onclick inside template not working at Reef 10

Question

onclick inside template not working at Reef 10

aalfiann opened this issue 3 years ago · comments

M ABD AZIZ ALFIAN commented 3 years ago

I found that Reef v10 is not working to use onclick inside the template.

To reproduce, I follow this codepen >> https://codepen.io/cferdinandi/pen/poEjLxg

Just change the CDN library to Reef v10..
https://cdn.jsdelivr.net/npm/reefjs@10/dist/reef.min.js

Thank you

Chris Ferdinandi · Answer 1 · Thu Sep 30 2021 05:32:07 GMT+0800 (China Standard Time)

Hi @aalfiann - that's an expected change as documented in the changelog.

M ABD AZIZ ALFIAN · Answer 2 · Thu Sep 30 2021 16:41:08 GMT+0800 (China Standard Time)

Oh sorry, I didn't read these information.

Because I use Reef since v7. I want to upgrade to v10.

Is there a configuration to allow this? Just in case for backwards compatibility?
I use Reef for many pages, so I haven't much time to refactor all pages.

Thanks

Chris Ferdinandi · Answer 3 · Thu Sep 30 2021 22:47:26 GMT+0800 (China Standard Time)

Is there a configuration to allow this?

Unfortunately, there is not. Reef uses semantic versioning, so major version bumps are considered breaking changes.

M ABD AZIZ ALFIAN · Answer 4 · Fri Oct 01 2021 01:38:46 GMT+0800 (China Standard Time)

Ok, that's make sense. but could you tell us why Reef 10 doesn't allow onclick event inside the template?

If its value is really useful, no matter what, I'll definitely refactor my source code.

Chris Ferdinandi · Answer 5 · Fri Oct 01 2021 01:58:45 GMT+0800 (China Standard Time)

Third-party data used in your templates can use them to inject XSS attacks. Older versions of Reef used an encoding approach that less performant and stripped out things like emoji. This approach removes dangerous attributes, but means that you can't attach listeners using on* attributes.