CesiumGS / CesiumGS/cesium

script tags do not work in entity descriptions

Open
#5,147 0 comments 0 reactions 0 assignees View on GitHub
category - entity type - enhancement
Dominant language
JavaScript
Stars
15.7k
Forks
3.9k
Avg merge
4d 6h
Merged PRs (30d)
34

Description

Inline tags do not work in description HTML, even if the sandbox is configured to allow scripts. Internally, the description is loaded by setting `frameContent.innerHTML = value;` and as far as I can tell, setting `innerHTML` will not execute inline script tags, regardless of sandboxing settings.

Instead, script tags need to be created individually using the DOM API. If you look in the jQuery source, for example, you can see that `$().html(str)` is more complex than simply setting `innerHTML`, for this reason. One mechanism would be to use createContextualFragment.

https://developer.mozilla.org/en-US/docs/Web/API/Range/createContextualFragment

Note that other scripts work as-is (with scripts allowed through the sandbox), such as an `<a onclick="">`.

Contributor guide

Open the contributing guide

Research direction

Search the entity-description rendering code for the `frameContent.innerHTML = value;` assignment and inspect how sandbox permissions are configured. Verify the current behavior in a browser, then ensure inline script tags in descriptions execute when scripts are allowed while existing inline handlers continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.