Possible XSS injection

[cwinland]

DragnDrop.ts (BuildDragEventHandler function) has a place that could possibly be XSS injection.

if (script) {
const scriptHandler = Function(`return ${script}`)()

Is it possible to do this a bit differently?

I could possibly add something to my PR #190

[Tewr]

Hello, I don't see how this can be used for injection, could you show me?

As documented here, user provided data/scripts must not be used as arguments here, that would indeed pose a risk for XSS. The idea is simply to provide extensibility.

[cwinland]

Hi, yes very good point. As long as the developer doesn't use data from user provided information, it should be fine.