I'm currently using markdown-it for my web-extensions to display translatable tutorials & changelogs. But Mozilla has safety checks in place telling me that the use of innerHTML
is unsafe. So I'm wondering if there is a JavaScript (ideally TypeScript) markdown library that creates dom-elements rather than rendering HTML text?
I found a workaround for the issue that works without using eval:
// This was the old code:
container.innerHTML = md.render(value);
// This is the new code:
const domParser = new DOMParser();
const doc = domParser.parseFromString(md.render(value), 'text/html');
removeAllChildren(container);
for(let i=0; i<doc.body.childNodes.length; i++)
container.appendChild(doc.body.childNodes[i]);
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.