GrapesJS / grapesjs

Free and Open source Web Builder Framework. Next generation tool for building templates without coding
https://grapesjs.com
BSD 3-Clause "New" or "Revised" License
22.36k stars 4.05k forks source link

BUG: editor.getSelected().toHTML() encodes inline javascript #3779

Closed stljeff1 closed 3 years ago

stljeff1 commented 3 years ago

GrapesJS version

What browser are you using?

latest (chrome)

Reproducible demo link

https://jsfiddle.net/4j1k0wde/24/

Describe the bug

How to reproduce the bug?

  1. create block with a script tag inside.
  2. use editor.getSelected.toHTML() to grab the block's markup (so user can edit that block's markup in a popup dialog)

What is the expected behavior? ... I get the block's HTML, including the script tag and it's contents

What is the current behavior? ... Either no script tag or the special characters are encoded.

Further info here: https://github.com/artf/grapesjs/discussions/3776

Using version 16.12, toHTML() works as expected. I get all the contents of my selected component, including the script tags with its original javascript intact.

using newer versions of GrapessJS (on my machine, in my app), toHTML() returns script tags with the javascript encoded like so: const form = document.getElementById('91003');

In the JSFiddle I created, the script tag isn't even returned by toHTML.

RE: My JSFiddle - I understand the way I am adding my Edit button to my component's toolbar is convoluted. I am dealing with a legacy app with a bunch of hack-ish things going on. Still, why should that affect the toHTML() function call?

Thanks for your attention.

Code of Conduct

artf commented 3 years ago

You have to use allowScripts

const editor = grapesjs.init({
  ...
  allowScripts: true,
});

And I see no issues with encoding (use the real inspector, not the jsfiddle beta console, which probably has a bug).

stljeff1 commented 3 years ago

Thank you!