comment)
This is best explained by a simple example:
This produces the following:
This is even worse if we use
"or', because currently they are interpreted as quotes and thus they can easily trigger Python syntax errors; e.g. the following trigger aSyntaxError:By reading the code, it seems that the interpretation of HTML entities happens here:
pyscript/pyscriptjs/src/utils.ts
Lines 17 to 24 in 6cb81b5
I don't really understand what's going on: inside
htmlDecodeinputseems to be the raw string of text that we want; then we put it insideDOMParser(), only to extract the text back.PR #684 mitigates the issue by escaping angle brackets, but why do we need to call
DOMParserin the first place?/cc @philippjfr who worked on this recently and @fpliger who might remember what was the original idea