-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Disallow non-templates as interpolations in Polymer.html #5023
Changes from 1 commit
5e890fa
08a020f
58f9780
4c5b739
8965cb3
a9ca5bf
46c07f5
99280df
bbe4c53
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -12,13 +12,31 @@ | |
(function() { | ||
'use strict'; | ||
|
||
class HTMLLiteral { | ||
constructor(string) { | ||
this.innerHTML = string; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I wouldn't name this There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It was an attempt to write less code, since both types can return their string value via |
||
} | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider adding a There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Done! |
||
} | ||
|
||
/** | ||
* @param {*} value Object to stringify into HTML | ||
* @return {string} HTML stringified form of `obj` | ||
*/ | ||
function literalValue(value) { | ||
if (value instanceof HTMLLiteral) { | ||
return /** @type {!HTMLLiteral} */(value).innerHTML; | ||
} else { | ||
throw new Error(`non-literal value passed to Polymer.htmlLiteral: ${value}`); | ||
} | ||
} | ||
|
||
/** | ||
* @param {*} value Object to stringify into HTML | ||
* @return {string} HTML stringified form of `obj` | ||
*/ | ||
function htmlValue(value) { | ||
if (value instanceof HTMLTemplateElement) { | ||
return /** @type {!HTMLTemplateElement} */(value).innerHTML; | ||
if (value instanceof HTMLTemplateElement || value instanceof HTMLLiteral) { | ||
return /** @type {!HTMLTemplateElement | !HTMLLiteral} */(value).innerHTML; | ||
} else { | ||
throw new Error(`non-template value passed to Polymer.html: ${value}`); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. this message should probably be updated to allow for htmlLiteral too |
||
} | ||
|
@@ -32,7 +50,7 @@ | |
* | ||
* Templates can be composed by interpolating `HTMLTemplateElement`s in | ||
* expressions in the JavaScript template literal. The nested template's | ||
* `innerHTML` is inluced in the containing template. | ||
* `innerHTML` is included in the containing template. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This should also include using |
||
* | ||
* All other values are disallowed in expressions to help prevent XSS | ||
* attacks. | ||
|
@@ -59,5 +77,33 @@ | |
acc + htmlValue(v) + strings[idx + 1], strings[0]); | ||
return template; | ||
}; | ||
|
||
/** | ||
* An html literal tag that can be used with `Polymer.html` to compose. | ||
* a literal string. | ||
* | ||
* Example: | ||
* | ||
* static get template() { | ||
* return Polymer.html` | ||
* <style> | ||
* :host { display: block; } | ||
* ${styleTemplate} | ||
* </style> | ||
* <div class="shadowed">${staticValue}</div> | ||
* ${super.template} | ||
* `; | ||
* } | ||
* static get styleTemplate() { return Polymer.htmlLiteral`.shadowed { background: gray; }`; } | ||
* | ||
* @memberof Polymer | ||
* @param {!ITemplateArray} strings Constant parts of tagged template literal | ||
* @param {...*} values Variable parts of tagged template literal | ||
* @return {!HTMLLiteral} Constructed literal string | ||
*/ | ||
Polymer.htmlLiteral = function(strings, ...values) { | ||
return new HTMLLiteral(values.reduce((acc, v, idx) => | ||
acc + literalValue(v) + strings[idx + 1], strings[0])); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. style nit: 4 space indent for wrapped expressions |
||
} | ||
})(); | ||
</script> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
docs