javascript - Add safe HTML inside unsafe string appended with .text() -
so if have unsafe string:
'<div id='unsafe'></div> unsafe2 <div id='unsafe3'></div>'
safely appended (or going appended) inside div
container
via div.text(str)
, how can safely , efficiently replace middle part of string - unsafe2
(or few separate parts in bigger string) trusted html (let's inline-block element
), displayed html,
i.e final display inside container
must this:
___ <div id='unsafe'></div> |___| <div id='unsafe3'></div>
edit: assuming know how find unsafe2
inside string. question of proper , safe replacement 1 bothers me.
edit2: here's simple fiddle: https://jsfiddle.net/5pa7do7w/ type containing word doggy
(hello doggy, i'm here!
) , hit enter, assume unsafe string came other user's end. in 'chat' field doggy
replaced colored span doggy
. easy do, using .html(str)
, approach if input unsafe string <script> alert
example - trigered, whole string appended html
. want append hello doggy, i'm here!
via .text(str)
'escape' it, butt still able swap doggy colored html
now.
edit3: while trying solve - updated fiddle. how must , work: https://jsfiddle.net/5pa7do7w/1/ try enter <div></div> hey doggy <script> window.alert(hello) </script> doggy
. afraid possible break out of js scope xss, costantly using unescaped string in code while splitting it, , not sure there vulnerability or not.