Quantcast
Channel: Recent Discussions — DataTables forums
Viewing all articles
Browse latest Browse all 82057

Possible bug when sanitizing strings

$
0
0

So, to prevent scripts from being executed when showing them in a data table, I usually do this:

var sanitized = $("div").text("<script>alert(1);</script>").html();

This works fine when rendering a table. However when re-rendering that table, DataTables won't initialize. See example:

$("#mytable").DataTable({
  columns: [{
    title: "Column"
  } ],
  data: [
    [`<a href="#">${$("div").text("<script>alert(1)</script>").html()}</a>`]
  ],
  destroy: true
});

$("#mytable").DataTable({
  columns: [{
    title: "Column"
  } ],
  data: [
    [`<a href="#">something else</a>`]
  ],
  destroy: true
});

No errors will show up in the chrome console. I think this is a bug! If you do not use the sanitizing, DataTables will initialize twice and show the expected result.


Viewing all articles
Browse latest Browse all 82057

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>