Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add style and script tag #83

Open
def-roth opened this issue Sep 29, 2023 · 2 comments
Open

Add style and script tag #83

def-roth opened this issue Sep 29, 2023 · 2 comments

Comments

@def-roth
Copy link
Contributor

def-roth commented Sep 29, 2023

Feature proposal style & script tag

Improvement:

Stylesheet Management, a solution for #44
CSS Animations without external deps.
Executing custom JS.

Currently reka.js has the text value

  if (props.view.tag === 'text') {
    return <span>{props.view.props.value}</span>;
  }

If right now one adds a script or style-tag and tries to insert a text value a span is inserted which is not how they work.
By adding the corresponding tags to the renderer they are usable.

  if (props.view.tag === 'style') {
    return <style>{props.view.props.value}</style>;
  }
  if (props.view.tag === 'script') {
    return <script>{props.view.props.value}</script>;
  }

Problems:

Adding either of those tags will open up for XSS.
Right now they're pretty safe as they cannot be used by default.

Otherwise:

An anchor tag can already be prepared with a malicious link for clickjacking.

I have both of those already running and can create a PR.

@prevwong
Copy link
Owner

Since this is already be possible right now where the only work that needs to be done to support this is on the Renderer ( on the consumer side), I don't think there's anything we need to do on Reka itself(?)

@def-roth
Copy link
Contributor Author

Yeah, adding it to the Renderer is no big deal. It's more of a question if this should be added to the main branch or if users of reka should add that feature themselves. Imho the addition would spare the users time to figure it out theirselves and point towards a possible direction. That's what the Renderer is for anyway i assume

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants