Call sanitizer

serenity-is · Aug 10, 2024 · 6285e41 · 6285e41
1 parent 5d4d914
commit 6285e41
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/src/Serenity.Extensions/Modules/ExportImport/PdfExportHelper.ts b/src/Serenity.Extensions/Modules/ExportImport/PdfExportHelper.ts
@@ -47,6 +47,7 @@ export namespace PdfExportHelper {
     function toAutoTableData(slickGrid: Grid, entities: any[], keys: string[], srcColumns: Column[]) {
         let el = document.createElement('span');
         let row = 0;
+        const sanitizer = slickGrid?.getOptions()?.sanitizer;
         return entities.map(item => {
             let dst = [];
             for (let cell = 0; cell < srcColumns.length; cell++) {
@@ -63,8 +64,12 @@ export namespace PdfExportHelper {
                     if (html instanceof Node) {
                         el.appendChild(html);
                     }
-                    else
+                    else {
+                        if (typeof html === "string" && html.length && sanitizer) {
+                            html = sanitizer(html);
+                        }
                         el.innerHTML = html;
+                    }
                     if (el.children.length == 1 &&
                         el.children[0]?.nodeName === 'SELECT') {
                         dst.push(el.children[0].querySelector("[selected]")?.textContent ?? '');

diff --git a/src/Serenity.Extensions/dist/index.d.ts b/src/Serenity.Extensions/dist/index.d.ts
@@ -332,8 +332,7 @@ export declare class EnumSelectFormatter implements Formatter {
 }
 export declare class SingleLineTextFormatter implements Formatter {
 	format(ctx: FormatterContext): string;
-	/** Formats html value as text, note that return value is plain text, e.g. is not html escaped */
-	static formatValue(htmlValue: string): string;
+	static formatValue(value: string): string;
 }
 export declare abstract class GridEditorBase<TEntity, P = {}> extends EntityGrid<TEntity, P> implements IGetEditValue, ISetEditValue {
 	protected getIdProperty(): string;