-
Notifications
You must be signed in to change notification settings - Fork 13.5k
feat(config): add option to disable custom html functionality #26956
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't forget to add this to the interface docs: https://ionicframework.com/docs/angular/config#ionicconfig (also for React and Vue)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh wait, that would be in the docs PR, wouldn't it 😆 Nvm, this one looks good.
Docs PR: ionic-team/ionic-docs#2826
Pull request checklist
Please check if your PR fulfills the following requirements:
ionic-docs
repo, in a separate PR. See the contributing guide for details.npm run build
) was run locally and any changes were pushednpm run lint
) has passed locally and any fixes were made for failuresPull request type
Please check the type of change your PR introduces:
What is the current behavior?
Issue URL: Internal ticket
Developers have requested a way to disable the
innerHTML
functionality in Ionic for use cases where they are only passing plain text. Accepting user content and passing toinnerHTML
without properly sanitizing their content poses a security risk. Ionic has a built-in sanitizer for this, but it is not designed to be comprehensive.What is the new behavior?
innerHTMLTemplatesEnabled
config. Whenfalse
, this will disable anyinnerHTML
functionality inside of Ionic. This avoids the need to user a sanitizer because user-generated content will be interpreted as text instead of custom HTML.Does this introduce a breaking change?
Other information