Jam*_*son 10 javascript xss svg reactjs
我在React组件中有一个动态生成的SVG字符串.我想将其作为图像嵌入到组件中.目前,我正在使用以下内容:
class SomeComponent extends React.Component {
render() {
var image = '<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny" width="47.4" height="40.65" viewBox="21 18.5 158 135.5"><path d="M25,50 l150,0 0,100 -150,0 z" stroke-width="4" stroke="black" fill="rgb(128,224,255)" fill-opacity="1" ></path><path d="M25,50 L175,150 M25,150 L175,50" stroke-width="4" stroke="black" fill="black" ></path><g transform="translate(0,0)" stroke-width="4" stroke="black" fill="none" ><circle cx="100" cy="30" r="7.5" fill="black" ></circle><circle cx="70" cy="30" r="7.5" fill="black" ></circle><circle cx="130" cy="30" r="7.5" fill="black" ></circle></g></svg>';
return (
<div dangerouslySetInnerHTML={{ __html: image }} />
)
}
}
Run Code Online (Sandbox Code Playgroud)
然而,使用一个叫做的属性dangerouslySetInnerHTML让我非常不安.是否有更普遍接受(和更安全)的方式来做到这一点?
Jam*_*s P 24
由于 SVG 是动态生成的,您无法将其存储为资产,作为 的替代方案dangerouslySetInnerHTML,您可以简单地将其设置为Data URI图像上的a 。所以像...
class SomeComponent extends React.Component {
render() {
const image = '<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny" width="47.4" height="40.65" viewBox="21 18.5 158 135.5"><path d="M25,50 l150,0 0,100 -150,0 z" stroke-width="4" stroke="black" fill="rgb(128,224,255)" fill-opacity="1" ></path><path d="M25,50 L175,150 M25,150 L175,50" stroke-width="4" stroke="black" fill="black" ></path><g transform="translate(0,0)" stroke-width="4" stroke="black" fill="none" ><circle cx="100" cy="30" r="7.5" fill="black" ></circle><circle cx="70" cy="30" r="7.5" fill="black" ></circle><circle cx="130" cy="30" r="7.5" fill="black" ></circle></g></svg>';
return (
<div>
<img src={`data:image/svg+xml;utf8,${image}` />
</div>
)
}
}
Run Code Online (Sandbox Code Playgroud)
请参阅此处的帖子:https : //css-tricks.com/lodge/svg/09-svg-data-uris/
Sol*_*ley 15
您可以做的一件事是将 svg 字符串转换为 base64,然后像这样使用它:
const image = '<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny" width="47.4" height="40.65" viewBox="21 18.5 158 135.5"><path d="M25,50 l150,0 0,100 -150,0 z" stroke-width="4" stroke="black" fill="rgb(128,224,255)" fill-opacity="1" ></path><path d="M25,50 L175,150 M25,150 L175,50" stroke-width="4" stroke="black" fill="black" ></path><g transform="translate(0,0)" stroke-width="4" stroke="black" fill="none" ><circle cx="100" cy="30" r="7.5" fill="black" ></circle><circle cx="70" cy="30" r="7.5" fill="black" ></circle><circle cx="130" cy="30" r="7.5" fill="black" ></circle></g></svg>';
const buff = new Buffer(image);
const base64data = buff.toString('base64');
return <img src='data:image/svg+xml;base64,${base64data }' alt="" />
Run Code Online (Sandbox Code Playgroud)
如果你不想使用缓冲区,请使用:
const base64data = btoa(unescape(encodeURIComponent(image)));
Run Code Online (Sandbox Code Playgroud)
Fre*_*lli 10
只需使用这个包: https: //github.com/gilbarbara/react-inlinesvg
例子:
import SVG from 'react-inlinesvg';
...
const mySVG = '<svg xmlns="http://www.w3.org/2000/svg">...</svg>';
return <SVG src={mySVG} />;
Run Code Online (Sandbox Code Playgroud)
React ref效果innerHTML很好而且很干净。var image = '<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny" width="47.4" height="40.65" viewBox="21 18.5 158 135.5"><path d="M25,50 l150,0 0,100 -150,0 z" stroke-width="4" stroke="black" fill="rgb(128,224,255)" fill-opacity="1" ></path><path d="M25,50 L175,150 M25,150 L175,50" stroke-width="4" stroke="black" fill="black" ></path><g transform="translate(0,0)" stroke-width="4" stroke="black" fill="none" ><circle cx="100" cy="30" r="7.5" fill="black" ></circle><circle cx="70" cy="30" r="7.5" fill="black" ></circle><circle cx="130" cy="30" r="7.5" fill="black" ></circle></g></svg>';
const useApp = () => {
const svgWrapperRef = React.useRef();
React.useEffect(() => {
svgWrapperRef.current.innerHTML = image;
}, [])
return {
svgWrapperRef
}
}
const App = () => {
const {svgWrapperRef} = useApp()
return (
<div ref={svgWrapperRef}></div>
)
}
const root = document.getElementById('root')
ReactDOM.render(<App />, root)Run Code Online (Sandbox Code Playgroud)
<script src="https://cdnjs.cloudflare.com/ajax/libs/react/16.13.1/umd/react.production.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/react-dom/16.13.1/umd/react-dom.production.min.js"></script>
<div id="root"></div>Run Code Online (Sandbox Code Playgroud)
祝你好运...
就这样,我成功了。
const svgStr = "<svg></svg>";
const svg = new Blob([svgStr], { type: "image/svg+xml" });
const url = URL.createObjectURL(svg);
Run Code Online (Sandbox Code Playgroud)
<img src={url} />
Run Code Online (Sandbox Code Playgroud)
eag*_*der -5
我会将 svg 图像存储在单独的文件夹(assets)中,并将图像导入到反应组件中
像这样的东西:
一些组件.js:
import { SampleImage } from '../assets/SomeFile';
class SomeComponent extends React.Component {
render() {
return (
<div>
<img src={SampleImage} />
<div/>
)
}
}
Run Code Online (Sandbox Code Playgroud)
一些文件.svg:
<?xmlns="http://www.w3.org/2000/svg" version="1.2"encoding="UTF-8"?>
<svg baseProfile="tiny" width="47.4" height="40.65" viewBox="21 18.5 158 135.5"><path d="M25,50 l150,0 0,100 -150,0 z" stroke-width="4" stroke="black" fill="rgb(128,224,255)" fill-opacity="1" ></path><path d="M25,50 L175,150 M25,150 L175,50" stroke-width="4" stroke="black" fill="black" ></path><g transform="translate(0,0)" stroke-width="4" stroke="black" fill="none" ><circle cx="100" cy="30" r="7.5" fill="black" ></circle><circle cx="70" cy="30" r="7.5" fill="black" ></circle><circle cx="130" cy="30" r="7.5" fill="black" >
</circle></g>
</svg>
Run Code Online (Sandbox Code Playgroud)
| 归档时间: |
|
| 查看次数: |
2050 次 |
| 最近记录: |