Shiki Help: Converting codeToHAST to JSX
Answered
alfon posted this in #help-forum
Answered by joulev
You need to understand when it’s dangerous and when it’s not. In this case the html is generated by shiki and does not have any xss risk so it is safe
18 Replies
@alfon everything is just so angry about my code
if you are using rehypeReact why do you get the hast, just use codeToHtml
the way i understand rehype-react, it takes a html string not a hast
in the first place why even bother with all of this, just
dangerouslySetInnerHtml@joulev if you are using rehypeReact why do you get the hast, just use codeToHtml
alfonOP
fuma says codeToHast but ill try
@alfon fuma says codeToHast but ill try
Because in fuma’s case, the input to .process() is still a string but it is converted to hast in a previous .use() step
alfonOP
ahhhhhhhh
okay
@joulev in the first place why even bother with all of this, just `dangerouslySetInnerHtml`
alfonOP
im still set to the idea that dangerouslySetInngerHtml is really dangerous
so just finding ways if there are other ways or jsut accept that its sometimes ok
however it should be less dangerous since the content is SSR'd (meaning its unchanging) and not dynamic like a web code editor
@alfon im still set to the idea that dangerouslySetInngerHtml is really dangerous
You need to understand when it’s dangerous and when it’s not. In this case the html is generated by shiki and does not have any xss risk so it is safe
Answer
They saying it’s dangerous doesn’t mean it’s dangerous at all time
@joulev You need to understand when it’s dangerous and when it’s not. In this case the html is generated by shiki and does not have any xss risk so it is safe
alfonOP
So whatever i put, even from user input, to shiki, it wont be dangerous because shiki's codeToHtml already sanitize the input?
I mean i can assume that way
Atleast
@alfon So whatever i put, even from user input, to shiki, it wont be dangerous because shiki's codeToHtml already sanitize the input?
If that’s not the case, why would they even expose the codeToHtml function?
@joulev If that’s not the case, why would they even expose the codeToHtml function?
alfonOP
If they are upholding such high standard then I shant worry. Its only natural to be a little bit skeptical of other peoples code.