@@ -422,53 +422,10 @@ def _script(
422422 key is given, the key is inferred to be the content of the script or, lastly its
423423 'src' attribute if that is given.
424424
425- If no attributes are given, the content of the script may evaluate to a function.
426- This function will be called when the script is initially created or when the
427- content of the script changes. The function may itself optionally return a teardown
428- function that is called when the script element is removed from the tree, or when
429- the script content changes.
430-
431425 Notes:
432426 Do not use unsanitized data from untrusted sources anywhere in your script.
433- Doing so may allow for malicious code injection. Consider this **insecure**
434- code:
435-
436- .. code-block::
437-
438- my_script = html.script(f"console.log('{user_bio}');")
439-
440- A clever attacker could construct ``user_bio`` such that they could escape the
441- string and execute arbitrary code to perform cross-site scripting
442- (`XSS <https://en.wikipedia.org/wiki/Cross-site_scripting>`__`). For example,
443- what if ``user_bio`` were of the form:
444-
445- .. code-block:: text
446-
447- '); attackerCodeHere(); ('
448-
449- This would allow the following Javascript code to be executed client-side:
450-
451- .. code-block:: js
452-
453- console.log(''); attackerCodeHere(); ('');
454-
455- One way to avoid this could be to escape ``user_bio`` so as to prevent the
456- injection of Javascript code. For example:
457-
458- .. code-block:: python
459-
460- import json
461- my_script = html.script(f"console.log({json.dumps(user_bio)});")
462-
463- This would prevent the injection of Javascript code by escaping the ``user_bio``
464- string. In this case, the following client-side code would be executed instead:
465-
466- .. code-block:: js
467-
468- console.log("'); attackerCodeHere(); ('");
469-
470- This is a very simple example, but it illustrates the point that you should
471- always be careful when using unsanitized data from untrusted sources.
427+ Doing so may allow for malicious code injection
428+ (`XSS <https://en.wikipedia.org/wiki/Cross-site_scripting>`__`).
472429 """
473430 model : VdomDict = {"tagName" : "script" }
474431
0 commit comments