add html cell

[muddydixon]

No description provided.

[wyuenho]

Thank you for the PR, but similar PRs have been rejected before. I don't want to make it easier for people to enable XSS security vulnerabilities.

[muddydixon]

Thank you for your answer.
Do you have another way to create anchor that I use text and href arbitrary?

[wyuenho]

#242

[morficus]

how do you feel about having an HTML-enabled cell, but not allowing it to have an "edit mode"?
I believe that removing the "edit mode" for an html-cell would mitigate the risk of XSS attacks in this type of cell

[wyuenho]

No it will not. Arbitrary HTML can come from many different places, but as long as they are not allowed to be rendered as HTML, they are harmless. The main line of defence is not edit mode, it's display mode.

I honestly can't think of a use case where it is preferable to allow arbitrary HTML code entered into a table cells. Why would that be useful?

[morficus]

This use case is when one needs to display something like icons in the cell next to the string-value.

Some more concrete examples:

• A table comparing historical values where we wish to display a green 🔼 for increases over time or a red 🔽 for decreases over time
• A table which displays the status of multiple invoices, and we wish to show a ⚠️ symbol next to those that are past due

None of the above use cases would need an edit-mode, since these cells are all intended a informational cells only.

But you are right; the real issue with XSS is the rendering, not the formatting or storing.

[wyuenho]

Sounds like the HTML are predefined. You can implement custom rendering yourself by extending one of the many cell types. I just don't want to make it easier for people who don't know what they are doing to hurt themselves.

[morficus]

That's actually what I have now - custom rendering function on a custom cell type, which is generic enough to render any HTML-string. Then I have a custom formatter which decides what icon (if any) to display.

It all works pretty well, and looks ver, but I was just considering contributing it back to the community since I have seen a few other comments about "how do I easily display HTML in a cell".

But I can understand your concern.

[wyuenho]

You can turn it into an extension and open source it ;) Call it an icon cell or something.

[morficus]

hhm.... that's not a bad idea 👍
FWIW, here is part of the custom implementation I'm using on another project: morficus@cfec6be

edit: updating link