Skip to content

Commit

Permalink
fix(pat-clone-code): Fix a Content-Security-Policy problem.
Browse files Browse the repository at this point in the history
Do not use dom.template for the wrapper template to not get caught by
the browser's Content-Security-Policy. If set, a unsafe-eval error would
be thrown and the pattern refuse to run.
  • Loading branch information
thet committed Dec 7, 2022
1 parent 78c544b commit e38f987
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 11 deletions.
17 changes: 11 additions & 6 deletions src/pat/clone-code/clone-code.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
import { BasePattern } from "../../core/basepattern";
import code_wrapper_template from "./templates/code-wrapper.html";
import dom from "../../core/dom";
import Parser from "../../core/parser";
import registry from "../../core/registry";
import utils from "../../core/utils";
Expand Down Expand Up @@ -63,17 +61,24 @@ class Pattern extends BasePattern {
});
}

markup = utils.escape_html(markup);
const pre_code_markup = dom.template(code_wrapper_template, { markup: markup });

// Now we need to wrap the contents in any case in a div.
tmp_wrapper = document.createElement("div");
tmp_wrapper.innerHTML = pre_code_markup;
tmp_wrapper.innerHTML = this.wrapper_template(utils.escape_html(markup));
const pre_code_el = tmp_wrapper.children[0];

this.el.appendChild(pre_code_el);
registry.scan(pre_code_el);
}

wrapper_template(markup) {
return `
<pre class="pat-syntax-highlight">
<code class="language-html">
${markup}
</code>
</pre>
`;
}
}

registry.register(Pattern);
Expand Down
5 changes: 0 additions & 5 deletions src/pat/clone-code/templates/code-wrapper.html

This file was deleted.

0 comments on commit e38f987

Please sign in to comment.