Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider removing setHooks #4442

Open
Tracked by #2964
nolanlawson opened this issue Aug 5, 2024 · 0 comments
Open
Tracked by #2964

Consider removing setHooks #4442

nolanlawson opened this issue Aug 5, 2024 · 0 comments

Comments

@nolanlawson
Copy link
Collaborator

nolanlawson commented Aug 5, 2024

Currently setHooks is required to allow lwc:inner-html, but it seems that most consumers are just doing:

import { setHooks } from 'lwc'
setHooks({
  sanitizeHtmlContent(content) {
    return content;
  },
})

I.e. they are just making it a no-op, not doing any sanitization.

It's also a bit annoying that you can't call setHooks() more than once, which can lead to unexpected errors if someone earlier in the page load called setHooks before you did.

Potentially the original issue this was designed to solve could be solved by CSP and/or TrustedTypes. We should re-evaluate whether we still need this API or not.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant