fix(pages): script tags can now be executed if they are provided through advanced settings #4824
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What are the main changes you did
I changed the v-html implementation to parsing the string as DOM elements, adding them to the page. For script tags I created new script tags, so they will execute once loaded. v-html uses innerHTML under the hood. That disables any execution.
How to test
Edit a page in advanced settings and add a script tag, example <script>alert("!")</script>, this will trigger when parsed.
You can ofcourse use window.onload or such, to await execution until page has been loaded
Partially implements #4606
Checklist