pyvis icon indicating copy to clipboard operation
pyvis copied to clipboard

Support HTML parsing for Node titles

Open boludo00 opened this issue 4 years ago • 2 comments

Perviously it was possible to supply HTML elements in a string to the node titles like

G.add_node(1, 1, title="This is<br>Node 1")

And the resulting tooltip would render the HTML, but it seems like VisJS has disabled this feature due to XSS issues. See here: https://visjs.github.io/vis-network/examples/network/other/html-in-titles.html

So as it stands, some solution would need to be implemented in the Pyvis layer to enable this parsing from the JavaScript side. I am thinking some sort of HTML object that would signify the template to provide and apply this:

function htmlTitle(html) {
  const container = document.createElement("div");
  container.innerHTML = html;
  return container;
}

to each node title.

For now though, it seems as if the '\n' character works fine in node titles, so that can be used instead of the HTML br tag.

boludo00 avatar Apr 29 '21 17:04 boludo00

I really want this too, but for just vanilla VisJS, having properly formatted popups is really useful to present contextual information for a specific node. Worth noting is that XSS is only possible when the end user can send parameters to the application and data gets rendered, if data is just fetched from a database without any user input - this vulnerability does not exist.

ProIntegritate avatar Mar 31 '23 10:03 ProIntegritate

A fix is provided, by updating the template.html. Refer to #166

yllowcool avatar Jun 09 '23 02:06 yllowcool