From 76638ab9606973d0fe09b9efbb117a17e5945406 Mon Sep 17 00:00:00 2001 From: Pete Date: Mon, 8 Nov 2021 09:48:54 -0800 Subject: [PATCH] Remove assignment to innerHTML Replaces the assignment of `''` to `innerHTML` with an assignment of `''` to `textContent` in order to resolve the CSP issue described in #339. The goal of this line of code is just to remove the content of the `style` node that is referenced by the `carouselCssNode` property. So there's no real difference between using `textContent` and `innerHTML`. Both have the same effect. However, since `innerHTML` potentially allows unsafe DOM injections, it should be avoided (such as in cases like this) when it's not needed. Resolves #339 --- .../ngu-carousel/src/lib/ngu-carousel/ngu-carousel.component.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/ngu-carousel/src/lib/ngu-carousel/ngu-carousel.component.ts b/projects/ngu-carousel/src/lib/ngu-carousel/ngu-carousel.component.ts index 4c03edf2..a5791e4b 100644 --- a/projects/ngu-carousel/src/lib/ngu-carousel/ngu-carousel.component.ts +++ b/projects/ngu-carousel/src/lib/ngu-carousel/ngu-carousel.component.ts @@ -484,7 +484,7 @@ export class NguCarousel extends NguCarouselStore /** Used to reset the carousel */ public reset(withOutAnimation?: boolean): void { withOutAnimation && (this.withAnim = false); - this.carouselCssNode.innerHTML = ''; + this.carouselCssNode.textContent = ''; this.moveTo(0); this._carouselPoint(); }