Skip to content

Commit 0195386

Browse files
XonXon
committed
allowHtml now defaults to false
1 parent 77f362e commit 0195386

File tree

16 files changed

+17
-96
lines changed

16 files changed

+17
-96
lines changed

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
### ⚠ BREAKING CHANGES
66

7+
* `allowHtml` now defaults to false.
78
* HTML escaping of choice/item labels should no longer double escape depending on allowHTML mode.
89
* Templates/text functions now escape `'` characters for display.
910
* `addItemText`/`uniqueItemText`/`customAddItemText` are now called with the `value` argument already escaped.

‎README.md

+2-4
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ Or include Choices directly:
129129
removeItemButton: false,
130130
removeItemButtonAlignLeft: false,
131131
editItems: false,
132-
allowHTML: true,
132+
allowHTML: false,
133133
duplicateItemsAllowed: true,
134134
delimiter: ',',
135135
paste: true,
@@ -359,14 +359,12 @@ Pass an array of objects:
359359

360360
### allowHTML
361361

362-
**Type:** `Boolean` **Default:** `true`
362+
**Type:** `Boolean` **Default:** `false`
363363

364364
**Input types affected:** `text`, `select-one`, `select-multiple`
365365

366366
**Usage:** Whether HTML should be rendered in all Choices elements. If `false`, all elements (placeholder, items, etc.) will be treated as plain text. If `true`, this can be used to perform XSS scripting attacks if you load choices from a remote source.
367367

368-
**Deprecation Warning:** This will default to `false` in a future release.
369-
370368
### allowHtmlUserInput
371369

372370
**Type:** `Boolean` **Default:** `false`

‎cypress/e2e/select-multiple.spec.ts

-28
Original file line numberDiff line numberDiff line change
@@ -949,34 +949,6 @@ describe('Choices - select multiple', () => {
949949
});
950950

951951
describe('allow html', () => {
952-
describe('is undefined', () => {
953-
it('logs a deprecation warning', () => {
954-
cy.get('@consoleWarn').should(
955-
'be.calledOnceWithExactly',
956-
'Deprecation warning: allowHTML will default to false in a future release. To render HTML in Choices, you will need to set it to true. Setting allowHTML will suppress this message.',
957-
);
958-
});
959-
960-
it('does not show as text when selected', () => {
961-
cy.get('[data-test-hook=allowhtml-undefined]')
962-
.find('.choices__list--multiple .choices__item')
963-
.first()
964-
.should(($choice) => {
965-
expect($choice.text().trim()).to.equal('Choice 1');
966-
});
967-
});
968-
969-
it('does not show html as text in dropdown', () => {
970-
cy.get('[data-test-hook=allowhtml-undefined]')
971-
.find('.choices__list--dropdown .choices__list')
972-
.children()
973-
.first()
974-
.should(($choice) => {
975-
expect($choice.text().trim()).to.equal('Choice 2');
976-
});
977-
});
978-
});
979-
980952
describe('set to true', () => {
981953
it('does not show as text when selected', () => {
982954
cy.get('[data-test-hook=allowhtml-true]')

‎cypress/e2e/select-one.spec.ts

-19
Original file line numberDiff line numberDiff line change
@@ -1070,25 +1070,6 @@ describe('Choices - select one', () => {
10701070
});
10711071

10721072
describe('allow html', () => {
1073-
describe('is undefined', () => {
1074-
it('logs a deprecation warning', () => {
1075-
cy.get('@consoleWarn').should(
1076-
'be.calledOnceWithExactly',
1077-
'Deprecation warning: allowHTML will default to false in a future release. To render HTML in Choices, you will need to set it to true. Setting allowHTML will suppress this message.',
1078-
);
1079-
});
1080-
1081-
it('does not show html as text', () => {
1082-
cy.get('[data-test-hook=allowhtml-undefined]')
1083-
.find('.choices__list--dropdown .choices__list')
1084-
.children()
1085-
.first()
1086-
.should(($choice) => {
1087-
expect($choice.text().trim()).to.equal('Choice 1');
1088-
});
1089-
});
1090-
});
1091-
10921073
describe('set to true', () => {
10931074
it('does not show html as text', () => {
10941075
cy.get('[data-test-hook=allowhtml-true]')

‎cypress/e2e/text.spec.ts

-18
Original file line numberDiff line numberDiff line change
@@ -360,24 +360,6 @@ describe('Choices - text element', () => {
360360
});
361361

362362
describe('allow html', () => {
363-
describe('is undefined', () => {
364-
it('logs a deprecation warning', () => {
365-
cy.get('@consoleWarn').should(
366-
'be.calledOnceWithExactly',
367-
'Deprecation warning: allowHTML will default to false in a future release. To render HTML in Choices, you will need to set it to true. Setting allowHTML will suppress this message.',
368-
);
369-
});
370-
371-
it('does not show html as text', () => {
372-
cy.get('[data-test-hook=allowhtml-undefined]')
373-
.find('.choices__list--multiple .choices__item')
374-
.first()
375-
.should(($choice) => {
376-
expect($choice.text().trim()).to.equal('Mason Rogers');
377-
});
378-
});
379-
});
380-
381363
describe('set to true', () => {
382364
it('does not show html as text', () => {
383365
cy.get('[data-test-hook=allowhtml-true]')

‎public/assets/scripts/choices.js

+3-6
Original file line numberDiff line numberDiff line change
@@ -230,20 +230,17 @@ var Choices = /** @class */function () {
230230
var _this = this;
231231
this._lastAddedChoiceId = 0;
232232
this._lastAddedGroupId = 0;
233-
if (userConfig.allowHTML === undefined) {
234-
console.warn('Deprecation warning: allowHTML will default to false in a future release. To render HTML in Choices, you will need to set it to true. Setting allowHTML will suppress this message.');
235-
}
236233
this.config = (0, utils_1.extend)(true, {}, defaults_1.DEFAULT_CONFIG, Choices.defaults.options, userConfig);
237234
var invalidConfigOptions = (0, utils_1.diff)(this.config, defaults_1.DEFAULT_CONFIG);
238235
if (invalidConfigOptions.length) {
239236
console.warn('Unknown config option(s) passed', invalidConfigOptions.join(', '));
240237
}
241238
if (!this.config.silent && this.config.allowHTML && this.config.allowHtmlUserInput) {
242239
if (this.config.addItems) {
243-
console.warn('Deprecation warning: allowHTML/allowHtmlUserInput/addItems all being true is strongly not recommended and may lead to XSS attacks');
240+
console.warn('Warning: allowHTML/allowHtmlUserInput/addItems all being true is strongly not recommended and may lead to XSS attacks');
244241
}
245242
if (this.config.addChoices) {
246-
console.warn('Deprecation warning: allowHTML/allowHtmlUserInput/addChoices all being true is strongly not recommended and may lead to XSS attacks');
243+
console.warn('Warning: allowHTML/allowHtmlUserInput/addChoices all being true is strongly not recommended and may lead to XSS attacks');
247244
}
248245
}
249246
var passedElement = typeof element === 'string' ? document.querySelector(element) : element;
@@ -2958,7 +2955,7 @@ exports.DEFAULT_CONFIG = {
29582955
removeItemButton: false,
29592956
removeItemButtonAlignLeft: false,
29602957
editItems: false,
2961-
allowHTML: true,
2958+
allowHTML: false,
29622959
allowHtmlUserInput: false,
29632960
duplicateItemsAllowed: true,
29642961
delimiter: ',',

‎public/assets/scripts/choices.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎public/test/select-multiple/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -386,7 +386,7 @@ <h2>Select multiple inputs</h2>
386386
</div>
387387

388388
<div data-test-hook="allowhtml-undefined">
389-
<label for="choices-allowhtml-undefined">HTML allowed by default</label>
389+
<label for="choices-allowhtml-undefined">HTML disabled by default</label>
390390
<select
391391
class="form-control"
392392
name="choices-allowhtml-undefined"

‎public/test/select-one/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -377,7 +377,7 @@ <h2>Select one inputs</h2>
377377
</div>
378378

379379
<div data-test-hook="allowhtml-undefined">
380-
<label for="choices-allowhtml-undefined">HTML allowed by default</label>
380+
<label for="choices-allowhtml-undefined">HTML disabled by default</label>
381381
<select
382382
class="form-control"
383383
name="choices-allowhtml-undefined"

‎public/test/text/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ <h2>Text inputs</h2>
7777
</div>
7878

7979
<div data-test-hook="allowhtml-undefined">
80-
<label for="allowhtml-undefined">HTML allowed by default</label>
80+
<label for="allowhtml-undefined">HTML disabled by default</label>
8181
<input class="form-control" id="allowhtml-undefined" type="text" />
8282
</div>
8383

‎public/types/src/scripts/choices.d.ts.map

+1-1
Original file line numberDiff line numberDiff line change

‎public/types/src/scripts/interfaces/options.d.ts

+1-3
Original file line numberDiff line numberDiff line change
@@ -230,11 +230,9 @@ export interface Options {
230230
* If `false`, all elements (placeholder, items, etc.) will be treated as plain text.
231231
* If `true`, this can be used to perform XSS scripting attacks if you load choices from a remote source.
232232
*
233-
* **Deprecation Warning:** This will default to `false` in a future release.
234-
*
235233
* **Input types affected:** text, select-one, select-multiple
236234
*
237-
* @default true
235+
* @default false
238236
*/
239237
allowHTML: boolean;
240238
/**

0 commit comments

Comments
 (0)