1
0
Falko Schindler 1 жил өмнө
parent
commit
d46c31eefa

+ 2 - 1
nicegui/templates/index.html

@@ -43,7 +43,8 @@
       const loaded_components = new Set();
 
       const domParser = new DOMParser();
-      const elements = JSON.parse(domParser.parseFromString('{{ elements | safe }}', 'text/html').documentElement.textContent);
+      const raw_elements = String.raw`{{ elements | safe }}`;
+      const elements = JSON.parse(domParser.parseFromString(raw_elements, 'text/html').documentElement.textContent);
 
       function stringifyEventArgs(args, event_args) {
         const result = [];

+ 9 - 4
tests/test_element.py

@@ -166,13 +166,18 @@ def test_move(screen: Screen):
 def test_xss(screen: Screen):
     ui.label('</script><script>alert(1)</script>')
     ui.label('<b>Bold 1</b>')
-    ui.button('Button 1', on_click=lambda: ui.label('</script><script>alert(2)</script>'))
-    ui.button('Button 2', on_click=lambda: ui.label('<b>Bold 2</b>'))
+    ui.label('multi\nline 1')
+    ui.button('Button', on_click=lambda: (
+        ui.label('</script><script>alert(2)</script>'),
+        ui.label('<b>Bold 2</b>'),
+        ui.label('multi\nline 2'),
+    ))
 
     screen.open('/')
-    screen.click('Button 1')
-    screen.click('Button 2')
+    screen.click('Button')
     screen.should_contain('</script><script>alert(1)</script>')
     screen.should_contain('</script><script>alert(2)</script>')
     screen.should_contain('<b>Bold 1</b>')
     screen.should_contain('<b>Bold 2</b>')
+    screen.should_contain('multi\nline 1')
+    screen.should_contain('multi\nline 2')