{"action":"created","issue":{"url":"https://api.github.com/repos/froala/wysiwyg-editor/issues/1846","repository_url":"https://api.github.com/repos/froala/wysiwyg-editor","labels_url":"https://api.github.com/repos/froala/wysiwyg-editor/issues/1846/labels{/name}","comments_url":"https://api.github.com/repos/froala/wysiwyg-editor/issues/1846/comments","events_url":"https://api.github.com/repos/froala/wysiwyg-editor/issues/1846/events","html_url":"https://github.com/froala/wysiwyg-editor/issues/1846","id":214701866,"number":1846,"title":"Script tag is executing when switching between code view and the normal view","user":{"login":"drdaemos","id":1313693,"avatar_url":"https://avatars1.githubusercontent.com/u/1313693?v=3","gravatar_id":"","url":"https://api.github.com/users/drdaemos","html_url":"https://github.com/drdaemos","followers_url":"https://api.github.com/users/drdaemos/followers","following_url":"https://api.github.com/users/drdaemos/following{/other_user}","gists_url":"https://api.github.com/users/drdaemos/gists{/gist_id}","starred_url":"https://api.github.com/users/drdaemos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drdaemos/subscriptions","organizations_url":"https://api.github.com/users/drdaemos/orgs","repos_url":"https://api.github.com/users/drdaemos/repos","events_url":"https://api.github.com/users/drdaemos/events{/privacy}","received_events_url":"https://api.github.com/users/drdaemos/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-03-16T13:20:42Z","updated_at":"2017-03-17T11:15:13Z","closed_at":"2017-03-17T07:42:28Z","body":"##### Expected behavior.\r\nSwitching between the code view and the normal view should not cause script tags to execute, otherwise this editor can't be used to write JavaScript.\r\n\r\nThe problem lies in editor.html.set() function, which internally uses jQuery .html() function, and that leads to script execution.\r\n\r\nThe problem can be solved by replacing html() call with the assignment via innerHTML property and I don't see any drawbacks to that solution right now.\r\n\r\n##### Actual behavior.\r\nSwitching between modes executes Javascript code inside <script> tags.\r\n\r\n##### Steps to reproduce the problem.\r\n1. Set froala options to allow script tags (htmlRemoveTags: []).\r\n2. Open the page with the editor\r\n3. Switch to the code view\r\n4. Write in the editor\r\n\r\n```\r\n<script>alert(1);</script>\r\n```\r\n5. Switch back to the normal view\r\n6. Alert happens.\r\n\r\n##### OS.\r\nMacOS Sierra 10.12.3 (16D32) (it is irrelevant though)\r\n\r\n##### Browser.\r\nGoogle Chrome 56.0.2924.87 (64-bit)\r\n\r\nP.S. I'm an OEM license owner, can provide you with the key to prove it."},"comment":{"url":"https://api.github.com/repos/froala/wysiwyg-editor/issues/comments/287328615","html_url":"https://github.com/froala/wysiwyg-editor/issues/1846#issuecomment-287328615","issue_url":"https://api.github.com/repos/froala/wysiwyg-editor/issues/1846","id":287328615,"user":{"login":"stefanneculai","id":637004,"avatar_url":"https://avatars3.githubusercontent.com/u/637004?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanneculai","html_url":"https://github.com/stefanneculai","followers_url":"https://api.github.com/users/stefanneculai/followers","following_url":"https://api.github.com/users/stefanneculai/following{/other_user}","gists_url":"https://api.github.com/users/stefanneculai/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanneculai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanneculai/subscriptions","organizations_url":"https://api.github.com/users/stefanneculai/orgs","repos_url":"https://api.github.com/users/stefanneculai/repos","events_url":"https://api.github.com/users/stefanneculai/events{/privacy}","received_events_url":"https://api.github.com/users/stefanneculai/received_events","type":"User","site_admin":false},"created_at":"2017-03-17T11:15:13Z","updated_at":"2017-03-17T11:15:13Z","body":"@drdaemos makes sense. I marked this as an `enhancement` and we'll put an option for it."}}
{"actor":{"display_login":"stefanneculai"}}