Giters

Knio / dominate

Dominate is a Python library for creating and manipulating HTML documents using an elegant DOM API. It allows you to write HTML pages in pure Python very concisely, which eliminate the need to learn another template language, and to take advantage of the more powerful features of Python.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Script tag converts " into "

Quadrangle opened this issue · comments

commented

I am really enjoying Dominate. Great job on this Team Knio!
I can use the script tag to refer to an external .js file and all works well.
But for a script tag in the head or body elements, sensitive characters are escaped. The script does not work.
Is there an immediate workaround, like injecting text?

commented

I just changed double quotes (") to single quotes (') in the javascript and all works.

commented

Hi, this is to prevent XSS attacks in case the content of tags is user-generated (and applies to all tags, not just <script>). If you trust the content or it's just a static string, use the raw() util to prevent escaping. e.g.:

from dominate.tags import *
from dominate.util import *

script(raw('''
    alert("Hello World!");
'''))