html-to-react
Advanced tools
Comparing version 1.4.6 to 1.4.7
@@ -5,2 +5,6 @@ # Change Log | ||
## [v1.4.7](https://github.com/aknuds1/html-to-react/tree/v1.4.7) | ||
- Make sure event handlers, f.ex. "onclick", are functions [#126](https://github.com/aknuds1/html-to-react/pull/126) ([aknuds1](https://github.com/aknuds1)) | ||
## [v1.4.6](https://github.com/aknuds1/html-to-react/tree/v1.4.6) | ||
@@ -7,0 +11,0 @@ |
@@ -5,2 +5,3 @@ 'use strict'; | ||
const reduce = require('ramda/src/reduce'); | ||
const startsWith = require('ramda/src/startsWith'); | ||
const React = require('react'); | ||
@@ -78,2 +79,4 @@ const includes = require('ramda/src/includes'); | ||
key = 'htmlFor'; | ||
} else if (startsWith('on', key)) { | ||
value = Function(value); | ||
} | ||
@@ -80,0 +83,0 @@ |
{ | ||
"name": "html-to-react", | ||
"version": "1.4.6", | ||
"version": "1.4.7", | ||
"description": "A lightweight library that converts raw HTML to a React DOM structure.", | ||
@@ -5,0 +5,0 @@ "main": "index.js", |
@@ -273,7 +273,8 @@ 'use strict'; | ||
it('should handle onclick attributes', function () { | ||
const htmlInput = '<button onclick="alert(\'hello!\')">Hello</button>'; | ||
const htmlInput = `<button onclick="alert('hello!')">Hello</button>`; | ||
const reactElem = parser.parse(htmlInput); | ||
assert.strictEqual(reactElem.props.onClick, 'alert(\'hello!\')'); | ||
assert.strictEqual(typeof reactElem.props.onClick, 'function'); | ||
assert.strictEqual(String(reactElem.props.onClick), String(Function(`alert('hello!')`))); | ||
}); | ||
@@ -280,0 +281,0 @@ |
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
59101
788
334028
2