pyvis
pyvis copied to clipboard
Support HTML parsing for Node titles
Perviously it was possible to supply HTML elements in a string to the node titles like
G.add_node(1, 1, title="This is<br>Node 1")
And the resulting tooltip would render the HTML, but it seems like VisJS has disabled this feature due to XSS issues. See here: https://visjs.github.io/vis-network/examples/network/other/html-in-titles.html
So as it stands, some solution would need to be implemented in the Pyvis layer to enable this parsing from the JavaScript side. I am thinking some sort of HTML object that would signify the template to provide and apply this:
function htmlTitle(html) {
const container = document.createElement("div");
container.innerHTML = html;
return container;
}
to each node title.
For now though, it seems as if the '\n' character works fine in node titles, so that can be used instead of the HTML br tag.
I really want this too, but for just vanilla VisJS, having properly formatted popups is really useful to present contextual information for a specific node. Worth noting is that XSS is only possible when the end user can send parameters to the application and data gets rendered, if data is just fetched from a database without any user input - this vulnerability does not exist.
A fix is provided, by updating the template.html. Refer to #166