sparcs-kaist / new-ara-web

KAIST Community Ara Renewal Project
https://ara.kaist.ac.kr
MIT License
21 stars 3 forks source link

Tiptap comunicate with HTML, not JSON #90

Closed jwoo0122 closed 5 years ago

jwoo0122 commented 5 years ago

Cause of the problem that It's extremely complicate to sanitizing Tiptap JSON from XSS (in Django), we need to change tiptap to make HTML itself not JSON. And there is no more tiptap readonly mode. React can just render HTML from Django, never considering XSS cause it already sanitized.

apple12347678 commented 5 years ago

다른 텍스트 필드 (유저명, 글 제목 등)은 전혀 sanitize하지 않을 것(vue에서 걸러야함) 글 내용은 pure HTML로 sanitize 후 저장하여 tiptap의 setHTML(?)을 쓰든, vue버전 dangerouslySetInnerHTML을 쓰든 그대로 나타나기만 하면 됨.