floraachy/layui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

添加 lay.options() 方法使用的安全提示注释

Browse Source
This commit is contained in:
贤心 2023-11-17 09:57:59 +08:00
parent 5895e84785
commit be5c58ef6f
1 changed files with 71 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/modules/lay.js
View File

@ -417,6 +417,10 @@
var attrValue = othis.attr(attrName); var attrValue = othis.attr(attrName);
try { try {
/**
* 请注意: 开发者在使用 lay-options="{}" 配置组件选项时，需确保属性值不来自于网页用户,
* 即属性值必须在网页开发者自身的可控范围内，否则请勿在 HTML 标签属性中获取组件选项。
*/
return new Function('return '+ (attrValue || '{}'))(); return new Function('return '+ (attrValue || '{}'))();
} catch(ev) { } catch(ev) {
layui.hint().error(opts.errorText || [ layui.hint().error(opts.errorText || [