Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Support for escaping HTML

See original GitHub issue

Sweetalert2 seems to have changed the html config option to no longer signal whether HTML should be escaped. This opens up the prospect of XSS attacks on user-supplied strings being used in Sweetalert2 dialogues. I’d like to propose adding a new config option escapeHTML that will behave the same as the original sweetalert html option, namely escaping HTML from the title and description.

I’m happy to open a PR if this is a feature you’d be open to adding. Also, if I’m mistaken about there not being an option for escaping HTML, please let me know 😃

Issue Analytics

State:
Created 7 years ago
Comments:8 (6 by maintainers)

Top GitHub Comments

2reactions

birjjcommented, Dec 20, 2016

@akarelas That is what this issue is about. After issue fixed vs. before issue fixed.

2reactions

limontecommented, Dec 2, 2016

Introducing titleText seems fine to me.

Top Results From Across the Web

Which characters need to be escaped in HTML?

In some cases it may be safe to skip escaping some of these characters, but I encourage you to escape all five in...

Free Online HTML Escape / Unescape Tool - FreeFormatter.com

A free online tool to escape or unescape HTML documents and files. ... Consult the HTML Entities page for a full list of...

Escape HTML (instance security hardening)

A malicious user can inject HTML code within the form field to execute unwanted scripts on different client/user sessions. Set this property to ......

HTML Escape Online Tool - LambdaTest

This tool will convert a string to HTML entities or convert HTML entities to plain text.

Using character escapes in markup and CSS - W3C

Character escapes are a way of writing a character in markup using only ASCII code points. They are useful if you are unable...