cleanMarkup関数
リファレンスの説明と例は英語です。見出しと目次は日本語です。
SVG markup with what could run or fetch taken out: scripts, foreignObject, frames, animation elements and
styles, every on… handler, and any href that is not a picture or a #fragment of the drawing itself. Anything
else is kept as it was written. This is a guard for markup that came from a page's own code, not a sanitiser for
strangers' files: never hand it what a visitor typed.
インポート
import { cleanMarkup } from "@johnmorrisdotca/toranpu/card-faces";定義
function cleanMarkup(markup: unknown): string引数
| 名前 | 型 | 説明 |
|---|---|---|
markup | unknown | Untrusted drawing markup to sanitize. |
戻り値
string
SVG markup with what could run or fetch taken out: scripts, foreignObject, frames, animation elements and styles, every on… handler, and any href that is not a picture or a #fragment of the drawing itself. Anything else is kept as it was written. This is a guard for markup that came from a page's own code, not a sanitiser for strangers' files: never hand it what a visitor typed.
例
import { cleanMarkup } from "@johnmorrisdotca/toranpu/card-faces";
console.log(cleanMarkup(`<svg><script>alert(1)</script><circle cx="5" cy="5" r="2"/></svg>`));<svg><circle cx="5" cy="5" r="2"/></svg>出力（このページを作ったときに実行した結果）
この日本語は、まだ日本語を母語とする方の確認を受けていません。訂正を歓迎します。