MCPcopy Create free account
hub / github.com/reactjs/react-rails / dangerousStyleValue

Function dangerousStyleValue

lib/assets/react-source/development/react.js:8104–8125  ·  view source on GitHub ↗

* Convert a value into the proper css writable value. The style name `name` * should be logical (no hyphens), as specified * in `CSSProperty.isUnitlessNumber`. * * @param {string} name CSS property name such as `topMargin`. * @param {*} value CSS property value such as `10px`. * @return

(name, value, isCustomProperty)

Source from the content-addressed store, hash-verified

8102 */
8103
8104 function dangerousStyleValue(name, value, isCustomProperty) {
8105 // Note that we've removed escapeTextForBrowser() calls here since the
8106 // whole string will be escaped when the attribute is injected into
8107 // the markup. If you provide unsafe user data here they can inject
8108 // arbitrary CSS which may be problematic (I couldn't repro this):
8109 // https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
8110 // http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/
8111 // This is not an XSS hole but instead a potential CSS injection issue
8112 // which has lead to a greater discussion about how we're going to
8113 // trust URLs moving forward. See #2115901
8114 var isEmpty = value == null || typeof value === 'boolean' || value === '';
8115
8116 if (isEmpty) {
8117 return '';
8118 }
8119
8120 if (!isCustomProperty && typeof value === 'number' && value !== 0 && !(isUnitlessNumber.hasOwnProperty(name) && isUnitlessNumber[name])) {
8121 return value + 'px'; // Presumes implicit 'px' suffix for unitless numbers
8122 }
8123
8124 return ('' + value).trim();
8125 }
8126
8127 var uppercasePattern = /([A-Z])/g;
8128 var msPattern = /^ms-/;

Callers 3

setValueForStylesFunction · 0.70
unhideInstanceFunction · 0.70

Calls

no outgoing calls

Tested by

no test coverage detected